BUG: TASK stack guard page was hit at ffffc9000d1e7fb8 (stack is ffffc9000d1e8000..ffffc9000d1f0000)
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.13.0-syzkaller-08291-g805ba04cb7cc #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__bfs+0x1f/0x6f0 kernel/locking/lockdep.c:1737
Code: 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec a0 00 00 00 45 89 ce <4c> 89 44 24 20 48 89 4c 24 10 48 89 54 24 30 48 89 74 24 08 48 89
RSP: 0018:ffffc9000d1e7fc0 EFLAGS: 00010086
RAX: ffff88801fa4d4b0 RBX: ffff88801fa4d400 RCX: 0000000000000000
RDX: ffffffff819bfcb0 RSI: ffff88801fa4d4b0 RDI: ffffc9000d1e8140
RBP: ffffc9000d1e80a0 R08: ffffc9000d1e8120 R09: 0000000000000020
R10: dffffc0000000000 R11: fffffbfff285f709 R12: ffffc9000d1e816b
R13: 1ffff11003f49a9f R14: 0000000000000020 R15: dffffc0000000000
FS: 00007fd25c58a6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000d1e7fb8 CR3: 0000000040ee8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<#DF>
</#DF>
<TASK>
__bfs_forwards kernel/locking/lockdep.c:1846 [inline]
check_path+0x21/0x40 kernel/locking/lockdep.c:2164
check_noncircular+0x259/0x4a0 kernel/locking/lockdep.c:2193
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
rmqueue_bulk mm/page_alloc.c:2310 [inline]
__rmqueue_pcplist+0x4a2/0x2a90 mm/page_alloc.c:3004
rmqueue_pcplist mm/page_alloc.c:3046 [inline]
rmqueue mm/page_alloc.c:3077 [inline]
get_page_from_freelist+0x886/0x37a0 mm/page_alloc.c:3474
__alloc_pages_slowpath+0x43e/0x10b0 mm/page_alloc.c:4288
__alloc_frozen_pages_noprof+0x49b/0x710 mm/page_alloc.c:4752
alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline]
alloc_pages_noprof+0x121/0x190 mm/mempolicy.c:2361
z3fold_alloc mm/z3fold.c:1036 [inline]
z3fold_zpool_malloc+0x3e5/0xd80 mm/z3fold.c:1388
zswap_compress mm/zswap.c:971 [inline]
zswap_store_page mm/zswap.c:1462 [inline]
zswap_store+0xdba/0x1c30 mm/zswap.c:1569
swap_writepage+0x647/0xce0 mm/page_io.c:278
pageout mm/vmscan.c:696 [inline]
shrink_folio_list+0x35c2/0x5ac0 mm/vmscan.c:1402
evict_folios+0x45fd/0x56a0 mm/vmscan.c:4655
try_to_shrink_lruvec+0x713/0x9b0 mm/vmscan.c:4816
shrink_one+0x3b9/0x850 mm/vmscan.c:4861
shrink_many mm/vmscan.c:4924 [inline]
lru_gen_shrink_node mm/vmscan.c:5002 [inline]
shrink_node+0x37c5/0x3e50 mm/vmscan.c:5973
shrink_zones mm/vmscan.c:6232 [inline]
do_try_to_free_pages+0x78c/0x1cf0 mm/vmscan.c:6294
try_to_free_pages+0x47c/0x1050 mm/vmscan.c:6544
__perform_reclaim mm/page_alloc.c:3929 [inline]
__alloc_pages_direct_reclaim+0x178/0x3c0 mm/page_alloc.c:3951
__alloc_pages_slowpath+0x811/0x10b0 mm/page_alloc.c:4382
__alloc_frozen_pages_noprof+0x49b/0x710 mm/page_alloc.c:4752
alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline]
alloc_pages_noprof+0x121/0x190 mm/mempolicy.c:2361
stack_depot_save_flags+0x72d/0x940 lib/stackdepot.c:627
save_stack+0x109/0x1f0 mm/page_owner.c:157
__set_page_owner+0x92/0x800 mm/page_owner.c:320
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
prep_new_page mm/page_alloc.c:1559 [inline]
get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3477
__alloc_pages_direct_reclaim+0x284/0x3c0 mm/page_alloc.c:3956
__alloc_pages_slowpath+0x811/0x10b0 mm/page_alloc.c:4382
__alloc_frozen_pages_noprof+0x49b/0x710 mm/page_alloc.c:4752
alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline]
alloc_pages_noprof+0x121/0x190 mm/mempolicy.c:2361
stack_depot_save_flags+0x72d/0x940 lib/stackdepot.c:627
kasan_save_stack mm/kasan/common.c:48 [inline]
kasan_save_track+0x51/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4294 [inline]
__kmalloc_node_track_caller_noprof+0x28b/0x4c0 mm/slub.c:4313
__do_krealloc mm/slub.c:4820 [inline]
krealloc_noprof+0x10f/0x2f0 mm/slub.c:4873
bch2_printbuf_make_room+0x1f1/0x350 fs/bcachefs/printbuf.c:59
bch2_prt_printf+0x267/0x6d0 fs/bcachefs/printbuf.c:186
bch2_btree_path_to_text_short+0x1f5/0xfa0 fs/bcachefs/btree_iter.c:1529
__bch2_trans_paths_to_text+0xe5/0x180 fs/bcachefs/btree_iter.c:1597
bch2_trans_update_max_paths+0x16e/0x420 fs/bcachefs/btree_iter.c:1633
btree_path_alloc+0x872/0xa60 fs/bcachefs/btree_iter.c:1730
bch2_path_get+0xb57/0x15d0 fs/bcachefs/btree_iter.c:1781
bch2_trans_iter_init_common fs/bcachefs/btree_iter.h:500 [inline]
bch2_trans_iter_init_outlined+0x2ed/0x4c0 fs/bcachefs/btree_iter.c:3051
bch2_trans_iter_init fs/bcachefs/btree_iter.h:518 [inline]
btree_key_cache_fill+0x1e1/0x3820 fs/bcachefs/btree_key_cache.c:302
bch2_btree_path_traverse_cached+0x8b2/0xc60 fs/bcachefs/btree_key_cache.c:379
bch2_btree_path_traverse_one+0x46a/0x2930 fs/bcachefs/btree_iter.c:1179
bch2_btree_path_traverse fs/bcachefs/btree_iter.h:249 [inline]
bch2_btree_iter_peek_slot+0x8c0/0x27c0 fs/bcachefs/btree_iter.c:2767
__bch2_bkey_get_iter fs/bcachefs/btree_iter.h:573 [inline]
bch2_bkey_get_iter fs/bcachefs/btree_iter.h:587 [inline]
bch2_check_discard_freespace_key+0x292/0xeb0 fs/bcachefs/alloc_background.c:1404
try_alloc_bucket fs/bcachefs/alloc_foreground.c:287 [inline]
bch2_bucket_alloc_freelist fs/bcachefs/alloc_foreground.c:438 [inline]
bch2_bucket_alloc_trans+0x1589/0x2eb0 fs/bcachefs/alloc_foreground.c:570
bch2_bucket_alloc_set_trans+0x57c/0xd60 fs/bcachefs/alloc_foreground.c:726
__open_bucket_add_buckets+0x13a2/0x1e10 fs/bcachefs/alloc_foreground.c:969
open_bucket_add_buckets+0x33a/0x410 fs/bcachefs/alloc_foreground.c:1013
bch2_alloc_sectors_start_trans+0xce9/0x2030
__bch2_btree_node_alloc fs/bcachefs/btree_update_interior.c:322 [inline]
bch2_btree_reserve_get+0x612/0x1890 fs/bcachefs/btree_update_interior.c:532
bch2_btree_update_start+0xe56/0x14e0 fs/bcachefs/btree_update_interior.c:1230
bch2_btree_split_leaf+0x121/0x880 fs/bcachefs/btree_update_interior.c:1851
bch2_trans_commit_error+0x212/0x1380 fs/bcachefs/btree_trans_commit.c:908
__bch2_trans_commit+0x8126/0x97a0 fs/bcachefs/btree_trans_commit.c:1085
wb_flush_one fs/bcachefs/btree_write_buffer.c:181 [inline]
bch2_btree_write_buffer_flush_locked+0x2c8c/0x5b10 fs/bcachefs/btree_write_buffer.c:379
btree_write_buffer_flush_seq+0x1c49/0x1e10 fs/bcachefs/btree_write_buffer.c:551
bch2_btree_write_buffer_journal_flush+0xc7/0x150 fs/bcachefs/btree_write_buffer.c:567
journal_flush_pins+0x5f7/0xb20 fs/bcachefs/journal_reclaim.c:574
journal_flush_done+0x8e/0x260 fs/bcachefs/journal_reclaim.c:830
bch2_journal_flush_pins+0x18a/0x3a0 fs/bcachefs/journal_reclaim.c:863
bch2_journal_flush_all_pins fs/bcachefs/journal_reclaim.h:76 [inline]
bch2_journal_replay+0x2744/0x2a70 fs/bcachefs/recovery.c:443
bch2_run_recovery_pass+0xf0/0x1e0 fs/bcachefs/recovery_passes.c:226
bch2_run_recovery_passes+0x2ad/0xa90 fs/bcachefs/recovery_passes.c:291
bch2_fs_recovery+0x265a/0x3de0 fs/bcachefs/recovery.c:937
bch2_fs_start+0x37c/0x610 fs/bcachefs/super.c:1030
bch2_fs_get_tree+0xd8d/0x1740 fs/bcachefs/fs.c:2203
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd25b78e54a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd25c589e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fd25c589ef0 RCX: 00007fd25b78e54a
RDX: 00000000200058c0 RSI: 0000000020005900 RDI: 00007fd25c589eb0
RBP: 00000000200058c0 R08: 00007fd25c589ef0 R09: 0000000000000014
R10: 0000000000000014 R11: 0000000000000246 R12: 0000000020005900
R13: 00007fd25c589eb0 R14: 00000000000058af R15: 0000000020000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__bfs+0x1f/0x6f0 kernel/locking/lockdep.c:1737
Code: 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec a0 00 00 00 45 89 ce <4c> 89 44 24 20 48 89 4c 24 10 48 89 54 24 30 48 89 74 24 08 48 89
RSP: 0018:ffffc9000d1e7fc0 EFLAGS: 00010086
RAX: ffff88801fa4d4b0 RBX: ffff88801fa4d400 RCX: 0000000000000000
RDX: ffffffff819bfcb0 RSI: ffff88801fa4d4b0 RDI: ffffc9000d1e8140
RBP: ffffc9000d1e80a0 R08: ffffc9000d1e8120 R09: 0000000000000020
R10: dffffc0000000000 R11: fffffbfff285f709 R12: ffffc9000d1e816b
R13: 1ffff11003f49a9f R14: 0000000000000020 R15: dffffc0000000000
FS: 00007fd25c58a6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000d1e7fb8 CR3: 0000000040ee8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: f3 0f 1e fa endbr64
f: 55 push %rbp
10: 48 89 e5 mov %rsp,%rbp
13: 41 57 push %r15
15: 41 56 push %r14
17: 41 55 push %r13
19: 41 54 push %r12
1b: 53 push %rbx
1c: 48 83 e4 e0 and $0xffffffffffffffe0,%rsp
20: 48 81 ec a0 00 00 00 sub $0xa0,%rsp
27: 45 89 ce mov %r9d,%r14d
* 2a: 4c 89 44 24 20 mov %r8,0x20(%rsp) <-- trapping instruction
2f: 48 89 4c 24 10 mov %rcx,0x10(%rsp)
34: 48 89 54 24 30 mov %rdx,0x30(%rsp)
39: 48 89 74 24 08 mov %rsi,0x8(%rsp)
3e: 48 rex.W
3f: 89 .byte 0x89