Re: [syzbot] [btrfs?] WARNING in __add_block_group_free_space

From: syzbot

Date: Sat Oct 31 2026 - 09:30:56 EST


syzbot has found a reproducer for the following issue on:

HEAD commit: 36aad21d50d1 Merge tag 'ksmbd-for-7.4-rc1-part2' of git://..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=113b8959580000
kernel config: https://syzkaller.appspot.com/x/.config?x=94cb1a71158c9027
dashboard link: https://syzkaller.appspot.com/bug?extid=6931616d57696102d8aa
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=147bccb1580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6931616d57696102d8aa@xxxxxxxxxxxxxxxxxxxxxxxxx

------------[ cut here ]------------
btrfs_abort_should_print_stack(__error)
WARNING: fs/btrfs/free-space-tree.c:1446 at __add_block_group_free_space+0x5a3/0x5b0 fs/btrfs/free-space-tree.c:1446, CPU#0: kworker/u4:7/185
Modules linked in:
CPU: 0 UID: 0 PID: 185 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound btrfs_async_reclaim_data_space
RIP: 0010:__add_block_group_free_space+0x5a3/0x5b0 fs/btrfs/free-space-tree.c:1446
Code: 07 38 c1 0f 8c ce fc ff ff 4c 89 f7 e8 66 3c f5 fd e9 c1 fc ff ff e8 cc 98 7c fd eb 10 e8 c5 98 7c fd eb 09 e8 be 98 7c fd 90 <0f> 0b 90 44 89 e1 f7 d9 e9 51 fe ff ff 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90001a7f578 EFLAGS: 00010293
RAX: ffffffff844c8872 RBX: ffff888013790001 RCX: ffff888034dc0000
RDX: 0000000000000000 RSI: ffffffff9081ef80 RDI: 00000000ffffffe4
RBP: ffff888037aea758 R08: ffff888034dc0000 R09: 0000000000000003
R10: 00000000fffffffb R11: 0000000000000000 R12: 00000000ffffffe4
R13: ffff88801377d000 R14: ffff888037aea7b8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88808aa01000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4b3d8dd080 CR3: 0000000041dd5000 CR4: 0000000000352ef0
Call Trace:
<TASK>
btrfs_add_block_group_free_space+0xd0/0x130 fs/btrfs/free-space-tree.c:1471
btrfs_create_pending_block_groups+0xcc6/0x15e0 fs/btrfs/block-group.c:2942
__btrfs_end_transaction+0x140/0x640 fs/btrfs/transaction.c:1119
flush_space+0x3e9/0xde0 fs/btrfs/space-info.c:912
do_async_reclaim_data_space+0x137/0x550 fs/btrfs/space-info.c:1455
btrfs_async_reclaim_data_space+0x41/0x90 fs/btrfs/space-info.c:1519
process_one_work kernel/workqueue.c:3495 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.