======================================================
WARNING: possible circular locking dependency detected
6.12.0-next-20241118-syzkaller #0 Not tainted
------------------------------------------------------
syz.5.1853/15515 is trying to acquire lock:
ffff8880250d2610 (set->srcu){.+.+}-{0:0}, at: srcu_lock_sync include/linux/srcu.h:170 [inline]
ffff8880250d2610 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x9d/0x400 kernel/rcu/srcutree.c:1418
but task is already holding lock:
ffff888025a5fb38 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_mq_elv_switch_none block/blk-mq.c:4847 [inline]
ffff888025a5fb38 (&q->sysfs_lock){+.+.}-{4:4}, at: __blk_mq_update_nr_hw_queues block/blk-mq.c:4925 [inline]
ffff888025a5fb38 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0x3fa/0x1ae0 block/blk-mq.c:4985
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #6 (&q->sysfs_lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
blk_mq_elv_switch_none block/blk-mq.c:4847 [inline]
__blk_mq_update_nr_hw_queues block/blk-mq.c:4925 [inline]
blk_mq_update_nr_hw_queues+0x3fa/0x1ae0 block/blk-mq.c:4985
nbd_start_device+0x16c/0xaa0 drivers/block/nbd.c:1413
nbd_start_device_ioctl drivers/block/nbd.c:1464 [inline]
__nbd_ioctl drivers/block/nbd.c:1539 [inline]
nbd_ioctl+0x5dc/0xf40 drivers/block/nbd.c:1579
blkdev_ioctl+0x57d/0x6a0 block/ioctl.c:693
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #5 (&q->q_usage_counter(io)#54){++++}-{0:0}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
bio_queue_enter block/blk.h:75 [inline]
blk_mq_submit_bio+0x1536/0x23a0 block/blk-mq.c:3092
__submit_bio+0x2c6/0x560 block/blk-core.c:629
__submit_bio_noacct_mq block/blk-core.c:710 [inline]
submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:739
submit_bh fs/buffer.c:2819 [inline]
block_read_full_folio+0x93b/0xcd0 fs/buffer.c:2446
filemap_read_folio+0x14b/0x630 mm/filemap.c:2366
filemap_update_page mm/filemap.c:2450 [inline]
filemap_get_pages+0x17af/0x2540 mm/filemap.c:2571
filemap_read+0x45c/0xf50 mm/filemap.c:2646
blkdev_read_iter+0x2d8/0x430 block/fops.c:767
new_sync_read fs/read_write.c:484 [inline]
vfs_read+0x991/0xb70 fs/read_write.c:565
ksys_read+0x18f/0x2b0 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #4 (mapping.invalidate_lock#2){.+.+}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524
filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
page_cache_ra_unbounded+0x143/0x8c0 mm/readahead.c:226
do_sync_mmap_readahead+0x499/0x970
filemap_fault+0x8c5/0x1950 mm/filemap.c:3344
__do_fault+0x135/0x460 mm/memory.c:4907
do_shared_fault mm/memory.c:5386 [inline]
do_fault mm/memory.c:5460 [inline]
do_pte_missing mm/memory.c:3979 [inline]
handle_pte_fault+0x1139/0x66b0 mm/memory.c:5801
__handle_mm_fault mm/memory.c:5944 [inline]
handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x2b9/0x8c0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
__put_user_4+0x11/0x20 arch/x86/lib/putuser.S:86
dccp_getsockopt_service net/dccp/proto.c:607 [inline]
do_dccp_getsockopt net/dccp/proto.c:634 [inline]
dccp_getsockopt+0x16d0/0x1910 net/dccp/proto.c:690
do_sock_getsockopt+0x3c4/0x7e0 net/socket.c:2374
__sys_getsockopt net/socket.c:2403 [inline]
__do_sys_getsockopt net/socket.c:2410 [inline]
__se_sys_getsockopt net/socket.c:2407 [inline]
__x64_sys_getsockopt+0x2a1/0x370 net/socket.c:2407
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (sk_lock-AF_INET){+.+.}-{0:0}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
lock_sock_nested+0x48/0x100 net/core/sock.c:3622
lock_sock include/net/sock.h:1617 [inline]
inet_autobind net/ipv4/af_inet.c:178 [inline]
inet_send_prepare net/ipv4/af_inet.c:837 [inline]
inet_sendmsg+0x120/0x390 net/ipv4/af_inet.c:848
sock_sendmsg_nosec net/socket.c:711 [inline]
__sock_sendmsg+0x1a6/0x270 net/socket.c:726
sock_sendmsg+0x134/0x200 net/socket.c:749
__sock_xmit+0x219/0x4e0 drivers/block/nbd.c:577
sock_xmit drivers/block/nbd.c:605 [inline]
nbd_send_cmd drivers/block/nbd.c:691 [inline]
nbd_handle_cmd drivers/block/nbd.c:1113 [inline]
nbd_queue_rq+0x163c/0x2f30 drivers/block/nbd.c:1143
blk_mq_dispatch_rq_list+0xad3/0x19d0 block/blk-mq.c:2120
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
__blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309
blk_mq_sched_dispatch_requests+0xd6/0x190 block/blk-mq-sched.c:331
blk_mq_run_hw_queue+0x354/0x500 block/blk-mq.c:2354
blk_mq_flush_plug_list+0x118e/0x1870 block/blk-mq.c:2915
__blk_flush_plug+0x420/0x500 block/blk-core.c:1213
blk_finish_plug block/blk-core.c:1240 [inline]
__submit_bio+0x46a/0x560 block/blk-core.c:637
__submit_bio_noacct_mq block/blk-core.c:710 [inline]
submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:739
submit_bh fs/buffer.c:2819 [inline]
block_read_full_folio+0x93b/0xcd0 fs/buffer.c:2446
filemap_read_folio+0x14b/0x630 mm/filemap.c:2366
do_read_cache_folio+0x3f5/0x850 mm/filemap.c:3826
read_mapping_folio include/linux/pagemap.h:1011 [inline]
read_part_sector+0xb3/0x330 block/partitions/core.c:722
adfspart_check_ICS+0xd9/0x9a0 block/partitions/acorn.c:360
check_partition block/partitions/core.c:141 [inline]
blk_add_partitions block/partitions/core.c:589 [inline]
bdev_disk_changed+0x72c/0x13f0 block/partitions/core.c:693
blkdev_get_whole+0x2d2/0x450 block/bdev.c:707
bdev_open+0x2d4/0xc50 block/bdev.c:916
blkdev_open+0x389/0x4f0 block/fops.c:627
do_dentry_open+0xbe1/0x1b70 fs/open.c:945
vfs_open+0x3e/0x330 fs/open.c:1075
do_open fs/namei.c:3828 [inline]
path_openat+0x2c84/0x3590 fs/namei.c:3987
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&nsock->tx_lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
nbd_handle_cmd drivers/block/nbd.c:1079 [inline]
nbd_queue_rq+0x29c/0x2f30 drivers/block/nbd.c:1143
blk_mq_dispatch_rq_list+0xad3/0x19d0 block/blk-mq.c:2120
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
__blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309
blk_mq_sched_dispatch_requests+0xd6/0x190 block/blk-mq-sched.c:331
blk_mq_run_hw_queue+0x354/0x500 block/blk-mq.c:2354
blk_mq_flush_plug_list+0x118e/0x1870 block/blk-mq.c:2915
__blk_flush_plug+0x420/0x500 block/blk-core.c:1213
blk_finish_plug block/blk-core.c:1240 [inline]
__submit_bio+0x46a/0x560 block/blk-core.c:637
__submit_bio_noacct_mq block/blk-core.c:710 [inline]
submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:739
submit_bh fs/buffer.c:2819 [inline]
block_read_full_folio+0x93b/0xcd0 fs/buffer.c:2446
filemap_read_folio+0x14b/0x630 mm/filemap.c:2366
do_read_cache_folio+0x3f5/0x850 mm/filemap.c:3826
read_mapping_folio include/linux/pagemap.h:1011 [inline]
read_part_sector+0xb3/0x330 block/partitions/core.c:722
adfspart_check_ICS+0xd9/0x9a0 block/partitions/acorn.c:360
check_partition block/partitions/core.c:141 [inline]
blk_add_partitions block/partitions/core.c:589 [inline]
bdev_disk_changed+0x72c/0x13f0 block/partitions/core.c:693
blkdev_get_whole+0x2d2/0x450 block/bdev.c:707
bdev_open+0x2d4/0xc50 block/bdev.c:916
blkdev_open+0x389/0x4f0 block/fops.c:627
do_dentry_open+0xbe1/0x1b70 fs/open.c:945
vfs_open+0x3e/0x330 fs/open.c:1075
do_open fs/namei.c:3828 [inline]
path_openat+0x2c84/0x3590 fs/namei.c:3987
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&cmd->lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
nbd_queue_rq+0xfe/0x2f30 drivers/block/nbd.c:1135
blk_mq_dispatch_rq_list+0xad3/0x19d0 block/blk-mq.c:2120
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
__blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309
blk_mq_sched_dispatch_requests+0xd6/0x190 block/blk-mq-sched.c:331
blk_mq_run_hw_queue+0x354/0x500 block/blk-mq.c:2354
blk_mq_flush_plug_list+0x118e/0x1870 block/blk-mq.c:2915
__blk_flush_plug+0x420/0x500 block/blk-core.c:1213
blk_finish_plug block/blk-core.c:1240 [inline]
__submit_bio+0x46a/0x560 block/blk-core.c:637
__submit_bio_noacct_mq block/blk-core.c:710 [inline]
submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:739
submit_bh fs/buffer.c:2819 [inline]
block_read_full_folio+0x93b/0xcd0 fs/buffer.c:2446
filemap_read_folio+0x14b/0x630 mm/filemap.c:2366
do_read_cache_folio+0x3f5/0x850 mm/filemap.c:3826
read_mapping_folio include/linux/pagemap.h:1011 [inline]
read_part_sector+0xb3/0x330 block/partitions/core.c:722
adfspart_check_ICS+0xd9/0x9a0 block/partitions/acorn.c:360
check_partition block/partitions/core.c:141 [inline]
blk_add_partitions block/partitions/core.c:589 [inline]
bdev_disk_changed+0x72c/0x13f0 block/partitions/core.c:693
blkdev_get_whole+0x2d2/0x450 block/bdev.c:707
bdev_open+0x2d4/0xc50 block/bdev.c:916
blkdev_open+0x389/0x4f0 block/fops.c:627
do_dentry_open+0xbe1/0x1b70 fs/open.c:945
vfs_open+0x3e/0x330 fs/open.c:1075
do_open fs/namei.c:3828 [inline]
path_openat+0x2c84/0x3590 fs/namei.c:3987
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (set->srcu){.+.+}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_sync+0x18b/0x310 kernel/locking/lockdep.c:5897
srcu_lock_sync include/linux/srcu.h:170 [inline]
__synchronize_srcu+0xb1/0x400 kernel/rcu/srcutree.c:1418
elevator_disable+0x8c/0x3f0 block/elevator.c:671
blk_mq_elv_switch_none block/blk-mq.c:4861 [inline]
__blk_mq_update_nr_hw_queues block/blk-mq.c:4925 [inline]
blk_mq_update_nr_hw_queues+0x646/0x1ae0 block/blk-mq.c:4985
nbd_start_device+0x16c/0xaa0 drivers/block/nbd.c:1413
nbd_start_device_ioctl drivers/block/nbd.c:1464 [inline]
__nbd_ioctl drivers/block/nbd.c:1539 [inline]
nbd_ioctl+0x5dc/0xf40 drivers/block/nbd.c:1579
blkdev_ioctl+0x57d/0x6a0 block/ioctl.c:693
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
set->srcu --> &q->q_usage_counter(io)#54 --> &q->sysfs_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&q->sysfs_lock);
lock(&q->q_usage_counter(io)#54);
lock(&q->sysfs_lock);
sync(set->srcu);
*** DEADLOCK ***
5 locks held by syz.5.1853/15515:
#0: ffff888026043998 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_ioctl+0x13c/0xf40 drivers/block/nbd.c:1572
#1: ffff8880260438d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xc2/0x1ae0 block/blk-mq.c:4984
#2: ffff888025a5f608 (&q->q_usage_counter(io)#54){++++}-{0:0}, at: nbd_start_device+0x16c/0xaa0 drivers/block/nbd.c:1413
#3: ffff888025a5f640 (&q->q_usage_counter(queue)#38){+.+.}-{0:0}, at: nbd_start_device+0x16c/0xaa0 drivers/block/nbd.c:1413
#4: ffff888025a5fb38 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_mq_elv_switch_none block/blk-mq.c:4847 [inline]
#4: ffff888025a5fb38 (&q->sysfs_lock){+.+.}-{4:4}, at: __blk_mq_update_nr_hw_queues block/blk-mq.c:4925 [inline]
#4: ffff888025a5fb38 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0x3fa/0x1ae0 block/blk-mq.c:4985
stack backtrace:
CPU: 0 UID: 0 PID: 15515 Comm: syz.5.1853 Not tainted 6.12.0-next-20241118-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_sync+0x18b/0x310 kernel/locking/lockdep.c:5897
srcu_lock_sync include/linux/srcu.h:170 [inline]
__synchronize_srcu+0xb1/0x400 kernel/rcu/srcutree.c:1418
elevator_disable+0x8c/0x3f0 block/elevator.c:671
blk_mq_elv_switch_none block/blk-mq.c:4861 [inline]
__blk_mq_update_nr_hw_queues block/blk-mq.c:4925 [inline]
blk_mq_update_nr_hw_queues+0x646/0x1ae0 block/blk-mq.c:4985
nbd_start_device+0x16c/0xaa0 drivers/block/nbd.c:1413
nbd_start_device_ioctl drivers/block/nbd.c:1464 [inline]
__nbd_ioctl drivers/block/nbd.c:1539 [inline]
nbd_ioctl+0x5dc/0xf40 drivers/block/nbd.c:1579
blkdev_ioctl+0x57d/0x6a0 block/ioctl.c:693
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f835e17e759
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f835c5f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f835e335f80 RCX: 00007f835e17e759
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003
RBP: 00007f835e1f175e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f835e335f80 R15: 00007ffe5d2d0dd8
</TASK>
block nbd5: shutting down sockets