el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent-tree.c:3300!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4602 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : btrfs_free_tree_block+0xa04/0xa38 fs/btrfs/extent-tree.c:3300
lr : btrfs_free_tree_block+0xa04/0xa38 fs/btrfs/extent-tree.c:3300
sp : ffff8000220e6be0
x29: ffff8000220e6ce0 x28: dfff800000000000 x27: ffff70000441cd84
x26: ffff000000000002 x25: ffff8000220e6c40 x24: 00000000fffffff4
x23: 0000000000000001 x22: ffff000000000100 x21: ffff0000d5d325d8
x20: ffff0000e0b240a8 x19: ffff0000d5d325d0 x18: 0000000011b4e991
x17: 0000000000000000 x16: ffff8000082dd38c x15: ffff800008a03020
x14: 0000000000000001 x13: 1ffff00002d90e5e x12: 0000000000000000
x11: ff00800009fcd3e4 x10: 0000000000000000 x9 : ffff800009fcd3e4
x8 : ffff0000d4c90000 x7 : ffff80000805a5e8 x6 : ffff80000805a7f8
x5 : ffff0000d2347dc0 x4 : ffff8000220e6888 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 00000000fffffff4 x0 : 0000000000000000
Call trace:
 btrfs_free_tree_block+0xa04/0xa38 fs/btrfs/extent-tree.c:3300
 btrfs_force_cow_block+0xc38/0x18c0 fs/btrfs/ctree.c:505
 btrfs_cow_block+0x2e0/0x71c fs/btrfs/ctree.c:623
 btrfs_search_slot+0xa48/0x2380 fs/btrfs/ctree.c:-1
 lookup_inline_extent_backref+0x284/0xeb8 fs/btrfs/extent-tree.c:847
 lookup_extent_backref fs/btrfs/extent-tree.c:1074 [inline]
 __btrfs_free_extent+0x22c/0x2254 fs/btrfs/extent-tree.c:2985
 run_delayed_tree_ref fs/btrfs/extent-tree.c:1696 [inline]
 run_one_delayed_ref fs/btrfs/extent-tree.c:1720 [inline]
 btrfs_run_delayed_refs_for_head fs/btrfs/extent-tree.c:1969 [inline]
 __btrfs_run_delayed_refs+0xbc4/0x3374 fs/btrfs/extent-tree.c:2033
 btrfs_run_delayed_refs+0x11c/0x474 fs/btrfs/extent-tree.c:2164
 btrfs_commit_transaction+0x1e4/0x28e4 fs/btrfs/transaction.c:2202
 create_snapshot+0x4fc/0x850 fs/btrfs/ioctl.c:863
 btrfs_mksubvol+0x550/0x6bc fs/btrfs/ioctl.c:1015
 btrfs_mksnapshot+0xc4/0x14c fs/btrfs/ioctl.c:1061
 __btrfs_ioctl_snap_create+0x30c/0x3f4 fs/btrfs/ioctl.c:2225
 btrfs_ioctl_snap_create_v2+0x1a4/0x38c fs/btrfs/ioctl.c:2312
 btrfs_ioctl+0xa30/0xb38 fs/btrfs/ioctl.c:-1
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 17fffe9d 97939dd5 d4210000 97939dd3 (d4210000) 
---[ end trace 0000000000000000 ]---