Root Cause Analysis

1. Involved Components and Functions

• Files:

  • drivers/block/nbd.c: Contains nbd_add_socket(), nbd_get_socket(), and nbd_reclassify_socket().
  • include/net/sock.h: Defines sock_allow_reclassification() and sock_lock_init_class_and_name().
  • net/ipv4/af_inet.c: Contains inet_shutdown().
  • net/core/sock.c: Contains lock_sock(), lock_sock_nested(), and release_sock().
  • kernel/locking/spinlock_debug.c: Contains debug_spin_unlock().

• Structures and Fields:

  • struct socket: Represents the BSD socket; contains struct sock *sk.
  • struct sock: Represents the network-layer socket; contains socket_lock_t sk_lock.
  • socket_lock_t: Contains spinlock slock, user ownership flag owned, waitqueue wq, and lockdep map dep_map.

2. Technical Mechanism and Trigger Sequence

1. User Socket Ingestion into NBD: In drivers/block/nbd.c, when userspace issues an ioctl such as NBD_SET_SOCK or sends a netlink connect message, nbd_add_socket() resolves the user-supplied file descriptor into a struct socket * via nbd_get_socket(nbd, arg, &err). Unlike kernel-internal sockets (e.g., in NVMe-oF or SunRPC, which are allocated via sock_create_kern() and never exposed to userspace), the NBD socket is an active, open file descriptor owned by userspace. Userspace threads can freely issue concurrent syscalls (e.g., shutdown(), send(), recv()) or attach the same socket fd across multiple NBD devices.

2. Lock Reclassification Mechanism: To prevent lockdep from flagging circular dependencies between filesystem/block memory reclaim (fs_reclaim) and socket locks (sk_lock), nbd_add_socket() invokes nbd_reclassify_socket(sock). Under #ifdef CONFIG_DEBUG_LOCK_ALLOC, this function checks whether the socket can be reclassified:

   static inline bool sock_allow_reclassification(const struct sock *csk)
   {
       struct sock *sk = (struct sock *)csk;
   
       return !sock_owned_by_user_nocheck(sk) &&
              !spin_is_locked(&sk->sk_lock.slock);
   }
   

   This check performs an unsynchronized read of sk->sk_lock.owned and sk->sk_lock.slock without acquiring either lock. Immediately after this condition evaluates to true, a concurrent thread can lock the socket.

3. Reinitialization of an Active Lock: nbd_reclassify_socket() then invokes sock_lock_init_class_and_name():

   #define sock_lock_init_class_and_name(sk, sname, skey, name, key)    \
   do {                                                                 \
       sk_owner_set(sk, THIS_MODULE);                                   \
       sk->sk_lock.owned = 0;                                           \
       init_waitqueue_head(&sk->sk_lock.wq);                            \
       spin_lock_init(&(sk)->sk_lock.slock);                            \
       debug_check_no_locks_freed((void *)&(sk)->sk_lock,               \
                                  sizeof((sk)->sk_lock));               \
       lockdep_set_class_and_name(&(sk)->sk_lock.slock,                \
                                  (skey), (sname));                     \
       lockdep_init_map(&(sk)->sk_lock.dep_map, (name), (key), 0);     \
   } while (0)
   

   Although called to update lockdep class annotations, sock_lock_init_class_and_name() was originally written for fresh socket initialization in sock_lock_init() (net/core/sock.c). Consequently, it unconditionally resets:

   • sk->sk_lock.slock via spin_lock_init() (resetting the raw spinlock to 0 and its owner to unowned).
   • sk->sk_lock.owned = 0 (resetting the user-space ownership flag).
   • sk->sk_lock.wq via init_waitqueue_head() (reinitializing the waitqueue head).

4. The Race Condition with inet_shutdown:

   • Thread 1 (runner/shutdown) calls inet_shutdown() -> release_sock(sk). Inside release_sock(), Thread 1 acquires spin_lock_bh(&sk->sk_lock.slock).
   • Thread 2 (reclassifier) enters nbd_add_socket() -> nbd_reclassify_socket(sock). Right before Thread 1 acquired the lock, sock_allow_reclassification(sk) returned true. Thread 2 calls sock_lock_init_class_and_name(), which invokes spin_lock_init(&sk->sk_lock.slock) while Thread 1 is holding slock.
   • spin_lock_init() zeroes the spinlock and marks it unlocked (SPINLOCK_OWNER_INIT).
   • Thread 1 finishes processing in release_sock() and calls spin_unlock_bh(&sk->sk_lock.slock).
   • In kernel/locking/spinlock_debug.c, debug_spin_unlock() validates lock state:

     SPIN_BUG_ON(!raw_spin_is_locked(lock), lock, "already unlocked");
     

   • Since Thread 2's spin_lock_init() cleared the locked state, SPIN_BUG_ON() triggers, resulting in the reported crash: BUG: spinlock already unlocked in inet_shutdown.

3. Configuration Guard

nbd_reclassify_socket() is explicitly guarded by #ifdef CONFIG_DEBUG_LOCK_ALLOC in drivers/block/nbd.c:

#ifdef CONFIG_DEBUG_LOCK_ALLOC
static void nbd_reclassify_socket(struct socket *sock) { ... }
#else
static inline void nbd_reclassify_socket(struct socket *sock) {}
#endif

In builds without CONFIG_DEBUG_LOCK_ALLOC (standard production kernels), nbd_reclassify_socket() compiles to an empty inline stub, so reclassification and destructive lock reinitialization do not occur.