------------[ cut here ]------------ BTRFS: Transaction aborted (error -28) WARNING: fs/btrfs/block-group.c:4175 at do_chunk_alloc fs/btrfs/block-group.c:4175 [inline], CPU#0: kworker/u4:10/5353 WARNING: fs/btrfs/block-group.c:4175 at btrfs_chunk_alloc+0x101d/0x15e0 fs/btrfs/block-group.c:4416, CPU#0: kworker/u4:10/5353 Modules linked in: CPU: 0 UID: 0 PID: 5353 Comm: kworker/u4:10 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_metadata_space RIP: 0010:do_chunk_alloc fs/btrfs/block-group.c:4175 [inline] RIP: 0010:btrfs_chunk_alloc+0x101f/0x15e0 fs/btrfs/block-group.c:4416 Code: 37 fe ad fd e9 6d 01 00 00 e8 fd 07 93 fd 84 c0 74 22 e8 24 fe ad fd e9 5a 01 00 00 e8 1a fe ad fd 48 8d 3d 03 eb 22 0c 89 de <67> 48 0f b9 3a e9 b3 fc ff ff e8 62 74 93 07 41 89 c6 31 ff 89 c6 RSP: 0018:ffffc900068af6d0 EFLAGS: 00010293 RAX: ffffffff8417d616 RBX: ffffffffffffffe4 RCX: ffff888000e12500 RDX: 0000000000000000 RSI: 00000000ffffffe4 RDI: ffffffff903ac120 RBP: 0000000000000000 R08: ffff888000e12500 R09: 0000000000000003 R10: 00000000fffffffb R11: 0000000000000000 R12: 1ffff110025c8816 R13: ffff8880123fa640 R14: ffff888041cac001 R15: ffff88804205e800 FS: 0000000000000000(0000) GS:ffff88808c87c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f75071f74c0 CR3: 00000000431de000 CR4: 0000000000352ef0 Call Trace: flush_space+0x3fb/0xe20 fs/btrfs/space-info.c:908 do_async_reclaim_metadata_space+0x3fc/0x960 fs/btrfs/space-info.c:1211 btrfs_async_reclaim_metadata_space+0x89/0xe0 fs/btrfs/space-info.c:1278 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x389/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: ad lods %ds:(%rsi),%eax 1: fd std 2: e9 6d 01 00 00 jmp 0x174 7: e8 fd 07 93 fd call 0xfd930809 c: 84 c0 test %al,%al e: 74 22 je 0x32 10: e8 24 fe ad fd call 0xfdadfe39 15: e9 5a 01 00 00 jmp 0x174 1a: e8 1a fe ad fd call 0xfdadfe39 1f: 48 8d 3d 03 eb 22 0c lea 0xc22eb03(%rip),%rdi # 0xc22eb29 26: 89 de mov %ebx,%esi * 28: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2d: e9 b3 fc ff ff jmp 0xfffffce5 32: e8 62 74 93 07 call 0x7937499 37: 41 89 c6 mov %eax,%r14d 3a: 31 ff xor %edi,%edi 3c: 89 c6 mov %eax,%esi