syzbot

=============================================================================
======================================================
WARNING: possible circular locking dependency detected
6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0 Not tainted
------------------------------------------------------
syz-executor131/5940 is trying to acquire lock:
ffffffff8ea14fb8 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139

but task is already holding lock:
ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:5609 [inline]
ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x9c/0x430 mm/slub.c:5647

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (&n->list_lock){-.-.}-{3:3}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       get_partial_node+0x37/0x3f0 mm/slub.c:2834
       get_partial mm/slub.c:2948 [inline]
       ___slab_alloc+0xb75/0x14a0 mm/slub.c:3806
       __slab_alloc+0x58/0xa0 mm/slub.c:3916
       __slab_alloc_node mm/slub.c:3991 [inline]
       slab_alloc_node mm/slub.c:4152 [inline]
       kmem_cache_alloc_noprof+0x268/0x380 mm/slub.c:4171
       kmem_alloc_batch lib/debugobjects.c:371 [inline]
       fill_pool+0x260/0x680 lib/debugobjects.c:403
       debug_objects_fill_pool lib/debugobjects.c:725 [inline]
       debug_object_activate+0x493/0x580 lib/debugobjects.c:814
       debug_hrtimer_activate kernel/time/hrtimer.c:455 [inline]
       debug_activate kernel/time/hrtimer.c:496 [inline]
       enqueue_hrtimer+0x30/0x3c0 kernel/time/hrtimer.c:1100
       __hrtimer_start_range_ns kernel/time/hrtimer.c:1282 [inline]
       hrtimer_start_range_ns+0xcc3/0xfa0 kernel/time/hrtimer.c:1343
       hrtimer_start include/linux/hrtimer.h:260 [inline]
       start_dl_timer+0x36a/0x4e0 kernel/sched/deadline.c:1190
       update_curr_dl_se+0x348/0x860 kernel/sched/deadline.c:1539
       update_curr+0x568/0xda0 kernel/sched/fair.c:1246
       entity_tick kernel/sched/fair.c:5628 [inline]
       task_tick_fair+0x69/0x4e0 kernel/sched/fair.c:13091
       sched_tick+0x21e/0x660 kernel/sched/core.c:5661
       update_process_times+0x276/0x2f0 kernel/time/timer.c:2520
       tick_sched_handle kernel/time/tick-sched.c:276 [inline]
       tick_nohz_handler+0x37c/0x500 kernel/time/tick-sched.c:297
       __run_hrtimer kernel/time/hrtimer.c:1801 [inline]
       __hrtimer_run_queues+0x551/0xd30 kernel/time/hrtimer.c:1865
       hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1927
       local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
       __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
       sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049
       asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
       native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
       arch_local_save_flags arch/x86/include/asm/irqflags.h:87 [inline]
       arch_local_irq_save arch/x86/include/asm/irqflags.h:123 [inline]
       lock_is_held_type+0x67/0x190 kernel/locking/lockdep.c:5919
       lock_is_held include/linux/lockdep.h:249 [inline]
       __might_resched+0xa5/0x780 kernel/sched/core.c:8729
       down_read+0x8e/0xa40 kernel/locking/rwsem.c:1523
       anon_vma_lock_read include/linux/rmap.h:136 [inline]
       validate_mm+0x2c8/0x590 mm/vma.c:612
       __split_vma+0xa60/0xbf0 mm/vma.c:513
       split_vma mm/vma.c:542 [inline]
       vma_modify+0x244/0x330 mm/vma.c:1529
       vma_modify_flags+0x3a5/0x430 mm/vma.c:1547
       mprotect_fixup+0x45a/0xaa0 mm/mprotect.c:666
       do_mprotect_pkey+0x99d/0xdd0 mm/mprotect.c:840
       __do_sys_mprotect mm/mprotect.c:861 [inline]
       __se_sys_mprotect mm/mprotect.c:858 [inline]
       __x64_sys_mprotect+0x80/0x90 mm/mprotect.c:858
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #3 (hrtimer_bases.lock){-.-.}-{2:2}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       lock_hrtimer_base kernel/time/hrtimer.c:181 [inline]
       hrtimer_start_range_ns+0xf9/0xfa0 kernel/time/hrtimer.c:1341
       hrtimer_start include/linux/hrtimer.h:260 [inline]
       start_dl_timer+0x36a/0x4e0 kernel/sched/deadline.c:1190
       enqueue_dl_entity+0x1056/0x1db0 kernel/sched/deadline.c:2076
       dl_server_start+0xe2/0x2a0 kernel/sched/deadline.c:1671
       enqueue_task_fair+0x9d7/0xd40 kernel/sched/fair.c:7012
       enqueue_task+0x73/0x3d0 kernel/sched/core.c:2070
       activate_task kernel/sched/core.c:2117 [inline]
       wake_up_new_task+0x576/0xc70 kernel/sched/core.c:4879
       kernel_clone+0x480/0x870 kernel/fork.c:2846
       user_mode_thread+0x144/0x1c0 kernel/fork.c:2893
       rest_init+0x23/0x300 init/main.c:708
       start_kernel+0x484/0x510 init/main.c:1099
       x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:515
       x86_64_start_kernel+0x66/0x70 arch/x86/kernel/head64.c:496
       common_startup_64+0x13e/0x147

-> #2 (&rq->__lock){-.-.}-{2:2}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
       raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
       raw_spin_rq_lock kernel/sched/sched.h:1521 [inline]
       task_rq_lock+0xc6/0x360 kernel/sched/core.c:700
       cgroup_move_task+0x9b/0x5a0 kernel/sched/psi.c:1161
       css_set_move_task+0x72e/0x950 kernel/cgroup/cgroup.c:898
       cgroup_post_fork+0x284/0x8b0 kernel/cgroup/cgroup.c:6695
       copy_process+0x398a/0x3cf0 kernel/fork.c:2629
       kernel_clone+0x223/0x870 kernel/fork.c:2815
       user_mode_thread+0x144/0x1c0 kernel/fork.c:2893
       rest_init+0x23/0x300 init/main.c:708
       start_kernel+0x484/0x510 init/main.c:1099
       x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:515
       x86_64_start_kernel+0x66/0x70 arch/x86/kernel/head64.c:496
       common_startup_64+0x13e/0x147

-> #1 (&p->pi_lock){-.-.}-{2:2}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
       try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4214
       up+0x72/0x90 kernel/locking/semaphore.c:191
       __up_console_sem kernel/printk/printk.c:343 [inline]
       __console_unlock+0x123/0x1f0 kernel/printk/printk.c:2869
       __console_flush_and_unlock kernel/printk/printk.c:3271 [inline]
       console_unlock+0x18f/0x3b0 kernel/printk/printk.c:3309
       vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
       _printk+0xd5/0x120 kernel/printk/printk.c:2457
       bt_err+0x127/0x180 net/bluetooth/lib.c:296
       hci_cmd_timeout+0x104/0x1e0 net/bluetooth/hci_core.c:1456
       process_one_work kernel/workqueue.c:3238 [inline]
       process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
       worker_thread+0x870/0xd30 kernel/workqueue.c:3400
       kthread+0x7a9/0x920 kernel/kthread.c:464
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((console_sem).lock){-...}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3163 [inline]
       check_prevs_add kernel/locking/lockdep.c:3282 [inline]
       validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
       __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
       __down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
       console_trylock kernel/printk/printk.c:2852 [inline]
       console_trylock_spinning kernel/printk/printk.c:2009 [inline]
       vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2431
       _printk+0xd5/0x120 kernel/printk/printk.c:2457
       slab_bug+0x6d/0xc0 mm/slub.c:1028
       slab_err+0x130/0x190 mm/slub.c:1129
       list_slab_objects mm/slub.c:5580 [inline]
       free_partial mm/slub.c:5615 [inline]
       __kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
       kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
       bio_put_slab block/bio.c:155 [inline]
       bioset_exit+0x54e/0x650 block/bio.c:1662
       bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
       __bch2_fs_free fs/bcachefs/super.c:558 [inline]
       bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
       kobject_cleanup lib/kobject.c:689 [inline]
       kobject_release lib/kobject.c:720 [inline]
       kref_put include/linux/kref.h:65 [inline]
       kobject_put+0x22f/0x480 lib/kobject.c:737
       bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
       vfs_get_tree+0x90/0x2b0 fs/super.c:1814
       do_new_mount+0x2be/0xb40 fs/namespace.c:3560
       do_mount fs/namespace.c:3900 [inline]
       __do_sys_mount fs/namespace.c:4111 [inline]
       __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  (console_sem).lock --> hrtimer_bases.lock --> &n->list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&n->list_lock);
                               lock(hrtimer_bases.lock);
                               lock(&n->list_lock);
  lock((console_sem).lock);

 *** DEADLOCK ***

4 locks held by syz-executor131/5940:
 #0: ffffffff8f2578c8 (bio_slab_lock){+.+.}-{4:4}, at: bio_put_slab block/bio.c:140 [inline]
 #0: ffffffff8f2578c8 (bio_slab_lock){+.+.}-{4:4}, at: bioset_exit+0x42f/0x650 block/bio.c:1662
 #1: ffffffff8e9d5210 (cpu_hotplug_lock){++++}-{0:0}, at: kmem_cache_destroy+0x3e/0x160 mm/slab_common.c:517
 #2: ffffffff8ec221b0 (slab_mutex){+.+.}-{4:4}, at: kmem_cache_destroy+0x4c/0x160 mm/slab_common.c:518
 #3: ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
 #3: ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:5609 [inline]
 #3: ffff88802a42da98 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x9c/0x430 mm/slub.c:5647

stack backtrace:
CPU: 1 UID: 0 PID: 5940 Comm: syz-executor131 Not tainted 6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076
 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208
 check_prev_add kernel/locking/lockdep.c:3163 [inline]
 check_prevs_add kernel/locking/lockdep.c:3282 [inline]
 validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
 down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
 __down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
 console_trylock kernel/printk/printk.c:2852 [inline]
 console_trylock_spinning kernel/printk/printk.c:2009 [inline]
 vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2431
 _printk+0xd5/0x120 kernel/printk/printk.c:2457
 slab_bug+0x6d/0xc0 mm/slub.c:1028
 slab_err+0x130/0x190 mm/slub.c:1129
 list_slab_objects mm/slub.c:5580 [inline]
 free_partial mm/slub.c:5615 [inline]
 __kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
 kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
 bio_put_slab block/bio.c:155 [inline]
 bioset_exit+0x54e/0x650 block/bio.c:1662
 bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
 __bch2_fs_free fs/bcachefs/super.c:558 [inline]
 bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22f/0x480 lib/kobject.c:737
 bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f04451d5c6a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 1e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff28174678 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff28174710 RCX: 00007f04451d5c6a
RDX: 00004000000000c0 RSI: 0000400000000000 RDI: 00007fff281746d0
RBP: 0000000000000000 R08: 00007fff28174710 R09: 0000000000005979
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000001000000 R14: 00004000000000c0 R15: 0000000000000003
 </TASK>
BUG bio-1200 (Not tainted): Objects remaining in bio-1200 on __kmem_cache_shutdown()
-----------------------------------------------------------------------------

Slab 0xffffea0001938500 objects=12 used=4 fp=0xffff888064e16a00 flags=0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
CPU: 1 UID: 0 PID: 5940 Comm: syz-executor131 Not tainted 6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 slab_err+0x15a/0x190 mm/slub.c:1131
 list_slab_objects mm/slub.c:5580 [inline]
 free_partial mm/slub.c:5615 [inline]
 __kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
 kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
 bio_put_slab block/bio.c:155 [inline]
 bioset_exit+0x54e/0x650 block/bio.c:1662
 bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
 __bch2_fs_free fs/bcachefs/super.c:558 [inline]
 bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22f/0x480 lib/kobject.c:737
 bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f04451d5c6a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 1e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff28174678 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff28174710 RCX: 00007f04451d5c6a
RDX: 00004000000000c0 RSI: 0000400000000000 RDI: 00007fff281746d0
RBP: 0000000000000000 R08: 00007fff28174710 R09: 0000000000005979
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000001000000 R14: 00004000000000c0 R15: 0000000000000003
 </TASK>
Object 0xffff888064e15500 @offset=5376
Object 0xffff888064e15a40 @offset=6720
Object 0xffff888064e15f80 @offset=8064
Object 0xffff888064e164c0 @offset=9408
------------[ cut here ]------------
kmem_cache_destroy bio-1200: Slab cache still has objects when called from bio_put_slab block/bio.c:155 [inline]
kmem_cache_destroy bio-1200: Slab cache still has objects when called from bioset_exit+0x54e/0x650 block/bio.c:1662
WARNING: CPU: 0 PID: 5940 at mm/slab_common.c:533 kmem_cache_destroy+0x153/0x160 mm/slab_common.c:532
Modules linked in:
CPU: 0 UID: 0 PID: 5940 Comm: syz-executor131 Tainted: G    B              6.14.0-rc5-syzkaller-00234-gb7c90e3e717a #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:kmem_cache_destroy+0x153/0x160 mm/slab_common.c:532
Code: 5f 18 48 89 de 5b 41 5e 5d e9 e9 e7 13 00 90 48 8b 53 60 48 c7 c7 43 3c 2c 8e 48 c7 c6 7c 3c 2c 8e 48 89 e9 e8 2e 45 7a ff 90 <0f> 0b 90 90 e9 25 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000422f860 EFLAGS: 00010246
RAX: 56da6a4a7fb35b00 RBX: ffff8880664ea000 RCX: ffff888030589e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff84cabf9e R08: ffffffff81819d62 R09: fffffbfff1d3a68c
R10: dffffc0000000000 R11: fffffbfff1d3a68c R12: 00000000000004b0
R13: 1ffff1100c489283 R14: 0000000000000001 R15: ffff88802758d748
FS:  000055557a2773c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f043d3ff000 CR3: 0000000030908000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 bio_put_slab block/bio.c:155 [inline]
 bioset_exit+0x54e/0x650 block/bio.c:1662
 bch2_fs_fs_io_direct_exit+0x19/0x30 fs/bcachefs/fs-io-direct.c:676
 __bch2_fs_free fs/bcachefs/super.c:558 [inline]
 bch2_fs_release+0x1a9/0x7b0 fs/bcachefs/super.c:624
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22f/0x480 lib/kobject.c:737
 bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f04451d5c6a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 1e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff28174678 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff28174710 RCX: 00007f04451d5c6a
RDX: 00004000000000c0 RSI: 0000400000000000 RDI: 00007fff281746d0
RBP: 0000000000000000 R08: 00007fff28174710 R09: 0000000000005979
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000001000000 R14: 00004000000000c0 R15: 0000000000000003
 </TASK>