[syzbot] general protection fault in blk_mq_run_hw_queues

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: dbe69e43 Merge tag 'net-next-5.14' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12690d94300000
kernel config: https://syzkaller.appspot.com/x/.config?x=ef0afdedbe2d773d
dashboard link: https://syzkaller.appspot.com/bug?extid=9ca43ff47167c0ee3466
compiler: Debian clang version 11.0.1-2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17ded6ac300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12af1344300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ca43f...@syzkaller.appspotmail.com

netlink: 4 bytes leftover after parsing attributes in process `syz-executor092'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor092'.
nbd: socks must be embedded in a SOCK_ITEM attr
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 8422 Comm: syz-executor092 Tainted: G W 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:blk_mq_map_queue_type block/blk-mq.h:96 [inline]
RIP: 0010:blk_mq_get_sq_hctx block/blk-mq.c:1663 [inline]
RIP: 0010:blk_mq_run_hw_queues+0x14f/0x430 block/blk-mq.c:1682
Code: 80 3c 08 00 74 08 48 89 ef e8 0d 0f dd fd 44 89 fb 48 c1 e3 02 48 03 5d 00 48 89 d8 48 c1 e8 03 48 bd 00 00 00 00 00 fc ff df <8a> 04 28 84 c0 0f 85 b7 02 00 00 8b 03 49 8d 1c c4 48 89 d8 48 c1
RSP: 0018:ffffc9000183f160 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88801f912b38
RBP: dffffc0000000000 R08: ffffffff83eb6412 R09: ffffed1003f22687
R10: ffffed1003f22687 R11: 0000000000000000 R12: ffff88814615f4d8
R13: 0000000000000000 R14: ffff88801f912af0 R15: 0000000000000000
FS: 0000000001ab6300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa915ace020 CR3: 0000000018231000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
blk_set_queue_dying block/blk-core.c:353 [inline]
blk_cleanup_queue+0x9c/0x220 block/blk-core.c:380
blk_cleanup_disk+0x3b/0x80 block/genhd.c:1324
nbd_dev_remove drivers/block/nbd.c:226 [inline]
nbd_put+0x9d/0x170 drivers/block/nbd.c:246
nbd_genl_connect+0x17e7/0x1aa0 drivers/block/nbd.c:1957
genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
genl_rcv_msg+0xfb4/0x13c0 net/netlink/genetlink.c:800
netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2504
genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1340
netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1929
sock_sendmsg_nosec net/socket.c:702 [inline]
sock_sendmsg net/socket.c:722 [inline]
____sys_sendmsg+0x5a2/0x900 net/socket.c:2385
___sys_sendmsg net/socket.c:2439 [inline]
__sys_sendmsg+0x319/0x400 net/socket.c:2468
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43fa29
Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcd5946088 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004004a0 RCX: 000000000043fa29
RDX: 0000000000000000 RSI: 0000000020000b40 RDI: 0000000000000003
RBP: 0000000000403490 R08: 0000000000000000 R09: 00000000004004a0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403520
R13: 0000000000000000 R14: 00000000004ad018 R15: 00000000004004a0
Modules linked in:
---[ end trace d9ad06d2dab45e1b ]---
RIP: 0010:blk_mq_map_queue_type block/blk-mq.h:96 [inline]
RIP: 0010:blk_mq_get_sq_hctx block/blk-mq.c:1663 [inline]
RIP: 0010:blk_mq_run_hw_queues+0x14f/0x430 block/blk-mq.c:1682
Code: 80 3c 08 00 74 08 48 89 ef e8 0d 0f dd fd 44 89 fb 48 c1 e3 02 48 03 5d 00 48 89 d8 48 c1 e8 03 48 bd 00 00 00 00 00 fc ff df <8a> 04 28 84 c0 0f 85 b7 02 00 00 8b 03 49 8d 1c c4 48 89 d8 48 c1
RSP: 0018:ffffc9000183f160 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88801f912b38
RBP: dffffc0000000000 R08: ffffffff83eb6412 R09: ffffed1003f22687
R10: ffffed1003f22687 R11: 0000000000000000 R12: ffff88814615f4d8
R13: 0000000000000000 R14: ffff88801f912af0 R15: 0000000000000000
FS: 0000000001ab6300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa915ace020 CR3: 0000000018231000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Guoqing Jiang]

Hi,

Maybe it can be fixed like this as commit
6a03cd9843fa4dcf827dc3ad60fa9b4217f3057c did.

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 614d82e7fae4..d2548d36bf21 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -222,8 +222,8 @@ static void nbd_dev_remove(struct nbd_device *nbd)

        if (disk) {
                del_gendisk(disk);
-               blk_mq_free_tag_set(&nbd->tag_set);
                blk_cleanup_disk(disk);
+               blk_mq_free_tag_set(&nbd->tag_set);
        }

Also paride/pd.c needs the same change, is my understanding correct?
Christoph.

Thanks,
Guoqing

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

T1] Modular ISDN core version 1.1.29
[ 11.319780][ T1] NET: Registered PF_ISDN protocol family
[ 11.321131][ T1] DSP module 2.0
[ 11.322040][ T1] mISDN_dsp: DSP clocks every 80 samples. This equals 1 jiffies.
[ 11.327311][ T1] mISDN: Layer-1-over-IP driver Rev. 2.00
[ 11.329355][ T1] 0 virtual devices registered
[ 11.331009][ T1] usbcore: registered new interface driver HFC-S_USB
[ 11.332210][ T1] intel_pstate: CPU model not supported
[ 11.334112][ T1] VUB300 Driver rom wait states = 1C irqpoll timeout = 0400
[ 11.335697][ T1] usbcore: registered new interface driver vub300
[ 11.339171][ T1] usbcore: registered new interface driver ushc
[ 11.347925][ T1] iscsi: registered transport (iser)
[ 11.352458][ T1] SoftiWARP attached
[ 11.353647][ T1] Driver 'framebuffer' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 11.355772][ T1] Driver 'memconsole' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 11.357825][ T1] Driver 'vpd' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 11.372565][ T1] hid: raw HID events driver (C) Jiri Kosina
[ 11.441424][ T1] usbcore: registered new interface driver usbhid
[ 11.443056][ T1] usbhid: USB HID core driver
[ 11.448167][ T1] usbcore: registered new interface driver es2_ap_driver
[ 11.450211][ T1] comedi: version 0.7.76 - http://www.comedi.org
[ 11.454129][ T1] usbcore: registered new interface driver dt9812
[ 11.456502][ T1] usbcore: registered new interface driver ni6501
[ 11.458049][ T1] usbcore: registered new interface driver usbdux
[ 11.459482][ T1] usbcore: registered new interface driver usbduxfast
[ 11.461617][ T1] usbcore: registered new interface driver usbduxsigma
[ 11.463430][ T1] usbcore: registered new interface driver vmk80xx
[ 11.465113][ T1] usbcore: registered new interface driver prism2_usb
[ 11.467262][ T1] usbcore: registered new interface driver r8712u
[ 11.470275][ T1] ashmem: initialized
[ 11.472359][ T1] greybus: registered new driver hid
[ 11.474630][ T1] greybus: registered new driver gbphy
[ 11.476637][ T1] gb_gbphy: registered new driver usb
[ 11.477543][ T1] asus_wmi: ASUS WMI generic driver loaded
[ 11.577256][ T1] usbcore: registered new interface driver snd-usb-audio
[ 11.581403][ T1] usbcore: registered new interface driver snd-ua101
[ 11.583045][ T1] usbcore: registered new interface driver snd-usb-usx2y
[ 11.584705][ T1] usbcore: registered new interface driver snd-usb-us122l
[ 11.586566][ T1] usbcore: registered new interface driver snd-usb-caiaq
[ 11.588769][ T1] usbcore: registered new interface driver snd-usb-6fire
[ 11.590383][ T1] usbcore: registered new interface driver snd-usb-hiface
[ 11.591792][ T1] usbcore: registered new interface driver snd-bcd2000
[ 11.593436][ T1] usbcore: registered new interface driver snd_usb_pod
[ 11.595185][ T1] usbcore: registered new interface driver snd_usb_podhd
[ 11.596643][ T1] usbcore: registered new interface driver snd_usb_toneport
[ 11.598326][ T1] usbcore: registered new interface driver snd_usb_variax
[ 11.600182][ T1] drop_monitor: Initializing network drop monitor service
[ 11.602286][ T1] NET: Registered PF_LLC protocol family
[ 11.604138][ T1] GACT probability on
[ 11.605293][ T1] Mirror/redirect action on
[ 11.606562][ T1] Simple TC action Loaded
[ 11.610293][ T1] netem: version 1.3
[ 11.611950][ T1] u32 classifier
[ 11.612751][ T1] Performance counters on
[ 11.613686][ T1] input device check on
[ 11.616271][ T1] Actions configured
[ 11.619114][ T1] nf_conntrack_irc: failed to register helpers
[ 11.621276][ T1] nf_conntrack_sane: failed to register helpers
[ 11.668810][ T1] nf_conntrack_sip: failed to register helpers
[ 11.674395][ T1] xt_time: kernel timezone is -0000
[ 11.675848][ T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 11.677460][ T1] IPVS: Connection hash table configured (size=4096, memory=64Kbytes)
[ 11.679631][ T1] IPVS: ipvs loaded.
[ 11.680543][ T1] IPVS: [rr] scheduler registered.
[ 11.681796][ T1] IPVS: [wrr] scheduler registered.
[ 11.685453][ T1] IPVS: [lc] scheduler registered.
[ 11.686651][ T1] IPVS: [wlc] scheduler registered.
[ 11.688394][ T1] IPVS: [fo] scheduler registered.
[ 11.689311][ T1] IPVS: [ovf] scheduler registered.
[ 11.690148][ T1] IPVS: [lblc] scheduler registered.
[ 11.691534][ T1] IPVS: [lblcr] scheduler registered.
[ 11.692642][ T1] IPVS: [dh] scheduler registered.
[ 11.693616][ T1] IPVS: [sh] scheduler registered.
[ 11.694518][ T1] IPVS: [mh] scheduler registered.
[ 11.695738][ T1] IPVS: [sed] scheduler registered.
[ 11.696527][ T1] IPVS: [nq] scheduler registered.
[ 11.697735][ T1] IPVS: [twos] scheduler registered.
[ 11.698761][ T1] IPVS: [sip] pe registered.
[ 11.699606][ T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[ 11.703607][ T1] gre: GRE over IPv4 demultiplexor driver
[ 11.704616][ T1] ip_gre: GRE over IPv4 tunneling driver
[ 11.712390][ T1] IPv4 over IPsec tunneling driver
[ 11.717427][ T1] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
[ 11.720053][ T1] Initializing XFRM netlink socket
[ 11.721962][ T1] IPsec XFRM device driver
[ 11.725714][ T1] NET: Registered PF_INET6 protocol family
[ 11.741584][ T1] Segment Routing with IPv6
[ 11.742884][ T1] RPL Segment Routing with IPv6
[ 11.744802][ T1] mip6: Mobile IPv6
[ 11.752540][ T1] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 11.762525][ T1] ip6_gre: GRE over IPv6 tunneling driver
[ 11.767315][ T1] NET: Registered PF_PACKET protocol family
[ 11.769373][ T1] NET: Registered PF_KEY protocol family
[ 11.771911][ T1] Bridge firewalling registered
[ 11.774276][ T1] NET: Registered PF_X25 protocol family
[ 11.775678][ T1] X25: Linux Version 0.2
[ 11.819115][ T1] NET: Registered PF_NETROM protocol family
[ 11.871435][ T1] NET: Registered PF_ROSE protocol family
[ 11.877483][ T1] NET: Registered PF_AX25 protocol family
[ 11.884089][ T1] can: controller area network core
[ 11.890055][ T1] NET: Registered PF_CAN protocol family
[ 11.895899][ T1] can: raw protocol
[ 11.899802][ T1] can: broadcast manager protocol
[ 11.905142][ T1] can: netlink gateway - max_hops=1
[ 11.910902][ T1] can: SAE J1939
[ 11.914489][ T1] can: isotp protocol
[ 11.919274][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 11.926240][ T1] Bluetooth: RFCOMM socket layer initialized
[ 11.932747][ T1] Bluetooth: RFCOMM ver 1.11
[ 11.937428][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 11.943950][ T1] Bluetooth: BNEP filters: protocol multicast
[ 11.950465][ T1] Bluetooth: BNEP socket layer initialized
[ 11.956570][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[ 11.962663][ T1] Bluetooth: CMTP socket layer initialized
[ 11.968521][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 11.975618][ T1] Bluetooth: HIDP socket layer initialized
[ 11.986515][ T1] NET: Registered PF_RXRPC protocol family
[ 11.992676][ T1] Key type rxrpc registered
[ 11.997269][ T1] Key type rxrpc_s registered
[ 12.003579][ T1] NET: Registered PF_KCM protocol family
[ 12.009800][ T1] lec:lane_module_init: lec.c: initialized
[ 12.015861][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 12.022093][ T1] l2tp_core: L2TP core driver, V2.0
[ 12.027390][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 12.033227][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 12.040872][ T1] l2tp_netlink: L2TP netlink interface
[ 12.046836][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 12.053777][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 12.061931][ T1] NET: Registered PF_PHONET protocol family
[ 12.068835][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 12.086033][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 12.092291][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 12.101876][ T1] sctp: Hash tables configured (bind 32/56)
[ 12.110549][ T1] NET: Registered PF_RDS protocol family
[ 12.117409][ T1] Registered RDS/infiniband transport
[ 12.124654][ T1] Registered RDS/tcp transport
[ 12.129626][ T1] tipc: Activated (version 2.0.0)
[ 12.135784][ T1] NET: Registered PF_TIPC protocol family
[ 12.142433][ T1] tipc: Started in single node mode
[ 12.148836][ T1] NET: Registered PF_SMC protocol family
[ 12.155556][ T1] 9pnet: Installing 9P2000 support
[ 12.161666][ T1] NET: Registered PF_CAIF protocol family
[ 12.173524][ T1] NET: Registered PF_IEEE802154 protocol family
[ 12.180288][ T1] Key type dns_resolver registered
[ 12.185762][ T1] Key type ceph registered
[ 12.191639][ T1] libceph: loaded (mon/osd proto 15/24)
[ 12.199645][ T1] batman_adv: B.A.T.M.A.N. advanced 2021.2 (compatibility version 15) loaded
[ 12.209283][ T1] openvswitch: Open vSwitch switching datapath
[ 12.220065][ T1] NET: Registered PF_VSOCK protocol family
[ 12.226669][ T1] mpls_gso: MPLS GSO support
[ 12.240064][ T1] IPI shorthand broadcast: enabled
[ 12.245772][ T1] AVX2 version of gcm_enc/dec engaged.
[ 12.251576][ T1] AES CTR mode by8 optimization enabled
[ 12.266711][ T1] sched_clock: Marking stable (12236049230, 30535590)->(12278128006, -11543186)
[ 12.277902][ T1] registered taskstats version 1
[ 12.289929][ T1] Loading compiled-in X.509 certificates
[ 12.298432][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: f850c787ad998c396ae089c083b940ff0a9abb77'
[ 12.312360][ T1] zswap: loaded using pool lzo/zbud
[ 12.318971][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 12.330460][ T1] Key type ._fscrypt registered
[ 12.335527][ T1] Key type .fscrypt registered
[ 12.340426][ T1] Key type fscrypt-provisioning registered
[ 12.350731][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 12.357429][ T1] FS-Cache: Netfs 'afs' registered for caching
[ 12.374675][ T1] Btrfs loaded, crc32c=crc32c-intel, assert=on, zoned=yes
[ 12.383600][ T1] Key type big_key registered
[ 12.392687][ T1] Key type encrypted registered
[ 12.397984][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 12.404832][ T1] Loading compiled-in module X.509 certificates
[ 12.412338][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: f850c787ad998c396ae089c083b940ff0a9abb77'
[ 12.423603][ T1] ima: Allocated hash algorithm: sha256
[ 12.429911][ T1] ima: No architecture policies found
[ 12.435752][ T1] evm: Initialising EVM extended attributes:
[ 12.441823][ T1] evm: security.selinux (disabled)
[ 12.447101][ T1] evm: security.SMACK64
[ 12.451381][ T1] evm: security.SMACK64EXEC
[ 12.455875][ T1] evm: security.SMACK64TRANSMUTE
[ 12.460917][ T1] evm: security.SMACK64MMAP
[ 12.465616][ T1] evm: security.apparmor (disabled)
[ 12.470887][ T1] evm: security.ima
[ 12.474847][ T1] evm: security.capability
[ 12.479282][ T1] evm: HMAC attrs: 0x1
[ 12.485047][ T1] PM: Magic number: 13:189:17
[ 12.490130][ T1] usb usb39-port5: hash matches
[ 12.495834][ T1] tty ttyce: hash matches
[ 12.503029][ T1] printk: console [netcon0] enabled
[ 12.508408][ T1] netconsole: network logging started
[ 12.514474][ T1] gtp: GTP module loaded (pdp ctx size 104 bytes)
[ 12.523212][ T1] rdma_rxe: loaded
[ 12.527410][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 12.538480][ T1] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 12.547398][ T20] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 12.552317][ T1] ALSA device list:
[ 12.557290][ T20] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 12.561078][ T1] #0: Dummy 1
[ 12.573314][ T1] #1: Loopback 1
[ 12.577501][ T1] #2: Virtual MIDI Card 1
[ 12.585243][ T1] md: Waiting for all devices to be available before autodetect
[ 12.593036][ T1] md: If you don't use raid, use raid=noautodetect
[ 12.599546][ T1] md: Autodetecting RAID arrays.
[ 12.604577][ T1] md: autorun ...
[ 12.608286][ T1] md: ... autorun DONE.
[ 12.615958][ T1] VFS: Cannot open root device "sda1" or unknown-block(0,0): error -6
[ 12.624809][ T1] Please append a correct "root=" boot option; here are the available partitions:
[ 12.636363][ T1] 0100 4096 ram0
[ 12.636384][ T1] (driver?)
[ 12.644237][ T1] 0101 4096 ram1
[ 12.644248][ T1] (driver?)
[ 12.653119][ T1] 0102 4096 ram2
[ 12.653131][ T1] (driver?)
[ 12.661702][ T1] 0103 4096 ram3
[ 12.661721][ T1] (driver?)
[ 12.669788][ T1] 0104 4096 ram4
[ 12.669800][ T1] (driver?)
[ 12.677982][ T1] 0105 4096 ram5
[ 12.677993][ T1] (driver?)
[ 12.686980][ T1] 0106 4096 ram6
[ 12.686994][ T1] (driver?)
[ 12.695653][ T1] 0107 4096 ram7
[ 12.695667][ T1] (driver?)
[ 12.703669][ T1] 0108 4096 ram8
[ 12.703683][ T1] (driver?)
[ 12.711930][ T1] 0109 4096 ram9
[ 12.711942][ T1] (driver?)
[ 12.720441][ T1] 010a 4096 ram10
[ 12.720506][ T1] (driver?)
[ 12.728472][ T1] 010b 4096 ram11
[ 12.728488][ T1] (driver?)
[ 12.737151][ T1] 010c 4096 ram12
[ 12.737164][ T1] (driver?)
[ 12.745658][ T1] 010d 4096 ram13
[ 12.745670][ T1] (driver?)
[ 12.754913][ T1] 010e 4096 ram14
[ 12.754924][ T1] (driver?)
[ 12.763031][ T1] 010f 4096 ram15
[ 12.763044][ T1] (driver?)
[ 12.771189][ T1] 1f00 128 mtdblock0
[ 12.771201][ T1] (driver?)
[ 12.780640][ T1] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 12.789927][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.13.0-syzkaller #0
[ 12.797828][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 12.808298][ T1] Call Trace:
[ 12.811775][ T1] dump_stack_lvl+0x1ae/0x29f
[ 12.816590][ T1] ? show_regs_print_info+0x12/0x12
[ 12.822571][ T1] ? vsnprintf+0x19e/0x1d60
[ 12.827375][ T1] ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 12.833329][ T1] panic+0x2e1/0x850
[ 12.837740][ T1] ? trace_hardirqs_on+0x30/0x80
[ 12.842905][ T1] ? nmi_panic+0x90/0x90
[ 12.848101][ T1] ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 12.853834][ T1] ? _raw_read_unlock+0x24/0x40
[ 12.858710][ T1] ? get_filesystem_list+0x11e/0x12c
[ 12.863996][ T1] ? do_mount_root+0x164/0x3c3
[ 12.870022][ T1] mount_block_root+0x3ab/0x4f5
[ 12.875217][ T1] ? root_delay_setup+0x22/0x22
[ 12.880071][ T1] ? memcpy+0x3c/0x60
[ 12.884453][ T1] prepare_namespace+0x1f3/0x22d
[ 12.889513][ T1] kernel_init_freeable+0x432/0x57e
[ 12.894999][ T1] ? report_meminit+0x64/0x64
[ 12.899686][ T1] ? _raw_spin_lock_irq+0xba/0xf0
[ 12.904805][ T1] ? _raw_spin_unlock_irq+0x1f/0x40
[ 12.910007][ T1] ? lockdep_hardirqs_on+0x8d/0x130
[ 12.915918][ T1] ? rest_init+0x2e0/0x2e0
[ 12.920344][ T1] kernel_init+0x19/0x2a0
[ 12.924872][ T1] ? rest_init+0x2e0/0x2e0
[ 12.929538][ T1] ret_from_fork+0x1f/0x30
[ 12.936019][ T1] Kernel Offset: disabled
[ 12.940731][ T1] Rebooting in 86400 seconds..


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=13fd2dac300000


Tested on:

commit: a180bd1d iov_iter: remove uaccess_kernel() warning from io..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=8a747de041b5bc06

dashboard link: https://syzkaller.appspot.com/bug?extid=9ca43ff47167c0ee3466
compiler: Debian clang version 11.0.1-2

patch: https://syzkaller.appspot.com/x/patch.diff?x=171e4628300000

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

red PF_ISDN protocol family
[ 12.240528][ T1] DSP module 2.0
[ 12.244986][ T1] mISDN_dsp: DSP clocks every 80 samples. This equals 1 jiffies.
[ 12.257991][ T1] mISDN: Layer-1-over-IP driver Rev. 2.00
[ 12.264269][ T1] 0 virtual devices registered
[ 12.269827][ T1] usbcore: registered new interface driver HFC-S_USB
[ 12.277664][ T1] intel_pstate: CPU model not supported
[ 12.284540][ T1] VUB300 Driver rom wait states = 1C irqpoll timeout = 0400
[ 12.285679][ T1] usbcore: registered new interface driver vub300
[ 12.301622][ T1] usbcore: registered new interface driver ushc
[ 12.312316][ T1] iscsi: registered transport (iser)
[ 12.319033][ T1] SoftiWARP attached
[ 12.323206][ T1] Driver 'framebuffer' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 12.336072][ T1] Driver 'memconsole' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 12.348850][ T1] Driver 'vpd' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 12.366478][ T1] hid: raw HID events driver (C) Jiri Kosina
[ 12.405401][ T1] usbcore: registered new interface driver usbhid
[ 12.412756][ T1] usbhid: USB HID core driver
[ 12.419958][ T1] usbcore: registered new interface driver es2_ap_driver
[ 12.427865][ T1] comedi: version 0.7.76 - http://www.comedi.org
[ 12.435911][ T1] usbcore: registered new interface driver dt9812
[ 12.442943][ T1] usbcore: registered new interface driver ni6501
[ 12.450560][ T1] usbcore: registered new interface driver usbdux
[ 12.458067][ T1] usbcore: registered new interface driver usbduxfast
[ 12.466568][ T1] usbcore: registered new interface driver usbduxsigma
[ 12.473776][ T1] usbcore: registered new interface driver vmk80xx
[ 12.480828][ T1] usbcore: registered new interface driver prism2_usb
[ 12.488346][ T1] usbcore: registered new interface driver r8712u
[ 12.496563][ T1] ashmem: initialized
[ 12.500825][ T1] greybus: registered new driver hid
[ 12.506560][ T1] greybus: registered new driver gbphy
[ 12.512743][ T1] gb_gbphy: registered new driver usb
[ 12.518786][ T1] asus_wmi: ASUS WMI generic driver loaded
[ 12.579531][ T1] usbcore: registered new interface driver snd-usb-audio
[ 12.588668][ T1] usbcore: registered new interface driver snd-ua101
[ 12.595993][ T1] usbcore: registered new interface driver snd-usb-usx2y
[ 12.603830][ T1] usbcore: registered new interface driver snd-usb-us122l
[ 12.612599][ T1] usbcore: registered new interface driver snd-usb-caiaq
[ 12.620361][ T1] usbcore: registered new interface driver snd-usb-6fire
[ 12.627937][ T1] usbcore: registered new interface driver snd-usb-hiface
[ 12.635451][ T1] usbcore: registered new interface driver snd-bcd2000
[ 12.642633][ T1] usbcore: registered new interface driver snd_usb_pod
[ 12.650010][ T1] usbcore: registered new interface driver snd_usb_podhd
[ 12.658613][ T1] usbcore: registered new interface driver snd_usb_toneport
[ 12.667504][ T1] usbcore: registered new interface driver snd_usb_variax
[ 12.675766][ T1] drop_monitor: Initializing network drop monitor service
[ 12.684524][ T1] NET: Registered PF_LLC protocol family
[ 12.690348][ T1] GACT probability on
[ 12.695333][ T1] Mirror/redirect action on
[ 12.700371][ T1] Simple TC action Loaded
[ 12.706657][ T1] netem: version 1.3
[ 12.712135][ T1] u32 classifier
[ 12.716192][ T1] Performance counters on
[ 12.721933][ T1] input device check on
[ 12.727193][ T1] Actions configured
[ 12.733105][ T1] nf_conntrack_irc: failed to register helpers
[ 12.740005][ T1] nf_conntrack_sane: failed to register helpers
[ 12.764331][ T1] nf_conntrack_sip: failed to register helpers
[ 12.773642][ T1] xt_time: kernel timezone is -0000
[ 12.779178][ T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 12.786776][ T1] IPVS: Connection hash table configured (size=4096, memory=64Kbytes)
[ 12.795159][ T1] IPVS: ipvs loaded.
[ 12.799363][ T1] IPVS: [rr] scheduler registered.
[ 12.804594][ T1] IPVS: [wrr] scheduler registered.
[ 12.810370][ T1] IPVS: [lc] scheduler registered.
[ 12.816067][ T1] IPVS: [wlc] scheduler registered.
[ 12.821809][ T1] IPVS: [fo] scheduler registered.
[ 12.827557][ T1] IPVS: [ovf] scheduler registered.
[ 12.834211][ T1] IPVS: [lblc] scheduler registered.
[ 12.839954][ T1] IPVS: [lblcr] scheduler registered.
[ 12.845592][ T1] IPVS: [dh] scheduler registered.
[ 12.850993][ T1] IPVS: [sh] scheduler registered.
[ 12.856536][ T1] IPVS: [mh] scheduler registered.
[ 12.861821][ T1] IPVS: [sed] scheduler registered.
[ 12.867256][ T1] IPVS: [nq] scheduler registered.
[ 12.872786][ T1] IPVS: [twos] scheduler registered.
[ 12.878468][ T1] IPVS: [sip] pe registered.
[ 12.883746][ T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[ 12.892949][ T1] gre: GRE over IPv4 demultiplexor driver
[ 12.899093][ T1] ip_gre: GRE over IPv4 tunneling driver
[ 12.910830][ T1] IPv4 over IPsec tunneling driver
[ 12.919889][ T1] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
[ 12.929471][ T1] Initializing XFRM netlink socket
[ 12.935112][ T1] IPsec XFRM device driver
[ 12.941138][ T1] NET: Registered PF_INET6 protocol family
[ 12.957244][ T1] Segment Routing with IPv6
[ 12.961883][ T1] RPL Segment Routing with IPv6
[ 12.967331][ T1] mip6: Mobile IPv6
[ 12.976381][ T1] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 12.988546][ T1] ip6_gre: GRE over IPv6 tunneling driver
[ 12.997790][ T1] NET: Registered PF_PACKET protocol family
[ 13.003809][ T1] NET: Registered PF_KEY protocol family
[ 13.010923][ T1] Bridge firewalling registered
[ 13.017483][ T1] NET: Registered PF_X25 protocol family
[ 13.024930][ T1] X25: Linux Version 0.2
[ 13.059539][ T1] NET: Registered PF_NETROM protocol family
[ 13.097481][ T1] NET: Registered PF_ROSE protocol family
[ 13.104427][ T1] NET: Registered PF_AX25 protocol family
[ 13.110810][ T1] can: controller area network core
[ 13.116756][ T1] NET: Registered PF_CAN protocol family
[ 13.122858][ T1] can: raw protocol
[ 13.128678][ T1] can: broadcast manager protocol
[ 13.137695][ T1] can: netlink gateway - max_hops=1
[ 13.144231][ T1] can: SAE J1939
[ 13.148167][ T1] can: isotp protocol
[ 13.153262][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 13.159721][ T1] Bluetooth: RFCOMM socket layer initialized
[ 13.166330][ T1] Bluetooth: RFCOMM ver 1.11
[ 13.171359][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 13.178105][ T1] Bluetooth: BNEP filters: protocol multicast
[ 13.185349][ T1] Bluetooth: BNEP socket layer initialized
[ 13.195795][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[ 13.203039][ T1] Bluetooth: CMTP socket layer initialized
[ 13.209408][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 13.219420][ T1] Bluetooth: HIDP socket layer initialized
[ 13.228565][ T1] NET: Registered PF_RXRPC protocol family
[ 13.236202][ T1] Key type rxrpc registered
[ 13.242470][ T1] Key type rxrpc_s registered
[ 13.249998][ T1] NET: Registered PF_KCM protocol family
[ 13.259156][ T1] lec:lane_module_init: lec.c: initialized
[ 13.266151][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 13.272663][ T1] l2tp_core: L2TP core driver, V2.0
[ 13.278233][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 13.284383][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 13.292124][ T1] l2tp_netlink: L2TP netlink interface
[ 13.297912][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 13.305141][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 13.313279][ T1] NET: Registered PF_PHONET protocol family
[ 13.320502][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 13.335540][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 13.342301][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 13.350849][ T1] sctp: Hash tables configured (bind 32/56)
[ 13.358943][ T1] NET: Registered PF_RDS protocol family
[ 13.367295][ T1] Registered RDS/infiniband transport
[ 13.374101][ T1] Registered RDS/tcp transport
[ 13.379697][ T1] tipc: Activated (version 2.0.0)
[ 13.385515][ T1] NET: Registered PF_TIPC protocol family
[ 13.391871][ T1] tipc: Started in single node mode
[ 13.398120][ T1] NET: Registered PF_SMC protocol family
[ 13.404160][ T1] 9pnet: Installing 9P2000 support
[ 13.409802][ T1] NET: Registered PF_CAIF protocol family
[ 13.419713][ T1] NET: Registered PF_IEEE802154 protocol family
[ 13.427065][ T1] Key type dns_resolver registered
[ 13.432417][ T1] Key type ceph registered
[ 13.437604][ T1] libceph: loaded (mon/osd proto 15/24)
[ 13.444994][ T1] batman_adv: B.A.T.M.A.N. advanced 2021.2 (compatibility version 15) loaded
[ 13.454485][ T1] openvswitch: Open vSwitch switching datapath
[ 13.463871][ T1] NET: Registered PF_VSOCK protocol family
[ 13.470262][ T1] mpls_gso: MPLS GSO support
[ 13.480648][ T1] IPI shorthand broadcast: enabled
[ 13.486132][ T1] AVX2 version of gcm_enc/dec engaged.
[ 13.492702][ T1] AES CTR mode by8 optimization enabled
[ 13.503100][ T1] sched_clock: Marking stable (13452091214, 50923833)->(13501355532, 1659515)
[ 13.514448][ T1] registered taskstats version 1
[ 13.524592][ T1] Loading compiled-in X.509 certificates
[ 13.532891][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: f850c787ad998c396ae089c083b940ff0a9abb77'
[ 13.546115][ T1] zswap: loaded using pool lzo/zbud
[ 13.553151][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 13.565905][ T1] Key type ._fscrypt registered
[ 13.570882][ T1] Key type .fscrypt registered
[ 13.575727][ T1] Key type fscrypt-provisioning registered
[ 13.585621][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 13.592442][ T1] FS-Cache: Netfs 'afs' registered for caching
[ 13.605323][ T1] Btrfs loaded, crc32c=crc32c-intel, assert=on, zoned=yes
[ 13.613599][ T1] Key type big_key registered
[ 13.620580][ T1] Key type encrypted registered
[ 13.625516][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 13.632729][ T1] Loading compiled-in module X.509 certificates
[ 13.639713][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: f850c787ad998c396ae089c083b940ff0a9abb77'
[ 13.650765][ T1] ima: Allocated hash algorithm: sha256
[ 13.656783][ T1] ima: No architecture policies found
[ 13.663238][ T1] evm: Initialising EVM extended attributes:
[ 13.670804][ T1] evm: security.selinux (disabled)
[ 13.676465][ T1] evm: security.SMACK64
[ 13.680952][ T1] evm: security.SMACK64EXEC
[ 13.685647][ T1] evm: security.SMACK64TRANSMUTE
[ 13.690778][ T1] evm: security.SMACK64MMAP
[ 13.695274][ T1] evm: security.apparmor (disabled)
[ 13.700645][ T1] evm: security.ima
[ 13.704524][ T1] evm: security.capability
[ 13.709389][ T1] evm: HMAC attrs: 0x1
[ 13.714577][ T1] PM: Magic number: 13:257:573
[ 13.720619][ T1] usbmon usbmon13: hash matches
[ 13.726316][ T1] tty ptyb5: hash matches
[ 13.732281][ T1] printk: console [netcon0] enabled
[ 13.737946][ T1] netconsole: network logging started
[ 13.744238][ T1] gtp: GTP module loaded (pdp ctx size 104 bytes)
[ 13.751937][ T1] rdma_rxe: loaded
[ 13.756176][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 13.766706][ T1] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 13.775073][ T5] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 13.776165][ T1] ALSA device list:
[ 13.784765][ T5] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 13.788820][ T1] #0: Dummy 1
[ 13.800618][ T1] #1: Loopback 1
[ 13.804320][ T1] #2: Virtual MIDI Card 1
[ 13.810523][ T1] md: Waiting for all devices to be available before autodetect
[ 13.818998][ T1] md: If you don't use raid, use raid=noautodetect
[ 13.825595][ T1] md: Autodetecting RAID arrays.
[ 13.830774][ T1] md: autorun ...
[ 13.834443][ T1] md: ... autorun DONE.
[ 13.841998][ T1] VFS: Cannot open root device "sda1" or unknown-block(0,0): error -6
[ 13.851183][ T1] Please append a correct "root=" boot option; here are the available partitions:
[ 13.860676][ T1] 0100 4096 ram0
[ 13.860687][ T1] (driver?)
[ 13.868773][ T1] 0101 4096 ram1
[ 13.868783][ T1] (driver?)
[ 13.877067][ T1] 0102 4096 ram2
[ 13.877084][ T1] (driver?)
[ 13.884858][ T1] 0103 4096 ram3
[ 13.884868][ T1] (driver?)
[ 13.893729][ T1] 0104 4096 ram4
[ 13.893743][ T1] (driver?)
[ 13.902187][ T1] 0105 4096 ram5
[ 13.902196][ T1] (driver?)
[ 13.911548][ T1] 0106 4096 ram6
[ 13.911559][ T1] (driver?)
[ 13.920747][ T1] 0107 4096 ram7
[ 13.920758][ T1] (driver?)
[ 13.928982][ T1] 0108 4096 ram8
[ 13.928992][ T1] (driver?)
[ 13.938032][ T1] 0109 4096 ram9
[ 13.938043][ T1] (driver?)
[ 13.946975][ T1] 010a 4096 ram10
[ 13.946986][ T1] (driver?)
[ 13.955951][ T1] 010b 4096 ram11
[ 13.955966][ T1] (driver?)
[ 13.964001][ T1] 010c 4096 ram12
[ 13.964012][ T1] (driver?)
[ 13.972382][ T1] 010d 4096 ram13
[ 13.972393][ T1] (driver?)
[ 13.980894][ T1] 010e 4096 ram14
[ 13.980904][ T1] (driver?)
[ 13.989992][ T1] 010f 4096 ram15
[ 13.990002][ T1] (driver?)
[ 13.997999][ T1] 1f00 128 mtdblock0
[ 13.998010][ T1] (driver?)
[ 14.006391][ T1] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 14.015687][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.13.0-syzkaller #0
[ 14.024977][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 14.035439][ T1] Call Trace:
[ 14.038789][ T1] dump_stack_lvl+0x1ae/0x29f
[ 14.043670][ T1] ? show_regs_print_info+0x12/0x12
[ 14.049325][ T1] ? vsnprintf+0x19e/0x1d60
[ 14.054115][ T1] ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 14.060034][ T1] ? printk_all_partitions+0x6ea/0x73d
[ 14.066003][ T1] panic+0x2e1/0x850
[ 14.070102][ T1] ? trace_hardirqs_on+0x30/0x80
[ 14.075117][ T1] ? nmi_panic+0x90/0x90
[ 14.079527][ T1] ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 14.085330][ T1] ? _raw_read_unlock+0x24/0x40
[ 14.090570][ T1] ? get_filesystem_list+0x11e/0x12c
[ 14.096408][ T1] ? do_mount_root+0x164/0x3c3
[ 14.101425][ T1] mount_block_root+0x3ab/0x4f5
[ 14.106273][ T1] ? root_delay_setup+0x22/0x22
[ 14.111521][ T1] ? memcpy+0x3c/0x60
[ 14.115593][ T1] prepare_namespace+0x1f3/0x22d
[ 14.120529][ T1] kernel_init_freeable+0x432/0x57e
[ 14.125912][ T1] ? report_meminit+0x64/0x64
[ 14.130822][ T1] ? _raw_spin_lock_irq+0xba/0xf0
[ 14.136246][ T1] ? _raw_spin_unlock_irq+0x1f/0x40
[ 14.141547][ T1] ? lockdep_hardirqs_on+0x8d/0x130
[ 14.147055][ T1] ? rest_init+0x2e0/0x2e0
[ 14.151667][ T1] kernel_init+0x19/0x2a0
[ 14.156169][ T1] ? rest_init+0x2e0/0x2e0
[ 14.160758][ T1] ret_from_fork+0x1f/0x30
[ 14.167477][ T1] Kernel Offset: disabled
[ 14.172270][ T1] Rebooting in 86400 seconds..

Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=165b6bac300000

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in del_gendisk

nbd: socks must be embedded in a SOCK_ITEM attr

======================================================
WARNING: possible circular locking dependency detected
5.13.0-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.4/10240 is trying to acquire lock:
ffff88801f280518 (&disk->open_mutex){+.+.}-{3:3}, at: del_gendisk+0x86/0x610 block/genhd.c:587

but task is already holding lock:
ffffffff8ce7c048 (nbd_index_mutex){+.+.}-{3:3}, at: refcount_dec_and_mutex_lock+0x2e/0x100 lib/refcount.c:118

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (nbd_index_mutex){+.+.}-{3:3}:
lock_acquire+0x182/0x4a0 kernel/locking/lockdep.c:5625
__mutex_lock_common+0x1ad/0x3770 kernel/locking/mutex.c:959
__mutex_lock kernel/locking/mutex.c:1104 [inline]
mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1119
nbd_open+0x84/0xb10 drivers/block/nbd.c:1456
blkdev_get_whole+0x94/0x500 fs/block_dev.c:1251
blkdev_get_by_dev+0x339/0xdc0 fs/block_dev.c:1415
blkdev_open+0x132/0x2c0 fs/block_dev.c:1510
do_dentry_open+0x7cb/0x1010 fs/open.c:826
do_open fs/namei.c:3361 [inline]
path_openat+0x28e6/0x39b0 fs/namei.c:3494
do_filp_open+0x221/0x460 fs/namei.c:3521
do_sys_openat2+0x124/0x460 fs/open.c:1195
do_sys_open fs/open.c:1211 [inline]
__do_sys_open fs/open.c:1219 [inline]
__se_sys_open fs/open.c:1215 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1215

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #0 (&disk->open_mutex){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add+0x4f9/0x5b30 kernel/locking/lockdep.c:3174
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x4476/0x6100 kernel/locking/lockdep.c:5015
lock_acquire+0x182/0x4a0 kernel/locking/lockdep.c:5625
__mutex_lock_common+0x1ad/0x3770 kernel/locking/mutex.c:959
__mutex_lock kernel/locking/mutex.c:1104 [inline]
mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1119
del_gendisk+0x86/0x610 block/genhd.c:587
nbd_dev_remove drivers/block/nbd.c:224 [inline]
nbd_put+0x8d/0x170 drivers/block/nbd.c:246

nbd_genl_connect+0x17e7/0x1aa0 drivers/block/nbd.c:1957
genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
genl_rcv_msg+0xfb4/0x13c0 net/netlink/genetlink.c:800
netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2504
genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1340
netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1929
sock_sendmsg_nosec net/socket.c:702 [inline]
sock_sendmsg net/socket.c:722 [inline]
____sys_sendmsg+0x5a2/0x900 net/socket.c:2385
___sys_sendmsg net/socket.c:2439 [inline]
__sys_sendmsg+0x319/0x400 net/socket.c:2468
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(nbd_index_mutex);
lock(&disk->open_mutex);
lock(nbd_index_mutex);
lock(&disk->open_mutex);

*** DEADLOCK ***

3 locks held by syz-executor.4/10240:
#0: ffffffff8d797230 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:810
#1: ffffffff8d7970e8 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
#1: ffffffff8d7970e8 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x125/0x13c0 net/netlink/genetlink.c:798
#2: ffffffff8ce7c048 (nbd_index_mutex){+.+.}-{3:3}, at: refcount_dec_and_mutex_lock+0x2e/0x100 lib/refcount.c:118

stack backtrace:
CPU: 1 PID: 10240 Comm: syz-executor.4 Not tainted 5.13.0-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack_lvl+0x1ae/0x29f lib/dump_stack.c:96
print_circular_bug+0xb17/0xdc0 kernel/locking/lockdep.c:2009
check_noncircular+0x2cc/0x390 kernel/locking/lockdep.c:2131
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add+0x4f9/0x5b30 kernel/locking/lockdep.c:3174
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x4476/0x6100 kernel/locking/lockdep.c:5015
lock_acquire+0x182/0x4a0 kernel/locking/lockdep.c:5625
__mutex_lock_common+0x1ad/0x3770 kernel/locking/mutex.c:959
__mutex_lock kernel/locking/mutex.c:1104 [inline]
mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1119
del_gendisk+0x86/0x610 block/genhd.c:587
nbd_dev_remove drivers/block/nbd.c:224 [inline]
nbd_put+0x8d/0x170 drivers/block/nbd.c:246

nbd_genl_connect+0x17e7/0x1aa0 drivers/block/nbd.c:1957
genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
genl_rcv_msg+0xfb4/0x13c0 net/netlink/genetlink.c:800
netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2504
genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1340
netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1929
sock_sendmsg_nosec net/socket.c:702 [inline]
sock_sendmsg net/socket.c:722 [inline]
____sys_sendmsg+0x5a2/0x900 net/socket.c:2385
___sys_sendmsg net/socket.c:2439 [inline]
__sys_sendmsg+0x319/0x400 net/socket.c:2468
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

RIP: 0033:0x4665d9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f245c406188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000020000b40 RDI: 0000000000000004
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffe78d98bcf R14: 00007f245c406300 R15: 0000000000022000


Tested on:

commit: dbe69e43 Merge tag 'net-next-5.14' of git://git.kernel.org..

git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=154930d2300000
kernel config: https://syzkaller.appspot.com/x/.config?x=fd790397a025efc4

dashboard link: https://syzkaller.appspot.com/bug?extid=9ca43ff47167c0ee3466
compiler: Debian clang version 11.0.1-2

patch: https://syzkaller.appspot.com/x/patch.diff?x=107dd5d8300000

[Christoph Hellwig]

On Mon, Jul 05, 2021 at 02:00:17PM +0800, Guoqing Jiang wrote:
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index 614d82e7fae4..d2548d36bf21 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -222,8 +222,8 @@ static void nbd_dev_remove(struct nbd_device *nbd)
>
>         if (disk) {
>                 del_gendisk(disk);
> -               blk_mq_free_tag_set(&nbd->tag_set);
>                 blk_cleanup_disk(disk);
> +               blk_mq_free_tag_set(&nbd->tag_set);
>         }
>
> Also paride/pd.c needs the same change, is my understanding correct?
> Christoph.

Yes. Do you have a patch or should I send one?

[Guoqing Jiang]

Thanks for confirm, will send it the fix for pd.c given someone has
already sent nbd part.

Guoqing