[syzbot] [btrfs?] WARNING in btrfs_add_link (2)

[syzbot <syzbot+f3a86ba8f6ee221654cd@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    8bf22c33e7a1 Merge tag 'net-7.0-rc1' of git://git.kernel.o..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=113f495a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=abe4fa590468dbfb
dashboard link: https://syzkaller.appspot.com/bug?extid=f3a86ba8f6ee221654cd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/010f0532c934/disk-8bf22c33.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ed0946db3f63/vmlinux-8bf22c33.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ef1efd866885/bzImage-8bf22c33.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f3a86ba8f6ee221654cd@syzkaller.appspotmail.com

---------[  137.618642][ T6713] ------------[ cut here ]------------
BTRFS: Transaction aborted (error -28)
WARNING: fs/btrfs/inode.c:6871 at btrfs_add_link+0xc1a/0xec0 fs/btrfs/inode.c:6871, CPU#1: syz.5.90/6713
Modules linked in:
CPU: 1 UID: 0 PID: 6713 Comm: syz.5.90 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:btrfs_add_link+0xc1e/0xec0 fs/btrfs/inode.c:6871
Code: e1 fd e9 ae 00 00 00 e8 b0 e3 c6 fd 84 c0 74 24 e8 17 dc e1 fd e9 9b 00 00 00 e8 0d dc e1 fd 48 8d 3d e6 64 90 0b 8b 74 24 08 <67> 48 0f b9 3a e9 76 fb ff ff e8 f3 7f 3f 07 41 89 c7 31 ff 89 c6
RSP: 0018:ffffc90005a07860 EFLAGS: 00010287
RAX: ffffffff83e27803 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc9001cdb1000 RSI: 00000000ffffffe4 RDI: ffffffff8f72dcf0
RBP: ffffc90005a07990 R08: ffff88802928bc80 R09: 0000000000000003
R10: 0000000000000100 R11: 00000000fffffffb R12: 1ffff1100c31e974
R13: 00000000ffffffe4 R14: ffff8880618f4ba0 R15: ffff88802a5f8001
FS:  00007f58cbb646c0(0000) GS:ffff888126442000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9c22d1fb4c CR3: 000000003d082000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 btrfs_create_new_inode+0x11e7/0x20e0 fs/btrfs/inode.c:6804
 btrfs_create_common+0x189/0x310 fs/btrfs/inode.c:6930
 btrfs_mkdir+0xc7/0xf0 fs/btrfs/inode.c:7069
 vfs_mkdir+0x40b/0x630 fs/namei.c:5233
 filename_mkdirat+0x289/0x520 fs/namei.c:5266
 __do_sys_mkdirat fs/namei.c:5287 [inline]
 __se_sys_mkdirat+0x35/0x150 fs/namei.c:5284
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f58cd94b507
Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f58cbb63e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f58cbb63ee0 RCX: 00007f58cd94b507
RDX: 00000000000001ff RSI: 00002000000000c0 RDI: 00000000ffffff9c
RBP: 0000200000000080 R08: 0000200000000140 R09: 0000000000000000
R10: 0000200000000080 R11: 0000000000000246 R12: 00002000000000c0
R13: 00007f58cbb63ea0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	e1 fd                	loope  0xffffffff
   2:	e9 ae 00 00 00       	jmp    0xb5
   7:	e8 b0 e3 c6 fd       	call   0xfdc6e3bc
   c:	84 c0                	test   %al,%al
   e:	74 24                	je     0x34
  10:	e8 17 dc e1 fd       	call   0xfde1dc2c
  15:	e9 9b 00 00 00       	jmp    0xb5
  1a:	e8 0d dc e1 fd       	call   0xfde1dc2c
  1f:	48 8d 3d e6 64 90 0b 	lea    0xb9064e6(%rip),%rdi        # 0xb90650c
  26:	8b 74 24 08          	mov    0x8(%rsp),%esi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 76 fb ff ff       	jmp    0xfffffbaa
  34:	e8 f3 7f 3f 07       	call   0x73f802c
  39:	41 89 c7             	mov    %eax,%r15d
  3c:	31 ff                	xor    %edi,%edi
  3e:	89 c6                	mov    %eax,%esi


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup