R13: 00007f0209a32050 R14: 000000000005e041 R15: 00007ffd3c89f930
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
=============================================================================
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G L
------------------------------------------------------
syz-executor/5851 is trying to acquire lock:
ffffffff8e74fae0 (console_owner){-.-.}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:317 [inline]
ffffffff8e74fae0 (console_owner){-.-.}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:428 [inline]
ffffffff8e74fae0 (console_owner){-.-.}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:291 [inline]
ffffffff8e74fae0 (console_owner){-.-.}-{0:0}, at: console_flush_one_record kernel/printk/printk.c:3246 [inline]
ffffffff8e74fae0 (console_owner){-.-.}-{0:0}, at: console_flush_all+0x123/0xb20 kernel/printk/printk.c:3343
but task is already holding lock:
ffff88803381a258 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:372 [inline]
ffff88803381a258 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:7934 [inline]
ffff88803381a258 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x10e/0x2a0 mm/slub.c:7983
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&n->list_lock){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166
get_partial_node_bulk mm/slub.c:3736 [inline]
__refill_objects_node+0x84/0x5c0 mm/slub.c:7099
refill_objects+0x62/0x3d0 mm/slub.c:7234
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
__do_kmalloc_node mm/slub.c:5291 [inline]
__kmalloc_noprof+0x474/0x760 mm/slub.c:5304
kmalloc_noprof include/linux/slab.h:954 [inline]
tty_buffer_alloc drivers/tty/tty_buffer.c:187 [inline]
__tty_buffer_request_room+0x1c8/0x520 drivers/tty/tty_buffer.c:280
__tty_insert_flip_string_flags+0xb8/0x430 drivers/tty/tty_buffer.c:316
tty_insert_flip_string_fixed_flag include/linux/tty_flip.h:35 [inline]
tty_insert_flip_string include/linux/tty_flip.h:83 [inline]
tty_insert_flip_string_and_push_buffer+0xa9/0x230 drivers/tty/tty_buffer.c:565
pty_write+0xa7/0xe0 drivers/tty/pty.c:116
n_tty_write+0x5e8/0x1220 drivers/tty/n_tty.c:2388
iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
file_tty_write+0x558/0xa10 drivers/tty/tty_io.c:1081
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&port->lock#2){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166
class_spinlock_irqsave_constructor include/linux/spinlock.h:619 [inline]
tty_port_tty_get drivers/tty/tty_port.c:322 [inline]
class_tty_port_tty_constructor include/linux/tty_port.h:293 [inline]
tty_port_default_wakeup+0x21/0x130 drivers/tty/tty_port.c:66
serial8250_tx_chars+0x72e/0x970 drivers/tty/serial/8250/8250_port.c:1721
serial8250_handle_irq+0x15f/0x570 drivers/tty/serial/8250/8250_port.c:1841
serial8250_default_handle_irq+0xbf/0x1f0 drivers/tty/serial/8250/8250_port.c:1855
serial8250_interrupt+0x8d/0x170 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x216/0x9a0 kernel/irq/handle.c:209
handle_irq_event_percpu kernel/irq/handle.c:246 [inline]
handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:263
handle_edge_irq+0x23b/0x9f0 kernel/irq/chip.c:855
generic_handle_irq_desc include/linux/irqdesc.h:186 [inline]
handle_irq arch/x86/kernel/irq.c:262 [inline]
call_irq_handler arch/x86/kernel/irq.c:-1 [inline]
__common_interrupt+0x141/0x1f0 arch/x86/kernel/irq.c:333
common_interrupt+0xb6/0xe0 arch/x86/kernel/irq.c:326
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:62
arch_safe_halt arch/x86/kernel/process.c:766 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:767
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x36a/0x5f0 kernel/sched/idle.c:352
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:451
rest_init+0x2de/0x300 init/main.c:761
start_kernel+0x38a/0x3e0 init/main.c:1212
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x143/0x1c0 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x147
-> #1 (&port_lock_key){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166
uart_port_lock_irqsave include/linux/serial_core.h:717 [inline]
serial8250_console_write+0x150/0x1ba0 drivers/tty/serial/8250/8250_port.c:3316
console_emit_next_record kernel/printk/printk.c:3183 [inline]
console_flush_one_record kernel/printk/printk.c:3269 [inline]
console_flush_all+0x718/0xb20 kernel/printk/printk.c:3343
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
vprintk_emit+0x485/0x560 kernel/printk/printk.c:2479
_printk+0xdd/0x130 kernel/printk/printk.c:2504
register_console+0xbc2/0xfa0 kernel/printk/printk.c:4208
univ8250_console_init+0x3a/0x70 drivers/tty/serial/8250/8250_core.c:515
console_init+0x10b/0x4a0 kernel/printk/printk.c:4407
start_kernel+0x230/0x3e0 init/main.c:1149
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x143/0x1c0 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x147
-> #0 (console_owner){-.-.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
console_lock_spinning_enable kernel/printk/printk.c:1902 [inline]
console_emit_next_record kernel/printk/printk.c:3177 [inline]
console_flush_one_record kernel/printk/printk.c:3269 [inline]
console_flush_all+0x6c1/0xb20 kernel/printk/printk.c:3343
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
vprintk_emit+0x485/0x560 kernel/printk/printk.c:2479
_printk+0xdd/0x130 kernel/printk/printk.c:2504
__slab_bug+0x6e/0xd0 mm/slub.c:1131
slab_bug+0x57/0x80 mm/slub.c:1142
list_slab_objects+0x35/0x1b0 mm/slub.c:7903
free_partial mm/slub.c:7940 [inline]
__kmem_cache_shutdown+0x13b/0x2a0 mm/slub.c:7983
kmem_cache_destroy+0x8e/0x170 mm/slab_common.c:569
gfs2_put_super+0x83f/0x890 fs/gfs2/super.c:642
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
console_owner --> &port->lock#2 --> &n->list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&n->list_lock);
lock(&port->lock#2);
lock(&n->list_lock);
lock(console_owner);
*** DEADLOCK ***
6 locks held by syz-executor/5851:
#0: ffff888034cba0d8 (&type->s_umount_key#74){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline]
#0: ffff888034cba0d8 (&type->s_umount_key#74){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline]
#0: ffff888034cba0d8 (&type->s_umount_key#74){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508
#1: ffffffff8e5ec390 (cpu_hotplug_lock){++++}-{0:0}, at: kmem_cache_destroy+0x56/0x170 mm/slab_common.c:556
#2: ffffffff8e866888 (slab_mutex){+.+.}-{4:4}, at: kmem_cache_destroy+0x64/0x170 mm/slab_common.c:557
#3: ffff88803381a258 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:372 [inline]
#3: ffff88803381a258 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:7934 [inline]
#3: ffff88803381a258 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x10e/0x2a0 mm/slub.c:7983
#4: ffffffff8e74fb40 (console_lock){+.+.}-{0:0}, at: _printk+0xdd/0x130 kernel/printk/printk.c:2504
#5: ffffffff8e637418 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:317 [inline]
#5: ffffffff8e637418 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:428 [inline]
#5: ffffffff8e637418 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:291 [inline]
#5: ffffffff8e637418 (console_srcu){....}-{0:0}, at: console_flush_one_record kernel/printk/printk.c:3246 [inline]
#5: ffffffff8e637418 (console_srcu){....}-{0:0}, at: console_flush_all+0x123/0xb20 kernel/printk/printk.c:3343
stack backtrace:
CPU: 1 UID: 0 PID: 5851 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
console_lock_spinning_enable kernel/printk/printk.c:1902 [inline]
console_emit_next_record kernel/printk/printk.c:3177 [inline]
console_flush_one_record kernel/printk/printk.c:3269 [inline]
console_flush_all+0x6c1/0xb20 kernel/printk/printk.c:3343
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
vprintk_emit+0x485/0x560 kernel/printk/printk.c:2479
_printk+0xdd/0x130 kernel/printk/printk.c:2504
__slab_bug+0x6e/0xd0 mm/slub.c:1131
slab_bug+0x57/0x80 mm/slub.c:1142
list_slab_objects+0x35/0x1b0 mm/slub.c:7903
free_partial mm/slub.c:7940 [inline]
__kmem_cache_shutdown+0x13b/0x2a0 mm/slub.c:7983
kmem_cache_destroy+0x8e/0x170 mm/slab_common.c:569
gfs2_put_super+0x83f/0x890 fs/gfs2/super.c:642
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f020999d9d7
Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffd3c89e7a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f0209a32050 RCX: 00007f020999d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3c89e860
RBP: 00007ffd3c89e860 R08: 00007ffd3c89f860 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3c89f8f0
R13: 00007f0209a32050 R14: 000000000005e041 R15: 00007ffd3c89f930
BUG gfs2-bufdata/syz:syz (Tainted: G L ): Objects remaining on __kmem_cache_shutdown()
-----------------------------------------------------------------------------
Object 0xffff88805db5b8c0 @offset=2240
Object 0xffff88805db5b9a0 @offset=2464
Object 0xffff88805db5ba10 @offset=2576
Slab 0xffffea000176d6c0 objects=36 used=3 fp=0xffff88805db5ba80 flags=0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
------------[ cut here ]------------
1
WARNING: mm/slub.c:1231 at __slab_err+0x15/0x20 mm/slub.c:1231, CPU#1: syz-executor/5851
Modules linked in:
CPU: 1 UID: 0 PID: 5851 Comm: syz-executor Tainted: G B L syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__slab_err+0x15/0x20 mm/slub.c:1231
Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 5b 01 00 00 bf 05 00 00 00 be 01 00 00 00 e8 0c cf 5e 00 90 <0f> 0b 90 c3 cc cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900043b7bf8 EFLAGS: 00010093
RAX: ffffffff81870b9a RBX: ffffc900043b7c20 RCX: ffff88803574db80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900043b7c20 R08: ffffffff932410a7 R09: 1ffffffff2648214
R10: dffffc0000000000 R11: fffffbfff2648215 R12: ffff88803381a288
R13: ffffea000176d6c0 R14: ffffea00013e1390 R15: ffff88803381a240
FS: 000055559425f500(0000) GS:ffff888125548000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000480 CR3: 000000007bbba000 CR4: 00000000003526f0
Call Trace:
free_partial mm/slub.c:7940 [inline]
__kmem_cache_shutdown+0x13b/0x2a0 mm/slub.c:7983
kmem_cache_destroy+0x8e/0x170 mm/slab_common.c:569
gfs2_put_super+0x83f/0x890 fs/gfs2/super.c:642
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f020999d9d7
Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffd3c89e7a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f0209a32050 RCX: 00007f020999d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3c89e860
RBP: 00007ffd3c89e860 R08: 00007ffd3c89f860 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3c89f8f0
R13: 00007f0209a32050 R14: 000000000005e041 R15: 00007ffd3c89f930