From: Leo Martins <loemra.dev@gmail.com>
To: "Gideon Farrell" <gideon@solnickfarrell.co.uk>
Cc: linux-btrfs@vger.kernel.org
Subject: Re: refcount_warn_saturate in __btrfs_release_delayed_node for 6.18.2-arch2-1
Date: Tue, 6 Jan 2026 17:10:20 -0800 [thread overview]
Message-ID: <20260107011054.2694891-1-loemra.dev@gmail.com> (raw)
In-Reply-To: <DFHUFTKLUCB5.11QUC5R2L77DO@solnickfarrell.co.uk>
On Tue, 06 Jan 2026 22:01:58 +0000 "Gideon Farrell" <gideon@solnickfarrell.co.uk> wrote:
> Hi there,
>
> I recently experienced a type of crash I haven't seen before on this system which seems to originate in __btrfs_release_delayed_node on Kernel 6.18.2-arch2-1.
Hey, thanks for the report. This looks very similar to a different
report that has been fixed in 6.19-rc5.
Report: https://lore.kernel.org/oe-lkp/202511262228.6dda231e-lkp@intel.com/
Fix: https://lore.kernel.org/linux-btrfs/7c89417ac3352ce3cb0a6373a1746155c1e2754d.1765588168.git.loemra.dev@gmail.com/
Please let me know if this fixes your issue.
>
> Here's the stack trace:
>
> ```
Are these the first refcount_t: warnings in your dmesg? I would
expect an earlier warning that looks like
refcount_t: addition on 0; use-after-free.
> Jan 06 16:46:07 leviathan kernel: ------------[ cut here ]------------
> Jan 06 16:46:07 leviathan kernel: refcount_t: saturated; leaking memory.
> Jan 06 16:46:07 leviathan kernel: WARNING: CPU: 5 PID: 299428 at lib/refcount.c:22 refcount_warn_saturate+0x55/0x110
> Jan 06 16:46:07 leviathan kernel: Modules linked in: uinput uas usb_storage rfcomm tun ip6table_nat ip6table_filter ip6_tables iptable_nat iptable_filter ip_tables x_tables cmac algif_hash algif_skcipher af_alg bnep 8021q garp mrp stp llc vfat fat amd_atl intel_rapl_msr intel_rapl_common mt7921e snd_hda_codec_atihdmi mt7921_common snd_hda_codec_hdmi mt792x_lib snd_hda_intel mt76_connac_lib uvcvideo kvm_amd snd_hda_codec mt76 videobuf2_vmalloc snd_usb_audio uvc btusb snd_hda_core snd_usbmidi_lib videobuf2_memops kvm btmtk asus_nb_wmi snd_ump snd_intel_dspcfg videobuf2_v4l2 btrtl asus_wmi mac80211 snd_rawmidi spd5118 asus_ec_sensors snd_intel_sdw_acpi btbcm videobuf2_common platform_profile irqbypass snd_hwdep snd_seq_device btintel sp5100_tco rapl pcspkr videodev snd_pcm sparse_keymap wmi_bmof cfg80211 bluetooth snd_timer i2c_piix4 igc snd k10temp i2c_smbus soundcore ptp mousedev mc joydev rfkill libarc4 pps_core wacom gpio_amdpt gpio_generic mac_hid nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_chain_nat nf_nat nf_conntrack
> Jan 06 16:46:07 leviathan kernel: nf_defrag_ipv6 nf_defrag_ipv4 nf_tables crypto_user pkcs8_key_parser ntsync nfnetlink dm_crypt encrypted_keys trusted asn1_encoder tee dm_mod hid_logitech_hidpp amdgpu amdxcp i2c_algo_bit drm_ttm_helper ttm drm_exec drm_panel_backlight_quirks gpu_sched drm_suballoc_helper drm_buddy nvme polyval_clmulni hid_logitech_dj drm_display_helper ghash_clmulni_intel nvme_core ccp cec aesni_intel video nvme_keyring nvme_auth hkdf wmi
> Jan 06 16:46:07 leviathan kernel: CPU: 5 UID: 0 PID: 299428 Comm: kworker/u97:4 Tainted: G W 6.18.2-arch2-1 #1 PREEMPT(full) e9d53cde2ee9d1bdaa4464d2214ad0f22bd43723
> Jan 06 16:46:07 leviathan kernel: Tainted: [W]=WARN
> Jan 06 16:46:07 leviathan kernel: Hardware name: ASUS System Product Name/ROG STRIX B650E-I GAMING WIFI, BIOS 3057 10/29/2024
> Jan 06 16:46:07 leviathan kernel: Workqueue: btrfs-delalloc btrfs_work_helper
> Jan 06 16:46:07 leviathan kernel: RIP: 0010:refcount_warn_saturate+0x55/0x110
> Jan 06 16:46:07 leviathan kernel: Code: 84 bc 00 00 00 e9 76 ff 56 ff 85 f6 74 46 80 3d b4 ce ae 01 00 75 ee 48 c7 c7 60 4a 5d 8f c6 05 a4 ce ae 01 01 e8 4b 7d 7b ff <0f> 0b e9 4f ff 56 ff 80 3d 8d ce ae 01 00 75 cb 48 c7 c7 10 4b 5d
> Jan 06 16:46:07 leviathan kernel: RSP: 0018:ffffcff6e1687b90 EFLAGS: 00010246
> Jan 06 16:46:07 leviathan kernel: RAX: 0000000000000000 RBX: ffff8e330174b110 RCX: 0000000000000027
> Jan 06 16:46:07 leviathan kernel: RDX: ffff8e41de15d008 RSI: 0000000000000001 RDI: ffff8e41de15d000
> Jan 06 16:46:07 leviathan kernel: RBP: ffff8e32d3349060 R08: 0000000000000000 R09: 00000000ffffdfff
> Jan 06 16:46:07 leviathan kernel: R10: ffffffff90bbaa40 R11: ffffcff6e1687a28 R12: 0000000000020000
> Jan 06 16:46:07 leviathan kernel: R13: 0000000000000000 R14: ffff8e330174b228 R15: 0000000000000000
> Jan 06 16:46:07 leviathan kernel: FS: 0000000000000000(0000) GS:ffff8e424d632000(0000) knlGS:0000000000000000
> Jan 06 16:46:07 leviathan kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> Jan 06 16:46:07 leviathan kernel: CR2: 000033b723ba6004 CR3: 0000000024a24000 CR4: 0000000000f50ef0
> Jan 06 16:46:07 leviathan kernel: PKRU: 55555554
> Jan 06 16:46:07 leviathan kernel: Call Trace:
> Jan 06 16:46:07 leviathan kernel: <TASK>
> Jan 06 16:46:07 leviathan kernel: __btrfs_release_delayed_node.part.0+0x2e7/0x310
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: btrfs_delayed_update_inode+0xf5/0x1e0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? btrfs_update_root_times+0x75/0xa0
> Jan 06 16:46:07 leviathan kernel: btrfs_update_inode+0x59/0xc0
> Jan 06 16:46:07 leviathan kernel: __cow_file_range_inline+0x16c/0x3f0
> Jan 06 16:46:07 leviathan kernel: cow_file_range_inline.constprop.0+0xd7/0x140
> Jan 06 16:46:07 leviathan kernel: compress_file_range+0x3d6/0x5c0
> Jan 06 16:46:07 leviathan kernel: ? __pfx_submit_compressed_extents+0x10/0x10
> Jan 06 16:46:07 leviathan kernel: btrfs_work_helper+0xe1/0x380
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: process_one_work+0x193/0x350
> Jan 06 16:46:07 leviathan kernel: worker_thread+0x2d7/0x410
> Jan 06 16:46:07 leviathan kernel: ? __pfx_worker_thread+0x10/0x10
> Jan 06 16:46:07 leviathan kernel: kthread+0xfc/0x240
> Jan 06 16:46:07 leviathan kernel: ? __pfx_kthread+0x10/0x10
> Jan 06 16:46:07 leviathan kernel: ? __pfx_kthread+0x10/0x10
> Jan 06 16:46:07 leviathan kernel: ret_from_fork+0x1c2/0x1f0
> Jan 06 16:46:07 leviathan kernel: ? __pfx_kthread+0x10/0x10
> Jan 06 16:46:07 leviathan kernel: ret_from_fork_asm+0x1a/0x30
> Jan 06 16:46:07 leviathan kernel: </TASK>
> Jan 06 16:46:07 leviathan kernel: ---[ end trace 0000000000000000 ]---
> Jan 06 16:46:07 leviathan kernel: ------------[ cut here ]------------
> Jan 06 16:46:07 leviathan kernel: refcount_t: decrement hit 0; leaking memory.
> Jan 06 16:46:07 leviathan kernel: WARNING: CPU: 5 PID: 327490 at lib/refcount.c:31 refcount_warn_saturate+0xff/0x110
> Jan 06 16:46:07 leviathan kernel: Modules linked in: uinput uas usb_storage rfcomm tun ip6table_nat ip6table_filter ip6_tables iptable_nat iptable_filter ip_tables x_tables cmac algif_hash algif_skcipher af_alg bnep 8021q garp mrp stp llc vfat fat amd_atl intel_rapl_msr intel_rapl_common mt7921e snd_hda_codec_atihdmi mt7921_common snd_hda_codec_hdmi mt792x_lib snd_hda_intel mt76_connac_lib uvcvideo kvm_amd snd_hda_codec mt76 videobuf2_vmalloc snd_usb_audio uvc btusb snd_hda_core snd_usbmidi_lib videobuf2_memops kvm btmtk asus_nb_wmi snd_ump snd_intel_dspcfg videobuf2_v4l2 btrtl asus_wmi mac80211 snd_rawmidi spd5118 asus_ec_sensors snd_intel_sdw_acpi btbcm videobuf2_common platform_profile irqbypass snd_hwdep snd_seq_device btintel sp5100_tco rapl pcspkr videodev snd_pcm sparse_keymap wmi_bmof cfg80211 bluetooth snd_timer i2c_piix4 igc snd k10temp i2c_smbus soundcore ptp mousedev mc joydev rfkill libarc4 pps_core wacom gpio_amdpt gpio_generic mac_hid nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_chain_nat nf_nat nf_conntrack
> Jan 06 16:46:07 leviathan kernel: nf_defrag_ipv6 nf_defrag_ipv4 nf_tables crypto_user pkcs8_key_parser ntsync nfnetlink dm_crypt encrypted_keys trusted asn1_encoder tee dm_mod hid_logitech_hidpp amdgpu amdxcp i2c_algo_bit drm_ttm_helper ttm drm_exec drm_panel_backlight_quirks gpu_sched drm_suballoc_helper drm_buddy nvme polyval_clmulni hid_logitech_dj drm_display_helper ghash_clmulni_intel nvme_core ccp cec aesni_intel video nvme_keyring nvme_auth hkdf wmi
> Jan 06 16:46:07 leviathan kernel: CPU: 5 UID: 1000 PID: 327490 Comm: Backgro~ol #189 Tainted: G W 6.18.2-arch2-1 #1 PREEMPT(full) e9d53cde2ee9d1bdaa4464d2214ad0f22bd43723
> Jan 06 16:46:07 leviathan kernel: Tainted: [W]=WARN
> Jan 06 16:46:07 leviathan kernel: Hardware name: ASUS System Product Name/ROG STRIX B650E-I GAMING WIFI, BIOS 3057 10/29/2024
> Jan 06 16:46:07 leviathan kernel: RIP: 0010:refcount_warn_saturate+0xff/0x110
> Jan 06 16:46:07 leviathan kernel: Code: 88 4a 5d 8f c6 05 13 ce ae 01 01 e8 bb 7c 7b ff 0f 0b e9 bf fe 56 ff 48 c7 c7 e0 4a 5d 8f c6 05 f7 cd ae 01 01 e8 a1 7c 7b ff <0f> 0b e9 a5 fe 56 ff 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
> Jan 06 16:46:07 leviathan kernel: RSP: 0018:ffffcff6eed07868 EFLAGS: 00010246
> Jan 06 16:46:07 leviathan kernel: RAX: 0000000000000000 RBX: ffff8e330174b110 RCX: 0000000000000027
> Jan 06 16:46:07 leviathan kernel: RDX: ffff8e41de15d008 RSI: 0000000000000001 RDI: ffff8e41de15d000
> Jan 06 16:46:07 leviathan kernel: RBP: ffff8e32d3349060 R08: 0000000000000000 R09: 00000000ffffdfff
> Jan 06 16:46:07 leviathan kernel: R10: ffffffff90bbaa40 R11: ffffcff6eed07700 R12: 0000000000000000
> Jan 06 16:46:07 leviathan kernel: R13: ffff8e32d35393f0 R14: ffff8e330174b228 R15: 0000000000000000
> Jan 06 16:46:07 leviathan kernel: FS: 00007fb4ae5e56c0(0000) GS:ffff8e424d632000(0000) knlGS:00007fa800000000
> Jan 06 16:46:07 leviathan kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> Jan 06 16:46:07 leviathan kernel: CR2: 00007f87aaf44000 CR3: 000000012615c000 CR4: 0000000000f50ef0
> Jan 06 16:46:07 leviathan kernel: PKRU: 55555554
> Jan 06 16:46:07 leviathan kernel: Call Trace:
> Jan 06 16:46:07 leviathan kernel: <TASK>
> Jan 06 16:46:07 leviathan kernel: __btrfs_release_delayed_node.part.0+0x2f6/0x310
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? balance_dirty_pages_ratelimited_flags+0x190/0x380
> Jan 06 16:46:07 leviathan kernel: btrfs_commit_inode_delayed_inode+0xda/0x120
> Jan 06 16:46:07 leviathan kernel: btrfs_evict_inode+0x286/0x3e0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? xas_load+0xd/0xd0
> Jan 06 16:46:07 leviathan kernel: evict+0x117/0x290
> Jan 06 16:46:07 leviathan kernel: __dentry_kill+0x6b/0x190
> Jan 06 16:46:07 leviathan kernel: dput+0xeb/0x1c0
> Jan 06 16:46:07 leviathan kernel: do_renameat2+0x41e/0x580
> Jan 06 16:46:07 leviathan kernel: __x64_sys_rename+0x7a/0xc0
> Jan 06 16:46:07 leviathan kernel: do_syscall_64+0x81/0x7f0
> Jan 06 16:46:07 leviathan kernel: ? __mark_inode_dirty+0x273/0x350
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? btrfs_block_rsv_release+0x105/0x1f0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? __btrfs_qgroup_free_meta+0x2b/0x160
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? btrfs_inode_rsv_release+0x60/0xf0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? btrfs_drop_folio+0x3c/0x60
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? btrfs_buffered_write+0x527/0x8a0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? vfs_write+0x2e6/0x480
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? xas_load+0xd/0xd0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? xa_load+0x76/0xb0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? refill_obj_stock+0x12e/0x240
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? __memcg_slab_free_hook+0xf4/0x140
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? kmem_cache_free+0x549/0x5d0
> Jan 06 16:46:07 leviathan kernel: ? __x64_sys_close+0x3d/0x80
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? __x64_sys_close+0x3d/0x80
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? do_syscall_64+0x81/0x7f0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: ? switch_fpu_return+0x4e/0xd0
> Jan 06 16:46:07 leviathan kernel: ? srso_alias_return_thunk+0x5/0xfbef5
> Jan 06 16:46:07 leviathan kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
> Jan 06 16:46:07 leviathan kernel: RIP: 0033:0x7fb53e460adb
> Jan 06 16:46:07 leviathan kernel: Code: c0 48 8b 5d f8 c9 c3 0f 1f 84 00 00 00 00 00 b8 ff ff ff ff eb eb 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 52 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 01 72 1a 00 f7 d8
> Jan 06 16:46:07 leviathan kernel: RSP: 002b:00007fb4ae5e3d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
> Jan 06 16:46:07 leviathan kernel: RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 00007fb53e460adb
> Jan 06 16:46:07 leviathan kernel: RDX: 0000000000000055 RSI: 00007fb4ae5e3d90 RDI: 00007fb4ae5e3f10
> Jan 06 16:46:07 leviathan kernel: RBP: 00007fb4ae5e4100 R08: 8080808080808080 R09: 0101010101010100
> Jan 06 16:46:07 leviathan kernel: R10: fffefffffefffcff R11: 0000000000000246 R12: 00007fb4ae5e3d90
> Jan 06 16:46:07 leviathan kernel: R13: 0000000000000054 R14: 00007fb471740790 R15: 00007fb4ae5e3f10
> Jan 06 16:46:07 leviathan kernel: </TASK>
> Jan 06 16:46:07 leviathan kernel: ---[ end trace 0000000000000000 ]---
> ```
>
> ~gtf
>
next prev parent reply other threads:[~2026-01-07 1:10 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-06 22:01 refcount_warn_saturate in __btrfs_release_delayed_node for 6.18.2-arch2-1 Gideon Farrell
2026-01-07 1:10 ` Leo Martins [this message]
2026-01-07 1:52 ` Christian Heusel
2026-01-07 13:15 ` Christian Heusel
2026-01-07 17:45 ` Leo Martins
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260107011054.2694891-1-loemra.dev@gmail.com \
--to=loemra.dev@gmail.com \
--cc=gideon@solnickfarrell.co.uk \
--cc=linux-btrfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox