In the meantime I've also reproduced it with just "btrfs: fix the btrfs_get_global_root return value", but it took a rather long time. After wading through the code my suspicion is that before this fix the ERR_PTR return made that for those cases btrfs_get_root_ref and btrfs_get_fs_root_commit_root don't actually do the btrfs_lookup_fs_root. Although that seemed unintentional as far as I can tell it might have prevented some additional problems with whatever syzcaller is fuzzing here. Not sure if anyone who knows this code has any good idea where to start looking?
