BUG: kernel NULL pointer dereference, address: 0000000000000008

[Ken Sharp]

Yet again my BTRFS root filesystem has failed. There is nothing wrong with my hardware - it's been tested over and over.

I can boot fine (the gods know what damage is done when I do) but processes eventually succumb to disk-wait and the whole system ends up frozen. Trying to force a shutdown with sysrq+e/i doesn't help as the processes are stuck disk-wait.

[ 28.460735] BTRFS error (device sdb3): incorrect extent count for 13631488; counted 0, expected 1
[ 28.476525] BTRFS error (device sdb3): incorrect extent count for 431808839680; counted 0, expected 1
[ 28.510255] BTRFS error (device sdb3): incorrect extent count for 646590758912; counted 5, expected 6
[ 28.512311] BTRFS error (device sdb3): incorrect extent count for 656254435328; counted 10, expected 11
[ 28.517812] BTRFS error (device sdb3): incorrect extent count for 684171722752; counted 1, expected 2
[ 28.518855] BTRFS error (device sdb3): incorrect extent count for 692761657344; counted 0, expected 1
[ 28.787901] BTRFS error (device sdb3): incorrect extent count for 1032064073728; counted 51, expected 52

No idea how to fix this. Running a Live DVD, mounting and scrubbing shows no errors. Unmounting sticks at disk-wait.

Running "btrfs check" in a Live DVD shows errors, but I daren't ask it to --repair as everyone advises not to, so why this is exists is anyone's guess.

[ 50.701078] BUG: kernel NULL pointer dereference, address: 0000000000000008
[ 50.701101] #PF: supervisor read access in kernel mode
[ 50.701112] #PF: error_code(0x0000) - not-present page
[ 50.701124] PGD 0 P4D 0
[ 50.701134] Oops: 0000 [#1] PREEMPT SMP PTI
[ 50.701146] CPU: 0 PID: 372 Comm: btrfs-transacti Tainted: P OE 6.5.0-14-generic #14~22.04.1-Ubuntu
[ 50.701166] Hardware name: LENOVO 0606AD5/LENOVO, BIOS A0KT60AUS 12/15/2016
[ 50.701180] RIP: 0010:assert_eb_page_uptodate+0x2b/0xd0 [btrfs]
[ 50.701317] Code: 1f 44 00 00 55 48 89 e5 41 55 41 54 53 48 8b 47 10 4c 8b 6f 18 f6 c4 04 75 26 41 81 bd 90 0c 00 00 ff 0f 00 00 49 89 f4 76 2b <48> 8b 46 08 a8 01 0f 85 82 00 00 00 66 90 49 8b 04 24 a8 04 74 3f
[ 50.701370] RSP: 0018:ffff96de80c0b9d8 EFLAGS: 00010212
[ 50.701394] RAX: 0000000000000213 RBX: 0000000000000000 RCX: 0000000000001000
[ 50.701419] RDX: 0000000000004087 RSI: 0000000000000000 RDI: ffff8ab9d10a4870
[ 50.701443] RBP: ffff96de80c0b9f0 R08: 0000000000000000 R09: 0000000000000000
[ 50.701468] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 50.701492] R13: ffff8ab9c1189000 R14: ffff8ab9d10a4870 R15: 0000000000d00000
[ 50.701517] FS: 0000000000000000(0000) GS:ffff8ac8ffa00000(0000) knlGS:0000000000000000
[ 50.701554] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 50.701577] CR2: 0000000000000008 CR3: 0000000118366001 CR4: 00000000000606f0
[ 50.701602] Call Trace:
[ 50.701621] <TASK>
[ 50.701640] ? show_regs+0x6d/0x80
[ 50.701667] ? __die+0x24/0x80
[ 50.701688] ? page_fault_oops+0x99/0x1b0
[ 50.701713] ? kernelmode_fixup_or_oops+0xb2/0x140
[ 50.701736] ? __bad_area_nosemaphore+0x1a5/0x2c0
[ 50.701758] ? bad_area_nosemaphore+0x16/0x30
[ 50.701780] ? do_user_addr_fault+0x2c4/0x6b0
[ 50.701802] ? exc_page_fault+0x83/0x1b0
[ 50.701826] ? asm_exc_page_fault+0x27/0x30
[ 50.701852] ? assert_eb_page_uptodate+0x2b/0xd0 [btrfs]
[ 50.701962] ? btrfs_search_slot+0x98b/0x1030 [btrfs]
[ 50.702054] extent_buffer_test_bit+0x51/0xa0 [btrfs]
[ 50.702163] free_space_test_bit+0xa6/0xe0 [btrfs]
[ 50.702275] modify_free_space_bitmap+0x106/0x400 [btrfs]
[ 50.702386] __add_to_free_space_tree+0x88/0xe0 [btrfs]
[ 50.702502] add_to_free_space_tree+0xaa/0x160 [btrfs]
[ 50.702611] do_free_extent_accounting+0x52/0x230 [btrfs]
[ 50.702705] __btrfs_free_extent+0x9df/0x1070 [btrfs]
[ 50.702799] run_delayed_data_ref+0x8b/0x180 [btrfs]
[ 50.702892] btrfs_run_delayed_refs_for_head+0x183/0x550 [btrfs]
[ 50.702986] __btrfs_run_delayed_refs+0xc0/0x150 [btrfs]
[ 50.703080] btrfs_run_delayed_refs+0x6d/0x1f0 [btrfs]
[ 50.703172] ? start_transaction+0x252/0x630 [btrfs]
[ 50.703271] btrfs_commit_transaction+0x6a/0xbb0 [btrfs]
[ 50.703369] ? start_transaction+0xc8/0x630 [btrfs]
[ 50.703468] transaction_kthread+0x14b/0x1c0 [btrfs]
[ 50.703564] ? __pfx_transaction_kthread+0x10/0x10 [btrfs]
[ 50.703662] kthread+0xf2/0x120
[ 50.703685] ? __pfx_kthread+0x10/0x10
[ 50.703707] ret_from_fork+0x47/0x70
[ 50.703730] ? __pfx_kthread+0x10/0x10
[ 50.703752] ret_from_fork_asm+0x1b/0x30
[ 50.703776] </TASK>
[ 50.703793] Modules linked in: bridge stp llc snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi ledtrig_audio intel_rapl_msr intel_rapl_common snd_hda_intel sb_edac snd_intel_dspcfg snd_intel_sdw_acpi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec snd_hda_core coretemp snd_hwdep crct10dif_pclmul crc32_pclmul polyval_clmulni snd_pcm polyval_generic ghash_clmulni_intel kvm_intel aesni_intel snd_seq_midi snd_seq_midi_event crypto_simd snd_rawmidi cryptd kvm snd_seq i2c_i801 rapl uas think_lmi snd_seq_device sunrpc binfmt_misc irqbypass usb_storage intel_cstate serio_raw firmware_attributes_class wmi_bmof i2c_smbus snd_timer xhci_pci lpc_ich mei_me xhci_pci_renesas e1000e snd mei ioatdma pata_acpi soundcore dca nvidia_uvm(POE) sch_fq_codel bfq msr efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic libcrc32c xor raid6_pq z3fold lz4 lz4_compress nvidia_drm(POE) nvidia_modeset(POE) input_leds nvidia(POE) video hid_generic drm_kms_helper usbhid hid psmouse nvme ahci drm libahci nvme_core nvme_common
[ 50.703872] wmi mac_hid
[ 50.704160] CR2: 0000000000000008
[ 50.704180] ---[ end trace 0000000000000000 ]---
[ 50.755600] RIP: 0010:assert_eb_page_uptodate+0x2b/0xd0 [btrfs]
[ 50.755721] Code: 1f 44 00 00 55 48 89 e5 41 55 41 54 53 48 8b 47 10 4c 8b 6f 18 f6 c4 04 75 26 41 81 bd 90 0c 00 00 ff 0f 00 00 49 89 f4 76 2b <48> 8b 46 08 a8 01 0f 85 82 00 00 00 66 90 49 8b 04 24 a8 04 74 3f
[ 50.755785] RSP: 0018:ffff96de80c0b9d8 EFLAGS: 00010212
[ 50.755808] RAX: 0000000000000213 RBX: 0000000000000000 RCX: 0000000000001000
[ 50.755833] RDX: 0000000000004087 RSI: 0000000000000000 RDI: ffff8ab9d10a4870
[ 50.755858] RBP: ffff96de80c0b9f0 R08: 0000000000000000 R09: 0000000000000000
[ 50.755883] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 50.755907] R13: ffff8ab9c1189000 R14: ffff8ab9d10a4870 R15: 0000000000d00000
[ 50.755932] FS: 0000000000000000(0000) GS:ffff8ac8ffa00000(0000) knlGS:0000000000000000
[ 50.755970] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 50.755993] CR2: 0000000000000008 CR3: 0000000118366001 CR4: 00000000000606f0
[ 50.756018] note: btrfs-transacti[372] exited with irqs disabled

So my guess is that the bug is caused by a dodgy filesystem, but I'm pretty sure this bug shouldn't occur.

Same with the 22.04.3 MATE Live DVD (which is believe is running a 6.2.0 kernel).

I assume I'll have to reinstall. Again.

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: linux-image-6.5.0-14-generic 6.5.0-14.14~22.04.1
ProcVersionSignature: Ubuntu 6.5.0-14.14~22.04.1-generic 6.5.3
Uname: Linux 6.5.0-14-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: MATE
Date: Wed Dec 20 13:37:41 2023
SourcePackage: linux-signed-hwe-6.5
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.apport.crashdb.conf: [modified]
mtime.conffile..etc.apport.crashdb.conf: 2019-08-06T11:56:22.315382

[Ken Sharp (kennybobs)]

So I ran multiple btrfs scrubs and they all reported no error, but for some reason my system now works. I still have the incorrect extent counts but there's no lock-ups. Additional scrubs find nothing wrong.