syzbot


kernel BUG in extent_writepage_io (2)

Status: upstream: reported on 2026/06/22 06:23
Subsystems: btrfs
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+11036d2e408a419c179c@syzkaller.appspotmail.com
First crash: 17d, last: 3d22h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
9517fd67-362a-4f88-957b-c1ea7a6bac24 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ kernel BUG in extent_writepage_io (2) 2026/06/20 00:32 2026/06/20 00:32 2026/06/20 01:42 023e42b533e586523329e56d8cc833583d338ca9

			
		
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] kernel BUG in extent_writepage_io (2) 0 (1) 2026/06/22 06:23
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in extent_writepage_io btrfs -1 C error done 6 198d 622d 0/29 auto-obsoleted due to no activity on 2026/03/29 20:26

Sample crash report:
assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1721
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent_io.c:1721!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 17638 Comm: syz.4.15089 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:submit_one_sector fs/btrfs/extent_io.c:1721 [inline]
RIP: 0010:extent_writepage_io+0x1070/0x11a0 fs/btrfs/extent_io.c:1826
Code: 29 fd 90 0f 0b e8 40 87 c8 fd 48 c7 c7 e0 b5 17 8c 48 c7 c6 00 cd 17 8c 48 c7 c2 60 b6 17 8c b9 b9 06 00 00 e8 31 c5 29 fd 90 <0f> 0b e8 19 87 c8 fd 48 89 ef 48 c7 c6 c0 bd 17 8c e8 3a 24 2a fd
RSP: 0018:ffffc9000d9ff080 EFLAGS: 00010246
RAX: 000000000000004e RBX: ffffea0001a6c108 RCX: 6b8e9eeffc3a1900
RDX: ffffc900116a5000 RSI: 000000000000be66 RDI: 000000000000be67
RBP: ffffea0001a6c100 R08: ffffc9000d9fee07 R09: 1ffff92001b3fdc0
R10: dffffc0000000000 R11: fffff52001b3fdc1 R12: 0000000000001000
R13: dffffc0000000000 R14: ffff888048aed980 R15: fffffffffffffffd
FS:  00007f8dcb7e36c0(0000) GS:ffff888125326000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32b03ff8 CR3: 00000000549ef000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 extent_writepage fs/btrfs/extent_io.c:1936 [inline]
 extent_write_cache_pages fs/btrfs/extent_io.c:2593 [inline]
 btrfs_writepages+0x17a1/0x28b0 fs/btrfs/extent_io.c:2725
 do_writepages+0x338/0x560 mm/page-writeback.c:2571
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_fdatawrite_range+0x1ef/0x2f0 mm/filemap.c:412
 btrfs_fdatawrite_range+0x54/0xf0 fs/btrfs/file.c:3884
 btrfs_direct_write+0x69d/0xc20 fs/btrfs/direct-io.c:1038
 btrfs_do_write_iter+0x325/0x790 fs/btrfs/file.c:1449
 do_iter_readv_writev+0x612/0x8c0 fs/read_write.c:-1
 vfs_writev+0x343/0x990 fs/read_write.c:1058
 do_pwritev fs/read_write.c:1154 [inline]
 __do_sys_pwritev2 fs/read_write.c:1212 [inline]
 __se_sys_pwritev2+0x177/0x2a0 fs/read_write.c:1203
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8dca99ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8dcb7e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
RAX: ffffffffffffffda RBX: 00007f8dcac16090 RCX: 00007f8dca99ce59
RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000005
RBP: 00007f8dcaa32e6f R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8dcac16128 R14: 00007f8dcac16090 R15: 00007ffd90c6dfb8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:submit_one_sector fs/btrfs/extent_io.c:1721 [inline]
RIP: 0010:extent_writepage_io+0x1070/0x11a0 fs/btrfs/extent_io.c:1826
Code: 29 fd 90 0f 0b e8 40 87 c8 fd 48 c7 c7 e0 b5 17 8c 48 c7 c6 00 cd 17 8c 48 c7 c2 60 b6 17 8c b9 b9 06 00 00 e8 31 c5 29 fd 90 <0f> 0b e8 19 87 c8 fd 48 89 ef 48 c7 c6 c0 bd 17 8c e8 3a 24 2a fd
RSP: 0018:ffffc9000d9ff080 EFLAGS: 00010246

RAX: 000000000000004e RBX: ffffea0001a6c108 RCX: 6b8e9eeffc3a1900
RDX: ffffc900116a5000 RSI: 000000000000be66 RDI: 000000000000be67
RBP: ffffea0001a6c100 R08: ffffc9000d9fee07 R09: 1ffff92001b3fdc0
R10: dffffc0000000000 R11: fffff52001b3fdc1 R12: 0000000000001000
R13: dffffc0000000000 R14: ffff888048aed980 R15: fffffffffffffffd
FS:  00007f8dcb7e36c0(0000) GS:ffff888125226000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d80bff8 CR3: 00000000549ef000 CR4: 0000000000350ef0

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/26 19:32 upstream 4edcdefd4083 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in extent_writepage_io
2026/07/02 04:33 upstream 4a50a141f05a 27192279 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/07/02 04:32 upstream 4a50a141f05a 27192279 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/07/02 04:32 upstream 4a50a141f05a 27192279 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/07/02 04:32 upstream 4a50a141f05a 27192279 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/07/02 04:32 upstream 4a50a141f05a 27192279 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/23 16:57 upstream 502d801f0ab0 4b1d8f01 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/23 14:43 upstream 502d801f0ab0 4b1d8f01 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/22 14:01 upstream ef0c9f75a195 ab2703f0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/21 04:56 upstream 1a3746ccbb0a 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/20 09:23 upstream a975094bf98c 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/19 15:09 upstream 9ecfb2f7287a 023e42b5 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/18 21:05 upstream e771677c937d a776b0d0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/18 06:15 upstream e771677c937d b62b3ded .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
* Struck through repros no longer work on HEAD.