Public bug reported:
# Launchpad bug: Oops in kernel zstd (ZSTD_btGetAllMatches_noDict_3 /
ZSTD_compressBlock_opt0) during parallel btrfs defragment on
compress=zstd fs — suspected btrfs zstd workspace UAF
**Summary:**
Three kernel panics within 40 minutes while running several `btrfs filesystem
defragment` processes in parallel on a btrfs fs mounted with `compress=zstd`.
All three oopsed inside the kernel zstd compressor invoked from btrfs
compressed writeback (btrfs-delalloc workqueue); two of them crashed at the
*identical* bogus address — deterministic memory corruption, consistent with a
use-after-free / race in btrfs's zstd workspace pool (`zstd_find_workspace` in
the trace). Kernel 7.3.0-8-generic.
## Environment
- Ubuntu, linux 7.3.0-8-generic, btrfs-progs v7.1
- ASRock Z690 Steel Legend, Intel i7-14700K, 48G RAM + 48G swapfile on the same
btrfs fs
- Root fs: btrfs on nvme0n1p3, `defaults,noatime,compress=zstd`, single device,
~950G, ~870G used at the time
- Trigger: multiple concurrent `btrfs filesystem defragment -r <path>`
processes (without `-f`), rewriting large parts of a fragmented fs
## Crash 1 & 2 (identical)
```
BUG: unable to handle page fault for address: 0000000100000005
#PF: supervisor write access in kernel mode, error_code(0x0002) - not-present
page
Workqueue: btrfs-delalloc btrfs_work_helper [btrfs]
RIP: 0010:ZSTD_btGetAllMatches_noDict_3+0x495/0x830
Call Trace:
ZSTD_compressBlock_opt0 / ZSTD_compressBlock_btopt
ZSTD_buildSeqStore+0x51b/0x710
ZSTD_resetCCtx_internal+0x320/0xef0
ZSTD_compressBlock_internal / ZSTD_compress_frameChunk /
ZSTD_compressContinue_internal
ZSTD_compressStream2 / ZSTD_endStream / zstd_end_stream
zstd_compress_bio+0x5ff/0x6c0 [btrfs]
zstd_find_workspace.isra.0+0x119/0x200 [btrfs]
btrfs_compress_bio+0x2ac/0x340 [btrfs]
compress_file_range+0x34d/0x5b0 [btrfs]
btrfs_work_helper+0xc7/0x1e0 [btrfs]
```
Two runs, different PIDs (kworker/u113:1 PID 57928 at uptime 5025 s;
kworker/u113:0 PID 36074 at uptime 1386 s), same fault address
`0x0000000100000005` — deterministic.
## Crash 3
```
BUG: unable to handle page fault for address: ffffcf308300395c
Workqueue: btrfs-delalloc btrfs_work_helper [btrfs]
RIP: 0010:ZSTD_compressBlock_opt0+0xf63/0x11f0
```
kworker/u114:10, PID 1425, uptime 585 s (crash ~10 s into a fresh boot —
leftover writeback from the crashed session).
## Additional data points
- During the storm the fs also logged `BTRFS error (device nvme0n1p3): pending
csums is 61440` on a post-crash mount (uncommitted csums at panic time —
expected consequence, listed for completeness).
- Level note: `ZSTD_compressBlock_btopt/opt0` indicates a high zstd strategy in
use, i.e. the defragmentation path was recompressing with a non-default level
(mount uses plain `compress=zstd`).
- Same machine has a second, unrelated kernel oops (fs/namei path_is_under) —
reported separately; kswapd/shrinker activity in this box is heavy, in case
that matters for this bug.
## Suspected root cause
Use-after-free or pool-handling race in btrfs's zstd workspace management
(`fs/btrfs/zstd.c`, `zstd_find_workspace` / `zstd_put_workspace`) under high
concurrency of `compress_file_range` workers. The parallel defragmentation
generated an extreme number of concurrent compression jobs.
## Attachments
- `/var/crash/202610031509/dmesg.202610031509`,
`/var/crash/202610031534/dmesg.202610031534`,
`/var/crash/202610031547/dmesg.202610031547` (kdump vmcore-dmesg, collected by
apport)
## Request
Please route to fs/btrfs / lib/zstd maintainers. Happy to test patches or a
debug kernel; the trigger (parallel defrag) is cheap to reproduce if it doesn't
trip immediately.
ProblemType: Bug
DistroRelease: Ubuntu 26.10
Package: linux-image-7.3.0-8-generic 7.3.0-8.8
ProcVersionSignature: Ubuntu 7.3.0-8.8-generic 7.3.0-rc5
Uname: Linux 7.3.0-8-generic x86_64
ApportVersion: 2.36.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Sat Oct 3 16:15:43 2026
InstallationDate: Installed on 2026-06-02 (123 days ago)
InstallationMedia: Kubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423)
IwDevWlp3s0f0Link: Not connected.
MachineType: ASRock Z690 Steel Legend
ProcFB: 0 nvidia-drmdrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.3.0-8-generic
root=UUID=94679966-1cae-40b2-b3c5-c09ce31d8dd2 ro rootflags=subvol=@ quiet
splash RESUME=UUID=94679966-1cae-40b2-b3c5-c09ce31d8dd2 resume_offset=35435763
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
SourcePackage: linux
UpgradeStatus: Upgraded to stonking on 2026-09-04 (29 days ago)
dmi.bios.date: 08/09/2024
dmi.bios.release: 5.27
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: 19.02
dmi.board.name: Z690 Steel Legend
dmi.board.vendor: ASRock
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvr19.02:bd08/09/2024:br5.27:svnASRock:pnZ690SteelLegend:pvrToBeFilledByO.E.M.:rvnASRock:rnZ690SteelLegend:rvr:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:skuToBeFilledByO.E.M.:pfaToBeFilledByO.E.M.:
dmi.product.family: To Be Filled By O.E.M.
dmi.product.name: Z690 Steel Legend
dmi.product.sku: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: ASRock
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug stonking third-party-packages wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169415
Title:
Oops in kernel zstd from btrfs compressed writeback during parallel
defrag
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169415/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
