syzbot

map[ReproOpts:{
    "threaded": false,
    "repeat": false,
    "procs": 1,
    "sandbox": "none",
    "fault_call": -1,
    "fault_nth": 0,
    "leak": false,
    "netdev": true,
    "close_fds": true
} ReproSyz:r0 = socket(0x10, 0x3, 0x10)
r1 = socket(0x1, 0x1, 0x0)
bind(r1, &(0x7f0000000000)={0x1, '\x00syz'}, 0x5)
listen(r1, 0x1)
r2 = socket(0x1, 0x1, 0x0)
connect(r2, &(0x7f0000000000)={0x1, '\x00syz'}, 0x5)
r3 = accept(r1, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000020)='/dev/nbd0\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id(&(0x7f0000000040)='nbd\x00')
sendmsg(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000000040)=[{&(0x7f0000000080)={0x40, 0x0, 0x0, 0x0}, 0x4}, {&(0x7f0000000084)=r4, 0x2}, {&(0x7f0000000086)={0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x2, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x7, 0x80, 0x8, 0x0, 0x1, 0x0}, 0x36}, {&(0x7f00000000bc)=r2, 0x4}], 0x4, 0x0, 0x0, 0x0}, 0x0)
sendmsg(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000000140)=[{&(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0}, 0x4}, {&(0x7f0000000184)=r4, 0x2}, {&(0x7f0000000186)={0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x16}], 0x3, 0x0, 0x0, 0x0}, 0x0)
 SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/e08610c461f588d45ad77564f36da2c79fc501a6]

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/2ab1c081cfb65ada95c18573b109cf241eb4ed9f]

gemini-3-pro-preview

map[ReproOpts:{
    "threaded": false,
    "repeat": false,
    "procs": 1,
    "sandbox": "none",
    "fault_call": -1,
    "fault_nth": 0,
    "leak": false,
    "netdev": true,
    "close_fds": true
}]

You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.




Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Title: possible deadlock in nbd_disconnect_and_put

Original Crash Report:
block nbd1: NBD_DISCONNECT
block nbd1: Disconnected due to user request.
block nbd1: shutting down sockets
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.1.1462/9805 is trying to acquire lock:
ffff8880271c7948 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: touch_wq_lockdep_map+0xb5/0x180 kernel/workqueue.c:3994

but task is already holding lock:
ffff888027014278 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_disconnect_and_put+0x2f/0x2c0 drivers/block/nbd.c:2256

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&nbd->config_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:614 [inline]
       __mutex_lock+0x19f/0x1300 kernel/locking/mutex.c:776
       refcount_dec_and_mutex_lock+0x30/0xa0 lib/refcount.c:118
       nbd_config_put+0x2c/0x580 drivers/block/nbd.c:1434
       recv_work+0x1cc1/0x1d90 drivers/block/nbd.c:1026
       process_one_work+0x949/0x1650 kernel/workqueue.c:3279
       process_scheduled_works kernel/workqueue.c:3362 [inline]
       worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
       kthread+0x388/0x470 kernel/kthread.c:467
       ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #1 ((work_completion)(&args->work)#3){+.+.}-{0:0}:
       process_one_work+0x895/0x1650 kernel/workqueue.c:3255
       process_scheduled_works kernel/workqueue.c:3362 [inline]
       worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
       kthread+0x388/0x470 kernel/kthread.c:467
       ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 ((wq_completion)nbd1-recv){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3165 [inline]
       check_prevs_add kernel/locking/lockdep.c:3284 [inline]
       validate_chain kernel/locking/lockdep.c:3908 [inline]
       __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
       lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
       touch_wq_lockdep_map+0xcb/0x180 kernel/workqueue.c:3994
       __flush_workqueue+0x14b/0x14f0 kernel/workqueue.c:4036
       nbd_disconnect_and_put+0x9e/0x2c0 drivers/block/nbd.c:2264
       nbd_genl_disconnect+0x4a9/0x590 drivers/block/nbd.c:2303
       genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
       genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
       genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
       netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
       genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
       netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
       netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
       sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
       __sock_sendmsg net/socket.c:752 [inline]
       ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
       ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
       __sys_sendmsg net/socket.c:2696 [inline]
       __do_sys_sendmsg net/socket.c:2701 [inline]
       __se_sys_sendmsg net/socket.c:2699 [inline]
       __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  (wq_completion)nbd1-recv --> (work_completion)(&args->work)#3 --> &nbd->config_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&nbd->config_lock);
                               lock((work_completion)(&args->work)#3);
                               lock(&nbd->config_lock);
  lock((wq_completion)nbd1-recv);

 *** DEADLOCK ***

3 locks held by syz.1.1462/9805:
 #0: ffffffff8fe5ba70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
 #1: ffffffff8fe5b888 (genl_mutex){+.+.}-{4:4}, at: genl_lock net/netlink/genetlink.c:35 [inline]
 #1: ffffffff8fe5b888 (genl_mutex){+.+.}-{4:4}, at: genl_op_lock net/netlink/genetlink.c:60 [inline]
 #1: ffffffff8fe5b888 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 net/netlink/genetlink.c:1209
 #2: ffff888027014278 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_disconnect_and_put+0x2f/0x2c0 drivers/block/nbd.c:2256

stack backtrace:
CPU: 0 UID: 0 PID: 9805 Comm: syz.1.1462 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043
 check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
 check_prev_add kernel/locking/lockdep.c:3165 [inline]
 check_prevs_add kernel/locking/lockdep.c:3284 [inline]
 validate_chain kernel/locking/lockdep.c:3908 [inline]
 __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
 touch_wq_lockdep_map+0xcb/0x180 kernel/workqueue.c:3994
 __flush_workqueue+0x14b/0x14f0 kernel/workqueue.c:4036
 nbd_disconnect_and_put+0x9e/0x2c0 drivers/block/nbd.c:2264
 nbd_genl_disconnect+0x4a9/0x590 drivers/block/nbd.c:2303
 genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
 __sock_sendmsg net/socket.c:752 [inline]
 ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
 __sys_sendmsg net/socket.c:2696 [inline]
 __do_sys_sendmsg net/socket.c:2701 [inline]
 __se_sys_sendmsg net/socket.c:2699 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f496959bf79
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f496a4cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f4969816090 RCX: 00007f496959bf79
RDX: 00000000000000c0 RSI: 0000200000000280 RDI: 0000000000000004
RBP: 00007f49696327e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4969816128 R14: 00007f4969816090 R15: 00007ffd35895958
 </TASK>


The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt

r0 = socket(0x10, 0x3, 0x10)
r1 = socket(0x1, 0x1, 0x0)
bind(r1, &(0x7f0000000000)={0x1, '\x00syz'}, 0x5)
listen(r1, 0x1)
r2 = socket(0x1, 0x1, 0x0)
connect(r2, &(0x7f0000000000)={0x1, '\x00syz'}, 0x5)
r3 = accept(r1, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000020)='/dev/nbd0\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id(&(0x7f0000000040)='nbd\x00')
sendmsg(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000000040)=[{&(0x7f0000000080)={0x40, 0x0, 0x0, 0x0}, 0x4}, {&(0x7f0000000084)=r4, 0x2}, {&(0x7f0000000086)={0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x2, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x7, 0x80, 0x8, 0x0, 0x1, 0x0}, 0x36}, {&(0x7f00000000bc)=r2, 0x4}], 0x4, 0x0, 0x0, 0x0}, 0x0)
sendmsg(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000000140)=[{&(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0}, 0x4}, {&(0x7f0000000184)=r4, 0x2}, {&(0x7f0000000186)={0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x16}], 0x3, 0x0, 0x0, 0x0}, 0x0)

gemini-3-pro-preview

							input: 5440
							output: 94
							thoughts: 19566
						

**Deadlock Reproduction in NBD with Netlink Disconnect**

Okay, so the goal here is to trigger that nasty deadlock in `nbd_disconnect_and_put`. The crash report points to a circular dependency between `nbd->config_lock` and the workqueue lock used by `(wq_completion)nbd1-recv`. Basically, `nbd_disconnect_and_put` wants to flush the workqueue *while* holding `nbd->config_lock`, and a worker thread (likely `recv_work`) is trying to grab `nbd->config_lock` while *already* holding the workqueue lock. It’s a classic, recipe-for-disaster kind of deadlock, but deterministic.

The key is in `nbd_genl_disconnect`. That netlink call triggers the disconnect, and the crash report says it's happening over Generic Netlink. The steps I've identified are: get a connected NBD device; a `recv_work` process that's alive and listening for more requests; then send the disconnect command via netlink. `recv_work` calls `nbd_config_put` when it stops listening (e.g. shutdown) so that's the key: shutdown and the race.

The program's logic: We'll open a netlink socket, connect a *pair* of UNIX domain sockets (one for the NBD connection that'll create `recv_work`), resolve the NBD family ID (using `syz_genetlink_get_family_id`), and then send the connect command. The NBD connect message will provide one of the UNIX domain sockets, as usual. Now we fire a disconnect message on the same netlink socket. Crucially, the shutdown will happen when the lock is held.

Specifically, the `sendmsg` syscalls are the ones that are critical to reproducing this condition.

So, let's think about how the code actually gets this deadlock. `recv_work` is the socket receive thread. It normally blocks on `sock_recvmsg` and goes to `nbd_config_put` to release the resources when this socket shuts down. So, a shutdown should be sent while the NBD server is processing. The netlink disconnect causes `nbd_clear_sock` that shuts down the socket. When this socket is shut down, `recv_work`'s receive call gets interrupted. It then calls `nbd_config_put`. `nbd_config_put` will try to take `nbd->config_lock`, but `nbd_disconnect_and_put` *already* holds it, waiting for `recv_work` to finish the flush which can never happen. Deadlock.

I have constructed a syzkaller program to reproduce this:

1.  Socket Pair: Create a UNIX socket pair using `socketpair`. These are our NBD connections. We create an `accept`ed and `connect`ed pair of UNIX domain sockets.

2.  Netlink Socket: Open a Generic Netlink socket.

3.  Family ID: Get the NBD family ID.

4.  NBD Connect: Craft and send a `NBD_CMD_CONNECT` netlink message. This tells the kernel to *connect* to the NBD device and provides it with our first UNIX socket. We must create the netlink message with correct attributes: device index, socket file descriptor (the unix socket).

5.  NBD Disconnect: Craft and send a `NBD_CMD_DISCONNECT` netlink message, this time using the Generic Netlink socket.

I will use two `sendmsg` syscalls to send the two messages.
The syzkaller description should look something like:

```
r0 = socket(0x10, 0x3, 0x10) // NETLINK_GENERIC
r1 = socket(0x1, 0x1, 0x0)
bind(r1, &(0x7f0000000000)={0x1, '\x00syz'}, 0x5)
listen(r1, 0x1)
r2 = socket(0x1, 0x1, 0x0)
connect(r2, &(0x7f0000000000)={0x1, '\x00syz'}, 0x5)
r3 = accept(r1, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000020)='/dev/nbd0\x00', 0x0, 0x0)

map[ReproOpts:{
    "threaded": false,
    "repeat": false,
    "procs": 1,
    "sandbox": "none",
    "fault_call": -1,
    "fault_nth": 0,
    "leak": false,
    "netdev": true,
    "close_fds": true
}]

map[ReproOpts:{
    "threaded": false,
    "repeat": false,
    "procs": 1,
    "sandbox": "none",
    "fault_call": -1,
    "fault_nth": 0,
    "leak": false,
    "netdev": true,
    "close_fds": true
}]

gemini-3-pro-preview

							input: 26215
							output: 1056
							thoughts: 0