[v6.1] possible deadlock in rds_trans_get_preferred

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a500ba24937a Linux 6.1.189
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1777ce8e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad298832474de60c
dashboard link: https://syzkaller.appspot.com/bug?extid=d01310e5d04c3cde5239
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e278ec6c88b0/disk-a500ba24.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e95551d48fd4/vmlinux-a500ba24.xz
kernel image: https://storage.googleapis.com/syzbot-assets/64269add15d8/Image-a500ba24.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d01310...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/1:3/4407 is trying to acquire lock:
ffff800018caa470 (rds_trans_sem){++++}-{3:3}, at: rds_trans_get_preferred+0xfc/0x328 net/rds/transport.c:100

but task is already holding lock:
ffff0000c4326420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x1e14/0x4218 drivers/infiniband/core/cma.c:2407

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&id_priv->handler_mutex/1){+.+.}-{3:3}:
__mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
cma_ib_req_handler+0x1e14/0x4218 drivers/infiniband/core/cma.c:2407
cm_process_work+0x58/0x3f4 drivers/infiniband/core/cm.c:1854
cm_queue_work_unlock+0x11c/0x1fc drivers/infiniband/core/cm.c:917
cm_req_handler drivers/infiniband/core/cm.c:2220 [inline]
cm_work_handler+0x7a48/0xd024 drivers/infiniband/core/cm.c:3869
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #1 (&id_priv->handler_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
rdma_destroy_id+0x24/0x3c drivers/infiniband/core/cma.c:2080
rds_ib_laddr_check_cm net/rds/ib.c:491 [inline]
rds_ib_laddr_check+0x3c4/0x4d0 net/rds/ib.c:513
rds_trans_get_preferred+0x134/0x328 net/rds/transport.c:104
rds_bind+0x4fc/0x6a4 net/rds/bind.c:254
__sys_bind+0x1f8/0x2a4 net/socket.c:1811
__do_sys_bind net/socket.c:1822 [inline]
__se_sys_bind net/socket.c:1820 [inline]
__arm64_sys_bind+0x7c/0x94 net/socket.c:1820
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #0 (rds_trans_sem){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3162 [inline]
check_prevs_add kernel/locking/lockdep.c:3281 [inline]
validate_chain kernel/locking/lockdep.c:3897 [inline]
__lock_acquire+0x3504/0x7280 kernel/locking/lockdep.c:5171
lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790
down_read+0x64/0x300 kernel/locking/rwsem.c:1520
rds_trans_get_preferred+0xfc/0x328 net/rds/transport.c:100
__rds_conn_create+0x8bc/0x1944 net/rds/connection.c:250
rds_conn_create+0x60/0x7c net/rds/connection.c:364
rds_ib_cm_handle_connect+0x470/0xf88 net/rds/ib_cm.c:860
rds_rdma_cm_event_handler_cmn+0x3d8/0x7b4 net/rds/rdma_transport.c:85
rds_rdma_cm_event_handler+0x2c/0x3c net/rds/rdma_transport.c:186
cma_listen_handler+0x104/0x13c drivers/infiniband/core/cma.c:2674
cma_cm_event_handler+0xb8/0x400 drivers/infiniband/core/cma.c:2137
cma_ib_req_handler+0x2318/0x4218 drivers/infiniband/core/cma.c:2418
cm_process_work+0x58/0x3f4 drivers/infiniband/core/cm.c:1854
cm_queue_work_unlock+0x11c/0x1fc drivers/infiniband/core/cm.c:917
cm_req_handler drivers/infiniband/core/cm.c:2220 [inline]
cm_work_handler+0x7a48/0xd024 drivers/infiniband/core/cm.c:3869
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

other info that might help us debug this:

Chain exists of:
rds_trans_sem --> &id_priv->handler_mutex --> &id_priv->handler_mutex/1

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&id_priv->handler_mutex/1);
lock(&id_priv->handler_mutex);
lock(&id_priv->handler_mutex/1);
rlock(rds_trans_sem);

*** DEADLOCK ***

4 locks held by kworker/1:3/4407:
#0: ffff0000d4238138 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff8000223b7c40 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2: ffff0000da31c420 (&id_priv->handler_mutex){+.+.}-{3:3}, at: cma_ib_req_handler+0x1a98/0x4218 drivers/infiniband/core/cma.c:2384
#3: ffff0000c4326420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x1e14/0x4218 drivers/infiniband/core/cma.c:2407

stack backtrace:
CPU: 1 PID: 4407 Comm: kworker/1:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: ib_cm cm_work_handler
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2088
check_noncircular+0x290/0x370 kernel/locking/lockdep.c:2215
check_prev_add kernel/locking/lockdep.c:3162 [inline]
check_prevs_add kernel/locking/lockdep.c:3281 [inline]
validate_chain kernel/locking/lockdep.c:3897 [inline]
__lock_acquire+0x3504/0x7280 kernel/locking/lockdep.c:5171
lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790
down_read+0x64/0x300 kernel/locking/rwsem.c:1520
rds_trans_get_preferred+0xfc/0x328 net/rds/transport.c:100
__rds_conn_create+0x8bc/0x1944 net/rds/connection.c:250
rds_conn_create+0x60/0x7c net/rds/connection.c:364
rds_ib_cm_handle_connect+0x470/0xf88 net/rds/ib_cm.c:860
rds_rdma_cm_event_handler_cmn+0x3d8/0x7b4 net/rds/rdma_transport.c:85
rds_rdma_cm_event_handler+0x2c/0x3c net/rds/rdma_transport.c:186
cma_listen_handler+0x104/0x13c drivers/infiniband/core/cma.c:2674
cma_cm_event_handler+0xb8/0x400 drivers/infiniband/core/cma.c:2137
cma_ib_req_handler+0x2318/0x4218 drivers/infiniband/core/cma.c:2418
cm_process_work+0x58/0x3f4 drivers/infiniband/core/cm.c:1854
cm_queue_work_unlock+0x11c/0x1fc drivers/infiniband/core/cm.c:917
cm_req_handler drivers/infiniband/core/cm.c:2220 [inline]
cm_work_handler+0x7a48/0xd024 drivers/infiniband/core/cm.c:3869
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: cecd39af8a1a Linux 6.6.159
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15141621580000
kernel config: https://syzkaller.appspot.com/x/.config?x=efe95d6e6ac7ee37
dashboard link: https://syzkaller.appspot.com/bug?extid=6bc07e4595f00bee60fa
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/0dd9a4d694bb/disk-cecd39af.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/424ddfa385b0/vmlinux-cecd39af.xz
kernel image: https://storage.googleapis.com/syzbot-assets/039829778ad0/bzImage-cecd39af.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+6bc07e...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------

kworker/1:0/21059 is trying to acquire lock:
ffffffff8f408690 (rds_trans_sem){++++}-{3:3}, at: rds_trans_get_preferred+0x133/0x3b0 net/rds/transport.c:100

but task is already holding lock:

ffff88805aed0420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x2dd4/0x50b0 drivers/infiniband/core/cma.c:2430

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&id_priv->handler_mutex/1){+.+.}-{3:3}:

__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
cma_ib_req_handler+0x2dd4/0x50b0 drivers/infiniband/core/cma.c:2430
cm_process_work+0x4b/0x410 drivers/infiniband/core/cm.c:1854
cm_req_handler drivers/infiniband/core/cm.c:2220 [inline]
cm_work_handler+0x9bbe/0xea50 drivers/infiniband/core/cm.c:3869
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

-> #1 (&id_priv->handler_mutex){+.+.}-{3:3}:

__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
rdma_destroy_id+0x1b/0x30 drivers/infiniband/core/cma.c:2103
rds_ib_laddr_check_cm net/rds/ib.c:491 [inline]
rds_ib_laddr_check+0x3e1/0x6b0 net/rds/ib.c:513
rds_trans_get_preferred+0x173/0x3b0 net/rds/transport.c:104
rds_bind+0x690/0x870 net/rds/bind.c:254
__sys_bind+0x2f0/0x3f0 net/socket.c:1856
__do_sys_bind net/socket.c:1867 [inline]
__se_sys_bind net/socket.c:1865 [inline]
__x64_sys_bind+0x7a/0x90 net/socket.c:1865
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

-> #0 (rds_trans_sem){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3162 [inline]
check_prevs_add kernel/locking/lockdep.c:3281 [inline]
validate_chain kernel/locking/lockdep.c:3897 [inline]

__lock_acquire+0x3a07/0x7eb0 kernel/locking/lockdep.c:5171
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5790
down_read+0x46/0x2e0 kernel/locking/rwsem.c:1520
rds_trans_get_preferred+0x133/0x3b0 net/rds/transport.c:100
__rds_conn_create+0xa1e/0x1fe0 net/rds/connection.c:250
rds_conn_create+0x43/0x60 net/rds/connection.c:364
rds_ib_cm_handle_connect+0x478/0x10d0 net/rds/ib_cm.c:860
rds_rdma_cm_event_handler_cmn+0x648/0x9a0 net/rds/rdma_transport.c:85
cma_cm_event_handler+0xa6/0x290 drivers/infiniband/core/cma.c:2160
cma_ib_req_handler+0x3435/0x50b0 drivers/infiniband/core/cma.c:2441
cm_process_work+0x4b/0x410 drivers/infiniband/core/cm.c:1854
cm_req_handler drivers/infiniband/core/cm.c:2220 [inline]
cm_work_handler+0x9bbe/0xea50 drivers/infiniband/core/cm.c:3869
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

other info that might help us debug this:

Chain exists of:
rds_trans_sem --> &id_priv->handler_mutex --> &id_priv->handler_mutex/1

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&id_priv->handler_mutex/1);
lock(&id_priv->handler_mutex);
lock(&id_priv->handler_mutex/1);
rlock(rds_trans_sem);

*** DEADLOCK ***

4 locks held by kworker/1:0/21059:
#0: ffff88802b9fcd38 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88802b9fcd38 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000d467d00 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000d467d00 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffff8880265dc420 (&id_priv->handler_mutex){+.+.}-{3:3}, at: cma_ib_req_handler+0x2186/0x50b0 drivers/infiniband/core/cma.c:2407
#3: ffff88805aed0420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x2dd4/0x50b0 drivers/infiniband/core/cma.c:2430

stack backtrace:
CPU: 1 PID: 21059 Comm: kworker/1:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: ib_cm cm_work_handler
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
check_noncircular+0x2fc/0x400 kernel/locking/lockdep.c:2215

check_prev_add kernel/locking/lockdep.c:3162 [inline]
check_prevs_add kernel/locking/lockdep.c:3281 [inline]
validate_chain kernel/locking/lockdep.c:3897 [inline]

__lock_acquire+0x3a07/0x7eb0 kernel/locking/lockdep.c:5171
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5790
down_read+0x46/0x2e0 kernel/locking/rwsem.c:1520
rds_trans_get_preferred+0x133/0x3b0 net/rds/transport.c:100
__rds_conn_create+0xa1e/0x1fe0 net/rds/connection.c:250
rds_conn_create+0x43/0x60 net/rds/connection.c:364
rds_ib_cm_handle_connect+0x478/0x10d0 net/rds/ib_cm.c:860
rds_rdma_cm_event_handler_cmn+0x648/0x9a0 net/rds/rdma_transport.c:85
cma_cm_event_handler+0xa6/0x290 drivers/infiniband/core/cma.c:2160
cma_ib_req_handler+0x3435/0x50b0 drivers/infiniband/core/cma.c:2441
cm_process_work+0x4b/0x410 drivers/infiniband/core/cm.c:1854
cm_req_handler drivers/infiniband/core/cm.c:2220 [inline]
cm_work_handler+0x9bbe/0xea50 drivers/infiniband/core/cm.c:3869
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
RDS/IB: Active conn connected <::ffff:172.20.20.170,::ffff:172.20.20.170,0> version 3.1
RDS/IB: Passive conn connected <::ffff:172.20.20.170,::ffff:172.20.20.170,0> version 3.1

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 79807e970724 Linux 6.1.190
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=169d0e7f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c2247e987d617e29
dashboard link: https://syzkaller.appspot.com/bug?extid=d01310e5d04c3cde5239
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150b9031580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a13c58be2909/disk-79807e97.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94c2491109d2/vmlinux-79807e97.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e79e5acd54dc/Image-79807e97.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d01310...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------

kworker/1:8/4505 is trying to acquire lock:

ffff800018caa470 (rds_trans_sem){++++}-{3:3}, at: rds_trans_get_preferred+0xfc/0x328 net/rds/transport.c:100

but task is already holding lock:

ffff0000d9032420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x1e14/0x4218 drivers/infiniband/core/cma.c:2407

4 locks held by kworker/1:8/4505:
#0: ffff0000d0c59538 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff800022117c40 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2: ffff0000dcd05420 (&id_priv->handler_mutex){+.+.}-{3:3}, at: cma_ib_req_handler+0x1a98/0x4218 drivers/infiniband/core/cma.c:2384
#3: ffff0000d9032420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x1e14/0x4218 drivers/infiniband/core/cma.c:2407

stack backtrace:
CPU: 1 PID: 4505 Comm: kworker/1:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 792fbe1537d8 Linux 5.15.223
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1061dda9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=24e573deff4d39b7
dashboard link: https://syzkaller.appspot.com/bug?extid=dd6d75cf33c5ef9bbacb

compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ac7c54df9a60/disk-792fbe15.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d6a042e367f4/vmlinux-792fbe15.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a3fa0a6dba38/bzImage-792fbe15.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+dd6d75...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------

kworker/1:1/23 is trying to acquire lock:
ffffffff8e441c10 (rds_trans_sem){++++}-{3:3}, at: rds_trans_get_preferred+0x12f/0x3a0 net/rds/transport.c:100

but task is already holding lock:

ffff8880625973b8 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x251a/0x4fd0 drivers/infiniband/core/cma.c:2270

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&id_priv->handler_mutex/1){+.+.}-{3:3}:

__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
cma_ib_req_handler+0x251a/0x4fd0 drivers/infiniband/core/cma.c:2270
cm_process_work+0x4b/0x410 drivers/infiniband/core/cm.c:1859
cm_req_handler drivers/infiniband/core/cm.c:2222 [inline]
cm_work_handler+0x9a26/0xeb30 drivers/infiniband/core/cm.c:3873
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

-> #1 (&id_priv->handler_mutex){+.+.}-{3:3}:

__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
rdma_destroy_id+0x17/0x20 drivers/infiniband/core/cma.c:1943
rds_ib_laddr_check_cm net/rds/ib.c:491 [inline]
rds_ib_laddr_check+0x3c1/0x680 net/rds/ib.c:513
rds_trans_get_preferred+0x16f/0x3a0 net/rds/transport.c:104
rds_bind+0x68c/0x870 net/rds/bind.c:254
__sys_bind+0x2e9/0x3e0 net/socket.c:1730
__do_sys_bind net/socket.c:1741 [inline]
__se_sys_bind net/socket.c:1739 [inline]
__x64_sys_bind+0x76/0x80 net/socket.c:1739
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

-> #0 (rds_trans_sem){++++}-{3:3}:

check_prev_add kernel/locking/lockdep.c:3120 [inline]
check_prevs_add kernel/locking/lockdep.c:3239 [inline]
validate_chain kernel/locking/lockdep.c:3855 [inline]
__lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120
lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737
down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498
rds_trans_get_preferred+0x12f/0x3a0 net/rds/transport.c:100
__rds_conn_create+0x9bc/0x1ea0 net/rds/connection.c:250
rds_conn_create+0x3f/0x50 net/rds/connection.c:364
rds_ib_cm_handle_connect+0x474/0x10d0 net/rds/ib_cm.c:860
rds_rdma_cm_event_handler_cmn+0x454/0x8e0 net/rds/rdma_transport.c:85
cma_cm_event_handler+0xa6/0x290 drivers/infiniband/core/cma.c:2000
cma_ib_req_handler+0x2c49/0x4fd0 drivers/infiniband/core/cma.c:2281
cm_process_work+0x4b/0x410 drivers/infiniband/core/cm.c:1859
cm_req_handler drivers/infiniband/core/cm.c:2222 [inline]
cm_work_handler+0x9a26/0xeb30 drivers/infiniband/core/cm.c:3873
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

other info that might help us debug this:

Chain exists of:
rds_trans_sem --> &id_priv->handler_mutex --> &id_priv->handler_mutex/1

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&id_priv->handler_mutex/1);
lock(&id_priv->handler_mutex);
lock(&id_priv->handler_mutex/1);
rlock(rds_trans_sem);

*** DEADLOCK ***

4 locks held by kworker/1:1/23:
#0: ffff88802b695138 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000ddfd00 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff8880640503b8 (&id_priv->handler_mutex){+.+.}-{3:3}, at: cma_ib_req_handler+0x2028/0x4fd0 drivers/infiniband/core/cma.c:2247
#3: ffff8880625973b8 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x251a/0x4fd0 drivers/infiniband/core/cma.c:2270

stack backtrace:
CPU: 1 PID: 23 Comm: kworker/1:1 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: ib_cm cm_work_handler
Call Trace:
<TASK>

dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2178
check_prev_add kernel/locking/lockdep.c:3120 [inline]
check_prevs_add kernel/locking/lockdep.c:3239 [inline]
validate_chain kernel/locking/lockdep.c:3855 [inline]
__lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120
lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737
down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498
rds_trans_get_preferred+0x12f/0x3a0 net/rds/transport.c:100
__rds_conn_create+0x9bc/0x1ea0 net/rds/connection.c:250
rds_conn_create+0x3f/0x50 net/rds/connection.c:364
rds_ib_cm_handle_connect+0x474/0x10d0 net/rds/ib_cm.c:860
rds_rdma_cm_event_handler_cmn+0x454/0x8e0 net/rds/rdma_transport.c:85
cma_cm_event_handler+0xa6/0x290 drivers/infiniband/core/cma.c:2000
cma_ib_req_handler+0x2c49/0x4fd0 drivers/infiniband/core/cma.c:2281
cm_process_work+0x4b/0x410 drivers/infiniband/core/cm.c:1859
cm_req_handler drivers/infiniband/core/cm.c:2222 [inline]
cm_work_handler+0x9a26/0xeb30 drivers/infiniband/core/cm.c:3873
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 792fbe1537d8 Linux 5.15.223
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=13a04bc9580000

kernel config: https://syzkaller.appspot.com/x/.config?x=24e573deff4d39b7
dashboard link: https://syzkaller.appspot.com/bug?extid=dd6d75cf33c5ef9bbacb
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1750f031580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ac7c54df9a60/disk-792fbe15.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d6a042e367f4/vmlinux-792fbe15.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a3fa0a6dba38/bzImage-792fbe15.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dd6d75...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------

kworker/1:4/4211 is trying to acquire lock:

ffffffff8e441c10 (rds_trans_sem){++++}-{3:3}, at: rds_trans_get_preferred+0x12f/0x3a0 net/rds/transport.c:100

but task is already holding lock:

ffff88807b1463b8 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x251a/0x4fd0 drivers/infiniband/core/cma.c:2270

4 locks held by kworker/1:4/4211:
#0: ffff88802ad78938 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc9000115fd00 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff88802111d3b8 (&id_priv->handler_mutex){+.+.}-{3:3}, at: cma_ib_req_handler+0x2028/0x4fd0 drivers/infiniband/core/cma.c:2247
#3: ffff88807b1463b8 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x251a/0x4fd0 drivers/infiniband/core/cma.c:2270

stack backtrace:
CPU: 1 PID: 4211 Comm: kworker/1:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: cecd39af8a1a Linux 6.6.159
git tree: linux-6.6.y

console output: https://syzkaller.appspot.com/x/log.txt?x=16fb5495580000

kernel config: https://syzkaller.appspot.com/x/.config?x=efe95d6e6ac7ee37
dashboard link: https://syzkaller.appspot.com/bug?extid=6bc07e4595f00bee60fa
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14d64bc9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0dd9a4d694bb/disk-cecd39af.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/424ddfa385b0/vmlinux-cecd39af.xz
kernel image: https://storage.googleapis.com/syzbot-assets/039829778ad0/bzImage-cecd39af.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6bc07e...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------

kworker/1:3/5905 is trying to acquire lock:

ffffffff8f408690 (rds_trans_sem){++++}-{3:3}, at: rds_trans_get_preferred+0x133/0x3b0 net/rds/transport.c:100

but task is already holding lock:

ffff88807b7a6420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x2dd4/0x50b0 drivers/infiniband/core/cma.c:2430

4 locks held by kworker/1:3/5905:
#0: ffff88802b840938 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88802b840938 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000337fd00 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000337fd00 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffff88807de8b420 (&id_priv->handler_mutex){+.+.}-{3:3}, at: cma_ib_req_handler+0x2186/0x50b0 drivers/infiniband/core/cma.c:2407
#3: ffff88807b7a6420 (&id_priv->handler_mutex/1){+.+.}-{3:3}, at: cma_ib_req_handler+0x2dd4/0x50b0 drivers/infiniband/core/cma.c:2430

stack backtrace:
CPU: 1 PID: 5905 Comm: kworker/1:3 Not tainted syzkaller #0