Created attachment 1067459 [details]
preliminary vmcore anaysis of the panic

Description of problem:
Two hosts that make use of btrfs and its snapshot feature crash often the message "kernel BUG at fs/btrfs/extent_io.c:4041".
Probably the crashes happen in time correlation with new snapshots.

kernel BUG at fs/btrfs/extent_io.c:4041!
invalid opcode: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:02.2/0000:03:00.0/host0/target0:2:1/0:2:1:0/model
CPU 22 
Modules linked in: nfs fscache mptctl mptbase nfsd lockd nfs_acl autofs4 rpcsec_gss_krb5 auth_rpcgss sunrpc 8021q garp stp llc bonding ipv6 btrfs(T) zlib_deflat
e lzo_decompress lzo_compress libcrc32c xfs exportfs ext3 jbd ipmi_devintf iTCO_wdt iTCO_vendor_support microcode power_meter acpi_ipmi ipmi_si ipmi_msghandler 
dcdbas joydev sb_edac edac_core lpc_ich mfd_core shpchp sg tg3 ptp pps_core ext4 jbd2 mbcache sd_mod crc_t10dif ahci wmi megaraid_sas dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]

Pid: 39533, comm: btrfs-endio-wri Tainted: G           -- ------------  T 2.6.32-573.1.1.el6.x86_64 #1 Dell Inc. PowerEdge R720/0020HJ
RIP: 0010:[<ffffffffa03e9550>]  [<ffffffffa03e9550>] btrfs_release_extent_buffer_page.clone.0+0x90/0x120 [btrfs]
RSP: 0018:ffff881f9cb87c10  EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8816525078b0 RCX: 0000000000000018
RDX: 0000000000000000 RSI: 000000000000002e RDI: ffff8816525078b0
RBP: ffff881f9cb87c30 R08: 0000000000000000 R09: ffff881f9cb87c50
R10: 0000006424d06000 R11: 0000000000000000 R12: ffff881855363c60
R13: ffff8816525078b0 R14: 0000000000000005 R15: 0000000000000004
FS:  0000000000000000(0000) GS:ffff880100f60000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000003c5b6700e0 CR3: 0000000001a8d000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process btrfs-endio-wri (pid: 39533, threadinfo ffff881f9cb84000, task ffff88305a441520)
Stack:
 ffff8816525078b0 ffff881855363c60 ffff881855363c30 ffffffffffffffe5
<d> ffff881f9cb87c60 ffffffffa03e9a9a ffff880dfc4dc910 ffff8816525078b0
<d> ffff880dfc4dc910 0000000000000000 ffff881f9cb87c80 ffffffffa03e9c9c
Call Trace:
 [<ffffffffa03e9a9a>] release_extent_buffer+0x4a/0xe0 [btrfs]
 [<ffffffffa03e9c9c>] free_extent_buffer+0x3c/0xa0 [btrfs]
 [<ffffffffa03a0c81>] btrfs_release_path+0x31/0x90 [btrfs]
 [<ffffffffa03bc4fa>] btrfs_csum_file_blocks+0x49a/0x6d0 [btrfs]
 [<ffffffffa03d4314>] ? insert_reserved_file_extent.clone.0+0x94/0x270 [btrfs]
 [<ffffffffa03c8eb9>] add_pending_csums+0x49/0x70 [btrfs]
 [<ffffffffa03d4755>] btrfs_finish_ordered_io+0x265/0x3f0 [btrfs]
 [<ffffffff81089c10>] ? process_timeout+0x0/0x10
 [<ffffffffa03d48f5>] finish_ordered_fn+0x15/0x20 [btrfs]
 [<ffffffffa03f8a02>] worker_loop+0x142/0x550 [btrfs]
 [<ffffffffa03f88c0>] ? worker_loop+0x0/0x550 [btrfs]
 [<ffffffff810a101e>] kthread+0x9e/0xc0
 [<ffffffff8100c28a>] child_rip+0xa/0x20
 [<ffffffff810a0f80>] ? kthread+0x0/0xc0
 [<ffffffff8100c280>] ? child_rip+0x0/0x20
Code: 00 00 48 83 eb 01 4c 8b 24 d8 4d 85 e4 75 24 0f 1f 40 00 48 85 db 75 e3 5b 41 5c 41 5d 41 5e c9 c3 66 2e 0f 1f 84 00 00 00 00 00 <0f> 0b eb fe 0f 1f 40 00 45 84 f6 75 13 4c 89 e7 e8 8b 48 d5 e0 
RIP  [<ffffffffa03e9550>] btrfs_release_extent_buffer_page.clone.0+0x90/0x120 [btrfs]
 RSP <ffff881f9cb87c10>


Version-Release number of selected component (if applicable):
* Red Hat Enterprise Linux 6
  * seen on kernel-2.6.32-573.1.1.el6, other kernels likely affected
* brtfs
* NOTE: btrfs is a [Technology Preview](https://access.redhat.com/solutions/21101) kernel module
~~~
crash> mod -t
NAME   TAINTS
btrfs  T   << Tech preview module 
~~~

How reproducible:
unsure

Steps to Reproduce:
TBD


Additional info:
we have a vmcore and I will attach preliminary analysis
There is a similar bug in fedora 19 and upstream from 2013
- Fedora https://bugzilla.redhat.com/show_bug.cgi?id=968689 - closed as UPSTREAM
- upstream bug https://bugzilla.kernel.org/show_bug.cgi?id=59021 marked Assigned