------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.3216/21781 is trying to acquire lock:
ffffffff8e6f31c0 (console_owner){-...}-{0:0}, at: console_lock_spinning_enable+0x61/0x80 kernel/printk/printk.c:1902
but task is already holding lock:
ffff8880b843b3e0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:655 [inline]
ffff8880b843b3e0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 kernel/sched/core.c:639
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:382
raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:647
raw_spin_rq_lock kernel/sched/sched.h:1618 [inline]
_task_rq_lock+0xcf/0x510 kernel/sched/core.c:742
cgroup_move_task+0x81/0x320 kernel/sched/psi.c:1170
css_set_move_task+0x285/0x600 kernel/cgroup/cgroup.c:948
cgroup_post_fork+0x202/0x9b0 kernel/cgroup/cgroup.c:6993
copy_process+0x6399/0x7e30 kernel/fork.c:2518
kernel_clone+0x12e/0x9c0 kernel/fork.c:2714
user_mode_thread+0xcc/0x110 kernel/fork.c:2790
rest_init+0x21/0x260 init/main.c:727
start_kernel+0x484/0x490 init/main.c:1220
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x148
-> #3 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:571 [inline]
try_to_wake_up+0xb5/0x1900 kernel/sched/core.c:4185
__wake_up_common+0x135/0x1f0 kernel/sched/wait.c:108
__wake_up_common_lock kernel/sched/wait.c:125 [inline]
__wake_up+0x31/0x60 kernel/sched/wait.c:146
tty_port_default_wakeup+0x52/0x70 drivers/tty/tty_port.c:67
serial8250_tx_chars+0x68f/0x860 drivers/tty/serial/8250/8250_port.c:1721
serial8250_handle_irq_locked+0x5e6/0x7e0 drivers/tty/serial/8250/8250_port.c:1825
serial8250_handle_irq.part.0+0xb4/0x530 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1837 [inline]
serial8250_default_handle_irq+0xc2/0x290 drivers/tty/serial/8250/8250_port.c:1855
serial8250_interrupt+0xf8/0x1c0 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x235/0x8c0 kernel/irq/handle.c:209
handle_irq_event_percpu kernel/irq/handle.c:246 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:263
handle_edge_irq+0x35e/0x960 kernel/irq/chip.c:856
generic_handle_irq_desc include/linux/irqdesc.h:186 [inline]
handle_irq arch/x86/kernel/irq.c:262 [inline]
call_irq_handler arch/x86/kernel/irq.c:318 [inline]
__common_interrupt+0xd8/0x2f0 arch/x86/kernel/irq.c:333
common_interrupt+0xb9/0xe0 arch/x86/kernel/irq.c:326
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
finish_task_switch.isra.0+0x2d3/0x1010 kernel/sched/core.c:5239
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x10f1/0x6820 kernel/sched/core.c:7183
__schedule_loop kernel/sched/core.c:7262 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7277
worker_thread+0x53b/0xe50 kernel/workqueue.c:3467
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #2 (&tty->write_wait){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
__wake_up_common_lock kernel/sched/wait.c:124 [inline]
__wake_up+0x1c/0x60 kernel/sched/wait.c:146
tty_port_default_wakeup+0x52/0x70 drivers/tty/tty_port.c:67
serial8250_tx_chars+0x68f/0x860 drivers/tty/serial/8250/8250_port.c:1721
serial8250_handle_irq_locked+0x5e6/0x7e0 drivers/tty/serial/8250/8250_port.c:1825
serial8250_handle_irq.part.0+0xb4/0x530 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1837 [inline]
serial8250_default_handle_irq+0xc2/0x290 drivers/tty/serial/8250/8250_port.c:1855
serial8250_interrupt+0xf8/0x1c0 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x235/0x8c0 kernel/irq/handle.c:209
handle_irq_event_percpu kernel/irq/handle.c:246 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:263
handle_edge_irq+0x35e/0x960 kernel/irq/chip.c:856
generic_handle_irq_desc include/linux/irqdesc.h:186 [inline]
handle_irq arch/x86/kernel/irq.c:262 [inline]
call_irq_handler arch/x86/kernel/irq.c:318 [inline]
__common_interrupt+0xd8/0x2f0 arch/x86/kernel/irq.c:333
common_interrupt+0xb9/0xe0 arch/x86/kernel/irq.c:326
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
finish_task_switch.isra.0+0x2d3/0x1010 kernel/sched/core.c:5239
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x10f1/0x6820 kernel/sched/core.c:7183
__schedule_loop kernel/sched/core.c:7262 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7277
worker_thread+0x53b/0xe50 kernel/workqueue.c:3467
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #1 (&port_lock_key){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
uart_port_lock_irqsave include/linux/serial_core.h:717 [inline]
serial8250_console_write+0x17e/0x1900 drivers/tty/serial/8250/8250_port.c:3316
console_emit_next_record kernel/printk/printk.c:3183 [inline]
console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3269
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3413
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
_printk+0xcf/0x110 kernel/printk/printk.c:2504
register_console.cold+0xc0/0x248 kernel/printk/printk.c:4208
univ8250_console_init+0x6f/0x80 drivers/tty/serial/8250/8250_core.c:515
console_init+0x3f7/0x5e0 kernel/printk/printk.c:4407
start_kernel+0x30a/0x490 init/main.c:1157
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x148
-> #0 (console_owner){-...}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
console_lock_spinning_enable+0x72/0x80 kernel/printk/printk.c:1902
console_emit_next_record kernel/printk/printk.c:3177 [inline]
console_flush_one_record+0x739/0xe50 kernel/printk/printk.c:3269
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3413
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
_printk+0xcf/0x110 kernel/printk/printk.c:2504
__report_bug.cold+0x15/0x137 lib/bug.c:240
report_bug+0xb2/0x220 lib/bug.c:278
handle_bug+0x16a/0x2a0 arch/x86/kernel/traps.c:436
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:490
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:616
lockdep_assert_rq_held kernel/sched/sched.h:1606 [inline]
lockdep_assert_rq_held kernel/sched/sched.h:1603 [inline]
update_rq_clock+0x40a/0xd20 kernel/sched/core.c:845
pick_next_task kernel/sched/core.c:6216 [inline]
__schedule+0x1cd8/0x6820 kernel/sched/core.c:7099
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7507
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:476 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline]
irqentry_exit+0x1fe/0x790 kernel/entry/common.c:164
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5833
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
is_module_text_address+0x33/0x220 kernel/module/main.c:3921
kernel_text_address kernel/extable.c:119 [inline]
kernel_text_address+0x81/0x100 kernel/extable.c:94
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:385
arch_stack_walk+0xa6/0xf0 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kmalloc_noprof include/linux/slab.h:950 [inline]
slab_free_hook mm/slub.c:2637 [inline]
slab_free mm/slub.c:6165 [inline]
kmem_cache_free+0x415/0x690 mm/slub.c:6295
mempool_free+0xde/0x130 mm/mempool.c:711
bio_put_percpu_cache block/bio.c:822 [inline]
bio_put+0x34f/0x5b0 block/bio.c:841
bio_endio+0x78f/0x8f0 block/bio.c:1794
blk_update_request+0x741/0x1380 block/blk-mq.c:1016
blk_mq_end_request+0x5b/0x420 block/blk-mq.c:1178
blk_mq_complete_request block/blk-mq.c:1356 [inline]
blk_mq_complete_request+0x8b/0xb0 block/blk-mq.c:1353
nullb_complete_cmd drivers/block/null_blk/main.c:1412 [inline]
null_handle_cmd drivers/block/null_blk/main.c:1464 [inline]
null_queue_rq+0xb48/0xfb0 drivers/block/null_blk/main.c:1703
null_queue_rqs+0xe9/0x2f0 drivers/block/null_blk/main.c:1717
__blk_mq_flush_list block/blk-mq.c:2858 [inline]
__blk_mq_flush_list+0x9a/0xc0 block/blk-mq.c:2854
blk_mq_dispatch_queue_requests+0x184/0x7c0 block/blk-mq.c:2903
blk_mq_flush_plug_list+0x1f2/0x600 block/blk-mq.c:2991
__blk_flush_plug+0x2c4/0x4b0 block/blk-core.c:1230
blk_finish_plug+0x5c/0xa0 block/blk-core.c:1257
blkdev_writepages+0xf6/0x150 block/fops.c:487
do_writepages+0x278/0x600 mm/page-writeback.c:2575
filemap_writeback+0x22d/0x2e0 mm/filemap.c:387
filemap_fdatawrite_range mm/filemap.c:412 [inline]
filemap_write_and_wait_range mm/filemap.c:684 [inline]
filemap_write_and_wait_range+0xa6/0x130 mm/filemap.c:675
filemap_write_and_wait include/linux/pagemap.h:65 [inline]
sync_blockdev block/bdev.c:276 [inline]
sync_blockdev block/bdev.c:272 [inline]
blkdev_flush_mapping+0x9d/0x2e0 block/bdev.c:719
blkdev_put_whole+0xc9/0xf0 block/bdev.c:727
bdev_release+0x47f/0x6d0 block/bdev.c:1152
blkdev_release+0x15/0x20 block/fops.c:705
__fput+0x3ff/0xb50 fs/file_table.c:510
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x8cf/0x2b50 kernel/exit.c:977
do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
__do_sys_exit_group kernel/exit.c:1130 [inline]
__se_sys_exit_group kernel/exit.c:1128 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1128
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
console_owner --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock(console_owner);
*** DEADLOCK ***
6 locks held by syz.0.3216/21781:
#0: ffff888027f9a350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1136
#1: ffffffff8e7e70a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8e7e70a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#1: ffffffff8e7e70a0 (rcu_read_lock){....}-{1:3}, at: blk_mq_dispatch_queue_requests+0x148/0x7c0 block/blk-mq.c:2903
#2: ffffffff8e7e70a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8e7e70a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8e7e70a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
#2: ffffffff8e7e70a0 (rcu_read_lock){....}-{1:3}, at: is_module_text_address+0x1f/0x220 kernel/module/main.c:3921
#3: ffff8880b843b3e0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:655 [inline]
#3: ffff8880b843b3e0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 kernel/sched/core.c:639
#4: ffffffff8e7d3600 (console_lock){+.+.}-{0:0}, at: _printk+0xcf/0x110 kernel/printk/printk.c:2504
#5: ffffffff8e7d3678 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:305 [inline]
#5: ffffffff8e7d3678 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:428 [inline]
#5: ffffffff8e7d3678 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:291 [inline]
#5: ffffffff8e7d3678 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfd/0xe50 kernel/printk/printk.c:3246
stack backtrace:
CPU: 0 UID: 0 PID: 21781 Comm: syz.0.3216 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1c7 kernel/locking/lockdep.c:2043
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
console_lock_spinning_enable+0x72/0x80 kernel/printk/printk.c:1902
console_emit_next_record kernel/printk/printk.c:3177 [inline]
console_flush_one_record+0x739/0xe50 kernel/printk/printk.c:3269
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3413
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
_printk+0xcf/0x110 kernel/printk/printk.c:2504
__report_bug.cold+0x15/0x137 lib/bug.c:240
report_bug+0xb2/0x220 lib/bug.c:278
handle_bug+0x16a/0x2a0 arch/x86/kernel/traps.c:436
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:490
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:616
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1606 [inline]
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1603 [inline]
RIP: 0010:update_rq_clock+0x40a/0xd20 kernel/sched/core.c:845
Code: ab 88 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d8 cd c0 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 80 0b 00 00 48 b8 00 00 00 00 00
RSP: 0018:ffffc90003686b08 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880b853b380 RCX: 0000000000000001
RDX: 0000000000000046 RSI: ffffffff8df0e9a7 RDI: ffffffff8c1b4e60
RBP: ffffc90003686cb8 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90dac717 R11: 0000000000000000 R12: ffffffff90dafaa4
R13: ffff8880b853c220 R14: ffff88801e6a1ec0 R15: ffff8880b853b380
pick_next_task kernel/sched/core.c:6216 [inline]
__schedule+0x1cd8/0x6820 kernel/sched/core.c:7099
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7507
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:476 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline]
irqentry_exit+0x1fe/0x790 kernel/entry/common.c:164
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 3b 3a 2c 12 83 f8 07 0f 87 d9 02 00 00 48 0f a3 05 06 41 f6 0e 0f 82 a4 02 00 00 8b 35 8e 74 f6 0e 85 f6 0f 85 bf 00 00 00 <48> 8b 44 24 30 65 48 2b 05 dd 39 2c 12 0f 85 ed 02 00 00 48 83 c4
RSP: 0018:ffffc90003686dc8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8df0e9a7 RDI: ffffffff8c1b4e60
RBP: ffffffff8e7e70a0 R08: 00000000f10cf92a R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
is_module_text_address+0x33/0x220 kernel/module/main.c:3921
kernel_text_address kernel/extable.c:119 [inline]
kernel_text_address+0x81/0x100 kernel/extable.c:94
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:385
arch_stack_walk+0xa6/0xf0 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kmalloc_noprof include/linux/slab.h:950 [inline]
slab_free_hook mm/slub.c:2637 [inline]
slab_free mm/slub.c:6165 [inline]
kmem_cache_free+0x415/0x690 mm/slub.c:6295
mempool_free+0xde/0x130 mm/mempool.c:711
bio_put_percpu_cache block/bio.c:822 [inline]
bio_put+0x34f/0x5b0 block/bio.c:841
bio_endio+0x78f/0x8f0 block/bio.c:1794
blk_update_request+0x741/0x1380 block/blk-mq.c:1016
blk_mq_end_request+0x5b/0x420 block/blk-mq.c:1178
blk_mq_complete_request block/blk-mq.c:1356 [inline]
blk_mq_complete_request+0x8b/0xb0 block/blk-mq.c:1353
nullb_complete_cmd drivers/block/null_blk/main.c:1412 [inline]
null_handle_cmd drivers/block/null_blk/main.c:1464 [inline]
null_queue_rq+0xb48/0xfb0 drivers/block/null_blk/main.c:1703
null_queue_rqs+0xe9/0x2f0 drivers/block/null_blk/main.c:1717
__blk_mq_flush_list block/blk-mq.c:2858 [inline]
__blk_mq_flush_list+0x9a/0xc0 block/blk-mq.c:2854
blk_mq_dispatch_queue_requests+0x184/0x7c0 block/blk-mq.c:2903
blk_mq_flush_plug_list+0x1f2/0x600 block/blk-mq.c:2991
__blk_flush_plug+0x2c4/0x4b0 block/blk-core.c:1230
blk_finish_plug+0x5c/0xa0 block/blk-core.c:1257
blkdev_writepages+0xf6/0x150 block/fops.c:487
do_writepages+0x278/0x600 mm/page-writeback.c:2575
filemap_writeback+0x22d/0x2e0 mm/filemap.c:387
filemap_fdatawrite_range mm/filemap.c:412 [inline]
filemap_write_and_wait_range mm/filemap.c:684 [inline]
filemap_write_and_wait_range+0xa6/0x130 mm/filemap.c:675
filemap_write_and_wait include/linux/pagemap.h:65 [inline]
sync_blockdev block/bdev.c:276 [inline]
sync_blockdev block/bdev.c:272 [inline]
blkdev_flush_mapping+0x9d/0x2e0 block/bdev.c:719
blkdev_put_whole+0xc9/0xf0 block/bdev.c:727
bdev_release+0x47f/0x6d0 block/bdev.c:1152
blkdev_release+0x15/0x20 block/fops.c:705
__fput+0x3ff/0xb50 fs/file_table.c:510
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x8cf/0x2b50 kernel/exit.c:977
do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
__do_sys_exit_group kernel/exit.c:1130 [inline]
__se_sys_exit_group kernel/exit.c:1128 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1128
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8548b9c819
Code: Unable to access opcode bytes at 0x7f8548b9c7ef.
RSP: 002b:00007fff97ee0a98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8548b9c819
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fff97ee0afc R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000006 R11: 0000000000000246 R12: 00000000000000ce
R13: 00000000000927c0 R14: 000000000011cc7e R15: 00007fff97ee0b50
debug_locks && !(lock_is_held(&(__rq_lockp(rq))->dep_map) != 0)
WARNING: kernel/sched/sched.h:1606 at lockdep_assert_rq_held kernel/sched/sched.h:1606 [inline], CPU#0: syz.0.3216/21781
WARNING: kernel/sched/sched.h:1606 at lockdep_assert_rq_held kernel/sched/sched.h:1603 [inline], CPU#0: syz.0.3216/21781
WARNING: kernel/sched/sched.h:1606 at update_rq_clock+0x40a/0xd20 kernel/sched/core.c:845, CPU#0: syz.0.3216/21781
Modules linked in:
CPU: 0 UID: 0 PID: 21781 Comm: syz.0.3216 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1606 [inline]
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1603 [inline]
RIP: 0010:update_rq_clock+0x40a/0xd20 kernel/sched/core.c:845
Code: ab 88 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d8 cd c0 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 80 0b 00 00 48 b8 00 00 00 00 00
RSP: 0018:ffffc90003686b08 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880b853b380 RCX: 0000000000000001
RDX: 0000000000000046 RSI: ffffffff8df0e9a7 RDI: ffffffff8c1b4e60
RBP: ffffc90003686cb8 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90dac717 R11: 0000000000000000 R12: ffffffff90dafaa4
R13: ffff8880b853c220 R14: ffff88801e6a1ec0 R15: ffff8880b853b380
FS: 0000000000000000(0000) GS:ffff888124314000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000cf000 CR3: 0000000075b6c000 CR4: 00000000003526f0
Call Trace:
pick_next_task kernel/sched/core.c:6216 [inline]
__schedule+0x1cd8/0x6820 kernel/sched/core.c:7099
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7507
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:476 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline]
irqentry_exit+0x1fe/0x790 kernel/entry/common.c:164
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 3b 3a 2c 12 83 f8 07 0f 87 d9 02 00 00 48 0f a3 05 06 41 f6 0e 0f 82 a4 02 00 00 8b 35 8e 74 f6 0e 85 f6 0f 85 bf 00 00 00 <48> 8b 44 24 30 65 48 2b 05 dd 39 2c 12 0f 85 ed 02 00 00 48 83 c4
RSP: 0018:ffffc90003686dc8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8df0e9a7 RDI: ffffffff8c1b4e60
RBP: ffffffff8e7e70a0 R08: 00000000f10cf92a R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
is_module_text_address+0x33/0x220 kernel/module/main.c:3921
kernel_text_address kernel/extable.c:119 [inline]
kernel_text_address+0x81/0x100 kernel/extable.c:94
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:385
arch_stack_walk+0xa6/0xf0 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kmalloc_noprof include/linux/slab.h:950 [inline]
slab_free_hook mm/slub.c:2637 [inline]
slab_free mm/slub.c:6165 [inline]
kmem_cache_free+0x415/0x690 mm/slub.c:6295
mempool_free+0xde/0x130 mm/mempool.c:711
bio_put_percpu_cache block/bio.c:822 [inline]
bio_put+0x34f/0x5b0 block/bio.c:841
bio_endio+0x78f/0x8f0 block/bio.c:1794
blk_update_request+0x741/0x1380 block/blk-mq.c:1016
blk_mq_end_request+0x5b/0x420 block/blk-mq.c:1178
blk_mq_complete_request block/blk-mq.c:1356 [inline]
blk_mq_complete_request+0x8b/0xb0 block/blk-mq.c:1353
nullb_complete_cmd drivers/block/null_blk/main.c:1412 [inline]
null_handle_cmd drivers/block/null_blk/main.c:1464 [inline]
null_queue_rq+0xb48/0xfb0 drivers/block/null_blk/main.c:1703
null_queue_rqs+0xe9/0x2f0 drivers/block/null_blk/main.c:1717
__blk_mq_flush_list block/blk-mq.c:2858 [inline]
__blk_mq_flush_list+0x9a/0xc0 block/blk-mq.c:2854
blk_mq_dispatch_queue_requests+0x184/0x7c0 block/blk-mq.c:2903
blk_mq_flush_plug_list+0x1f2/0x600 block/blk-mq.c:2991
__blk_flush_plug+0x2c4/0x4b0 block/blk-core.c:1230
blk_finish_plug+0x5c/0xa0 block/blk-core.c:1257
blkdev_writepages+0xf6/0x150 block/fops.c:487
do_writepages+0x278/0x600 mm/page-writeback.c:2575
filemap_writeback+0x22d/0x2e0 mm/filemap.c:387
filemap_fdatawrite_range mm/filemap.c:412 [inline]
filemap_write_and_wait_range mm/filemap.c:684 [inline]
filemap_write_and_wait_range+0xa6/0x130 mm/filemap.c:675
filemap_write_and_wait include/linux/pagemap.h:65 [inline]
sync_blockdev block/bdev.c:276 [inline]
sync_blockdev block/bdev.c:272 [inline]
blkdev_flush_mapping+0x9d/0x2e0 block/bdev.c:719
blkdev_put_whole+0xc9/0xf0 block/bdev.c:727
bdev_release+0x47f/0x6d0 block/bdev.c:1152
blkdev_release+0x15/0x20 block/fops.c:705
__fput+0x3ff/0xb50 fs/file_table.c:510
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x8cf/0x2b50 kernel/exit.c:977
do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
__do_sys_exit_group kernel/exit.c:1130 [inline]
__se_sys_exit_group kernel/exit.c:1128 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1128
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8548b9c819
Code: Unable to access opcode bytes at 0x7f8548b9c7ef.
RSP: 002b:00007fff97ee0a98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8548b9c819
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fff97ee0afc R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000006 R11: 0000000000000246 R12: 00000000000000ce
R13: 00000000000927c0 R14: 000000000011cc7e R15: 00007fff97ee0b50
----------------
Code disassembly (best guess):
0: 05 3b 3a 2c 12 add $0x122c3a3b,%eax
5: 83 f8 07 cmp $0x7,%eax
8: 0f 87 d9 02 00 00 ja 0x2e7
e: 48 0f a3 05 06 41 f6 bt %rax,0xef64106(%rip) # 0xef6411c
15: 0e
16: 0f 82 a4 02 00 00 jb 0x2c0
1c: 8b 35 8e 74 f6 0e mov 0xef6748e(%rip),%esi # 0xef674b0
22: 85 f6 test %esi,%esi
24: 0f 85 bf 00 00 00 jne 0xe9
* 2a: 48 8b 44 24 30 mov 0x30(%rsp),%rax <-- trapping instruction
2f: 65 48 2b 05 dd 39 2c sub %gs:0x122c39dd(%rip),%rax # 0x122c3a14
36: 12
37: 0f 85 ed 02 00 00 jne 0x32a
3d: 48 rex.W
3e: 83 .byte 0x83
3f: c4 .byte 0xc4