[syzbot] [btrfs?] kernel BUG in extent_writepage_io (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1a3746ccbb0a Merge tag 'strncpy-removal-v7.2-rc1' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15dc501c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5fece1a9477c321
dashboard link: https://syzkaller.appspot.com/bug?extid=11036d2e408a419c179c
compiler: Debian clang version 22.1.6 (++20260514074242+fc4aad7b5db3-1~exp1~20260514074407.73), Debian LLD 22.1.6

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-1a3746cc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/376997b632fc/vmlinux-1a3746cc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0920309c4838/bzImage-1a3746cc.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+11036d...@syzkaller.appspotmail.com

assertion failed: !btrfs_extent_map_is_compressed(em), in fs/btrfs/extent_io.c:1720
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent_io.c:1720!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 24 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound btrfs_async_reclaim_metadata_space
RIP: 0010:submit_one_sector fs/btrfs/extent_io.c:1720 [inline]
RIP: 0010:extent_writepage_io+0x1022/0x11a0 fs/btrfs/extent_io.c:1826
Code: 28 fd 90 0f 0b e8 9e 6b c7 fd 48 c7 c7 20 aa 17 8c 48 c7 c6 e0 c0 17 8c 48 c7 c2 a0 aa 17 8c b9 b8 06 00 00 e8 af d4 28 fd 90 <0f> 0b e8 77 6b c7 fd 48 c7 c7 20 aa 17 8c 48 c7 c6 80 c1 17 8c 48
RSP: 0000:ffffc9000031edc0 EFLAGS: 00010246
RAX: 0000000000000053 RBX: 0000000000000002 RCX: 2628df0bc8950a00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffea00014e8dc0 R08: ffffc9000031eb47 R09: 1ffff92000063d68
R10: dffffc0000000000 R11: fffff52000063d69 R12: 0000000000001000
R13: dffffc0000000000 R14: ffff88803fc2b2f0 R15: 000000000051f000
FS: 0000000000000000(0000) GS:ffff88808c848000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2289ad1000 CR3: 000000003f92d000 CR4: 0000000000352ef0
Call Trace:
<TASK>
extent_writepage fs/btrfs/extent_io.c:1936 [inline]
extent_write_cache_pages fs/btrfs/extent_io.c:2593 [inline]
btrfs_writepages+0x17a1/0x28b0 fs/btrfs/extent_io.c:2725
do_writepages+0x338/0x560 mm/page-writeback.c:2571
filemap_writeback mm/filemap.c:388 [inline]
filemap_flush_nr+0x21b/0x360 mm/filemap.c:463
start_delalloc_inodes+0x4cf/0xab0 fs/btrfs/inode.c:8752
btrfs_start_delalloc_roots+0x513/0x790 fs/btrfs/inode.c:8812
shrink_delalloc fs/btrfs/space-info.c:773 [inline]
flush_space+0x73c/0xde0 fs/btrfs/space-info.c:883
do_async_reclaim_metadata_space+0x3e8/0x940 fs/btrfs/space-info.c:1211
btrfs_async_reclaim_metadata_space+0x89/0xe0 fs/btrfs/space-info.c:1278
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:submit_one_sector fs/btrfs/extent_io.c:1720 [inline]
RIP: 0010:extent_writepage_io+0x1022/0x11a0 fs/btrfs/extent_io.c:1826
Code: 28 fd 90 0f 0b e8 9e 6b c7 fd 48 c7 c7 20 aa 17 8c 48 c7 c6 e0 c0 17 8c 48 c7 c2 a0 aa 17 8c b9 b8 06 00 00 e8 af d4 28 fd 90 <0f> 0b e8 77 6b c7 fd 48 c7 c7 20 aa 17 8c 48 c7 c6 80 c1 17 8c 48
RSP: 0000:ffffc9000031edc0 EFLAGS: 00010246
RAX: 0000000000000053 RBX: 0000000000000002 RCX: 2628df0bc8950a00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffea00014e8dc0 R08: ffffc9000031eb47 R09: 1ffff92000063d68
R10: dffffc0000000000 R11: fffff52000063d69 R12: 0000000000001000
R13: dffffc0000000000 R14: ffff88803fc2b2f0 R15: 000000000051f000
FS: 0000000000000000(0000) GS:ffff88808c848000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f22964869c8 CR3: 00000000121e5000 CR4: 0000000000352ef0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup