------------[ cut here ]------------
BTRFS: Transaction aborted (error -28)
WARNING: fs/btrfs/block-group.c:4012 at 0x0, CPU#0: kworker/u8:18/6256
Modules linked in:
CPU: 0 UID: 0 PID: 6256 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_unbound btrfs_async_reclaim_metadata_space
RIP: 0010:do_chunk_alloc fs/btrfs/block-group.c:4012 [inline]
RIP: 0010:btrfs_chunk_alloc+0x101f/0x15d0 fs/btrfs/block-group.c:4253
Code: 37 59 cb fd e9 6d 01 00 00 e8 6d 42 b1 fd 84 c0 74 22 e8 24 59 cb fd e9 5a 01 00 00 e8 1a 59 cb fd 48 8d 3d 03 2b 94 0b 89 de <67> 48 0f b9 3a e9 b3 fc ff ff e8 d2 0d 63 07 41 89 c6 31 ff 89 c6
RSP: 0018:ffffc9000bd5e658 EFLAGS: 00010293
RAX: ffffffff83f65a16 RBX: ffffffffffffffe4 RCX: ffff88801d3e1e80
RDX: 0000000000000000 RSI: 00000000ffffffe4 RDI: ffffffff8f8a8520
RBP: 0000000000000000 R08: ffff88801d3e1e80 R09: 0000000000000003
R10: 00000000fffffffb R11: 0000000000000000 R12: 1ffff1100adf0516
R13: ffff88804644fbf0 R14: ffff888026c48001 R15: ffff8880281a6000
FS:  0000000000000000(0000) GS:ffff888125e4f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000003c0 CR3: 0000000032aa2000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 find_free_extent_update_loop fs/btrfs/extent-tree.c:4199 [inline]
 find_free_extent+0x45b7/0x5d00 fs/btrfs/extent-tree.c:4611
 btrfs_reserve_extent+0x2c7/0x780 fs/btrfs/extent-tree.c:4705
 cow_file_range+0x4d1/0x10a0 fs/btrfs/inode.c:1365
 writepage_delalloc+0xf06/0x1a60 fs/btrfs/extent_io.c:1501
 extent_writepage fs/btrfs/extent_io.c:1864 [inline]
 extent_write_cache_pages fs/btrfs/extent_io.c:2552 [inline]
 btrfs_writepages+0x12fd/0x21e0 fs/btrfs/extent_io.c:2685
 do_writepages+0x32e/0x550 mm/page-writeback.c:2598
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_flush_nr+0x1c7/0x2b0 mm/filemap.c:462
 start_delalloc_inodes+0x504/0xae0 fs/btrfs/inode.c:8808
 btrfs_start_delalloc_roots+0x54c/0x7c0 fs/btrfs/inode.c:8868
 shrink_delalloc fs/btrfs/space-info.c:759 [inline]
 flush_space+0x6b9/0xd20 fs/btrfs/space-info.c:869
 do_async_reclaim_metadata_space+0x11e/0x350 fs/btrfs/space-info.c:1185
 btrfs_async_reclaim_metadata_space+0x89/0xe0 fs/btrfs/space-info.c:1252
 process_one_work+0x93a/0x15a0 kernel/workqueue.c:3261
 process_scheduled_works kernel/workqueue.c:3344 [inline]
 worker_thread+0x9f5/0xee0 kernel/workqueue.c:3425
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	59                   	pop    %rcx
   1:	cb                   	lret
   2:	fd                   	std
   3:	e9 6d 01 00 00       	jmp    0x175
   8:	e8 6d 42 b1 fd       	call   0xfdb1427a
   d:	84 c0                	test   %al,%al
   f:	74 22                	je     0x33
  11:	e8 24 59 cb fd       	call   0xfdcb593a
  16:	e9 5a 01 00 00       	jmp    0x175
  1b:	e8 1a 59 cb fd       	call   0xfdcb593a
  20:	48 8d 3d 03 2b 94 0b 	lea    0xb942b03(%rip),%rdi        # 0xb942b2a
  27:	89 de                	mov    %ebx,%esi
* 29:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2e:	e9 b3 fc ff ff       	jmp    0xfffffce6
  33:	e8 d2 0d 63 07       	call   0x7630e0a
  38:	41 89 c6             	mov    %eax,%r14d
  3b:	31 ff                	xor    %edi,%edi
  3d:	89 c6                	mov    %eax,%esi