From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 072B5382287 for ; Fri, 13 Mar 2026 23:08:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773443316; cv=none; b=RcHA0qqdKhaYAzxsAwbqj8/kFIL+0F0FHE3fGdz/fxawtGdcjDlGwOHvCL+oApRdnM9IzV1Lms+rQdjRCYvHN4zN+QZ3TXkBAvim784Bf4Nt0i1oQASELVyZj4fWeWDDJSUMC/I1soeJtON5rRy5hkEs7xImumHqSzkH9bowD3o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773443316; c=relaxed/simple; bh=QnGqm4m7X7QiiuC8gNebDwYpWyIiIWZWKuMslVNLatY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=aYZXF58R4A5jDcImyggK/X1BzJXeMS0yvTJPJDXrMfTtWvYly5vBQSEruvVzaT4hJu2r0mDEl3sKlXzlzf1QvrsFjFBdFY424dDz2nv2cs9TqFUqD/pxoKyZdQqSjFJkKxblpzP0CXFl40MRSLW9DAx6lpT0X9oUe0lYAj80SCs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cmpxchg.org; spf=pass smtp.mailfrom=cmpxchg.org; dkim=pass (2048-bit key) header.d=cmpxchg.org header.i=@cmpxchg.org header.b=kej8Ud5K; arc=none smtp.client-ip=209.85.219.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cmpxchg.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cmpxchg.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cmpxchg.org header.i=@cmpxchg.org header.b="kej8Ud5K" Received: by mail-qv1-f49.google.com with SMTP id 6a1803df08f44-89a6e6225e4so30865806d6.2 for ; Fri, 13 Mar 2026 16:08:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cmpxchg.org; s=google; t=1773443313; x=1774048113; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=iQn6r17fR0ZCkH5iTyR5vE7sb4nJUi8kn661lqcNUlc=; b=kej8Ud5KfXGqXkMwWXetPp1Pi2YybZrzzdC6vDqJygTsIK5TF2kuvlKEwgr7mSLK1+ xuqVpfixqJSJgQ0L6qDAYNy9mbnZjbdxrDvugZb7T/npMGarTURe1MlkwtgVZK4mVf5f aOhuWIRn+8B1Fi+RJa3fT7Sl3neT44429HHoad+OLYhIqPQNqoOGpEZ2FtIXMyDrc+LO AlNqv9UQFb33iH+gsT9+WnnPsynZcrgUN+ohneGFoczsGJdtMPBJUO9UOxMncZjt446o ghKHqmxDyj4QUYYw+XfXGEr9wrFpqF/F+On3LqgjMmP0imjLVFozBGwA+CFQu88ham4h I0Ww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773443313; x=1774048113; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=iQn6r17fR0ZCkH5iTyR5vE7sb4nJUi8kn661lqcNUlc=; b=W3DVDuCUQ8Gfpiol8gBuD36jcTaE3MxljMliHi+hSPloFlwkR12CD+fKEsybGS0HRa RmHwsXPozfRu8B9LfxG8yxapbdo+zHa7IC0b6cbSnlvjcY7u4dQWij34m8FWpd/1WpNC DIMDDk5mtT5aPCvJhZhOEoWex5OFIS0T4SAuGPquxizA1o/VpFdW/9zf+73xOtnvwnbn wvfuahIuEHsg1lpGGArvWBwl5LkS00AxoYh/t1EJypu49ztxN5XYBlWdsxvzGT3NpWR1 zLHoACNZNux/Ivp4YFF7nCDUSM2vd3Gl0JnwHPnyoM6i8BPcmH+d0sJdP4qWzp5ailv0 d0ww== X-Forwarded-Encrypted: i=1; AJvYcCVHYl/vq7uIL6DWwF5OnvvvSqBsHb4PxtmJ1McJHlZENYRIi5uWGXXUHpDrEaWyOwqs4Rbi7d1PFPaLevo=@vger.kernel.org X-Gm-Message-State: AOJu0Yy00s+ei7wgAQxbnQsY+8HDx7jyaQ68SnTWeW1EGtswf8Kccfi2 HL1cG71iAelCaKALKLAOG/3bIjy6xaq7w4c+ylELWlVGFw1UCObUCnn5q7npINHldIV6UZzSE6U wqDqC X-Gm-Gg: ATEYQzwNkoSZ8F+Li68qg19JS/XQ09m/3kiKD109wG4wEbY949biIOeHMsmFDYCGdAc 3pG0iEqXUjpELJY8U8wn/5J+uHcydZwiKb/5IES7jIkPsqhtSu/OJ25WrhFyvpaK3crtCJyqYL1 UP5lU4re5cXeNFG/puDLTTexGzzo9oUu1ZepJ46pAKQwXHpIaWmBwPaw/6YNXT7QDEruoo0IexC v95nEqKpE+w0dwjpR7HzQoOufhMQiggTYLqw+bVzH0BGHWviWhaA6uFgwDLU6l/bN/zCJ6mrUal 749xgxxWNBXUoVo5vG5ylON9Pab/2t9uRCLAPMlb5BkQB9GzfJ5tOwr/d0jamkWQ5R67n83HGGK rUo5v4dT73rS11kW5xJFfLuu9UvnMxRJZjZNi0DuGWBkjPv57eVEypHTtOtYb9rEiz/P80/k4Y6 +sqeXIStC8/TqkKd7NBMIV5g== X-Received: by 2002:ad4:5766:0:b0:89a:c88:1fb6 with SMTP id 6a1803df08f44-89a820283abmr79354466d6.53.1773443312789; Fri, 13 Mar 2026 16:08:32 -0700 (PDT) Received: from localhost ([2603:7000:c00:3a00:365a:60ff:fe62:ff29]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89a65cfc409sm67174226d6.35.2026.03.13.16.08.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 13 Mar 2026 16:08:31 -0700 (PDT) Date: Fri, 13 Mar 2026 19:08:27 -0400 From: Johannes Weiner To: syzbot ci Cc: akpm@linux-foundation.org, david@fromorbit.com, david@kernel.org, kas@kernel.org, liam.howlett@oracle.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, roman.gushchin@linux.dev, shakeel.butt@linux.dev, usama.arif@linux.dev, yosry.ahmed@linux.dev, ziy@nvidia.com, syzbot@lists.linux.dev, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot ci] Re: mm: switch THP shrinker to list_lru Message-ID: References: <20260312205321.638053-1-hannes@cmpxchg.org> <69b44bda.050a0220.36eb34.000d.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <69b44bda.050a0220.36eb34.000d.GAE@google.com> On Fri, Mar 13, 2026 at 10:39:38AM -0700, syzbot ci wrote: > ------------[ cut here ]------------ > !css_is_dying(&memcg->css) > WARNING: mm/list_lru.c:110 at lock_list_lru_of_memcg+0x33d/0x470 mm/list_lru.c:110, CPU#0: syz.0.17/5950 > Modules linked in: > CPU: 0 UID: 0 PID: 5950 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 > RIP: 0010:lock_list_lru_of_memcg+0x33d/0x470 mm/list_lru.c:110 > Code: 3c 28 00 74 08 4c 89 e7 e8 b0 02 1d 00 4d 8b 24 24 48 8b 54 24 20 4d 85 e4 0f 85 00 fe ff ff e9 75 fe ff ff e8 d4 df b3 ff 90 <0f> 0b 90 eb c1 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 06 fe ff ff 48 > RSP: 0018:ffffc90004017110 EFLAGS: 00010093 > RAX: ffffffff8211b3ac RBX: 0000000000000000 RCX: ffff888104f057c0 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 0000000000000000 R08: ffff888104f057c0 R09: 0000000000000002 > R10: 0000000000000406 R11: 0000000000000000 R12: ffff8881026d0d00 > R13: dffffc0000000000 R14: ffffffff9a2de05c R15: 0000000000000002 > FS: 0000555572bfe500(0000) GS:ffff88818de66000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000200000001000 CR3: 0000000112554000 CR4: 00000000000006f0 > Call Trace: > > __folio_freeze_and_split_unmapped+0x2ab/0x34b0 mm/huge_memory.c:3767 > __folio_split+0xae1/0x1570 mm/huge_memory.c:4033 > try_folio_split_to_order include/linux/huge_mm.h:411 [inline] > try_folio_split_or_unmap+0x5b/0x1e0 mm/truncate.c:189 > truncate_inode_partial_folio+0x4ab/0x8e0 mm/truncate.c:255 File pages aren't on the deferred_split_lru. We're calling list_lru_lock() on a nid+memcg combination that doesn't have list_lru heads allocated. This should either fail gracefully or needs page type filtering in __folio_freeze_and_split_unmapped(). Needs more thought. > possible deadlock in __folio_end_writeback > > ===================================================== > WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected > syzkaller #0 Not tainted > ----------------------------------------------------- > syz.0.17/5949 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: > ffff88810c90c240 (&l->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:341 [inline] > ffff88810c90c240 (&l->lock){+.+.}-{3:3}, at: lock_list_lru mm/list_lru.c:26 [inline] > ffff88810c90c240 (&l->lock){+.+.}-{3:3}, at: lock_list_lru_of_memcg+0x268/0x470 mm/list_lru.c:95 > > and this task is already holding: > ffff8881107ad160 (&xa->xa_lock#9){..-.}-{3:3}, at: spin_lock include/linux/spinlock.h:341 [inline] > ffff8881107ad160 (&xa->xa_lock#9){..-.}-{3:3}, at: __folio_split+0xa2e/0x1570 mm/huge_memory.c:4025 > which would create a new lock dependency: > (&xa->xa_lock#9){..-.}-{3:3} -> (&l->lock){+.+.}-{3:3} > > but this new dependency connects a SOFTIRQ-irq-safe lock: > (&xa->xa_lock#9){..-.}-{3:3} > > ... which became SOFTIRQ-irq-safe at: > lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] > _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:162 > __folio_end_writeback+0x157/0x770 mm/page-writeback.c:2946 > > to a SOFTIRQ-irq-unsafe lock: > (&l->lock){+.+.}-{3:3} > > ... which became SOFTIRQ-irq-unsafe at: > ... > lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 > __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] > _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 > spin_lock include/linux/spinlock.h:341 [inline] > lock_list_lru mm/list_lru.c:26 [inline] > lock_list_lru_of_memcg+0x268/0x470 mm/list_lru.c:95 > list_lru_lock mm/list_lru.c:154 [inline] > list_lru_add+0x46/0x260 mm/list_lru.c:208 > list_lru_add_obj+0x191/0x270 mm/list_lru.c:221 > d_lru_add+0xd6/0x160 fs/dcache.c:497 Different locks, deferred_split_lru needs its own lockdep key.