====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ ksoftirqd/0/15 is trying to acquire lock: ffff888143fa89b0 (&q->queue_lock){..-.}-{2:2} , at: spin_lock_irq include/linux/spinlock.h:376 [inline] , at: throtl_pending_timer_fn+0x111/0x1dd0 block/blk-throttle.c:1209 but task is already holding lock: ffffc90000147a60 ((&sq->pending_timer)){+.-.}-{0:0} , at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 ((&sq->pending_timer) ){+.-.}-{0:0} : __timer_delete_sync+0xe1/0x2e0 kernel/time/timer.c:1556 del_timer_sync include/linux/timer.h:200 [inline] throtl_pd_free+0x15/0x30 block/blk-throttle.c:504 blkcg_deactivate_policy+0x35f/0x5d0 block/blk-cgroup.c:1542 blk_throtl_exit+0xa6/0x140 block/blk-throttle.c:2424 blkcg_init_disk+0x38d/0x400 block/blk-cgroup.c:1319 __alloc_disk_node+0x2b3/0x570 block/genhd.c:1432 __blk_alloc_disk+0x2c/0x80 block/genhd.c:1471 alloc_dev drivers/md/dm.c:2057 [inline] dm_create+0x46b/0xf90 drivers/md/dm.c:2261 dev_create+0x12e/0x2c0 drivers/md/dm-ioctl.c:887 ctl_ioctl drivers/md/dm-ioctl.c:2070 [inline] dm_ctl_ioctl+0xa9c/0xec0 drivers/md/dm-ioctl.c:2092 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #1 (&blkcg->lock){....}-{2:2}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] blkg_create+0xbe9/0x1390 block/blk-cgroup.c:322 blkcg_init_disk+0x272/0x400 block/blk-cgroup.c:1293 __alloc_disk_node+0x2b3/0x570 block/genhd.c:1432 __blk_alloc_disk+0x2c/0x80 block/genhd.c:1471 brd_alloc+0x377/0x760 drivers/block/brd.c:424 brd_init+0x125/0x1a5 drivers/block/brd.c:529 do_one_initcall+0x257/0x800 init/main.c:1271 do_initcall_level+0x13d/0x1ed init/main.c:1344 do_initcalls+0x4b/0x8a init/main.c:1360 kernel_init_freeable+0x401/0x5ab init/main.c:1599 kernel_init+0x19/0x1b0 init/main.c:1487 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #0 (&q->queue_lock){..-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3162 [inline] check_prevs_add kernel/locking/lockdep.c:3281 [inline] validate_chain kernel/locking/lockdep.c:3897 [inline] __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] throtl_pending_timer_fn+0x111/0x1dd0 block/blk-throttle.c:1209 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x291/0x910 kernel/softirq.c:596 run_ksoftirqd+0xa4/0x100 kernel/softirq.c:968 smpboot_thread_fn+0x667/0xa30 kernel/smpboot.c:164 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 other info that might help us debug this: Chain exists of: &q->queue_lock --> &blkcg->lock --> (&sq->pending_timer) Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock((&sq->pending_timer)); lock(&blkcg->lock); lock((&sq->pending_timer)); lock(&q->queue_lock); *** DEADLOCK *** 1 lock held by ksoftirqd/0/15: #0: ffffc90000147a60 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698 stack backtrace: CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2215 check_prev_add kernel/locking/lockdep.c:3162 [inline] check_prevs_add kernel/locking/lockdep.c:3281 [inline] validate_chain kernel/locking/lockdep.c:3897 [inline] __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] throtl_pending_timer_fn+0x111/0x1dd0 block/blk-throttle.c:1209 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x291/0x910 kernel/softirq.c:596 run_ksoftirqd+0xa4/0x100 kernel/softirq.c:968 smpboot_thread_fn+0x667/0xa30 kernel/smpboot.c:164 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888027ca3c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 6 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88802ceebc00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88802d20da00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 109 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888027ca3c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888027ca3c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 6 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 net_ratelimit: 71 callbacks suppressed wireguard: wg0: Sending keepalive packet to peer 8 ([::1]:20003/0%0) kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 wireguard: wg0: Sending keepalive packet to peer 38 ([::1]:20003/0%0) wireguard: wg0: Sending keepalive packet to peer 50 ([::1]:20003/0%0) kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888057141e00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888057141e00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 geneve1: no route to fc00:0000:0000:0000:0000:0000:0000:0001 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 2 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888031c11e00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888031c11e00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888031c11e00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 27 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88807d3c9e00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 6 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 81 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88802ef90000, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 6 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88802ef90000, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 6 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88802ae38000, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88807d3cbc00, size = 262144, area = ffffc90002322000 kcov: kcov_start: t = ffff88807d3cbc00, size = 1048576, area = ffffc9001c4bc000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 6 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffffffff98086598 is addr:169.254.221.105 for cmd:0 at entry:ffff88807e5d6780 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888018743c00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 12 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88802eca9e00, size = 262144, area = ffffc90002322000 kcov: kcov_move_area: ffffc9001f408000 1048576 <= ffffc90002322000 3 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffffffff98086598 is addr:169.254.167.145 for cmd:0 at entry:ffff888056207980 sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffffffff98086598 is addr:169.254.221.105 for cmd:0 at entry:ffff888055218480 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 wireguard: wg1: Receiving keepalive packet from peer 39 ([::1]:20001/0%0) wireguard: wg1: Receiving keepalive packet from peer 45 ([::1]:20001/0%0) wireguard: wg1: Receiving keepalive packet from peer 3 ([::1]:20001/0%0) wireguard: wg0: Sending keepalive packet to peer 2 ([::1]:20003/0%0) virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800 virtqueue callback for ffff888144a5cc00 (ffffffff84709a30) virtqueue interrupt with no work for ffff888144a5ca00 virtqueue interrupt with no work for ffff888144a5c800