======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.2.2009/11304 is trying to acquire lock:
ffff888024a3a790 (&q->queue_lock){..-.}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
ffff888024a3a790 (&q->queue_lock){..-.}-{2:2}, at: throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
but task is already holding lock:
ffffc900001e0bc0 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 ((&sq->pending_timer)){+.-.}-{0:0}:
__timer_delete_sync+0xe1/0x2e0 kernel/time/timer.c:1556
del_timer_sync include/linux/timer.h:200 [inline]
throtl_pd_free+0x15/0x40 block/blk-throttle.c:493
blkcg_deactivate_policy+0x35c/0x5c0 block/blk-cgroup.c:1533
blk_throtl_exit+0xa6/0x140 block/blk-throttle.c:2415
blkcg_init_disk+0x37b/0x3f0 block/blk-cgroup.c:1310
__alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
__blk_alloc_disk+0x2c/0x80 block/genhd.c:1471
alloc_dev drivers/md/dm.c:2055 [inline]
dm_create+0x46b/0xf90 drivers/md/dm.c:2259
dev_create+0x12e/0x2c0 drivers/md/dm-ioctl.c:875
ctl_ioctl drivers/md/dm-ioctl.c:2055 [inline]
dm_ctl_ioctl+0xa9c/0xec0 drivers/md/dm-ioctl.c:2077
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
-> #1 (&blkcg->lock){....}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
blkg_create+0xbe9/0x13c0 block/blk-cgroup.c:322
blkcg_init_disk+0x28c/0x3f0 block/blk-cgroup.c:1286
__alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
__blk_alloc_disk+0x2c/0x80 block/genhd.c:1471
brd_alloc+0x377/0x760 drivers/block/brd.c:424
brd_init+0x125/0x1a5 drivers/block/brd.c:529
do_one_initcall+0x257/0x800 init/main.c:1270
do_initcall_level+0x13d/0x1ed init/main.c:1343
do_initcalls+0x4b/0x8a init/main.c:1359
kernel_init_freeable+0x401/0x5ab init/main.c:1598
kernel_init+0x19/0x1b0 init/main.c:1486
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #0 (&q->queue_lock){..-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3095 [inline]
check_prevs_add kernel/locking/lockdep.c:3214 [inline]
validate_chain kernel/locking/lockdep.c:3830 [inline]
__lock_acquire+0x2d18/0x7c40 kernel/locking/lockdep.c:5063
lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
native_irq_enable arch/x86/include/asm/irqflags.h:45 [inline]
arch_local_irq_enable arch/x86/include/asm/irqflags.h:80 [inline]
raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline]
finish_lock_switch kernel/sched/core.c:5005 [inline]
finish_task_switch+0x267/0x8e0 kernel/sched/core.c:5123
context_switch kernel/sched/core.c:5249 [inline]
__schedule+0x1087/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
unix_wait_for_peer+0x1f2/0x2e0 net/unix/af_unix.c:1449
unix_dgram_sendmsg+0xeba/0x16f0 net/unix/af_unix.c:2051
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5ed/0x9a0 net/socket.c:2519
___sys_sendmsg+0x2a2/0x360 net/socket.c:2573
__sys_sendmmsg+0x2c3/0x510 net/socket.c:2659
__do_sys_sendmmsg net/socket.c:2688 [inline]
__se_sys_sendmmsg net/socket.c:2685 [inline]
__x64_sys_sendmmsg+0x9c/0xb0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
other info that might help us debug this:
Chain exists of:
&q->queue_lock --> &blkcg->lock --> (&sq->pending_timer)
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((&sq->pending_timer));
lock(&blkcg->lock);
lock((&sq->pending_timer));
lock(&q->queue_lock);
*** DEADLOCK ***
1 lock held by syz.2.2009/11304:
#0: ffffc900001e0bc0 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698
stack backtrace:
CPU: 1 PID: 11304 Comm: syz.2.2009 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
check_noncircular+0x296/0x330 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3095 [inline]
check_prevs_add kernel/locking/lockdep.c:3214 [inline]
validate_chain kernel/locking/lockdep.c:3830 [inline]
__lock_acquire+0x2d18/0x7c40 kernel/locking/lockdep.c:5063
lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:finish_task_switch+0x267/0x8e0 kernel/sched/core.c:5125
Code: d9 08 85 c0 0f 84 38 01 00 00 48 85 db 0f 85 57 01 00 00 0f 1f 44 00 00 4c 89 e7 e8 93 20 e3 08 e8 1e 18 2f 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0000:ffffc900039c7320 EFLAGS: 00000282
RAX: 0ab7cb020fe85e00 RBX: 0000000000000000 RCX: 0ab7cb020fe85e00
RDX: dffffc0000000000 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf68a0
RBP: ffffc900039c7370 R08: ffff8880b8f3acc3 R09: 1ffff110171e7598
R10: dffffc0000000000 R11: ffffed10171e7599 R12: ffff88807c0b3c00
R13: 0000000000000000 R14: dffffc0000000000 R15: ffffffff816080f0
context_switch kernel/sched/core.c:5249 [inline]
__schedule+0x1087/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144
unix_wait_for_peer+0x1f2/0x2e0 net/unix/af_unix.c:1449
unix_dgram_sendmsg+0xeba/0x16f0 net/unix/af_unix.c:2051
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5ed/0x9a0 net/socket.c:2519
___sys_sendmsg+0x2a2/0x360 net/socket.c:2573
__sys_sendmmsg+0x2c3/0x510 net/socket.c:2659
__do_sys_sendmmsg net/socket.c:2688 [inline]
__se_sys_sendmmsg net/socket.c:2685 [inline]
__x64_sys_sendmmsg+0x9c/0xb0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc7d479e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc7d55c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007fc7d4a25fa0 RCX: 00007fc7d479e159
RDX: 0000000000000318 RSI: 00002000000bd000 RDI: 0000000000000005
RBP: 00007fc7d483506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc7d4a26038 R14: 00007fc7d4a25fa0 R15: 00007ffcd8c7f798
----------------
Code disassembly (best guess):
0: d9 08 (bad) (%rax)
2: 85 c0 test %eax,%eax
4: 0f 84 38 01 00 00 je 0x142
a: 48 85 db test %rbx,%rbx
d: 0f 85 57 01 00 00 jne 0x16a
13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
18: 4c 89 e7 mov %r12,%rdi
1b: e8 93 20 e3 08 call 0x8e320b3
20: e8 1e 18 2f 00 call 0x2f1843
25: fb sti
26: 4c 8b 65 b8 mov -0x48(%rbp),%r12
* 2a: 49 8d bc 24 f8 15 00 lea 0x15f8(%r12),%rdi <-- trapping instruction
31: 00
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax
3e: 84 c0 test %al,%al