ldm_validate_partition_table(): Disk read failed.
Dev nbd2: unable to read RDB block 0
 nbd2: unable to read partition table
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G             L     
------------------------------------------------------
udevd/15751 is trying to acquire lock:
ffffffff8e2f5100 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline]
ffffffff8e2f5100 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4636 [inline]
ffffffff8e2f5100 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:4974 [inline]
ffffffff8e2f5100 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x68/0x660 mm/slub.c:5068

but task is already holding lock:
ffffffff8f97cc78 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
ffffffff8f97cc78 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x281/0x560 lib/kobject_uevent.c:410

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #9 (uevent_sock_mutex){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
       kobject_uevent_net_broadcast+0x281/0x560 lib/kobject_uevent.c:410
       kobject_uevent_env+0x569/0x9e0 lib/kobject_uevent.c:611
       device_add+0x544/0xb80 drivers/base/core.c:3742
       device_create_groups_vargs drivers/base/core.c:4458 [inline]
       device_create+0x269/0x300 drivers/base/core.c:4497
       msr_device_create+0x33/0x50 arch/x86/kernel/msr.c:254
       cpuhp_invoke_callback+0x434/0x810 kernel/cpu.c:194
       cpuhp_thread_fun+0x362/0x780 kernel/cpu.c:1109
       smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #8 (cpuhp_state-up){+.+.}-{0:0}:
       cpuhp_lock_acquire kernel/cpu.c:103 [inline]
       cpuhp_thread_fun+0x127/0x780 kernel/cpu.c:1086
       smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #7 (cpu_hotplug_lock){++++}-{0:0}:
       percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline]
       percpu_down_read include/linux/percpu-rwsem.h:77 [inline]
       cpus_read_lock+0x42/0x160 kernel/cpu.c:490
       static_key_slow_inc+0x12/0x30 kernel/jump_label.c:190
       udp_tunnel_encap_enable include/net/udp_tunnel.h:234 [inline]
       setup_udp_tunnel_sock+0x2eb/0x4f0 net/ipv4/udp_tunnel_core.c:90
       l2tp_tunnel_register+0xdff/0x14c0 net/l2tp/l2tp_core.c:1687
       pppol2tp_tunnel_get net/l2tp/l2tp_ppp.c:663 [inline]
       pppol2tp_connect+0x8e3/0x18b0 net/l2tp/l2tp_ppp.c:711
       connect_socket net/socket.c:2141 [inline]
       __sys_connect_file net/socket.c:2166 [inline]
       __sys_connect+0x32d/0x470 net/socket.c:2183
       __do_sys_connect net/socket.c:2189 [inline]
       __se_sys_connect net/socket.c:2186 [inline]
       __x64_sys_connect+0x7a/0x90 net/socket.c:2186
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #6 (sk_lock-AF_INET){+.+.}-{0:0}:
       lock_sock_nested+0x41/0x130 net/core/sock.c:3830
       lock_sock include/net/sock.h:1713 [inline]
       inet_shutdown+0x6a/0x390 net/ipv4/af_inet.c:913
       nbd_mark_nsock_dead+0x2cb/0x550 drivers/block/nbd.c:319
       recv_work+0x1d0c/0x1e40 drivers/block/nbd.c:1030
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #5 (&nsock->tx_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       nbd_handle_cmd drivers/block/nbd.c:1143 [inline]
       nbd_queue_rq+0x373/0x1000 drivers/block/nbd.c:1207
       blk_mq_dispatch_rq_list+0x4af/0x1a00 block/blk-mq.c:2117
       __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
       blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
       __blk_mq_sched_dispatch_requests+0xd45/0x1590 block/blk-mq-sched.c:307
       blk_mq_sched_dispatch_requests+0xda/0x1a0 block/blk-mq-sched.c:329
       blk_mq_run_work_fn+0x16f/0x300 block/blk-mq.c:2532
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #4 (&cmd->lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       nbd_queue_rq+0xc1/0x1000 drivers/block/nbd.c:1199
       blk_mq_dispatch_rq_list+0x4af/0x1a00 block/blk-mq.c:2117
       __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
       blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
       __blk_mq_sched_dispatch_requests+0xd45/0x1590 block/blk-mq-sched.c:307
       blk_mq_sched_dispatch_requests+0xda/0x1a0 block/blk-mq-sched.c:329
       blk_mq_run_work_fn+0x16f/0x300 block/blk-mq.c:2532
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #3 (set->srcu){.+.+}-{0:0}:
       srcu_lock_sync include/linux/srcu.h:210 [inline]
       __synchronize_srcu+0xc9/0x2f0 kernel/rcu/srcutree.c:1462
       elevator_switch+0x1e8/0x7b0 block/elevator.c:576
       elevator_change+0x2fa/0x480 block/elevator.c:681
       elevator_set_default+0x375/0x440 block/elevator.c:754
       blk_register_queue+0x3f3/0x4e0 block/blk-sysfs.c:992
       __add_disk+0x6b8/0xdb0 block/genhd.c:531
       add_disk_fwnode+0x100/0x3a0 block/genhd.c:600
       add_disk include/linux/blkdev.h:798 [inline]
       nbd_dev_add+0x733/0xb60 drivers/block/nbd.c:2026
       nbd_init+0x168/0x1f0 drivers/block/nbd.c:2743
       do_one_initcall+0x250/0x870 init/main.c:1362
       do_initcall_level+0x10a/0x1a0 init/main.c:1424
       do_initcalls+0x59/0xa0 init/main.c:1440
       kernel_init_freeable+0x29d/0x3e0 init/main.c:1675
       kernel_init+0x22/0x1d0 init/main.c:1565
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #2 (&q->elevator_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       elevator_change+0x1af/0x480 block/elevator.c:679
       elv_iosched_store+0x504/0x630 block/elevator.c:826
       queue_attr_store+0x207/0x2b0 block/blk-sysfs.c:906
       kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
       new_sync_write fs/read_write.c:595 [inline]
       vfs_write+0x61e/0xbb0 fs/read_write.c:687
       ksys_write+0x156/0x270 fs/read_write.c:739
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&q->q_usage_counter(io)#66){++++}-{0:0}:
       blk_alloc_queue+0x54c/0x690 block/blk-core.c:504
       blk_mq_alloc_queue block/blk-mq.c:4420 [inline]
       __blk_mq_alloc_disk+0x194/0x390 block/blk-mq.c:4467
       null_add_dev+0xe8a/0x1d70 drivers/block/null_blk/main.c:2017
       null_create_dev drivers/block/null_blk/main.c:2114 [inline]
       null_init+0x1e3/0x390 drivers/block/null_blk/main.c:2178
       do_one_initcall+0x250/0x870 init/main.c:1362
       do_initcall_level+0x10a/0x1a0 init/main.c:1424
       do_initcalls+0x59/0xa0 init/main.c:1440
       kernel_init_freeable+0x29d/0x3e0 init/main.c:1675
       kernel_init+0x22/0x1d0 init/main.c:1565
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (fs_reclaim){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3209 [inline]
       check_prevs_add kernel/locking/lockdep.c:3328 [inline]
       validate_chain kernel/locking/lockdep.c:3952 [inline]
       __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
       __fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
       fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4389
       might_alloc include/linux/sched/mm.h:316 [inline]
       slab_pre_alloc_hook mm/slub.c:4636 [inline]
       slab_alloc_node mm/slub.c:4974 [inline]
       kmem_cache_alloc_node_noprof+0x68/0x660 mm/slub.c:5068
       kmalloc_reserve net/core/skbuff.c:615 [inline]
       __alloc_skb+0x27a/0x7a0 net/core/skbuff.c:715
       alloc_skb include/linux/skbuff.h:1384 [inline]
       alloc_uevent_skb+0x7d/0x230 lib/kobject_uevent.c:289
       uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline]
       kobject_uevent_net_broadcast+0x2fd/0x560 lib/kobject_uevent.c:410
       kobject_uevent_env+0x569/0x9e0 lib/kobject_uevent.c:611
       nbd_config_put+0x2d4/0x7f0 drivers/block/nbd.c:1481
       nbd_release+0x101/0x140 drivers/block/nbd.c:1797
       bdev_release+0x57c/0x690 block/bdev.c:-1
       blkdev_release+0x15/0x20 block/fops.c:682
       __fput+0x42a/0xa80 fs/file_table.c:512
       fput_close_sync+0x11f/0x240 fs/file_table.c:617
       __do_sys_close fs/open.c:1560 [inline]
       __se_sys_close fs/open.c:1545 [inline]
       __x64_sys_close+0x7e/0x110 fs/open.c:1545
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  fs_reclaim --> cpuhp_state-up --> uevent_sock_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(uevent_sock_mutex);
                               lock(cpuhp_state-up);
                               lock(uevent_sock_mutex);
  lock(fs_reclaim);

 *** DEADLOCK ***

locks held by udevd/15751: 3, last CPU#0:
 #0: ffff88802774d4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1be/0x690 block/bdev.c:1173
 #1: ffff888027738248 (&nbd->config_lock){+.+.}-{4:4}, at: refcount_dec_and_mutex_lock+0x30/0xa0 lib/refcount.c:118
 #2: ffffffff8f97cc78 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
 #2: ffffffff8f97cc78 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x281/0x560 lib/kobject_uevent.c:410

stack backtrace:
CPU: 0 UID: 0 PID: 15751 Comm: udevd Tainted: G             L      syzkaller #0 PREEMPT_{RT,(lazy)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
 check_prev_add kernel/locking/lockdep.c:3209 [inline]
 check_prevs_add kernel/locking/lockdep.c:3328 [inline]
 validate_chain kernel/locking/lockdep.c:3952 [inline]
 __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
 fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4389
 might_alloc include/linux/sched/mm.h:316 [inline]
 slab_pre_alloc_hook mm/slub.c:4636 [inline]
 slab_alloc_node mm/slub.c:4974 [inline]
 kmem_cache_alloc_node_noprof+0x68/0x660 mm/slub.c:5068
 kmalloc_reserve net/core/skbuff.c:615 [inline]
 __alloc_skb+0x27a/0x7a0 net/core/skbuff.c:715
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_uevent_skb+0x7d/0x230 lib/kobject_uevent.c:289
 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline]
 kobject_uevent_net_broadcast+0x2fd/0x560 lib/kobject_uevent.c:410
 kobject_uevent_env+0x569/0x9e0 lib/kobject_uevent.c:611
 nbd_config_put+0x2d4/0x7f0 drivers/block/nbd.c:1481
 nbd_release+0x101/0x140 drivers/block/nbd.c:1797
 bdev_release+0x57c/0x690 block/bdev.c:-1
 blkdev_release+0x15/0x20 block/fops.c:682
 __fput+0x42a/0xa80 fs/file_table.c:512
 fput_close_sync+0x11f/0x240 fs/file_table.c:617
 __do_sys_close fs/open.c:1560 [inline]
 __se_sys_close fs/open.c:1545 [inline]
 __x64_sys_close+0x7e/0x110 fs/open.c:1545
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f81657e1407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fffbbb096c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007f81656f3880 RCX: 00007f81657e1407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 00007f81656f36e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
R13: 000055f47b97d190 R14: 0000000000000008 R15: 000055f47b9929d0
 </TASK>