======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.4.747/8650 is trying to acquire lock:
ffff8881437ad480 (&q->queue_lock){..-.}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
ffff8881437ad480 (&q->queue_lock){..-.}-{2:2}, at: throtl_pending_timer_fn+0x111/0x1dd0 block/blk-throttle.c:1209

but task is already holding lock:
ffffc90000007bc0 ((&sq->pending_timer)){+.-.}-{0:0}
, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2
 ((&sq->pending_timer)
){+.-.}-{0:0}
:
       __timer_delete_sync+0xe1/0x2e0 kernel/time/timer.c:1556
       del_timer_sync include/linux/timer.h:200 [inline]
       throtl_pd_free+0x15/0x30 block/blk-throttle.c:504
       blkcg_deactivate_policy+0x35f/0x5d0 block/blk-cgroup.c:1542
       blk_throtl_exit+0xa6/0x140 block/blk-throttle.c:2424
       blkcg_init_disk+0x38d/0x400 block/blk-cgroup.c:1319
       __alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
       __blk_alloc_disk+0x2c/0x80 block/genhd.c:1471
       alloc_dev drivers/md/dm.c:2057 [inline]
       dm_create+0x46b/0xf90 drivers/md/dm.c:2261
       dev_create+0x12e/0x2c0 drivers/md/dm-ioctl.c:887
       ctl_ioctl drivers/md/dm-ioctl.c:2070 [inline]
       dm_ctl_ioctl+0xa9c/0xec0 drivers/md/dm-ioctl.c:2092
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:870 [inline]
       __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
       do_syscall_x64 arch/x86/entry/common.c:46 [inline]
       do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
       entry_SYSCALL_64_after_hwframe+0x68/0xd2

-> #1 (&blkcg->lock){....}-{2:2}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       blkg_create+0xbe9/0x1390 block/blk-cgroup.c:322
       blkcg_init_disk+0x272/0x400 block/blk-cgroup.c:1293
       __alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
       __blk_alloc_disk+0x2c/0x80 block/genhd.c:1471
       brd_alloc+0x377/0x760 drivers/block/brd.c:424
       brd_init+0x125/0x1a5 drivers/block/brd.c:529
       do_one_initcall+0x257/0x800 init/main.c:1271
       do_initcall_level+0x13d/0x1ed init/main.c:1344
       do_initcalls+0x4b/0x8a init/main.c:1360
       kernel_init_freeable+0x401/0x5ab init/main.c:1599
       kernel_init+0x19/0x1b0 init/main.c:1487
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #0 (&q->queue_lock){..-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3162 [inline]
       check_prevs_add kernel/locking/lockdep.c:3281 [inline]
       validate_chain kernel/locking/lockdep.c:3897 [inline]
       __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171
       lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
       __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
       _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
       spin_lock_irq include/linux/spinlock.h:376 [inline]
       throtl_pending_timer_fn+0x111/0x1dd0 block/blk-throttle.c:1209
       call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
       expire_timers kernel/time/timer.c:1752 [inline]
       __run_timers+0x56c/0x810 kernel/time/timer.c:2023
       run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
       handle_softirqs+0x291/0x910 kernel/softirq.c:596
       __do_softirq kernel/softirq.c:630 [inline]
       invoke_softirq kernel/softirq.c:470 [inline]
       __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
       irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
       sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
       asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
       lock_acquire+0x226/0x4a0 kernel/locking/lockdep.c:5794
       fs_reclaim_acquire+0x94/0x100 mm/page_alloc.c:4766
       might_alloc include/linux/sched/mm.h:271 [inline]
       prepare_alloc_pages+0x156/0x5b0 mm/page_alloc.c:5428
       __alloc_pages+0x130/0x4f0 mm/page_alloc.c:5647
       __folio_alloc+0xe/0x30 mm/page_alloc.c:5690
       vma_alloc_folio+0x499/0x900 mm/mempolicy.c:2245
       shmem_alloc_folio mm/shmem.c:1598 [inline]
       shmem_alloc_and_acct_folio+0x463/0xbd0 mm/shmem.c:1622
       shmem_get_folio_gfp+0x1439/0x35e0 mm/shmem.c:1950
       shmem_get_folio mm/shmem.c:2081 [inline]
       shmem_write_begin+0xee/0x3f0 mm/shmem.c:2565
       generic_perform_write+0x2fa/0x5c0 mm/filemap.c:3862
       __generic_file_write_iter+0x148/0x2a0 mm/filemap.c:3960
       generic_file_write_iter+0xab/0x2e0 mm/filemap.c:3989
       call_write_iter include/linux/fs.h:2271 [inline]
       new_sync_write fs/read_write.c:491 [inline]
       vfs_write+0x482/0x9a0 fs/read_write.c:584
       ksys_write+0x14d/0x260 fs/read_write.c:637
       do_syscall_x64 arch/x86/entry/common.c:46 [inline]
       do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
       entry_SYSCALL_64_after_hwframe+0x68/0xd2

other info that might help us debug this:

Chain exists of:
  &q->queue_lock --> &blkcg->lock --> (&sq->pending_timer)

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock((&sq->pending_timer));
                               lock(&blkcg->lock);
                               lock((&sq->pending_timer));
  lock(&q->queue_lock);

 *** DEADLOCK ***

5 locks held by syz.4.747/8650:
 #0: ffff88813ff56460 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580
 #1: ffff888059441bd0 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:764 [inline]
 #1: ffff888059441bd0 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:3986
 #2: ffffffff8dc07380 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:271 [inline]
 #2: ffffffff8dc07380 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x156/0x5b0 mm/page_alloc.c:5428
 #3: ffffffff8dc18f00 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: fs_reclaim_acquire+0x78/0x100 mm/page_alloc.c:4766
 #4: ffffc90000007bc0 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698

stack backtrace:
CPU: 0 PID: 8650 Comm: syz.4.747 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2215
 check_prev_add kernel/locking/lockdep.c:3162 [inline]
 check_prevs_add kernel/locking/lockdep.c:3281 [inline]
 validate_chain kernel/locking/lockdep.c:3897 [inline]
 __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171
 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
 spin_lock_irq include/linux/spinlock.h:376 [inline]
 throtl_pending_timer_fn+0x111/0x1dd0 block/blk-throttle.c:1209
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:lock_acquire+0x226/0x4a0 kernel/locking/lockdep.c:5794
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 ef 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc90005f8f360 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 5548979430084f00
RDX: 0000000000000000 RSI: ffffffff8aac2e40 RDI: ffffffff8afe72a0
RBP: ffffc90005f8f480 R08: dffffc0000000000 R09: 1ffffffff236c44a
R10: dffffc0000000000 R11: fffffbfff236c44b R12: 1ffff92000bf1e78
R13: 0000000000000000 R14: 0000000000000246 R15: dffffc0000000000
 fs_reclaim_acquire+0x94/0x100 mm/page_alloc.c:4766
 might_alloc include/linux/sched/mm.h:271 [inline]
 prepare_alloc_pages+0x156/0x5b0 mm/page_alloc.c:5428
 __alloc_pages+0x130/0x4f0 mm/page_alloc.c:5647
 __folio_alloc+0xe/0x30 mm/page_alloc.c:5690
 vma_alloc_folio+0x499/0x900 mm/mempolicy.c:2245
 shmem_alloc_folio mm/shmem.c:1598 [inline]
 shmem_alloc_and_acct_folio+0x463/0xbd0 mm/shmem.c:1622
 shmem_get_folio_gfp+0x1439/0x35e0 mm/shmem.c:1950
 shmem_get_folio mm/shmem.c:2081 [inline]
 shmem_write_begin+0xee/0x3f0 mm/shmem.c:2565
 generic_perform_write+0x2fa/0x5c0 mm/filemap.c:3862
 __generic_file_write_iter+0x148/0x2a0 mm/filemap.c:3960
 generic_file_write_iter+0xab/0x2e0 mm/filemap.c:3989
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe9aeb6034e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fe9afa09da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe9afa0a6c0 RCX: 00007fe9aeb6034e
RDX: 0000000001000000 RSI: 00007fe9a49f7000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 00007fe9afa09ee0 R14: 00007fe9afa09ea0 R15: 00007fe9a49f7000
 </TASK>
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
proto(17) != IPPROTO_TCP or too short (len = 40)
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
wireguard: wg0: Sending keepalive packet to peer 80 ([::1]:20003/0%0)
wireguard: wg0: Sending keepalive packet to peer 86 ([::1]:20003/0%0)
wireguard: wg0: Sending keepalive packet to peer 68 ([::1]:20003/0%0)
wireguard: wg2: Receiving keepalive packet from peer 83 ([::1]:20001/0%0)
wireguard: wg2: Receiving keepalive packet from peer 89 ([::1]:20001/0%0)
virtqueue callback for ffff888027b1a800 (ffffffff85854420)
No more buffers in queue
Receiving skb proto 0x0806 len 28 type 1
No more buffers in queue
No more buffers in queue
eth0: xmit ffff88805e6bdc80 42:01:0a:80:00:01
Added buffer head 7 to ffff888027b1aa00
virtqueue callback for ffff888027b1aa00 (ffffffff85854510)
Sent skb ffff88805e6bdc80
No more buffers in queue
proto(17) != IPPROTO_TCP or too short (len = 40)
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
virtqueue interrupt with no work for ffff888027b1a800
virtqueue interrupt with no work for ffff888027b1a800
virtqueue interrupt with no work for ffff888027b1a800
virtqueue interrupt with no work for ffff888027b1a800
virtqueue interrupt with no work for ffff888027b1a800
virtqueue interrupt with no work for ffff888027b1a800
virtqueue interrupt with no work for ffff888027b1a800
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
virtqueue callback for ffff88814164f400 (ffffffff8486e350)
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
proto(17) != IPPROTO_TCP or too short (len = 40)
virtqueue callback for ffff888019e68800 (ffffffff84709a30)
virtqueue interrupt with no work for ffff888019e68600
virtqueue interrupt with no work for ffff888019e68400
wireguard: wg1: Receiving keepalive packet from peer 9 ([::1]:20001/0%0)
wireguard: wg1: Receiving keepalive packet from peer 81 (127.0.0.1:20001)
----------------
Code disassembly (best guess):
   0:	f7 84 24 80 00 00 00 	testl  $0x200,0x80(%rsp)
   7:	00 02 00 00
   b:	43 c6 44 3c 04 f8    	movb   $0xf8,0x4(%r12,%r15,1)
  11:	0f 85 ef 00 00 00    	jne    0x106
  17:	41 f7 c6 00 02 00 00 	test   $0x200,%r14d
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	48 c7 44 24 60 0e 36 	movq   $0x45e0360e,0x60(%rsp)
  28:	e0 45
* 2a:	4b c7 04 3c 00 00 00 	movq   $0x0,(%r12,%r15,1) <-- trapping instruction
  31:	00
  32:	43 c7 44 3c 08 00 00 	movl   $0x0,0x8(%r12,%r15,1)
  39:	00 00
  3b:	65                   	gs
  3c:	48                   	rex.W
  3d:	8b                   	.byte 0x8b
  3e:	04 25                	add    $0x25,%al