Hello, syzbot found the following issue on:
HEAD commit: d7fa1af5b33e Merge branch 'for-next/core' into for-kernelci git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci console output: https://syzkaller.appspot.com/x/log.txt?x=177629d4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=89c13de706fbf07a dashboard link: https://syzkaller.appspot.com/bug?extid=1a64e5e20993a6c1a9f2 compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1633ca0c580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12b7f570580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/da97ad659b2c/disk-d7fa1af5.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/659e123552a8/vmlinux-d7fa1af5.xz kernel image: https://storage.googleapis.com/syzbot-assets/6ec5dbf4643e/Image-d7fa1af5.gz.xz mounted in repro #1: https://storage.googleapis.com/syzbot-assets/9fd1de80f5c7/mount_0.gz mounted in repro #2: https://storage.googleapis.com/syzbot-assets/db42b08e4cec/mount_1.gz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: [email protected] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6496 at kernel/rcu/srcutree.c:695 cleanup_srcu_struct+0x420/0x504 kernel/rcu/srcutree.c:718 Modules linked in: CPU: 0 UID: 0 PID: 6496 Comm: syz-executor216 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cleanup_srcu_struct+0x420/0x504 kernel/rcu/srcutree.c:718 lr : cleanup_srcu_struct+0x2b8/0x504 kernel/rcu/srcutree.c:694 sp : ffff8000a4f079b0 x29: ffff8000a4f079d0 x28: 1ffff00011d84e4b x27: 1fffe0001da80844 x26: ffff80008ec27000 x25: dfff800000000000 x24: fffffdffbf7693c8 x23: fffffdffbf769300 x22: ffff0000ed404220 x21: ffffffffffffffff x20: ffff80008f321e88 x19: 0000000000000001 x18: 1fffe0003386aa76 x17: ffff80008f31e000 x16: ffff80008adbeaf4 x15: 0000000000000001 x14: 1fffffbff7eed28c x13: 0000000000000000 x12: 0000000000000000 x11: ffff7fbff7eed28d x10: 0000000000ff0100 x9 : 96b044024d34f400 x8 : 0000000000000006 x7 : ffff800080433050 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080422d24 x2 : 0000000000000000 x1 : 0000000000000080 x0 : 0000000000000000 Call trace: cleanup_srcu_struct+0x420/0x504 kernel/rcu/srcutree.c:718 (P) bch2_fs_btree_iter_exit+0x380/0x420 fs/bcachefs/btree_iter.c:3617 __bch2_fs_free fs/bcachefs/super.c:564 [inline] bch2_fs_release+0x24c/0x72c fs/bcachefs/super.c:618 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2b0/0x438 lib/kobject.c:737 bch2_fs_free+0x308/0x378 fs/bcachefs/super.c:681 bch2_kill_sb+0x48/0x58 fs/bcachefs/fs.c:2623 deactivate_locked_super+0xc4/0x12c fs/super.c:473 deactivate_super+0xe0/0x100 fs/super.c:506 cleanup_mnt+0x31c/0x3ac fs/namespace.c:1431 __cleanup_mnt+0x20/0x30 fs/namespace.c:1438 task_work_run+0x1dc/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] do_notify_resume+0x16c/0x1ec arch/arm64/kernel/entry-common.c:151 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline] el0_svc+0xb4/0x17c arch/arm64/kernel/entry-common.c:768 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 irq event stamp: 324162 hardirqs last enabled at (324161): [<ffff80008addfa48>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (324161): [<ffff80008addfa48>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194 hardirqs last disabled at (324162): [<ffff80008adb9eb8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511 softirqs last enabled at (322512): [<ffff8000803cf71c>] softirq_handle_end kernel/softirq.c:425 [inline] softirqs last enabled at (322512): [<ffff8000803cf71c>] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:607 softirqs last disabled at (322371): [<ffff800080020efc>] __do_softirq+0x14/0x20 kernel/softirq.c:613 ---[ end trace 0000000000000000 ]--- bcachefs (loop4): shutting down bcachefs (loop4): going read-only bcachefs (loop4): finished waiting for writes to stop bcachefs (loop4): flushing journal and stopping allocators, journal seq 3 bcachefs (loop4): flushing journal and stopping allocators complete, journal seq 3 bcachefs (loop4): clean shutdown complete, journal seq 4 bcachefs (loop4): marking filesystem clean bcachefs (loop4): shutdown complete --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected]. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
