------------[ cut here ]------------
WARNING: CPU: 1 PID: 8673 at include/linux/backing-dev.h:256 inode_to_wb include/linux/backing-dev.h:252 [inline]
WARNING: CPU: 1 PID: 8673 at include/linux/backing-dev.h:256 folio_account_dirtied mm/page-writeback.c:2640 [inline]
WARNING: CPU: 1 PID: 8673 at include/linux/backing-dev.h:256 __folio_mark_dirty+0x91c/0x1160 mm/page-writeback.c:2691
Modules linked in:
CPU: 1 PID: 8673 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:inode_to_wb include/linux/backing-dev.h:252 [inline]
RIP: 0010:folio_account_dirtied mm/page-writeback.c:2640 [inline]
RIP: 0010:__folio_mark_dirty+0x91c/0x1160 mm/page-writeback.c:2691
Code: e9 88 f8 ff ff e8 b4 05 ce ff 0f 0b e9 cf f8 ff ff e8 a8 05 ce ff 48 89 df 48 8b 74 24 10 e8 bb 92 2e 00 eb a6 e8 94 05 ce ff <0f> 0b e9 69 fb ff ff 89 c2 80 e2 07 80 c2 03 38 ca 0f 8c e8 f8 ff
RSP: 0018:ffffc900033d7a08 EFLAGS: 00010093
RAX: ffffffff81b9d90c RBX: ffffea0001887c80 RCX: ffff8880587c8000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffea0001887c87 R09: 1ffffd4000310f90
R10: dffffc0000000000 R11: fffff94000310f91 R12: 0000000000000000
R13: ffff8880210c86e0 R14: 1ffff1100421910b R15: ffff8880210c8858
FS: 00005555814a0500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f86471e6e9c CR3: 0000000063b61000 CR4: 00000000003506e0
Call Trace:
mark_buffer_dirty+0x26e/0x4d0 fs/buffer.c:1212
gfs2_unpin+0x125/0xa00 fs/gfs2/lops.c:111
buf_lo_after_commit+0x165/0x1b0 fs/gfs2/lops.c:745
lops_after_commit fs/gfs2/lops.h:51 [inline]
__gfs2_log_flush+0x10c5/0x24d0 fs/gfs2/log.c:1118
gfs2_log_flush+0x34/0x50 fs/gfs2/log.c:1180
gfs2_kill_sb+0x5c/0x2e0 fs/gfs2/ops_fstype.c:1789
deactivate_locked_super+0x9c/0x210 fs/super.c:479
cleanup_mnt+0x3d7/0x460 fs/namespace.c:1259
task_work_run+0x1d4/0x260 kernel/task_work.c:245
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
__syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5b6dfaa157
Code: a2 c7 05 9c 25 25 00 00 00 00 00 eb 96 e8 c1 13 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffdd5223218 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f5b6e037363 RCX: 00007f5b6dfaa157
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdd52232d0
RBP: 00007ffdd52232d0 R08: 00007ffdd52242d0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdd5224360
R13: 00007f5b6e037363 R14: 000000000004051f R15: 00007ffdd52243a0
irq event stamp: 579328
hardirqs last enabled at (579327): [] folio_memcg_lock+0x184/0x320 mm/memcontrol.c:2162
hardirqs last disabled at (579328): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (579328): [] _raw_spin_lock_irqsave+0x8f/0x100 kernel/locking/spinlock.c:162
softirqs last enabled at (579280): [] __do_softirq kernel/softirq.c:612 [inline]
softirqs last enabled at (579280): [] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last enabled at (579280): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
softirqs last disabled at (579167): [] __do_softirq kernel/softirq.c:612 [inline]
softirqs last disabled at (579167): [] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last disabled at (579167): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8673 at include/linux/backing-dev.h:256 inode_to_wb include/linux/backing-dev.h:252 [inline]
WARNING: CPU: 0 PID: 8673 at include/linux/backing-dev.h:256 __folio_start_writeback+0x9a9/0xf90 mm/page-writeback.c:3035
Modules linked in:
CPU: 0 PID: 8673 Comm: syz-executor Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:inode_to_wb include/linux/backing-dev.h:252 [inline]
RIP: 0010:__folio_start_writeback+0x9a9/0xf90 mm/page-writeback.c:3035
Code: 65 48 8b 04 25 28 00 00 00 48 3b 84 24 20 01 00 00 75 1e 44 89 f8 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 57 cd cd ff <0f> 0b e9 c0 fb ff ff e8 2b d0 dd 08 44 89 f1 80 e1 07 80 c1 03 38
RSP: 0018:ffffc900033d7460 EFLAGS: 00010093
RAX: ffffffff81ba1149 RBX: ffffea0001887c80 RCX: ffff8880587c8000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900033d75c8 R08: ffff88805af2eb77 R09: 1ffff1100b5e5d6e
R10: dffffc0000000000 R11: ffffed100b5e5d6f R12: dffffc0000000000
R13: 1ffff9200067ae98 R14: ffff88805c29c2a0 R15: 0000000000000000
FS: 00005555814a0500(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f86fb9f6158 CR3: 0000000063b61000 CR4: 00000000003506f0
Call Trace:
gfs2_aspace_writepage+0x57c/0xa80 fs/gfs2/meta_io.c:73
__gfs2_writepage+0x67/0x130 fs/gfs2/log.c:87
write_cache_pages+0x724/0x1290 mm/page-writeback.c:2496
gfs2_ail1_start_one fs/gfs2/log.c:143 [inline]
gfs2_ail1_flush+0xb0f/0xd70 fs/gfs2/log.c:223
gfs2_ail1_start fs/gfs2/log.c:254 [inline]
empty_ail1_list+0x14a/0x240 fs/gfs2/log.c:986
__gfs2_log_flush+0x1fdc/0x24d0 fs/gfs2/log.c:1133
gfs2_log_flush+0x34/0x50 fs/gfs2/log.c:1180
gfs2_kill_sb+0x5c/0x2e0 fs/gfs2/ops_fstype.c:1789
deactivate_locked_super+0x9c/0x210 fs/super.c:479
cleanup_mnt+0x3d7/0x460 fs/namespace.c:1259
task_work_run+0x1d4/0x260 kernel/task_work.c:245
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
__syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5b6dfaa157
Code: a2 c7 05 9c 25 25 00 00 00 00 00 eb 96 e8 c1 13 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffdd5223218 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f5b6e037363 RCX: 00007f5b6dfaa157
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdd52232d0
RBP: 00007ffdd52232d0 R08: 00007ffdd52242d0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdd5224360
R13: 00007f5b6e037363 R14: 000000000004051f R15: 00007ffdd52243a0
irq event stamp: 579556
hardirqs last enabled at (579555): [] folio_memcg_lock+0x184/0x320 mm/memcontrol.c:2162
hardirqs last disabled at (579556): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (579556): [] _raw_spin_lock_irqsave+0x8f/0x100 kernel/locking/spinlock.c:162
softirqs last enabled at (579528): [] __do_softirq kernel/softirq.c:612 [inline]
softirqs last enabled at (579528): [] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last enabled at (579528): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
softirqs last disabled at (579333): [] __do_softirq kernel/softirq.c:612 [inline]
softirqs last disabled at (579333): [] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last disabled at (579333): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
---[ end trace 0000000000000000 ]---
gfs2: fsid=syz:syz.0: original: gfs2_quota_sync+0x411/0x5a0 fs/gfs2/quota.c:1345
gfs2: fsid=syz:syz.0: pid: 8673
gfs2: fsid=syz:syz.0: lock type: 8 req lock state : 1
gfs2: fsid=syz:syz.0: new: gfs2_quota_sync+0x411/0x5a0 fs/gfs2/quota.c:1345
gfs2: fsid=syz:syz.0: pid: 8673
gfs2: fsid=syz:syz.0: lock type: 8 req lock state : 1
gfs2: fsid=syz:syz.0: G: s:EX n:8/1 f:qb t:EX d:EX/0 a:0 v:0 r:5 m:20 p:0
gfs2: fsid=syz:syz.0: H: s:EX f:cH e:0 p:8673 [syz-executor] gfs2_quota_sync+0x411/0x5a0 fs/gfs2/quota.c:1345
------------[ cut here ]------------
kernel BUG at fs/gfs2/glock.c:1605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8673 Comm: syz-executor Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:add_to_queue fs/gfs2/glock.c:1605 [inline]
RIP: 0010:gfs2_glock_nq+0x115e/0x1440 fs/gfs2/glock.c:1630
Code: e8 a7 f1 33 fe 41 0f b7 0e 48 c7 c7 80 4a 2f 8b 4c 89 e6 89 da e8 02 3e df 06 31 ff 48 8b 34 24 ba 01 00 00 00 e8 42 70 ff ff <0f> 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 22 f1 ff ff 48 89 df e8
RSP: 0018:ffffc900033d79f8 EFLAGS: 00010246
RAX: f93b81651765da00 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: fffff5200067af34
RBP: ffff88803156a622 R08: ffffffff8f8dda6f R09: 0000000000000000
R10: fffff5200067aef0 R11: fffffbfff1f1bb4e R12: ffff888020bf5280
R13: ffff8880578c3be0 R14: ffff88803156a65a R15: ffff88803156a618
FS: 00005555814a0500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056301b5d9d51 CR3: 0000000063b61000 CR4: 00000000003506e0
Call Trace:
gfs2_glock_nq_init fs/gfs2/glock.h:253 [inline]
do_sync+0x3fc/0xd90 fs/gfs2/quota.c:913
gfs2_quota_sync+0x411/0x5a0 fs/gfs2/quota.c:1345
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:673
sync_filesystem+0xea/0x220 fs/sync.c:56
generic_shutdown_super+0x6f/0x2b0 fs/super.c:663
kill_block_super+0x44/0x90 fs/super.c:1671
deactivate_locked_super+0x9c/0x210 fs/super.c:479
cleanup_mnt+0x3d7/0x460 fs/namespace.c:1259
task_work_run+0x1d4/0x260 kernel/task_work.c:245
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
__syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5b6dfaa157
Code: a2 c7 05 9c 25 25 00 00 00 00 00 eb 96 e8 c1 13 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffdd5223218 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f5b6e037363 RCX: 00007f5b6dfaa157
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdd52232d0
RBP: 00007ffdd52232d0 R08: 00007ffdd52242d0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdd5224360
R13: 00007f5b6e037363 R14: 000000000004051f R15: 00007ffdd52243a0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:add_to_queue fs/gfs2/glock.c:1605 [inline]
RIP: 0010:gfs2_glock_nq+0x115e/0x1440 fs/gfs2/glock.c:1630
Code: e8 a7 f1 33 fe 41 0f b7 0e 48 c7 c7 80 4a 2f 8b 4c 89 e6 89 da e8 02 3e df 06 31 ff 48 8b 34 24 ba 01 00 00 00 e8 42 70 ff ff <0f> 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 22 f1 ff ff 48 89 df e8
RSP: 0018:ffffc900033d79f8 EFLAGS: 00010246
RAX: f93b81651765da00 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: fffff5200067af34
RBP: ffff88803156a622 R08: ffffffff8f8dda6f R09: 0000000000000000
R10: fffff5200067aef0 R11: fffffbfff1f1bb4e R12: ffff888020bf5280
R13: ffff8880578c3be0 R14: ffff88803156a65a R15: ffff88803156a618
FS: 00005555814a0500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056301b5d9d51 CR3: 0000000063b61000 CR4: 00000000003506e0