=============================================================================
======================================================
WARNING: possible circular locking dependency detected
6.14.0-rc4-syzkaller-00090-gdd83757f6e68 #0 Not tainted
------------------------------------------------------
syz.3.24/6991 is trying to acquire lock:
ffffffff8ea14bf8 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139

but task is already holding lock:
ffff888020b7c858 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
ffff888020b7c858 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:5609 [inline]
ffff888020b7c858 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x9c/0x430 mm/slub.c:5647

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (&n->list_lock){-.-.}-{3:3}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       get_partial_node+0x37/0x3f0 mm/slub.c:2834
       get_partial mm/slub.c:2948 [inline]
       ___slab_alloc+0xb75/0x14a0 mm/slub.c:3806
       __slab_alloc+0x58/0xa0 mm/slub.c:3916
       __slab_alloc_node mm/slub.c:3991 [inline]
       slab_alloc_node mm/slub.c:4152 [inline]
       kmem_cache_alloc_noprof+0x268/0x380 mm/slub.c:4171
       kmem_alloc_batch lib/debugobjects.c:371 [inline]
       fill_pool+0x260/0x680 lib/debugobjects.c:403
       debug_objects_fill_pool lib/debugobjects.c:725 [inline]
       debug_object_activate+0x493/0x580 lib/debugobjects.c:814
       debug_hrtimer_activate kernel/time/hrtimer.c:455 [inline]
       debug_activate kernel/time/hrtimer.c:496 [inline]
       enqueue_hrtimer+0x30/0x3c0 kernel/time/hrtimer.c:1100
       __run_hrtimer kernel/time/hrtimer.c:1818 [inline]
       __hrtimer_run_queues+0x6cb/0xd30 kernel/time/hrtimer.c:1865
       hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1927
       local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
       __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
       sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049
       asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

-> #3 (hrtimer_bases.lock){-.-.}-{2:2}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       lock_hrtimer_base kernel/time/hrtimer.c:181 [inline]
       hrtimer_start_range_ns+0xf9/0xfa0 kernel/time/hrtimer.c:1341
       hrtimer_start include/linux/hrtimer.h:260 [inline]
       start_dl_timer+0x36a/0x4e0 kernel/sched/deadline.c:1190
       enqueue_dl_entity+0x1056/0x1db0 kernel/sched/deadline.c:2076
       dl_server_start+0xe2/0x2a0 kernel/sched/deadline.c:1671
       enqueue_task_fair+0x9d7/0xd40 kernel/sched/fair.c:7010
       enqueue_task+0x73/0x3d0 kernel/sched/core.c:2070
       activate_task kernel/sched/core.c:2117 [inline]
       wake_up_new_task+0x576/0xc70 kernel/sched/core.c:4879
       kernel_clone+0x480/0x870 kernel/fork.c:2846
       user_mode_thread+0x144/0x1c0 kernel/fork.c:2893
       rest_init+0x23/0x300 init/main.c:708
       start_kernel+0x484/0x510 init/main.c:1099
       x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:515
       x86_64_start_kernel+0x66/0x70 arch/x86/kernel/head64.c:496
       common_startup_64+0x13e/0x147

-> #2 (&rq->__lock){-.-.}-{2:2}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
       raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
       raw_spin_rq_lock kernel/sched/sched.h:1521 [inline]
       task_rq_lock+0xc6/0x360 kernel/sched/core.c:700
       cgroup_move_task+0x9b/0x5a0 kernel/sched/psi.c:1161
       css_set_move_task+0x72e/0x950 kernel/cgroup/cgroup.c:898
       cgroup_post_fork+0x284/0x8b0 kernel/cgroup/cgroup.c:6695
       copy_process+0x398a/0x3cf0 kernel/fork.c:2629
       kernel_clone+0x223/0x870 kernel/fork.c:2815
       user_mode_thread+0x144/0x1c0 kernel/fork.c:2893
       rest_init+0x23/0x300 init/main.c:708
       start_kernel+0x484/0x510 init/main.c:1099
       x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:515
       x86_64_start_kernel+0x66/0x70 arch/x86/kernel/head64.c:496
       common_startup_64+0x13e/0x147

-> #1 (&p->pi_lock){-.-.}-{2:2}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
       try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4214
       up+0x72/0x90 kernel/locking/semaphore.c:191
       __up_console_sem kernel/printk/printk.c:343 [inline]
       __console_unlock+0x123/0x1f0 kernel/printk/printk.c:2869
       __console_flush_and_unlock kernel/printk/printk.c:3271 [inline]
       console_unlock+0x18f/0x3b0 kernel/printk/printk.c:3309
       vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
       _printk+0xd5/0x120 kernel/printk/printk.c:2457
       ieee80211_sta_find_ibss net/mac80211/ibss.c:1451 [inline]
       ieee80211_ibss_work+0xddd/0x14c0 net/mac80211/ibss.c:1670
       cfg80211_wiphy_work+0x2f0/0x490 net/wireless/core.c:435
       process_one_work kernel/workqueue.c:3238 [inline]
       process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
       worker_thread+0x870/0xd30 kernel/workqueue.c:3400
       kthread+0x7a9/0x920 kernel/kthread.c:464
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((console_sem).lock){-...}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3163 [inline]
       check_prevs_add kernel/locking/lockdep.c:3282 [inline]
       validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
       __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
       down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
       __down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
       console_trylock kernel/printk/printk.c:2852 [inline]
       console_trylock_spinning kernel/printk/printk.c:2009 [inline]
       vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2431
       _printk+0xd5/0x120 kernel/printk/printk.c:2457
       slab_bug+0x6d/0xc0 mm/slub.c:1028
       slab_err+0x130/0x190 mm/slub.c:1129
       list_slab_objects mm/slub.c:5580 [inline]
       free_partial mm/slub.c:5615 [inline]
       __kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
       kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
       bio_put_slab block/bio.c:155 [inline]
       bioset_exit+0x54e/0x650 block/bio.c:1662
       __bch2_fs_free fs/bcachefs/super.c:562 [inline]
       bch2_fs_release+0x1c9/0x7b0 fs/bcachefs/super.c:624
       kobject_cleanup lib/kobject.c:689 [inline]
       kobject_release lib/kobject.c:720 [inline]
       kref_put include/linux/kref.h:65 [inline]
       kobject_put+0x22f/0x480 lib/kobject.c:737
       bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
       vfs_get_tree+0x90/0x2b0 fs/super.c:1814
       do_new_mount+0x2be/0xb40 fs/namespace.c:3560
       do_mount fs/namespace.c:3900 [inline]
       __do_sys_mount fs/namespace.c:4111 [inline]
       __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  (console_sem).lock --> hrtimer_bases.lock --> &n->list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&n->list_lock);
                               lock(hrtimer_bases.lock);
                               lock(&n->list_lock);
  lock((console_sem).lock);

 *** DEADLOCK ***

4 locks held by syz.3.24/6991:
 #0: ffffffff8f257148 (bio_slab_lock){+.+.}-{4:4}, at: bio_put_slab block/bio.c:140 [inline]
 #0: ffffffff8f257148 (bio_slab_lock){+.+.}-{4:4}, at: bioset_exit+0x42f/0x650 block/bio.c:1662
 #1: ffffffff8e9d4e50 (cpu_hotplug_lock){++++}-{0:0}, at: kmem_cache_destroy+0x3e/0x160 mm/slab_common.c:517
 #2: ffffffff8ec21d70 (slab_mutex){+.+.}-{4:4}, at: kmem_cache_destroy+0x4c/0x160 mm/slab_common.c:518
 #3: ffff888020b7c858 (&n->list_lock){-.-.}-{3:3}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
 #3: ffff888020b7c858 (&n->list_lock){-.-.}-{3:3}, at: free_partial mm/slub.c:5609 [inline]
 #3: ffff888020b7c858 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x9c/0x430 mm/slub.c:5647

stack backtrace:
CPU: 1 UID: 0 PID: 6991 Comm: syz.3.24 Not tainted 6.14.0-rc4-syzkaller-00090-gdd83757f6e68 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076
 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208
 check_prev_add kernel/locking/lockdep.c:3163 [inline]
 check_prevs_add kernel/locking/lockdep.c:3282 [inline]
 validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
 down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
 __down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
 console_trylock kernel/printk/printk.c:2852 [inline]
 console_trylock_spinning kernel/printk/printk.c:2009 [inline]
 vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2431
 _printk+0xd5/0x120 kernel/printk/printk.c:2457
 slab_bug+0x6d/0xc0 mm/slub.c:1028
 slab_err+0x130/0x190 mm/slub.c:1129
 list_slab_objects mm/slub.c:5580 [inline]
 free_partial mm/slub.c:5615 [inline]
 __kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
 kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
 bio_put_slab block/bio.c:155 [inline]
 bioset_exit+0x54e/0x650 block/bio.c:1662
 __bch2_fs_free fs/bcachefs/super.c:562 [inline]
 bch2_fs_release+0x1c9/0x7b0 fs/bcachefs/super.c:624
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22f/0x480 lib/kobject.c:737
 bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb11d98e54a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb11e83ee68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb11e83eef0 RCX: 00007fb11d98e54a
RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007fb11e83eeb0
RBP: 0000000020000000 R08: 00007fb11e83eef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000040
R13: 00007fb11e83eeb0 R14: 000000000000593f R15: 0000000020000380
 </TASK>
BUG bio-224 (Not tainted): Objects remaining in bio-224 on __kmem_cache_shutdown()
-----------------------------------------------------------------------------

Slab 0xffffea000092e2c0 objects=12 used=1 fp=0xffff888024b8b8c0 flags=0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
CPU: 1 UID: 0 PID: 6991 Comm: syz.3.24 Not tainted 6.14.0-rc4-syzkaller-00090-gdd83757f6e68 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 slab_err+0x15a/0x190 mm/slub.c:1131
 list_slab_objects mm/slub.c:5580 [inline]
 free_partial mm/slub.c:5615 [inline]
 __kmem_cache_shutdown+0x134/0x430 mm/slub.c:5647
 kmem_cache_destroy+0x76/0x160 mm/slab_common.c:530
 bio_put_slab block/bio.c:155 [inline]
 bioset_exit+0x54e/0x650 block/bio.c:1662
 __bch2_fs_free fs/bcachefs/super.c:562 [inline]
 bch2_fs_release+0x1c9/0x7b0 fs/bcachefs/super.c:624
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22f/0x480 lib/kobject.c:737
 bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb11d98e54a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb11e83ee68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb11e83eef0 RCX: 00007fb11d98e54a
RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007fb11e83eeb0
RBP: 0000000020000000 R08: 00007fb11e83eef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000040
R13: 00007fb11e83eeb0 R14: 000000000000593f R15: 0000000020000380
 </TASK>
Object 0xffff888024b8b000 @offset=0
------------[ cut here ]------------
kmem_cache_destroy bio-224: Slab cache still has objects when called from bio_put_slab block/bio.c:155 [inline]
kmem_cache_destroy bio-224: Slab cache still has objects when called from bioset_exit+0x54e/0x650 block/bio.c:1662
WARNING: CPU: 0 PID: 6991 at mm/slab_common.c:533 kmem_cache_destroy+0x153/0x160 mm/slab_common.c:532
Modules linked in:
CPU: 0 UID: 0 PID: 6991 Comm: syz.3.24 Tainted: G    B              6.14.0-rc4-syzkaller-00090-gdd83757f6e68 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:kmem_cache_destroy+0x153/0x160 mm/slab_common.c:532
Code: 5f 18 48 89 de 5b 41 5e 5d e9 e9 e7 13 00 90 48 8b 53 60 48 c7 c7 72 20 2c 8e 48 c7 c6 ab 20 2c 8e 48 89 e9 e8 de 45 7a ff 90 <0f> 0b 90 90 e9 25 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003617870 EFLAGS: 00010246
RAX: 604fc68cc2c5ab00 RBX: ffff88814dbf8780 RCX: ffff88802dae3c00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffffff84ca8cfe R08: ffffffff81817d42 R09: fffffbfff1d3a614
R10: dffffc0000000000 R11: fffffbfff1d3a614 R12: 00000000000000e0
R13: 1ffff1100a899129 R14: 0000000000000001 R15: ffff88802a868948
FS:  00007fb11e83f6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffb259b4ff8 CR3: 000000007cfea000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 bio_put_slab block/bio.c:155 [inline]
 bioset_exit+0x54e/0x650 block/bio.c:1662
 __bch2_fs_free fs/bcachefs/super.c:562 [inline]
 bch2_fs_release+0x1c9/0x7b0 fs/bcachefs/super.c:624
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22f/0x480 lib/kobject.c:737
 bch2_fs_get_tree+0xdee/0x17a0 fs/bcachefs/fs.c:2299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb11d98e54a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb11e83ee68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb11e83eef0 RCX: 00007fb11d98e54a
RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007fb11e83eeb0
RBP: 0000000020000000 R08: 00007fb11e83eef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000040
R13: 00007fb11e83eeb0 R14: 000000000000593f R15: 0000000020000380
 </TASK>