[v5.15] kernel BUG in btrfs_free_tree_block (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 674f684f7c61 Linux 5.15.212
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=144e72a9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=1e47e820a43a89a9e5e4
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f55be2937b89/disk-674f684f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a19fb0ffc049/vmlinux-674f684f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/365d4529a007/bzImage-674f684f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1e47e8...@syzkaller.appspotmail.com

kernel BUG at fs/btrfs/extent-tree.c:3311!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5575 Comm: syz.1.344 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:btrfs_free_tree_block+0xb71/0xb80 fs/btrfs/extent-tree.c:3311
Code: e9 02 f9 ff ff 44 89 e1 80 e1 07 38 c1 0f 8c 07 f9 ff ff be 08 00 00 00 4c 89 e7 e8 e9 a0 79 fe e9 f5 f8 ff ff e8 5f 7d 34 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 55 41 57 41 56 41 55
RSP: 0018:ffffc9000348f180 EFLAGS: 00010246

RAX: ffffffff83448421 RBX: 1ffff11004b47b4a RCX: 0000000000080000
RDX: ffffc9000e64a000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000348f2d0 R08: ffffffff901ee25f R09: 1ffffffff203dc4b
R10: dffffc0000000000 R11: fffffbfff203dc4c R12: ffff8880207dc064
R13: ffff888025a3da50 R14: 00000000fffffff4 R15: 0000000000000005
FS: 00007fdb953626c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb77358f2f8 CR3: 000000007e19b000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
btrfs_force_cow_block+0xabf/0x1760 fs/btrfs/ctree.c:502
btrfs_cow_block+0x33e/0x7d0 fs/btrfs/ctree.c:598
btrfs_search_slot+0x9d4/0x2090 fs/btrfs/ctree.c:-1
btrfs_lookup_inode+0xd6/0x470 fs/btrfs/inode-item.c:408
__btrfs_update_delayed_inode+0x176/0x910 fs/btrfs/delayed-inode.c:948
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1029 [inline]
__btrfs_commit_inode_delayed_items+0x176f/0x17e0 fs/btrfs/delayed-inode.c:1052
__btrfs_run_delayed_items+0x1ef/0x450 fs/btrfs/delayed-inode.c:1086
btrfs_commit_transaction+0x999/0x3580 fs/btrfs/transaction.c:2276
sync_filesystem+0x1be/0x220 fs/sync.c:66
generic_shutdown_super+0x6b/0x300 fs/super.c:448
kill_anon_super+0x36/0x70 fs/super.c:1089
btrfs_kill_super+0x3d/0x50 fs/btrfs/super.c:2390
deactivate_locked_super+0x93/0xf0 fs/super.c:335
cleanup_mnt+0x426/0x4d0 fs/namespace.c:1148
task_work_run+0x125/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fdb9712ae99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdb95362028 EFLAGS: 00000246
ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fdb973b3090 RCX: 00007fdb9712ae99
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000000
RBP: 00007fdb971c0eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdb973b3128 R14: 00007fdb973b3090 R15: 00007ffcaa208fd8
</TASK>
Modules linked in:

---[ end trace aef1e5926b7f08be ]---
RIP: 0010:btrfs_free_tree_block+0xb71/0xb80 fs/btrfs/extent-tree.c:3311
Code: e9 02 f9 ff ff 44 89 e1 80 e1 07 38 c1 0f 8c 07 f9 ff ff be 08 00 00 00 4c 89 e7 e8 e9 a0 79 fe e9 f5 f8 ff ff e8 5f 7d 34 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 55 41 57 41 56 41 55
RSP: 0018:ffffc9000348f180 EFLAGS: 00010246

RAX: ffffffff83448421 RBX: 1ffff11004b47b4a RCX: 0000000000080000
RDX: ffffc9000e64a000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000348f2d0 R08: ffffffff901ee25f R09: 1ffffffff203dc4b
R10: dffffc0000000000 R11: fffffbfff203dc4c R12: ffff8880207dc064
R13: ffff888025a3da50 R14: 00000000fffffff4 R15: 0000000000000005
FS: 00007fdb953626c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558edc44e8 CR3: 000000007e19b000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup