From: syzbot <syzbot+725322cc4ff5c53abfac@syzkaller.appspotmail.com>
To: anna-maria@linutronix.de, frederic@kernel.org,
kent.overstreet@linux.dev, linux-bcachefs@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tglx@linutronix.de
Subject: Re: [syzbot] [bcachefs?] possible deadlock in get_partial_node (2)
Date: Sun, 09 Mar 2025 03:40:28 -0700 [thread overview]
Message-ID: <67cd701c.050a0220.2eb24d.0000.GAE@google.com> (raw)
In-Reply-To: <67b1f949.050a0220.173698.000c.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: b7c90e3e717a Merge tag 'x86-urgent-2025-03-08' of git://gi..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10898664580000
kernel config: https://syzkaller.appspot.com/x/.config?x=523d3ff8e053340a
dashboard link: https://syzkaller.appspot.com/bug?extid=725322cc4ff5c53abfac
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=137c1fa0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12e0fa54580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/efe746eddadf/disk-b7c90e3e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8dcac591074f/vmlinux-b7c90e3e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f9ac7aeb49a3/bzImage-b7c90e3e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/b499053db8a0/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+725322cc4ff5c53abfac@syzkaller.appspotmail.com
=============================================================================
======================================================
WARNING: possible circular locking dependency detected
6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0 Not tainted
------------------------------------------------------
syz-executor131/5940 is trying to acquire lock:
ffffffff8ea14fb8 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
but task is already holding lock:
ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:5609 [inline]
ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x9c/0x430 mm/slub.c:5647
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&n->list_lock){-.-.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
get_partial_node+0x37/0x3f0 mm/slub.c:2834
get_partial mm/slub.c:2948 [inline]
___slab_alloc+0xb75/0x14a0 mm/slub.c:3806
__slab_alloc+0x58/0xa0 mm/slub.c:3916
__slab_alloc_node mm/slub.c:3991 [inline]
slab_alloc_node mm/slub.c:4152 [inline]
kmem_cache_alloc_noprof+0x268/0x380 mm/slub.c:4171
kmem_alloc_batch lib/debugobjects.c:371 [inline]
fill_pool+0x260/0x680 lib/debugobjects.c:403
debug_objects_fill_pool lib/debugobjects.c:725 [inline]
debug_object_activate+0x493/0x580 lib/debugobjects.c:814
debug_hrtimer_activate kernel/time/hrtimer.c:455 [inline]
debug_activate kernel/time/hrtimer.c:496 [inline]
enqueue_hrtimer+0x30/0x3c0 kernel/time/hrtimer.c:1100
__hrtimer_start_range_ns kernel/time/hrtimer.c:1282 [inline]
hrtimer_start_range_ns+0xcc3/0xfa0 kernel/time/hrtimer.c:1343
hrtimer_start include/linux/hrtimer.h:260 [inline]
start_dl_timer+0x36a/0x4e0 kernel/sched/deadline.c:1190
update_curr_dl_se+0x348/0x860 kernel/sched/deadline.c:1539
update_curr+0x568/0xda0 kernel/sched/fair.c:1246
entity_tick kernel/sched/fair.c:5628 [inline]
task_tick_fair+0x69/0x4e0 kernel/sched/fair.c:13091
sched_tick+0x21e/0x660 kernel/sched/core.c:5661
update_process_times+0x276/0x2f0 kernel/time/timer.c:2520
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x37c/0x500 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1801 [inline]
__hrtimer_run_queues+0x551/0xd30 kernel/time/hrtimer.c:1865
hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1927
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
arch_local_save_flags arch/x86/include/asm/irqflags.h:87 [inline]
arch_local_irq_save arch/x86/include/asm/irqflags.h:123 [inline]
lock_is_held_type+0x67/0x190 kernel/locking/lockdep.c:5919
lock_is_held include/linux/lockdep.h:249 [inline]
__might_resched+0xa5/0x780 kernel/sched/core.c:8729
down_read+0x8e/0xa40 kernel/locking/rwsem.c:1523
anon_vma_lock_read include/linux/rmap.h:136 [inline]
validate_mm+0x2c8/0x590 mm/vma.c:612
__split_vma+0xa60/0xbf0 mm/vma.c:513
split_vma mm/vma.c:542 [inline]
vma_modify+0x244/0x330 mm/vma.c:1529
vma_modify_flags+0x3a5/0x430 mm/vma.c:1547
mprotect_fixup+0x45a/0xaa0 mm/mprotect.c:666
do_mprotect_pkey+0x99d/0xdd0 mm/mprotect.c:840
__do_sys_mprotect mm/mprotect.c:861 [inline]
__se_sys_mprotect mm/mprotect.c:858 [inline]
__x64_sys_mprotect+0x80/0x90 mm/mprotect.c:858
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (hrtimer_bases.lock){-.-.}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
lock_hrtimer_base kernel/time/hrtimer.c:181 [inline]
hrtimer_start_range_ns+0xf9/0xfa0 kernel/time/hrtimer.c:1341
hrtimer_start include/linux/hrtimer.h:260 [inline]
start_dl_timer+0x36a/0x4e0 kernel/sched/deadline.c:1190
enqueue_dl_entity+0x1056/0x1db0 kernel/sched/deadline.c:2076
dl_server_start+0xe2/0x2a0 kernel/sched/deadline.c:1671
enqueue_task_fair+0x9d7/0xd40 kernel/sched/fair.c:7012
enqueue_task+0x73/0x3d0 kernel/sched/core.c:2070
activate_task kernel/sched/core.c:2117 [inline]
wake_up_new_task+0x576/0xc70 kernel/sched/core.c:4879
kernel_clone+0x480/0x870 kernel/fork.c:2846
user_mode_thread+0x144/0x1c0 kernel/fork.c:2893
rest_init+0x23/0x300 init/main.c:708
start_kernel+0x484/0x510 init/main.c:1099
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:515
x86_64_start_kernel+0x66/0x70 arch/x86/kernel/head64.c:496
common_startup_64+0x13e/0x147
-> #2 (&rq->__lock){-.-.}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
raw_spin_rq_lock kernel/sched/sched.h:1521 [inline]
task_rq_lock+0xc6/0x360 kernel/sched/core.c:700
cgroup_move_task+0x9b/0x5a0 kernel/sched/psi.c:1161
css_set_move_task+0x72e/0x950 kernel/cgroup/cgroup.c:898
cgroup_post_fork+0x284/0x8b0 kernel/cgroup/cgroup.c:6695
copy_process+0x398a/0x3cf0 kernel/fork.c:2629
kernel_clone+0x223/0x870 kernel/fork.c:2815
user_mode_thread+0x144/0x1c0 kernel/fork.c:2893
rest_init+0x23/0x300 init/main.c:708
start_kernel+0x484/0x510 init/main.c:1099
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:515
x86_64_start_kernel+0x66/0x70 arch/x86/kernel/head64.c:496
common_startup_64+0x13e/0x147
-> #1 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4214
up+0x72/0x90 kernel/locking/semaphore.c:191
__up_console_sem kernel/printk/printk.c:343 [inline]
__console_unlock+0x123/0x1f0 kernel/printk/printk.c:2869
__console_flush_and_unlock kernel/printk/printk.c:3271 [inline]
console_unlock+0x18f/0x3b0 kernel/printk/printk.c:3309
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
_printk+0xd5/0x120 kernel/printk/printk.c:2457
bt_err+0x127/0x180 net/bluetooth/lib.c:296
hci_cmd_timeout+0x104/0x1e0 net/bluetooth/hci_core.c:1456
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd30 kernel/workqueue.c:3400
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 ((console_sem).lock){-...}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
console_trylock kernel/printk/printk.c:2852 [inline]
console_trylock_spinning kernel/printk/printk.c:2009 [inline]
vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2431
_printk+0xd5/0x120 kernel/printk/printk.c:2457
slab_bug+0x6d/0xc0 mm/slub.c:1028
slab_err+0x130/0x190 mm/slub.c:1129
list_slab_objects mm/slub.c:5580 [inline]
free_partial mm/slub.c:5615 [inline]
__kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
bio_put_slab block/bio.c:155 [inline]
bioset_exit+0x54e/0x650 block/bio.c:1662
bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
__bch2_fs_free fs/bcachefs/super.c:558 [inline]
bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> hrtimer_bases.lock --> &n->list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&n->list_lock);
lock(hrtimer_bases.lock);
lock(&n->list_lock);
lock((console_sem).lock);
*** DEADLOCK ***
4 locks held by syz-executor131/5940:
#0: ffffffff8f2578c8 (bio_slab_lock){+.+.}-{4:4}, at: bio_put_slab block/bio.c:140 [inline]
#0: ffffffff8f2578c8 (bio_slab_lock){+.+.}-{4:4}, at: bioset_exit+0x42f/0x650 block/bio.c:1662
#1: ffffffff8e9d5210 (cpu_hotplug_lock){++++}-{0:0}, at: kmem_cache_destroy+0x3e/0x160 mm/slab_common.c:517
#2: ffffffff8ec221b0 (slab_mutex){+.+.}-{4:4}, at: kmem_cache_destroy+0x4c/0x160 mm/slab_common.c:518
#3: ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
#3: ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:5609 [inline]
#3: ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x9c/0x430 mm/slub.c:5647
stack backtrace:
CPU: 1 UID: 0 PID: 5940 Comm: syz-executor131 Not tainted 6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
console_trylock kernel/printk/printk.c:2852 [inline]
console_trylock_spinning kernel/printk/printk.c:2009 [inline]
vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2431
_printk+0xd5/0x120 kernel/printk/printk.c:2457
slab_bug+0x6d/0xc0 mm/slub.c:1028
slab_err+0x130/0x190 mm/slub.c:1129
list_slab_objects mm/slub.c:5580 [inline]
free_partial mm/slub.c:5615 [inline]
__kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
bio_put_slab block/bio.c:155 [inline]
bioset_exit+0x54e/0x650 block/bio.c:1662
bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
__bch2_fs_free fs/bcachefs/super.c:558 [inline]
bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f04451d5c6a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 1e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff28174678 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff28174710 RCX: 00007f04451d5c6a
RDX: 00004000000000c0 RSI: 0000400000000000 RDI: 00007fff281746d0
RBP: 0000000000000000 R08: 00007fff28174710 R09: 0000000000005979
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000001000000 R14: 00004000000000c0 R15: 0000000000000003
</TASK>
BUG bio-1200 (Not tainted): Objects remaining in bio-1200 on __kmem_cache_shutdown()
-----------------------------------------------------------------------------
Slab 0xffffea0001938500 objects=12 used=4 fp=0xffff888064e16a00 flags=0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
CPU: 1 UID: 0 PID: 5940 Comm: syz-executor131 Not tainted 6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
slab_err+0x15a/0x190 mm/slub.c:1131
list_slab_objects mm/slub.c:5580 [inline]
free_partial mm/slub.c:5615 [inline]
__kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
bio_put_slab block/bio.c:155 [inline]
bioset_exit+0x54e/0x650 block/bio.c:1662
bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
__bch2_fs_free fs/bcachefs/super.c:558 [inline]
bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f04451d5c6a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 1e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff28174678 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff28174710 RCX: 00007f04451d5c6a
RDX: 00004000000000c0 RSI: 0000400000000000 RDI: 00007fff281746d0
RBP: 0000000000000000 R08: 00007fff28174710 R09: 0000000000005979
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000001000000 R14: 00004000000000c0 R15: 0000000000000003
</TASK>
Object 0xffff888064e15500 @offset=5376
Object 0xffff888064e15a40 @offset=6720
Object 0xffff888064e15f80 @offset=8064
Object 0xffff888064e164c0 @offset=9408
------------[ cut here ]------------
kmem_cache_destroy bio-1200: Slab cache still has objects when called from bio_put_slab block/bio.c:155 [inline]
kmem_cache_destroy bio-1200: Slab cache still has objects when called from bioset_exit+0x54e/0x650 block/bio.c:1662
WARNING: CPU: 0 PID: 5940 at mm/slab_common.c:533 kmem_cache_destroy+0x153/0x160 mm/slab_common.c:532
Modules linked in:
CPU: 0 UID: 0 PID: 5940 Comm: syz-executor131 Tainted: G B 6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:kmem_cache_destroy+0x153/0x160 mm/slab_common.c:532
Code: 5f 18 48 89 de 5b 41 5e 5d e9 e9 e7 13 00 90 48 8b 53 60 48 c7 c7 43 3c 2c 8e 48 c7 c6 7c 3c 2c 8e 48 89 e9 e8 2e 45 7a ff 90 <0f> 0b 90 90 e9 25 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000422f860 EFLAGS: 00010246
RAX: 56da6a4a7fb35b00 RBX: ffff8880664ea000 RCX: ffff888030589e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff84cabf9e R08: ffffffff81819d62 R09: fffffbfff1d3a68c
R10: dffffc0000000000 R11: fffffbfff1d3a68c R12: 00000000000004b0
R13: 1ffff1100c489283 R14: 0000000000000001 R15: ffff88802758d748
FS: 000055557a2773c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f043d3ff000 CR3: 0000000030908000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bio_put_slab block/bio.c:155 [inline]
bioset_exit+0x54e/0x650 block/bio.c:1662
bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
__bch2_fs_free fs/bcachefs/super.c:558 [inline]
bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f04451d5c6a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 1e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff28174678 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff28174710 RCX: 00007f04451d5c6a
RDX: 00004000000000c0 RSI: 0000400000000000 RDI: 00007fff281746d0
RBP: 0000000000000000 R08: 00007fff28174710 R09: 0000000000005979
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000001000000 R14: 00004000000000c0 R15: 0000000000000003
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2025-03-09 10:40 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-16 14:42 [syzbot] [kernel?] possible deadlock in get_partial_node (2) syzbot
2025-03-09 10:40 ` syzbot [this message]
2025-03-10 8:16 ` [syzbot] [bcachefs?] " syzbot
2025-04-14 19:22 ` syzbot
2025-04-15 12:31 ` [syzbot] " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67cd701c.050a0220.2eb24d.0000.GAE@google.com \
--to=syzbot+725322cc4ff5c53abfac@syzkaller.appspotmail.com \
--cc=anna-maria@linutronix.de \
--cc=frederic@kernel.org \
--cc=kent.overstreet@linux.dev \
--cc=linux-bcachefs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.