==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x104/0x6800 kernel/locking/lockdep.c:4919
Read of size 8 at addr ffff0000d3a0cbb0 by task gfs2_quotad/6851

CPU: 1 PID: 6851 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351
 __lock_acquire+0x104/0x6800 kernel/locking/lockdep.c:4919
 lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x6c/0xb0 kernel/locking/spinlock.c:162
 finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
 gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

The buggy address belongs to the physical page:
page:000000002db63263 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113a0c
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 fffffc00034e8308 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d3a0ca80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d3a0cb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000d3a0cb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                     ^
 ffff0000d3a0cc00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d3a0cc80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 PID: 6851 Comm: gfs2_quotad Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 assign_lock_key+0x230/0x264 kernel/locking/lockdep.c:974
 register_lock_class+0x1ac/0x694 kernel/locking/lockdep.c:1287
 __lock_acquire+0x164/0x6800 kernel/locking/lockdep.c:4928
 lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x6c/0xb0 kernel/locking/spinlock.c:162
 finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
 gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
list_del corruption. prev->next should be ffff800021cf7d98, but was 0000000000000000. (prev=ffff0000d3a0cbd8)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 6851 Comm: gfs2_quotad Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
lr : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
sp : ffff800021cf7c70
x29: ffff800021cf7c70 x28: 0000000000000000 x27: 0000000000000bb8
x26: 0000000000001770 x25: dfff800000000000 x24: dfff800000000000
x23: ffff0000d3a0c7c0 x22: dfff800000000000 x21: ffff0000d3a0cbd8
x20: ffff0000d3a0cbd8 x19: ffff800021cf7d98 x18: 0000000000000000
x17: 20747562202c3839 x16: ffff800011a529a8 x15: 0000000000000000
x14: 0000000000000001 x13: 1fffe00033ea39a3 x12: 0000000000ff0100
x11: ff008000083121f4 x10: 0000000000000000 x9 : 0e58044adc18df00
x8 : 0e58044adc18df00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021cf7738 x4 : ffff800015324ea0 x3 : ffff80000853974c
x2 : 0000000000000001 x1 : 0000000100000001 x0 : 000000000000006d
Call trace:
 __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
 __list_del_entry include/linux/list.h:134 [inline]
 list_del_init include/linux/list.h:206 [inline]
 finish_wait+0xd4/0x1ac kernel/sched/wait.c:411
 gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: 911b0000 aa1303e1 aa1503e3 95c246f3 (d4210000) 
---[ end trace 0000000000000000 ]---