protocol 88fb is buggy, dev hsr_slave_1 block nbd0: Receive control failed (result -107) block nbd0: shutting down sockets ============================================ IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready WARNING: possible recursive locking detected 4.14.159-syzkaller #0 Not tainted -------------------------------------------- knbd0-recv/15071 is trying to acquire lock: ("knbd%d-recv"nbd->index){+.+.}, at: [] flush_workqueue+0xda/0x1400 kernel/workqueue.c:2619 but task is already holding lock: ("knbd%d-recv"nbd->index){+.+.}, at: [] work_static include/linux/workqueue.h:199 [inline] ("knbd%d-recv"nbd->index){+.+.}, at: [] set_work_data kernel/workqueue.c:619 [inline] ("knbd%d-recv"nbd->index){+.+.}, at: [] set_work_pool_and_clear_pending kernel/workqueue.c:646 [inline] ("knbd%d-recv"nbd->index){+.+.}, at: [] process_one_work+0x76e/0x1600 kernel/workqueue.c:2085 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock("knbd%d-recv"nbd->index); lock("knbd%d-recv"nbd->index); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by knbd0-recv/15071: #0: ("knbd%d-recv"nbd->index){+.+.} kobject: 'kvm' (ffff8880a641ce50): kobject_uevent_env , at: [] work_static include/linux/workqueue.h:199 [inline] , at: [] set_work_data kernel/workqueue.c:619 [inline] , at: [] set_work_pool_and_clear_pending kernel/workqueue.c:646 [inline] , at: [] process_one_work+0x76e/0x1600 kernel/workqueue.c:2085 #1: ((&args->work)){+.+.}, at: [] process_one_work+0x7ab/0x1600 kernel/workqueue.c:2089 #2: (&nbd->config_lock){+.+.}, at: [] refcount_dec_and_mutex_lock lib/refcount.c:312 [inline] #2: (&nbd->config_lock){+.+.}, at: [] refcount_dec_and_mutex_lock+0x41/0x5f lib/refcount.c:307 stack backtrace: kobject: 'kvm' (ffff8880a641ce50): fill_kobj_path: path = '/devices/virtual/misc/kvm' CPU: 0 PID: 15071 Comm: knbd0-recv Not tainted 4.14.159-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: knbd0-recv recv_work IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 print_deadlock_bug kernel/locking/lockdep.c:1796 [inline] check_deadlock kernel/locking/lockdep.c:1843 [inline] validate_chain kernel/locking/lockdep.c:2444 [inline] __lock_acquire.cold+0x2bf/0x8dc kernel/locking/lockdep.c:3487 lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994 flush_workqueue+0x109/0x1400 kernel/workqueue.c:2622 drain_workqueue+0x177/0x3e0 kernel/workqueue.c:2787 destroy_workqueue+0x75/0x670 kernel/workqueue.c:4100 nbd_config_put+0x43c/0x7a0 drivers/block/nbd.c:1151 recv_work+0x18d/0x1f0 drivers/block/nbd.c:730 process_one_work+0x863/0x1600 kernel/workqueue.c:2114 process_scheduled_works kernel/workqueue.c:2174 [inline] rescuer_thread+0x78f/0xd90 kernel/workqueue.c:2356 kthread+0x319/0x430 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready kobject: 'loop2' (ffff8880a403cca0): kobject_uevent_env kobject: 'loop2' (ffff8880a403cca0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop4' (ffff8880a41304e0): kobject_uevent_env kobject: 'loop4' (ffff8880a41304e0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'kvm' (ffff8880a641ce50): kobject_uevent_env kobject: 'kvm' (ffff8880a641ce50): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'loop1' (ffff8880a4034c20): kobject_uevent_env kobject: 'loop1' (ffff8880a4034c20): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop0' (ffff8880a47cc320): kobject_uevent_env kobject: 'loop0' (ffff8880a47cc320): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop3' (ffff8880a40e55a0): kobject_uevent_env kobject: 'loop3' (ffff8880a40e55a0): fill_kobj_path: path = '/devices/virtual/block/loop3' IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready kobject: 'kvm' (ffff8880a641ce50): kobject_uevent_env IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready kobject: 'kvm' (ffff8880a641ce50): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'loop5' (ffff8880a4168560): kobject_uevent_env kobject: 'loop5' (ffff8880a4168560): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop4' (ffff8880a41304e0): kobject_uevent_env kobject: 'loop4' (ffff8880a41304e0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop3' (ffff8880a40e55a0): kobject_uevent_env kobject: 'loop3' (ffff8880a40e55a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'kvm' (ffff8880a641ce50): kobject_uevent_env protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 kobject: 'loop1' (ffff8880a4034c20): kobject_uevent_env kobject: 'loop1' (ffff8880a4034c20): fill_kobj_path: path = '/devices/virtual/block/loop1' IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready kobject: 'kvm' (ffff8880a641ce50): fill_kobj_path: path = '/devices/virtual/misc/kvm' IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready kobject: 'loop5' (ffff8880a4168560): kobject_uevent_env IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready kobject: 'kvm' (ffff8880a641ce50): kobject_uevent_env kobject: 'loop5' (ffff8880a4168560): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'kvm' (ffff8880a641ce50): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'loop5' (ffff8880a4168560): kobject_uevent_env kobject: 'kvm' (ffff8880a641ce50): kobject_uevent_env kobject: 'loop5' (ffff8880a4168560): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'kvm' (ffff8880a641ce50): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'kvm' (ffff8880a641ce50): kobject_uevent_env kobject: 'loop4' (ffff8880a41304e0): kobject_uevent_env kobject: 'loop4' (ffff8880a41304e0): fill_kobj_path: path = '/devices/virtual/block/loop4' IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready kobject: 'loop2' (ffff8880a403cca0): kobject_uevent_env kobject: 'loop2' (ffff8880a403cca0): fill_kobj_path: path = '/devices/virtual/block/loop2' protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 kobject: 'loop5' (ffff8880a4168560): kobject_uevent_env kobject: 'loop5' (ffff8880a4168560): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'kvm' (ffff8880a641ce50): fill_kobj_path: path = '/devices/virtual/misc/kvm' IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready kobject: 'loop4' (ffff8880a41304e0): kobject_uevent_env kobject: 'loop4' (ffff8880a41304e0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop1' (ffff8880a4034c20): kobject_uevent_env kobject: 'loop1' (ffff8880a4034c20): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop3' (ffff8880a40e55a0): kobject_uevent_env kobject: 'loop3' (ffff8880a40e55a0): fill_kobj_path: path = '/devices/virtual/block/loop3' protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 net_ratelimit: 14 callbacks suppressed protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1