possible deadlock in xfs_icwalk_ag

Status: upstream: reported on 2026/08/09 21:20
Reported-by: syzbot+7b73a3cb8c2499ca2318@syzkaller.appspotmail.com
First crash: 11d, last: 3d09h
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in xfs_icwalk_ag (3) prio:high xfs 4 syz, C 858 18d 374d 0/29 upstream: reported C repro on 2025/08/11 15:30
upstream possible deadlock in xfs_icwalk_ag xfs 4 14 864d 881d 0/29 closed as dup on 2024/03/23 08:37
upstream possible deadlock in xfs_icwalk_ag (2) xfs 4 syz, C 1066 512d 856d 28/29 fixed on 2025/05/06 15:33

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd1/88 is trying to acquire lock:
ffff8881495f2f98 (&xfs_nondir_ilock_class#3){++++}-{3:3}, at: xfs_reclaim_inode fs/xfs/xfs_icache.c:937 [inline]
ffff8881495f2f98 (&xfs_nondir_ilock_class#3){++++}-{3:3}, at: xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1632 [inline]
ffff8881495f2f98 (&xfs_nondir_ilock_class#3){++++}-{3:3}, at: xfs_icwalk_ag+0x1257/0x1ae0 fs/xfs/xfs_icache.c:1714

but task is already holding lock:
ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7435 [inline]
ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x2ce0 mm/vmscan.c:7807

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (fs_reclaim){+.+.}-{0:0}:
       __fs_reclaim_acquire mm/page_alloc.c:3600 [inline]
       fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:3614
       might_alloc include/linux/sched/mm.h:303 [inline]
       slab_pre_alloc_hook+0x2a/0x300 mm/slab.h:714
       slab_alloc_node mm/slub.c:3477 [inline]
       slab_alloc mm/slub.c:3503 [inline]
       __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
       kmem_cache_alloc+0x5a/0x2c0 mm/slub.c:3519
       kmem_cache_zalloc include/linux/slab.h:711 [inline]
       xfs_trans_dup+0xb3/0x5f0 fs/xfs/xfs_trans.c:95
       xfs_trans_roll+0x102/0x420 fs/xfs/xfs_trans.c:1143
       xfs_defer_trans_roll+0x18a/0x570 fs/xfs/libxfs/xfs_defer.c:403
       xfs_defer_relog fs/xfs/libxfs/xfs_defer.c:479 [inline]
       xfs_defer_finish_noroll+0xac8/0x1230 fs/xfs/libxfs/xfs_defer.c:581
       __xfs_trans_commit+0x276/0xd90 fs/xfs/xfs_trans.c:965
       xfs_dquot_disk_alloc+0x85c/0xb90 fs/xfs/xfs_dquot.c:383
       xfs_qm_dqread+0xff/0x4c0 fs/xfs/xfs_dquot.c:665
       xfs_qm_dqget+0x1ee/0x560 fs/xfs/xfs_dquot.c:869
       xfs_qm_quotacheck_dqadjust+0xda/0x4d0 fs/xfs/xfs_qm.c:1085
       xfs_qm_dqusage_adjust+0x3ee/0x5d0 fs/xfs/xfs_qm.c:1204
       xfs_iwalk_ag_recs+0x4c5/0x830 fs/xfs/xfs_iwalk.c:220
       xfs_iwalk_run_callbacks+0x236/0x460 fs/xfs/xfs_iwalk.c:376
       xfs_iwalk_ag+0x8f5/0x9d0 fs/xfs/xfs_iwalk.c:482
       xfs_iwalk_ag_work+0xf5/0x1a0 fs/xfs/xfs_iwalk.c:624
       xfs_pwork_work+0x7b/0x180 fs/xfs/xfs_pwork.c:47
       process_one_work kernel/workqueue.c:2657 [inline]
       process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
       worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
       kthread+0x2fa/0x390 kernel/kthread.c:388
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

-> #0 (&xfs_nondir_ilock_class#3){++++}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3134 [inline]
       check_prevs_add kernel/locking/lockdep.c:3253 [inline]
       validate_chain kernel/locking/lockdep.c:3869 [inline]
       __lock_acquire+0x37ef/0x7d80 kernel/locking/lockdep.c:5137
       lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
       down_write_nested+0x9e/0x200 kernel/locking/rwsem.c:1689
       xfs_reclaim_inode fs/xfs/xfs_icache.c:937 [inline]
       xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1632 [inline]
       xfs_icwalk_ag+0x1257/0x1ae0 fs/xfs/xfs_icache.c:1714
       xfs_icwalk fs/xfs/xfs_icache.c:1763 [inline]
       xfs_reclaim_inodes_nr+0x188/0x230 fs/xfs/xfs_icache.c:1003
       super_cache_scan+0x3e1/0x460 fs/super.c:234
       do_shrink_slab+0x519/0xd20 mm/vmscan.c:907
       shrink_slab_memcg mm/vmscan.c:976 [inline]
       shrink_slab+0x487/0x7c0 mm/vmscan.c:1055
       shrink_one+0x284/0x7c0 mm/vmscan.c:5452
       shrink_many mm/vmscan.c:5515 [inline]
       lru_gen_shrink_node mm/vmscan.c:5607 [inline]
       shrink_node+0x3179/0x3740 mm/vmscan.c:6547
       kswapd_shrink_node mm/vmscan.c:7356 [inline]
       balance_pgdat mm/vmscan.c:7547 [inline]
       kswapd+0x1694/0x2ce0 mm/vmscan.c:7807
       kthread+0x2fa/0x390 kernel/kthread.c:388
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(fs_reclaim);
                               lock(&xfs_nondir_ilock_class#3);
                               lock(fs_reclaim);
  lock(&xfs_nondir_ilock_class#3);

 *** DEADLOCK ***

3 locks held by kswapd1/88:
 #0: ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7435 [inline]
 #0: ffffffff8d216e40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x9b6/0x2ce0 mm/vmscan.c:7807
 #1: ffffffff8d1e7bb0 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab_memcg mm/vmscan.c:949 [inline]
 #1: ffffffff8d1e7bb0 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x22c/0x7c0 mm/vmscan.c:1055
 #2: ffff88814ed280e0 (&type->s_umount_key#68){++++}-{3:3}, at: super_trylock_shared fs/super.c:607 [inline]
 #2: ffff88814ed280e0 (&type->s_umount_key#68){++++}-{3:3}, at: super_cache_scan+0x74/0x460 fs/super.c:203

stack backtrace:
CPU: 0 PID: 88 Comm: kswapd1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 check_noncircular+0x2fc/0x400 kernel/locking/lockdep.c:2187
 check_prev_add kernel/locking/lockdep.c:3134 [inline]
 check_prevs_add kernel/locking/lockdep.c:3253 [inline]
 validate_chain kernel/locking/lockdep.c:3869 [inline]
 __lock_acquire+0x37ef/0x7d80 kernel/locking/lockdep.c:5137
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
 down_write_nested+0x9e/0x200 kernel/locking/rwsem.c:1689
 xfs_reclaim_inode fs/xfs/xfs_icache.c:937 [inline]
 xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1632 [inline]
 xfs_icwalk_ag+0x1257/0x1ae0 fs/xfs/xfs_icache.c:1714
 xfs_icwalk fs/xfs/xfs_icache.c:1763 [inline]
 xfs_reclaim_inodes_nr+0x188/0x230 fs/xfs/xfs_icache.c:1003
 super_cache_scan+0x3e1/0x460 fs/super.c:234
 do_shrink_slab+0x519/0xd20 mm/vmscan.c:907
 shrink_slab_memcg mm/vmscan.c:976 [inline]
 shrink_slab+0x487/0x7c0 mm/vmscan.c:1055
 shrink_one+0x284/0x7c0 mm/vmscan.c:5452
 shrink_many mm/vmscan.c:5515 [inline]
 lru_gen_shrink_node mm/vmscan.c:5607 [inline]
 shrink_node+0x3179/0x3740 mm/vmscan.c:6547
 kswapd_shrink_node mm/vmscan.c:7356 [inline]
 balance_pgdat mm/vmscan.c:7547 [inline]
 kswapd+0x1694/0x2ce0 mm/vmscan.c:7807
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/18 01:35 linux-6.6.y d27334b2888c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in xfs_icwalk_ag
2026/08/09 21:20 linux-6.6.y d27334b2888c 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in xfs_icwalk_ag
* Struck through repros no longer work on HEAD.