From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f71.google.com (mail-ot1-f71.google.com [209.85.210.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 333B3277CAF for ; Mon, 19 Jan 2026 07:38:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.71 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768808284; cv=none; b=l2thSpyYtuS+Wh5XMMXA9Pj1ZoYekhglNUAtyLTvvTT4Vj4isKCwPB6rBr7C9P9OmkGByLO/oolARbngzx/PlJ6JQ3wuId8ni3OAU6Ro7rGPuwc2sPm4+Sx5DM0p3Z5pRrAByoYSoTD3KPqfsYcVIUaCTXULVlmgAUtRzhWdrBI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768808284; c=relaxed/simple; bh=nXdpN0aAj2BV8Yiw0h/jk0Xc/rGaB4TF1HUcSKFeCvs=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=FCenLVW+Ljz1VL6O2BZYlSxc154w6VOzod1K8+trMH070PUOx20QZLwdBqdhXVs8Lq5ZZC4zFqa25kC66cLtAfDQyJXnHHNxxUr18jdmAmUqFPj+erujeRQ8W+SmRKMyFVLrrLTxj6Li3Sse+ONET/LMU+yJoslOrwo51PGNeVU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f71.google.com with SMTP id 46e09a7af769-7cfd14607b0so7700752a34.0 for ; Sun, 18 Jan 2026 23:38:02 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768808282; x=1769413082; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=u17TDd0O2aRjgPGpyf9+kN3LRuqgAITfQio0IcMT/ZE=; b=kfUXLROJkkYZUwwwuj9V7+AfDX6cvlIgBPbCxG0O6zVF8vZ+Du6sLvbrE92ED3MS1v HHuB1UmVRyHiQYhByW0Liu+IMRMiSmF0Sari/MOO5zJsbc3yx7H/p6WN6PiE/Cc3+Wn9 Ns2g5li3xUTTy9awvuJbkcBGwABe8eYGOIjNoNSep+JcdWNflqcTrre9P8xgs99uW+Z2 MhsnNbySTtFT7qO8DUZmzFcNbrE0nfVjOvAuouDM6+fFZEr/cUcyX17Lys87/fF6FT+z TLZ1+9Bjkv3sIDBSiWqX9X1hDR4OPwagGP7Wmq616tO7AsFdH9MlzgHtj3P9/WbyJtVq +5hA== X-Forwarded-Encrypted: i=1; AJvYcCWQgLZF8+QMCHRaHtB4f3ALycQpZdjZ/AOIYIu+Vz5bW0h9nCEdQwTrYTlYAJrv852EWfGUgSsn/vfMDQw=@vger.kernel.org X-Gm-Message-State: AOJu0Ywgu3vmysgbCoE1UvkxMBvH9I0BYAOtClZL6vy+M4LpCUJ4Wne+ QxArAPcX2iylv4r5K3lvDqtAa2pWrtIASNRGO+PVwvhRsK/+ULQsMSCe9/rBJlUbBXXPydD89WE m6q9UII8qQzdF4kcn2N2ICW9K/wd2zmlblG0eWwWWFsuzcGeCkxdAPKIi4GY= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:229c:b0:65c:fa23:2d04 with SMTP id 006d021491bc7-661188d5c3amr3980306eaf.13.1768808282190; Sun, 18 Jan 2026 23:38:02 -0800 (PST) Date: Sun, 18 Jan 2026 23:38:02 -0800 In-Reply-To: X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <696ddf5a.050a0220.3390f1.003b.GAE@google.com> Subject: Re: [syzbot] [xfs?] KASAN: slab-use-after-free Read in xfs_buf_rele (4) From: syzbot To: hch@infradead.org, linux-kernel@vger.kernel.org, linux-xfs@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: BUG: MAX_LOCKDEP_CHAINS too low! BUG: MAX_LOCKDEP_CHAINS too low! turning off the locking correctness validator. CPU: 0 UID: 0 PID: 1610 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Workqueue: xfs_iwalk-13497 xfs_pwork_work Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 add_chain_cache kernel/locking/lockdep.c:-1 [inline] lookup_chain_cache_add kernel/locking/lockdep.c:3855 [inline] validate_chain kernel/locking/lockdep.c:3876 [inline] __lock_acquire+0xf9c/0x30a4 kernel/locking/lockdep.c:5237 lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162 debug_object_activate+0x7c/0x460 lib/debugobjects.c:818 debug_timer_activate kernel/time/timer.c:793 [inline] __mod_timer+0x8c4/0xd00 kernel/time/timer.c:1124 add_timer_global+0x88/0xc0 kernel/time/timer.c:1283 __queue_delayed_work+0x218/0x2c8 kernel/workqueue.c:2520 queue_delayed_work_on+0xe4/0x194 kernel/workqueue.c:2555 queue_delayed_work include/linux/workqueue.h:684 [inline] xfs_reclaim_work_queue+0x154/0x244 fs/xfs/xfs_icache.c:211 xfs_perag_set_inode_tag+0x19c/0x4bc fs/xfs/xfs_icache.c:263 xfs_inodegc_set_reclaimable+0x1e0/0x444 fs/xfs/xfs_icache.c:1917 xfs_inode_mark_reclaimable+0x2c8/0x10f8 fs/xfs/xfs_icache.c:2252 xfs_fs_destroy_inode+0x2fc/0x618 fs/xfs/xfs_super.c:712 destroy_inode fs/inode.c:396 [inline] evict+0x7cc/0xa74 fs/inode.c:861 iput_final fs/inode.c:1954 [inline] iput+0xc54/0xfdc fs/inode.c:2006 xfs_irele+0xd0/0x2ac fs/xfs/xfs_inode.c:2662 xfs_qm_dqusage_adjust+0x4f4/0x5b0 fs/xfs/xfs_qm.c:1411 xfs_iwalk_ag_recs+0x404/0x7c8 fs/xfs/xfs_iwalk.c:209 xfs_iwalk_run_callbacks+0x1c0/0x3e8 fs/xfs/xfs_iwalk.c:370 xfs_iwalk_ag+0x6ac/0x82c fs/xfs/xfs_iwalk.c:473 xfs_iwalk_ag_work+0xf8/0x1a0 fs/xfs/xfs_iwalk.c:620 xfs_pwork_work+0x80/0x1a4 fs/xfs/xfs_pwork.c:47 process_one_work+0x7c0/0x1558 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3421 kthread+0x5fc/0x75c kernel/kthread.c:463 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 Tested on: commit: 855e81db xfs: switch (back) to a per-buftarg buffer hash git tree: git://git.infradead.org/users/hch/xfs.git xfs-buf-hash console output: https://syzkaller.appspot.com/x/log.txt?x=162bb63a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=1707867b02964a26 dashboard link: https://syzkaller.appspot.com/bug?extid=0391d34e801643e2809b compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 userspace arch: arm64 Note: no patches were applied.