====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.0.5761/18490 is trying to acquire lock: ffffffff8fe8de00 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline] ffffffff8fe8de00 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4636 [inline] ffffffff8fe8de00 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:4974 [inline] ffffffff8fe8de00 (fs_reclaim){+.+.}-{0:0}, at: __do_kmalloc_node mm/slub.c:5413 [inline] ffffffff8fe8de00 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_noprof+0xbc/0x710 mm/slub.c:5439 but task is already holding lock: ffff8880270e9bc0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:619 [inline] ffff8880270e9bc0 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:441 [inline] ffff8880270e9bc0 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 mm/mmap_lock.c:501 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #7 (&mm->mmap_lock){++++}-{4:4}: __might_fault+0xcb/0x130 mm/memory.c:7482 _inline_copy_from_user include/linux/uaccess.h:169 [inline] _copy_from_user+0x28/0xb0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:222 [inline] csum_and_copy_from_user include/net/checksum.h:31 [inline] copy_from_user_iter_csum net/core/skbuff.c:7623 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] csum_and_copy_from_iter_full+0x210/0x1fb0 net/core/skbuff.c:7635 ip_generic_getfrag+0x149/0x2d0 net/ipv4/ip_output.c:949 __ip6_append_data+0x3b26/0x40c0 net/ipv6/ip6_output.c:1736 ip6_append_data+0x108/0x270 net/ipv6/ip6_output.c:1891 rawv6_sendmsg+0x1298/0x18c0 net/ipv6/raw.c:913 sock_sendmsg_nosec+0x10f/0x190 net/socket.c:801 __sock_sendmsg net/socket.c:818 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2715 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769 __sys_sendmsg net/socket.c:2801 [inline] __do_sys_sendmsg net/socket.c:2806 [inline] __se_sys_sendmsg net/socket.c:2804 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: lock_sock_nested+0x41/0x100 net/core/sock.c:3908 lock_sock include/net/sock.h:1717 [inline] inet_shutdown+0x6a/0x390 net/ipv4/af_inet.c:910 nbd_mark_nsock_dead+0x2cb/0x550 drivers/block/nbd.c:319 sock_shutdown+0x15e/0x260 drivers/block/nbd.c:420 nbd_clear_sock+0x24/0x170 drivers/block/nbd.c:1463 nbd_config_put+0x477/0x7e0 drivers/block/nbd.c:1492 nbd_genl_connect+0x19b8/0x1cd0 drivers/block/nbd.c:2319 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2576 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x8ef/0xa80 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x7f0/0xb20 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800 __sock_sendmsg net/socket.c:818 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2715 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769 __sys_sendmsg net/socket.c:2801 [inline] __do_sys_sendmsg net/socket.c:2806 [inline] __se_sys_sendmsg net/socket.c:2804 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #5 (&nsock->tx_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 nbd_handle_cmd drivers/block/nbd.c:1143 [inline] nbd_queue_rq+0x373/0xff0 drivers/block/nbd.c:1207 blk_mq_dispatch_rq_list+0x499/0x1990 block/blk-mq.c:2130 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline] __blk_mq_sched_dispatch_requests+0xd36/0x1580 block/blk-mq-sched.c:307 blk_mq_sched_dispatch_requests+0xd7/0x190 block/blk-mq-sched.c:329 blk_mq_run_work_fn+0x167/0x2f0 block/blk-mq.c:2545 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #4 (&cmd->lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 nbd_queue_rq+0xc1/0xff0 drivers/block/nbd.c:1199 blk_mq_dispatch_rq_list+0x499/0x1990 block/blk-mq.c:2130 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline] __blk_mq_sched_dispatch_requests+0xd36/0x1580 block/blk-mq-sched.c:307 blk_mq_sched_dispatch_requests+0xd7/0x190 block/blk-mq-sched.c:329 blk_mq_run_work_fn+0x167/0x2f0 block/blk-mq.c:2545 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #3 (set->srcu){.+.+}-{0:0}: srcu_lock_sync include/linux/srcu.h:225 [inline] __synchronize_srcu+0xca/0x2f0 kernel/rcu/srcutree.c:1662 elevator_switch+0x1e8/0x7b0 block/elevator.c:576 elevator_change+0x2fa/0x480 block/elevator.c:681 elevator_set_default+0x375/0x440 block/elevator.c:754 blk_register_queue+0x404/0x4f0 block/blk-sysfs.c:992 __add_disk+0x6b8/0xdb0 block/genhd.c:531 add_disk_fwnode+0x100/0x3a0 block/genhd.c:600 add_disk include/linux/blkdev.h:798 [inline] nbd_dev_add+0x733/0xb60 drivers/block/nbd.c:2026 nbd_init+0x168/0x1f0 drivers/block/nbd.c:2743 do_one_initcall+0x250/0x870 init/main.c:1362 do_initcall_level+0x10a/0x1a0 init/main.c:1424 do_initcalls+0x59/0xa0 init/main.c:1440 kernel_init_freeable+0x29d/0x3e0 init/main.c:1675 kernel_init+0x22/0x1d0 init/main.c:1565 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #2 (&q->elevator_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 elevator_change+0x1af/0x480 block/elevator.c:679 elevator_set_none+0xb5/0x140 block/elevator.c:769 blk_mq_elv_switch_none block/blk-mq.c:5113 [inline] __blk_mq_update_nr_hw_queues block/blk-mq.c:5158 [inline] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 block/blk-mq.c:5223 nbd_start_device+0x189/0xb30 drivers/block/nbd.c:1530 nbd_genl_connect+0x167d/0x1cd0 drivers/block/nbd.c:2310 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2576 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x8ef/0xa80 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x7f0/0xb20 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800 __sock_sendmsg net/socket.c:818 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2715 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769 __sys_sendmsg net/socket.c:2801 [inline] __do_sys_sendmsg net/socket.c:2806 [inline] __se_sys_sendmsg net/socket.c:2804 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&q->q_usage_counter(io)#52){++++}-{0:0}: blk_alloc_queue+0x544/0x690 block/blk-core.c:504 blk_mq_alloc_queue block/blk-mq.c:4431 [inline] __blk_mq_alloc_disk+0x194/0x390 block/blk-mq.c:4478 nbd_dev_add+0x494/0xb60 drivers/block/nbd.c:1996 nbd_init+0x168/0x1f0 drivers/block/nbd.c:2743 do_one_initcall+0x250/0x870 init/main.c:1362 do_initcall_level+0x10a/0x1a0 init/main.c:1424 do_initcalls+0x59/0xa0 init/main.c:1440 kernel_init_freeable+0x29d/0x3e0 init/main.c:1675 kernel_init+0x22/0x1d0 init/main.c:1565 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #0 (fs_reclaim){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline] fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4389 might_alloc include/linux/sched/mm.h:316 [inline] slab_pre_alloc_hook mm/slub.c:4636 [inline] slab_alloc_node mm/slub.c:4974 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0xbc/0x710 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] task_numa_fault+0x340d/0x4010 kernel/sched/fair.c:4165 do_numa_page mm/memory.c:6375 [inline] handle_pte_fault mm/memory.c:6571 [inline] __handle_mm_fault mm/memory.c:6707 [inline] handle_mm_fault+0x2a63/0x3750 mm/memory.c:6876 do_user_addr_fault+0x7f6/0x1480 arch/x86/mm/fault.c:1394 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 __get_user_8+0x14/0x30 arch/x86/lib/getuser.S:98 fetch_robust_entry kernel/futex/core.c:1136 [inline] exit_robust_list+0x58/0x2b0 kernel/futex/core.c:1163 futex_cleanup kernel/futex/core.c:1470 [inline] futex_exit_exec_release+0x14f/0x1f0 kernel/futex/core.c:1571 mm_exit_exec_release+0x20/0x290 kernel/fork.c:1513 exit_mm+0x50/0x240 kernel/exit.c:556 do_exit+0x6a8/0x2360 kernel/exit.c:967 do_group_exit+0x22d/0x2f0 kernel/exit.c:1123 get_signal+0x1216/0x12c0 kernel/signal.c:3112 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(&mm->mmap_lock); lock(sk_lock-AF_INET6); lock(&mm->mmap_lock); lock(fs_reclaim); *** DEADLOCK *** locks held by syz.0.5761/18490: 2, last CPU#0: #0: ffff88801ebc94b8 (&tsk->futex.exit_mutex){+.+.}-{4:4}, at: futex_cleanup_begin kernel/futex/core.c:1521 [inline] #0: ffff88801ebc94b8 (&tsk->futex.exit_mutex){+.+.}-{4:4}, at: futex_exit_exec_release+0x38/0x1f0 kernel/futex/core.c:1570 #1: ffff8880270e9bc0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:619 [inline] #1: ffff8880270e9bc0 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:441 [inline] #1: ffff8880270e9bc0 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 mm/mmap_lock.c:501 stack backtrace: CPU: 0 UID: 0 PID: 18490 Comm: syz.0.5761 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219 check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline] fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4389 might_alloc include/linux/sched/mm.h:316 [inline] slab_pre_alloc_hook mm/slub.c:4636 [inline] slab_alloc_node mm/slub.c:4974 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0xbc/0x710 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] task_numa_fault+0x340d/0x4010 kernel/sched/fair.c:4165 do_numa_page mm/memory.c:6375 [inline] handle_pte_fault mm/memory.c:6571 [inline] __handle_mm_fault mm/memory.c:6707 [inline] handle_mm_fault+0x2a63/0x3750 mm/memory.c:6876 do_user_addr_fault+0x7f6/0x1480 arch/x86/mm/fault.c:1394 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:__get_user_8+0x14/0x30 arch/x86/lib/getuser.S:101 Code: ca e9 00 6a 04 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <48> 8b 10 31 c0 0f 01 ca e9 cf 69 04 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc9000a0bf9e8 EFLAGS: 00050287 RAX: 00007f653879e9a0 RBX: ffff88801ebc9430 RCX: 0000000000000046 RDX: 00007ffffffff000 RSI: ffffffff8e70fdbb RDI: ffffffff8c6e1780 RBP: dffffc0000000000 R08: ffffffff82203d7f R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff22f8258 R12: ffff88801ebc8000 R13: ffff88801ebc8000 R14: ffff88801ebc9430 R15: 00007f653879e9a0 fetch_robust_entry kernel/futex/core.c:1136 [inline] exit_robust_list+0x58/0x2b0 kernel/futex/core.c:1163 futex_cleanup kernel/futex/core.c:1470 [inline] futex_exit_exec_release+0x14f/0x1f0 kernel/futex/core.c:1571 mm_exit_exec_release+0x20/0x290 kernel/fork.c:1513 exit_mm+0x50/0x240 kernel/exit.c:556 do_exit+0x6a8/0x2360 kernel/exit.c:967 do_group_exit+0x22d/0x2f0 kernel/exit.c:1123 get_signal+0x1216/0x12c0 kernel/signal.c:3112 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f653799f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f653879e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: fffffffffffffffc RBX: 00007f6537c25fa0 RCX: 00007f653799f559 RDX: 0000000000000050 RSI: 0000200000001780 RDI: 000000000000000a RBP: 00007f6537a36b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6537c26038 R14: 00007f6537c25fa0 R15: 00007fffc361a368 ---------------- Code disassembly (best guess): 0: ca e9 00 lret $0xe9 3: 6a 04 push $0x4 5: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax) b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 48 ba 00 f0 ff ff ff movabs $0x7ffffffff000,%rdx 1d: 7f 00 00 20: 48 39 d0 cmp %rdx,%rax 23: 48 0f 47 c2 cmova %rdx,%rax 27: 0f 01 cb stac * 2a: 48 8b 10 mov (%rax),%rdx <-- trapping instruction 2d: 31 c0 xor %eax,%eax 2f: 0f 01 ca clac 32: e9 cf 69 04 00 jmp 0x46a06 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop