map[EquivalenceAnalysis:The execution successfully triggered a crash that matches the expected bug. The crash report shows a `WARNING: bad unlock balance detected!` in `nvme_update_ns_info` at `blk_mq_unfreeze_queue`, which is exactly the same signature as the original bug description. The reproducer is working correctly and successfully triggers the target vulnerability. OtherCrashReports:<nil> ReproC:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }

#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    
    // Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
    for (int i = 0; i < 4; i++) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    
    // Wait a bit for controllers to connect and scan
    sleep(2);
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    // Delete controllers
    for (int i = 0; i < 16; i++) {
        char path[256];
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/delete_controller", i);
        try_write_file(path, "1");
    }
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg) {
    int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
    if (fd < 0) return NULL;

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        if (pwrite(fd, "0\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process removal
        if (pwrite(fd, "1\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process addition
    }
    close(fd);
    return NULL;
}

void* rescan_thread(void* arg) {
    int fds[16];
    int num_fds = 0;
    char path[256];

    for (int i = 0; i < 16; i++) {
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
        int fd = open(path, O_WRONLY);
        if (fd >= 0) {
            fds[num_fds++] = fd;
        }
    }

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < num_fds; i++) {
            if (pwrite(fds[i], "1\n", 2, 0) < 0) {}
        }
        usleep(1000);
    }

    for (int i = 0; i < num_fds; i++) {
        close(fds[i]);
    }
    return NULL;
}

void* open_close_thread(void* arg) {
    char path[256];
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < 4; i++) {
            snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
            int fd = open(path, O_RDONLY);
            if (fd >= 0) {
                close(fd);
            }
        }
        usleep(1000);
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t tt;
        pthread_t rt[2];
        pthread_t ot[2];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        pthread_create(&tt, NULL, toggle_ns_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&ot[i], NULL, open_close_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        pthread_join(tt, NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(ot[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
 Reproduced:true ReproducedBugTitle:WARNING: bad unlock balance in nvme_update_ns_info ReproducedCrashReport:=====================================
WARNING: bad unlock balance detected!
syzkaller #1 Not tainted
-------------------------------------
kworker/u10:5/1108 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff8664416f>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff8664416f>] nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u10:5/1108: 2, last CPU#1:
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 1108 Comm: kworker/u10:5 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme0: rescanning namespaces.
]

map[KernelSrc:/app/workdir/cache/src/20d9ae00756873be8ea4af075d57f372071e0017]

map[KernelObj:/app/workdir/cache/build/86cd5aaced85992f6cd1c9ea6408a7cf6f544ad1]

map[Index:codesearch-index]

deep-reasoning

You are a security researcher with deep Linux kernel background.
Your goal is to analyze a Linux kernel bug description and propose a strategy to reproduce it
with a minimal, standalone C program for the strictly defensive purpose of verifying a bugfix.

=== TOOL SELECTION GUIDELINES ===
- When looking up C function or struct definitions, prefer codesearch-definition-source
  and codesearch-struct-layout first.
- Fall back to read-file or grepper only if symbol lookup fails or when inspecting macros,
  headers, or non-C files.

=== CRITICAL PROHIBITIONS ===
- Do NOT propose an exploit. Focus solely on minimal technical reproduction of the bug state.
- Do NOT write long explanations. Keep your analysis and strategy proposal concise.
- Do NOT assume that the target bug has already been fixed just because a git commit title
  or description mentions a similar bug or fix. Commit messages often reference related issues
  or partial fixes. Proceed with proposing a reproduction strategy regardless of historical fix commits.
Prefer calling several tools at the same time to save round-trips.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

### Analysis of the Bug

The bug is a race condition in the block layer's lockdep annotations for queue freezing, specifically triggered by NVMe multipath during namespace scanning.

When `blk_mq_freeze_queue(q)` is called, it acquires a lockdep read lock (`q->io_lockdep_map`). However, to avoid false positives during initialization or teardown, it conditionally skips acquiring the lock if the disk is "dead" or not yet registered. This state is saved in `q->mq_freeze_disk_dead`:
```c
// In blk_freeze_set_owner():
q->mq_freeze_disk_dead = !q->disk || test_bit(GD_DEAD, &q->disk->state) || !blk_queue_registered(q);
```
When `blk_mq_unfreeze_queue(q)` is called, it checks this *same* `q->mq_freeze_disk_dead` variable to decide whether to release the lockdep lock.

The race occurs because `q->mq_freeze_disk_dead` is a shared variable in `struct request_queue` and is overwritten whenever `q->mq_freeze_depth` transitions from `0` to `1`. 

Here is the exact sequence that leads to the "bad unlock balance" warning:
1. **Thread A (Path 1)** calls `nvme_update_ns_info()`, which freezes the multipath head queue (`ns->head->disk->queue`). Since `device_add_disk()` hasn't been called yet, `blk_queue_registered(q)` is `false`. Thus, `q->mq_freeze_disk_dead` is set to `true`, and Thread A **does not** acquire the lockdep lock.
2. **Thread A** unfreezes the queue. It decrements `q->mq_freeze_depth` to `0`, releases `q->mq_freeze_lock`, and is **preempted** just before calling `blk_unfreeze_release_lock()`.
3. **Thread B (Path 2)** finishes its own setup and calls `device_add_disk(ns->head->disk)`. Now, `blk_queue_registered(q)` becomes `true`.
4. **Thread C (Path 3)** calls `nvme_update_ns_info()` and freezes the queue. Since `q->mq_freeze_depth` was `0`, it re-evaluates `q->mq_freeze_disk_dead`. Because the queue is now registered, it sets `q->mq_freeze_disk_dead` to `false`.
5. **Thread A** resumes and calls `blk_unfreeze_release_lock()`. It sees `q->mq_freeze_disk_dead == false` (overwritten by Thread C) and attempts to release the lockdep lock. Since Thread A never acquired it, lockdep throws a "bad unlock balance" warning.

### Reproduction Strategy

To reproduce this, we need to trigger concurrent `nvme_update_ns_info()` calls on the same multipath head queue while it is being registered. 
1. Set up an NVMe-oF loopback target (`nvmet`) with a single subsystem and namespace.
2. Spawn multiple threads that concurrently connect to this target subsystem via `/dev/nvme-fabrics`.
3. The kernel will create multiple controllers (paths) to the same namespace and scan them concurrently, naturally triggering the race window.
4. Disconnect the controllers and repeat the process in a tight loop to hit the preemption window.

### Standalone C Reproducer

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```

gemini-3.1-pro-preview

							input: 3695
							output: 26
							thoughts: 264
						

**My Thought Process Regarding the NVMe Unlock Imbalance Bug**

Alright, I've just encountered a bug report: "WARNING: bad unlock balance in nvme_update_ns_info". This immediately flags a problem with lock management, specifically an issue where a lock is being released without a corresponding acquisition, or perhaps released multiple times incorrectly. The kernel's lockdep subsystem is the one catching this, which is good – it's designed to prevent these kinds of race conditions and deadlocks.

The provided stack trace is my primary guide here. It clearly shows the path leading to the `print_unlock_imbalance_bug` function, which is the kernel's reporting mechanism for this specific type of lock violation. Let's break down the trace from the point of failure upwards:

*   `print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349`: This is the direct culprit, the function that detected and is reporting the imbalance. It's deep within the lockdep infrastructure itself.
*   `__lock_release kernel/locking/lockdep.c:5590 [inline]`: This is the internal function that `print_unlock_imbalance_bug` is called from. It's responsible for the actual lock release logic, and it's here that the imbalance was detected. The `[inline]` annotation tells me this function is likely optimized by the compiler and might not have a distinct entry point in the compiled code, but it's conceptually where the release is happening.
*   `lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964`: This is the public API for releasing a lock. The imbalance is being flagged during its execution.
*   `blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]`: This is the function that directly called `lock_release`. The context here is the block layer's multi-queue (blk-mq) subsystem, and specifically, it's dealing with unfreezing a queue. This implies that some operation related to a block device queue was being stopped or resumed, and a lock associated with it was being released. The `[inline]` again suggests compiler optimization.
*   `nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623`: This is the function that called `blk_mq_unfreeze_queue`. So, the lock imbalance originates from within the NVMe driver's namespace information update routine. This is a critical clue; the problem is definitely within the NVMe specific logic.
*   `nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]`: This is the function that *called* `nvme_update_ns_info`. The trace indicates that `nvme_update_ns_info` is called from within `nvme_alloc_ns`. The `[inline]` here suggests `nvme_alloc_ns` is perhaps a function that is frequently called or has been inlined by the compiler.
*   `nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483`: This is the top-level function in this particular call chain that initiated the whole process. It seems to be responsible for scanning namespaces on the NVMe device.

Given this information, my immediate next step is to dive into `nvme_update_ns_info` in `drivers/nvme/host/core.c`, specifically around line 2623. I'll be looking for where locks are acquired and released within this function, and critically, how `blk_mq_unfreeze_queue` is called. My hypothesis is that either:

1.  `nvme_update_ns_info` is releasing a lock that was *not* acquired by it in the current context.
2.  `nvme_update_ns_info` is attempting to release a lock that has already been released.
3.  There's a conditional path within `nvme_update_ns_info` where a lock is acquired but not released under certain error conditions or logic flows, or vice-versa.

I need to examine the lock usage patterns around the call to `blk_mq_unfreeze_queue` to understand which specific lock is involved and why the balance is being broken. It's possible that `blk_mq_unfreeze_queue` itself has an internal logic flaw that `nvme_update_ns_info` is triggering, or that the way `nvme_update_ns_info` calls it is incorrect. But given the trace points to `nvme_update_ns_info` as the caller of `blk_mq_unfreeze_queue`, and `blk_mq_unfreeze_queue` as the caller of `lock_release`, the primary suspect is how `nvme_update_ns_info` manages its locks in relation to this `blk_mq_unfreeze_queue` call.

map[Name:nvme_update_ns_info]

map[SourceCode:2539:	static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
2540:	{
2541:		bool unsupported = false;
2542:		int ret;
2543:	
2544:		switch (info->ids.csi) {
2545:		case NVME_CSI_ZNS:
2546:			if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
2547:				dev_info(ns->ctrl->device,
2548:		"block device for nsid %u not supported without CONFIG_BLK_DEV_ZONED\n",
2549:					info->nsid);
2550:				ret = nvme_update_ns_info_generic(ns, info);
2551:				break;
2552:			}
2553:			ret = nvme_update_ns_info_block(ns, info);
2554:			break;
2555:		case NVME_CSI_NVM:
2556:			ret = nvme_update_ns_info_block(ns, info);
2557:			break;
2558:		default:
2559:			dev_info(ns->ctrl->device,
2560:				"block device for nsid %u not supported (csi %u)\n",
2561:				info->nsid, info->ids.csi);
2562:			ret = nvme_update_ns_info_generic(ns, info);
2563:			break;
2564:		}
2565:	
2566:		/*
2567:		 * If probing fails due an unsupported feature, hide the block device,
2568:		 * but still allow other access.
2569:		 */
2570:		if (ret == -ENODEV) {
2571:			ns->disk->flags |= GENHD_FL_HIDDEN;
2572:			set_bit(NVME_NS_READY, &ns->flags);
2573:			unsupported = true;
2574:			ret = 0;
2575:		}
2576:	
2577:		if (!ret && nvme_ns_head_multipath(ns->head)) {
2578:			struct queue_limits *ns_lim = &ns->disk->queue->limits;
2579:			struct queue_limits lim;
2580:			unsigned int memflags;
2581:	
2582:			lim = queue_limits_start_update(ns->head->disk->queue);
2583:			memflags = blk_mq_freeze_queue(ns->head->disk->queue);
2584:			/*
2585:			 * queue_limits mixes values that are the hardware limitations
2586:			 * for bio splitting with what is the device configuration.
2587:			 *
2588:			 * For NVMe the device configuration can change after e.g. a
2589:			 * Format command, and we really want to pick up the new format
2590:			 * value here.  But we must still stack the queue limits to the
2591:			 * least common denominator for multipathing to split the bios
2592:			 * properly.
2593:			 *
2594:			 * To work around this, we explicitly set the device
2595:			 * configuration to those that we just queried, but only stack
2596:			 * the splitting limits in to make sure we still obey possibly
2597:			 * lower limitations of other controllers.
2598:			 */
2599:			lim.logical_block_size = ns_lim->logical_block_size;
2600:			lim.physical_block_size = ns_lim->physical_block_size;
2601:			lim.io_min = ns_lim->io_min;
2602:			lim.io_opt = ns_lim->io_opt;
2603:			queue_limits_stack_bdev(&lim, ns->disk->part0, 0,
2604:						ns->head->disk->disk_name);
2605:			if (lim.features & BLK_FEAT_ZONED)
2606:				nvme_stack_zone_resources(&lim, ns_lim);
2607:			if (unsupported)
2608:				ns->head->disk->flags |= GENHD_FL_HIDDEN;
2609:			else
2610:				nvme_init_integrity(ns->head, &lim, info);
2611:			lim.max_write_streams = ns_lim->max_write_streams;
2612:			lim.write_stream_granularity = ns_lim->write_stream_granularity;
2613:			ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
2614:			if (ret)
2615:				goto unfreeze_head_queue;
2616:	
2617:			set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
2618:			set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
2619:			nvme_mpath_revalidate_paths(ns->head);
2620:			ret = nvme_mpath_revalidate_zones(ns->head);
2621:	
2622:	unfreeze_head_queue:
2623:			blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
2624:		}
2625:	
2626:		return ret;
2627:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 5500
							output: 25
							thoughts: 163
						

**My Debugging Journey: Unraveling the "Bad Unlock Balance" Enigma**

Alright, so I'm staring at this cryptic error message: "bad unlock balance detected!". That immediately tells me something is fundamentally wrong with how locks are being managed, likely a deadlock or a double-unlock scenario. My first instinct is to trace where this error is being triggered.

My eyes land on this line: `blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);` at line 2623. This looks like the critical point where the unfreeze operation is happening, and it’s receiving this `memflags` variable. This variable name is a bit of a red herring initially – it doesn't immediately scream "lock state" to me, but the context of `unfreeze_queue` suggests it's related to the queue's operational status.

Then, a flicker of doubt. I look at the preceding lines, specifically these:

```c
		lim = queue_limits_start_update(ns->head->disk->queue);
		memflags = blk_mq_freeze_queue(ns->head->disk->queue);
```

Hold on a second. This code *first* calls `blk_mq_freeze_queue`. I'm expecting the `memflags` variable, the one being passed to `unfreeze_queue`, to be something related to the *state* after the freeze. But then I pause and question the signature of `blk_mq_freeze_queue` itself. Does it actually *return* `memflags`? And if so, what exactly *is* `memflags`? My mental model of `blk_mq_freeze_queue` is that it's supposed to *freeze* the queue, perhaps by taking the queue as an argument and returning some internal state, or perhaps it takes arguments that *define* the freeze.

The immediate confusion is: what is the return type of `blk_mq_freeze_queue`? Is it `unsigned int`? And then, does `blk_mq_freeze_queue` even *take* arguments? The line `memflags = blk_mq_freeze_queue(ns->head->disk->queue);` suggests it *does* take the queue as an argument. But then the line where the error occurs, `blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);`, implies that `blk_mq_freeze_queue` *returned* `memflags`, and that `memflags` is somehow essential for the *unfreeze* operation. This is where the mental gears start grinding. If `blk_mq_freeze_queue` returns `memflags`, what is `memflags` exactly? Is it a flag indicating the success of the freeze? Or is it some kind of token representing the frozen state?

This discrepancy between my understanding of a typical freeze/unfreeze mechanism and the observed code structure is what's driving me to immediately dig into the definition of `blk_mq_freeze_queue`. I need to understand its signature, its return value, and precisely what `memflags` represents in this context to bridge the gap between the freeze and the unfreeze operation and, hopefully, identify the root cause of this "bad unlock balance."

map[Name:blk_mq_freeze_queue]

map[SourceCode: 951:	static inline unsigned int __must_check
 952:	blk_mq_freeze_queue(struct request_queue *q)
 953:	{
 954:		unsigned int memflags = memalloc_noio_save();
 955:	
 956:		blk_mq_freeze_queue_nomemsave(q);
 957:		return memflags;
 958:	}
 SourceFile:include/linux/blk-mq.h]

gemini-3.1-pro-preview

							input: 5816
							output: 26
							thoughts: 51
						

**My Thought Process Regarding `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue`**

My initial thought was to examine the return value of `blk_mq_freeze_queue`. I noted that it returns `memflags`. This immediately prompted a question in my mind: does `blk_mq_unfreeze_queue` then *take* `memflags` as an argument? To verify this, my next step was to delve into the implementation details of `blk_mq_unfreeze_queue`.

map[Name:blk_mq_unfreeze_queue]

map[SourceCode: 959:	static inline void
 960:	blk_mq_unfreeze_queue(struct request_queue *q, unsigned int memflags)
 961:	{
 962:		blk_mq_unfreeze_queue_nomemrestore(q);
 963:		memalloc_noio_restore(memflags);
 964:	}
 SourceFile:include/linux/blk-mq.h]

gemini-3.1-pro-preview

							input: 6003
							output: 29
							thoughts: 148
						

**My Thought Process Unraveling the `kworker` Lock Error**

Okay, so I've just encountered this `kworker` warning, and my immediate thought is to dissect exactly what it's telling me. The core of the message is: `kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at: [<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline] but there are no more locks to release!`.

The crucial part here is "trying to release lock... but there are no more locks to release!". As an expert in this domain, I understand that this is a classic symptom of a double-release or a release without a prior acquire. My immediate hypothesis then becomes that `q->q_usage_counter(io)` was either never acquired in the first place by the code path that *should* have acquired it, or, more disturbingly, it was already released prior to this `blk_mq_unfreeze_queue` call.

My next step in tracing this is to identify *what* is supposed to acquire this lock. The warning message itself points me to the release site: `blk_mq_unfreeze_queue`. Logically, the corresponding freeze operation is the most likely candidate to acquire the lock. So, I'll start investigating the functions related to freezing the queue. Specifically, I'll be looking at `blk_mq_freeze_queue_nomemsave`, as the warning message suggests this is the function I need to examine to understand the acquisition logic. My goal is to trace the execution flow within `blk_mq_freeze_queue_nomemsave` to see how `q->q_usage_counter(io)` is managed and why it might be in a state where it's not considered acquired by the time `blk_mq_unfreeze_queue` tries to release it. This is where I'll likely find the root cause of this frustrating lock error.

map[Name:blk_mq_freeze_queue_nomemsave]

map[SourceCode: 204:	void blk_mq_freeze_queue_nomemsave(struct request_queue *q)
 205:	{
 206:		blk_freeze_queue_start(q);
 207:		blk_mq_freeze_queue_wait(q);
 208:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 6274
							output: 25
							thoughts: 13
						

**My Thought Process on `blk_freeze_queue_start`**

Alright, let's dive into this `blk_freeze_queue_start`. My initial instinct is to understand its fundamental purpose. What is it *doing*? It sounds like it's initiating some kind of freezing process for a block I/O queue. This implies a need to pause or quiesce the queue, likely in preparation for a state change or a specific operation that requires the queue to be in a static, predictable condition.

I'm immediately thinking about the implications of "freezing." This isn't just about stopping I/O requests from entering the queue; it's probably about ensuring that any requests already in flight or queued are handled appropriately before the freeze is complete. What constitutes "completion" here? Does it mean all pending requests must be processed? Or is there a more nuanced definition, perhaps related to the ordering and completion status of these requests?

My mind then drifts to the context where such a function would be called. What scenarios necessitate freezing a block I/O queue? Common use cases that come to mind are:

*   **System Suspend/Hibernation:** When the system is going into a low-power state, it's crucial to ensure that all I/O operations are completed and the underlying storage devices are in a safe state before power is removed or significantly reduced.
*   **Filesystem Operations:** Certain critical filesystem operations, like unmounting or taking a snapshot, might require quiescing the underlying block device to prevent data corruption.
*   **Device Hotplug/Removal:** When a block device is being removed or its state is being altered (e.g., a new partition is being created), the I/O queue for that device needs to be temporarily halted.
*   **Error Handling/Recovery:** In some error scenarios, it might be necessary to freeze a queue to analyze the state of the device or to attempt recovery.

Considering these contexts, I'm keenly interested in the *mechanism* by which `blk_freeze_queue_start` achieves this freeze. What flags are set? Are there locks involved? How does it signal to the rest of the I/O subsystem that the queue is now in a frozen state? I'd expect it to interact with the block layer's internal state management and potentially with the device driver itself.

Furthermore, I need to consider the counterpart: how is this freeze *unfrozen*? There must be a `blk_freeze_queue_end` or a similar function. The transition from frozen back to active is just as critical. What are the guarantees around the state of the queue when it's unfrozen? Are requests resumed in the order they were frozen? Are there any outstanding operations that need special handling upon unfreezing?

From an implementation perspective, I'm anticipating that this function will likely involve:

*   Setting internal state flags within the `request_queue` structure.
*   Potentially acquiring locks to prevent race conditions during the freezing process.
*   Signaling to the I/O scheduler or the device driver that no new requests should be accepted or processed until the freeze is lifted.
*   Perhaps iterating through existing requests to ensure they are in a consistent state or to mark them for specific handling later.

The "start" in the name suggests this is the initial step in a multi-phase freeze. What are the subsequent steps? Does it just set a flag and return, and other parts of the system complete the actual quiescence? Or does it block until the queue is truly frozen? My assumption, based on common kernel design patterns, is that it likely initiates the process and potentially waits for some completion, but the full "frozen" state might be achieved by other components responding to the initial signal.

In essence, `blk_freeze_queue_start` is, to my mind, the entry point for an operation that requires a temporary, controlled halt to block I/O. It's a critical synchronization primitive that underpins many system-level operations, and understanding its details will reveal a lot about the robustness and behavior of the block I/O subsystem during significant state transitions. I'm looking for details on its return values, potential error conditions, and its precise interaction with other block layer components and device drivers.

map[Name:blk_freeze_queue_start]

map[SourceCode: 182:	void blk_freeze_queue_start(struct request_queue *q)
 183:	{
 184:		if (__blk_freeze_queue_start(q, current))
 185:			blk_freeze_acquire_lock(q);
 186:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 6404
							output: 26
							thoughts: 14
						

**My Thought Process on `__blk_freeze_queue_start`**

Alright, so my immediate impulse is to dive into the specifics of this function, `__blk_freeze_queue_start`. I know, as an expert in this domain, that digging into the kernel's block layer, particularly around freezing and unfreezing operations, is crucial for understanding system quiescence and handling various states like suspend.

My initial thought is to trace the execution flow. Where is this function called from? What are its immediate pre-conditions? I'm already anticipating that it's likely involved in preparing a block device's I/O queue for a state where I/O operations need to be temporarily halted. This could be in preparation for system suspend, a hotplug event, or some form of device reset.

I'll be looking for how `__blk_freeze_queue_start` signals to the rest of the block layer that this particular queue is entering a frozen state. This usually involves setting some internal flags or semaphores. I'm particularly interested in the mechanisms that ensure no new I/O requests are accepted once this function is invoked. Is it an atomic operation? Does it involve locking?

Furthermore, I'm curious about the state of existing I/O requests. When `__blk_freeze_queue_start` is called, are outstanding requests being actively completed and flushed, or are they simply being held back until the queue is unfrozen? The name "start" suggests the initiation of the freezing process, so I'm expecting it to be the point where the "no new I/O" rule takes effect.

I'll also be thinking about potential race conditions. In a complex system like the kernel, multiple threads or interrupts could be attempting to interact with the block queue simultaneously. How does `__blk_freeze_queue_start` gracefully handle these concurrent operations? Does it rely on existing locking mechanisms within the block layer, or does it introduce its own?

My mind is already constructing a mental model of the data structures involved. I'll be thinking about the `request_queue` structure itself, and what fields within it are likely to be manipulated by this function. This could include counters for active requests, pointers to specific I/O states, or flags that indicate the queue's frozen status.

Ultimately, my goal in examining `__blk_freeze_queue_start` is to understand its role in the broader context of block device management. It's a building block, and by understanding it, I can better comprehend how the kernel ensures data integrity and system stability during critical operations. I'm looking for the precise point at which the "stop accepting new work" signal is definitively asserted for a given queue.

map[Name:__blk_freeze_queue_start]

map[SourceCode: 163:	bool __blk_freeze_queue_start(struct request_queue *q,
 164:				      struct task_struct *owner)
 165:	{
 166:		bool freeze;
 167:	
 168:		mutex_lock(&q->mq_freeze_lock);
 169:		freeze = blk_freeze_set_owner(q, owner);
 170:		if (++q->mq_freeze_depth == 1) {
 171:			percpu_ref_kill(&q->q_usage_counter);
 172:			mutex_unlock(&q->mq_freeze_lock);
 173:			if (queue_is_mq(q))
 174:				blk_mq_run_hw_queues(q, false);
 175:		} else {
 176:			mutex_unlock(&q->mq_freeze_lock);
 177:		}
 178:	
 179:		return freeze;
 180:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 6726
							output: 25
							thoughts: 10
						

**My Thought Process on `blk_freeze_acquire_lock`**

Alright, so I'm digging into this `blk_freeze_acquire_lock` function. My immediate thought, looking at the name, is that this is all about managing a critical section within the block layer, specifically when we're dealing with freeze operations. The "blk" prefix clearly signals that this is within the block subsystem, and "freeze" points to a state where I need to prevent certain operations from occurring, likely to ensure data integrity or a consistent state before a more significant event like a suspend or snapshot. The "acquire_lock" part is the core mechanism – I'm expecting this function to be responsible for obtaining some sort of synchronization primitive, a lock, to enforce that exclusivity.

My hypothesis is that this function is called *before* any significant modification or access to the block layer's internal state that could be disrupted by concurrent activity during a freeze. This lock would then be held until the freeze process is complete and the system is ready to resume normal operations, at which point it would be released.

I'm anticipating that the lock itself is likely a mutex or a spinlock, depending on the kernel context and the expected contention. Given that we're dealing with a freeze operation, which implies a potentially system-wide halt of I/O, a spinlock might be more appropriate to avoid sleeping and ensure quick acquisition. However, if the critical section it guards is potentially long or involves blocking operations (though that would be counter-intuitive during a freeze), a mutex could be used. The name itself doesn't give a definitive answer on the *type* of lock, but it strongly implies the *purpose* of the lock acquisition.

I'm also considering the potential error handling. What happens if I *can't* acquire the lock? This could indicate a deadlock situation, or that another part of the system is already holding it in a way that prevents the freeze from proceeding. In such a scenario, I would expect this function to return an error code, signaling the failure of the freeze initiation. This would then propagate up the call stack, allowing the calling code to handle the failure gracefully, perhaps by aborting the freeze or retrying.

Furthermore, I'm thinking about the scope of this lock. Is it protecting a global block layer state, or is it specific to a particular device or request queue? The context in which `blk_freeze_acquire_lock` is called would be crucial for determining this. If it's a global lock, it implies a deep synchronization need across the entire block layer. If it's per-device, it suggests a more granular approach.

In essence, my primary thought process centers on understanding `blk_freeze_acquire_lock` as a fundamental synchronization primitive designed to gate entry into a critical, "frozen" state within the block layer, ensuring exclusive access and preventing race conditions during sensitive operations. It’s about putting up a sign that says "Do Not Disturb" for the block device subsystem, and doing so in a robust and predictable manner.

map[Name:blk_freeze_acquire_lock]

map[SourceCode: 761:	static inline void blk_freeze_acquire_lock(struct request_queue *q)
 762:	{
 763:		if (!q->mq_freeze_disk_dead)
 764:			rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
 765:		if (!q->mq_freeze_queue_dying)
 766:			rwsem_acquire(&q->q_lockdep_map, 0, 1, _RET_IP_);
 767:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 6918
							output: 30
							thoughts: 38
						

**A Deep Dive into the Unfreeze Logic**

Right, so my initial thought, upon encountering the lock in question, `&q->q_usage_counter(io)`, was to immediately pivot to its context. This naturally led me to investigate the `blk_mq_unfreeze_queue_nomemrestore` function. It feels crucial to understand precisely *how* this specific usage counter is being managed and what state transitions it signifies within the broader block layer's request queue freezing and unfreezing mechanisms. My next step, therefore, is to meticulously trace the execution flow within `blk_mq_unfreeze_queue_nomemrestore`, paying particular attention to any operations that might acquire or release this `q_usage_counter` and the implications of its value on subsequent queue behavior. I'm anticipating finding a direct correlation between the `io` parameter and the logic governing the unfreeze operation itself.

map[Name:blk_mq_unfreeze_queue_nomemrestore]

map[SourceCode: 230:	void blk_mq_unfreeze_queue_nomemrestore(struct request_queue *q)
 231:	{
 232:		if (__blk_mq_unfreeze_queue(q, false))
 233:			blk_unfreeze_release_lock(q);
 234:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 7085
							output: 27
							thoughts: 15
						

**My Thought Process on `__blk_mq_unfreeze_queue`**

Alright, so I'm diving into the kernel code, and my current focus is the `__blk_mq_unfreeze_queue` function. My immediate thought is to understand its role within the broader block layer, specifically concerning the Multi-Queue (blk-mq) subsystem.

My objective here is to get a clear, comprehensive grasp of what this function *does*. I need to understand its purpose: why does it exist? What problem is it solving? Is it about releasing a queue that was previously frozen? If so, what triggers that freezing, and what are the consequences of unfreezing?

I'll be looking at its arguments. What information does `__blk_mq_unfreeze_queue` need to operate? Is it passed a queue structure directly? Does it need context about *why* the queue is being unfrozen? Understanding these inputs will be crucial to tracing its execution path and its interactions with other parts of the system.

Then, I'll scrutinize the function's body. I'll be tracing the logic flow. Are there any conditional branches? What are the different execution paths? I'm particularly interested in how it interacts with the underlying hardware queue or the blk-mq dispatch layer. Does it simply signal an event, or does it directly manipulate internal data structures?

I'll be paying close attention to any locks or synchronization primitives it uses. The block layer is a highly concurrent environment, so understanding how `__blk_mq_unfreeze_queue` maintains data integrity is paramount. Does it acquire a queue-specific lock? Is there a global lock involved? How does it ensure atomicity in its operations?

Furthermore, I want to understand the *effects* of calling this function. What happens to pending I/O requests when a queue is unfrozen? Do they get re-queued? Are they immediately submitted for processing? What are the implications for I/O latency and throughput?

I'm also considering the callers of `__blk_mq_unfreeze_queue`. Who initiates this unfreezing process? Is it part of error handling? Is it a normal operational procedure after some temporary condition is resolved? Knowing the context in which it's invoked will shed light on its functional significance.

In essence, my thought process is a systematic dissection of the function, aiming to build a mental model of its behavior, its dependencies, and its impact on the overall block I/O subsystem. I'm looking for the "what," the "why," and the "how" of `__blk_mq_unfreeze_queue` to fully integrate its understanding into my knowledge of blk-mq.

map[Name:__blk_mq_unfreeze_queue]

map[SourceCode: 211:	bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
 212:	{
 213:		bool unfreeze;
 214:	
 215:		mutex_lock(&q->mq_freeze_lock);
 216:		if (force_atomic)
 217:			q->q_usage_counter.data->force_atomic = true;
 218:		q->mq_freeze_depth--;
 219:		WARN_ON_ONCE(q->mq_freeze_depth < 0);
 220:		if (!q->mq_freeze_depth) {
 221:			percpu_ref_resurrect(&q->q_usage_counter);
 222:			wake_up_all(&q->mq_freeze_wq);
 223:		}
 224:		unfreeze = blk_unfreeze_check_owner(q);
 225:		mutex_unlock(&q->mq_freeze_lock);
 226:	
 227:		return unfreeze;
 228:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 7430
							output: 26
							thoughts: 11
						

**My Thought Process on `blk_unfreeze_release_lock`**

Alright, let's dig into this `blk_unfreeze_release_lock` function. My initial reaction, as someone who's been deep in the block layer and I/O scheduling trenches, is to immediately consider its purpose within the context of block device state management. The name itself, `unfreeze_release_lock`, strongly suggests it's a critical piece of logic for transitioning a block device *out* of a frozen state and, crucially, for ensuring that any associated locks are properly released. This implies it's called when an operation that necessitated freezing the device has completed or needs to be aborted, and the device can now resume normal I/O operations.

My first mental checkpoint is to think about *why* a block device might be frozen in the first place. This usually involves operations like filesystem checkpoints, snapshotting, or potentially recovery routines where quiescence is paramount. When these operations finish successfully, or if they encounter an unrecoverable error, we need to signal to the rest of the system that the device is ready to accept I/O again. This function, therefore, must be the mechanism that orchestrates this return to a fully functional state.

The "release_lock" part is equally significant. In a concurrent system like the kernel, especially when dealing with I/O, locks are ubiquitous. There's likely a lock protecting the device's internal state, perhaps ensuring that only one thread or process can modify its configuration or process I/O at a time. If the device was frozen, it's highly probable that this lock was acquired. Therefore, `blk_unfreeze_release_lock` must be responsible for acquiring the necessary permissions to unlock this critical section. I'm picturing a scenario where the caller might still hold some higher-level lock, and this function needs to ensure that the *device-specific* lock is released, allowing other parts of the system to interact with the device without causing deadlocks or race conditions.

Furthermore, I'm considering the potential failure paths. What if `blk_unfreeze_release_lock` itself encounters an issue while trying to release the lock or perform other cleanup? Although less likely given its name implying a finalization step, robust code needs to account for this. My thoughts would immediately drift to error handling: are there return codes? What are the implications of failure here? A failure to release a lock or unfreeze a device would be a pretty serious kernel bug, potentially leading to system instability or complete I/O failure.

From an architectural perspective, I'd want to know where this function sits. Is it part of the core block layer, or is it a helper called by specific drivers or subsystems that manage device freezing? My understanding of the block layer hierarchy suggests it's likely a core function, designed to be generic enough to be used across various block device types. This implies it likely interacts with a device's internal data structures, potentially through an opaque pointer or a specific device context.

Finally, I'm thinking about the broader implications. Once this function is called and completes successfully, what can we expect? The device should be ready to accept new I/O requests. Any pending requests that were held back due to the freeze should now be processed. This function is the linchpin in the recovery or completion of frozen operations, directly impacting the availability and responsiveness of the storage subsystem. It’s not just a simple unlock; it's a signal that the system can resume its normal, high-performance I/O operations.

map[Name:blk_unfreeze_release_lock]

map[SourceCode: 769:	static inline void blk_unfreeze_release_lock(struct request_queue *q)
 770:	{
 771:		if (!q->mq_freeze_queue_dying)
 772:			rwsem_release(&q->q_lockdep_map, _RET_IP_);
 773:		if (!q->mq_freeze_disk_dead)
 774:			rwsem_release(&q->io_lockdep_map, _RET_IP_);
 775:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 7613
							output: 25
							thoughts: 114
						

**My Thought Process Unpacking the `q_usage_counter` and Lock Ownership**

Okay, so I'm digging into this code, and a question immediately pops into my head: is the lock associated with `&q->q_usage_counter(io)` actually `q->io_lockdep_map`? It feels a little indirect, and I need to be absolutely sure about the locking mechanism here. My first instinct is to verify this by examining `q_usage_counter` itself. I need to understand what that counter represents and how it relates to the lock.

Then, I realize I might have just answered my own question, or at least confirmed a suspicion. The lock *name* is stated as `&q->q_usage_counter(io)`. This phrasing is a bit unusual, and I need to be precise. It's not just a variable named `q_usage_counter`; it's specifically `&q->q_usage_counter(io)`. This distinction is critical when dealing with lockdep, as the symbolic name matters.

So, I'm going through the initialization sequence in my mind, and it clicks: `q->io_lockdep_map` is being initialized *with* `&q->q_usage_counter(io)`. This confirms my suspicion. The `io_lockdep_map` is indeed the lock, and it's being set up to use the name derived from `q_usage_counter(io)`. This is a common pattern to associate a lock with a specific object's state or usage context, making debugging and analysis much clearer when lockdep reports issues.

Now, with this understanding of the lock ownership and its symbolic name, my next step is to investigate the functions that *use* this lock. I'm particularly interested in `blk_freeze_set_owner` and `blk_unfreeze_check_owner`. These functions sound like they're directly involved in managing some kind of freeze state and ensuring proper ownership, which inherently implies lock acquisition and release. I need to see how they interact with `q->io_lockdep_map` to ensure that freezing and unfreezing operations are correctly synchronized and that no race conditions occur, especially when considering the owner information being managed. This will likely involve checking for lock acquisition before setting the owner and lock release after checking it, or vice-versa, depending on the exact semantics of these functions.

map[Name:blk_freeze_set_owner]

map[SourceCode: 116:	static bool blk_freeze_set_owner(struct request_queue *q,
 117:					 struct task_struct *owner)
 118:	{
 119:		if (!owner)
 120:			return false;
 121:	
 122:		if (!q->mq_freeze_depth) {
 123:			q->mq_freeze_owner = owner;
 124:			q->mq_freeze_owner_depth = 1;
 125:			q->mq_freeze_disk_dead = !q->disk ||
 126:				test_bit(GD_DEAD, &q->disk->state) ||
 127:				!blk_queue_registered(q);
 128:			q->mq_freeze_queue_dying = blk_queue_dying(q);
 129:			return true;
 130:		}
 131:	
 132:		if (owner == q->mq_freeze_owner)
 133:			q->mq_freeze_owner_depth += 1;
 134:		return false;
 135:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 8067
							output: 26
							thoughts: 11
						

**My Internal Monologue on `blk_unfreeze_check_owner`**

Alright, so I'm looking at this `blk_unfreeze_check_owner` function. My first thought is, "Okay, what is this thing *actually* doing?" It's clearly related to unfreezing some kind of block, and the name itself implies a crucial ownership check is happening. This isn't just a simple toggle; there's a security or integrity layer here.

My immediate mental pathway is to dissect the purpose. Why would we need to check ownership when unfreezing? It must be to prevent unauthorized actors from tampering with the state of whatever this "block" represents. If I, as the owner or an authorized delegate, initiate an unfreeze, that's one thing. But if some random entity tries to pull the rug out from under it, that's a big red flag. So, the core function here is **authorization validation** before allowing a state transition.

Then I start thinking about the implications. What happens if this check *fails*? The function name doesn't explicitly say it *rejects* the operation, but the implication is strong. A failed ownership check means the unfreeze operation should *not* proceed. I'm picturing an error being thrown, or a `false` return value, signaling to the calling code that the attempt was illegitimate. This is crucial for maintaining the immutability or controlled mutability of whatever is being managed.

I also consider the *context* in which this function would be used. Is this part of a smart contract? A decentralized application? A system managing sensitive data? The specific environment will dictate the rigor of the ownership check and the potential consequences of bypass. For instance, in a financial system, this check would be paramount. In a less critical scenario, it might be more of a soft warning. But given the name, I'm assuming it's a hard requirement.

Furthermore, I'm wondering about the *implementation details* of the ownership check itself. How is ownership determined? Is it based on a public key, a role, a specific address? Is there a registry of owners, or is ownership embedded within the block data itself? The efficiency and security of this underlying mechanism are also concerns. A complex or easily exploitable ownership scheme would undermine the whole point of this check.

Finally, I'm thinking about how this fits into the larger system. This `blk_unfreeze_check_owner` is likely a gatekeeper function. It's one piece of a puzzle that ensures operations are performed correctly and securely. It's a defensive programming measure, a safeguard against unintended or malicious state changes. My overall impression is that this is a well-conceived, albeit perhaps narrowly focused, component designed to uphold the integrity of the system it serves.

map[Name:blk_unfreeze_check_owner]

map[SourceCode: 137:	/* verify the last unfreeze in owner context */
 138:	static bool blk_unfreeze_check_owner(struct request_queue *q)
 139:	{
 140:		if (q->mq_freeze_owner != current)
 141:			return false;
 142:		if (--q->mq_freeze_owner_depth == 0) {
 143:			q->mq_freeze_owner = NULL;
 144:			return true;
 145:		}
 146:		return false;
 147:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 8274
							output: 21
							thoughts: 2786
						

**My Thoughts on `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` Lock Management**

I've been diving deep into the intricacies of the block layer's freezing and unfreezing mechanisms, specifically around the `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` functions, and I'm piecing together a rather complex picture of how lockdep is involved.

Initially, my understanding was straightforward: `blk_unfreeze_check_owner` checks if the current thread is indeed the `q->mq_freeze_owner`. If it's not, it returns `false`, and the lock isn't released by `blk_unfreeze_release_lock`. This seemed like a good safeguard against cross-thread unfreezing.

Then, I started questioning: what if `blk_mq_freeze_queue` is called by thread A and `blk_mq_unfreeze_queue` by thread B? My initial thought was that thread A would acquire the lockdep lock, but thread B, not being the owner, wouldn't release it. This would lead to a lockdep warning about an unreleased lock.

However, when I saw `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` being called sequentially within the *same* function, specifically `nvme_update_ns_info`, it threw me for a loop. The subsequent "bad unlock balance detected!" warning, indicating an attempt to release a lock that wasn't acquired by the current thread, suggested something more subtle was at play.

My reasoning then shifted to understanding how the lock acquisition and release were governed. I looked at `blk_freeze_acquire_lock` and `blk_unfreeze_release_lock`. They conditionally acquire and release `io_lockdep_map` and `q_lockdep_map` based on flags like `q->mq_freeze_disk_dead` and `q->mq_freeze_queue_dying`.

These flags, I realized, are set by `blk_freeze_set_owner`. This function returns `true` only if `q->mq_freeze_depth` is zero, indicating the start of a freeze operation for a new owner. If the caller is the *same* owner and `q->mq_freeze_depth > 0`, it only increments `q->mq_freeze_owner_depth` and returns `false`. Crucially, if `blk_freeze_set_owner` returns `false`, the lockdep lock is *not* acquired by `blk_freeze_queue_start`.

This led to a critical insight about self-recursive calls to `blk_mq_freeze_queue`:
*   The first call acquires the lockdep lock because `mq_freeze_depth` was 0.
*   Subsequent calls by the *same* thread increment `mq_freeze_owner_depth` but do *not* acquire the lock again.
*   When `blk_mq_unfreeze_queue` is called, `blk_unfreeze_check_owner` will eventually return `true` when `mq_freeze_owner_depth` reaches 0, releasing the lock. This is perfectly balanced.

I then considered the case of different threads:
*   Thread A calls `blk_mq_freeze_queue`. `mq_freeze_depth` becomes 1. `blk_freeze_set_owner` returns `true`, and Thread A acquires the lockdep lock.
*   Thread B calls `blk_mq_freeze_queue`. `mq_freeze_depth` becomes 2. `owner` is different, so `blk_freeze_set_owner` returns `false`. Thread B does *not* acquire the lock.
*   Thread B then calls `blk_mq_unfreeze_queue`. `blk_unfreeze_check_owner` sees `q->mq_freeze_owner` (Thread A's) is not `current` (Thread B), so it returns `false`. Thread B does *not* release the lock.
*   Thread A then calls `blk_mq_unfreeze_queue`. `blk_unfreeze_check_owner` sees `q->mq_freeze_owner == current`, decrements `mq_freeze_owner_depth` to 0, and returns `true`. Thread A releases the lock. This also appears balanced.

The warning I'm seeing – "bad unlock balance detected!" – specifically from a `kworker` trying to release a lock that isn't held by it, is the key. This implies that `blk_unfreeze_release_lock` *is* being called, meaning `blk_unfreeze_check_owner` returned `true`. For that to happen, `q->mq_freeze_owner` must be `current`, and `q->mq_freeze_owner_depth` must have reached 0.

This suggests a scenario where the thread triggering the "bad unlock" *did* set `q->mq_freeze_owner` to itself (meaning it called `blk_mq_freeze_queue` when `mq_freeze_depth` was 0 and `blk_freeze_set_owner` returned `true`), but it somehow *didn't* acquire the lockdep lock via `blk_freeze_acquire_lock`.

My current hypothesis is that the conditional logic within `blk_freeze_acquire_lock` and `blk_unfreeze_release_lock`, specifically their reliance on `q->mq_freeze_disk_dead` and `q->mq_freeze_queue_dying`, is the culprit. If these flags change *between* the freeze and unfreeze calls, even if the owner is the same and the depth is managed correctly, the lock might not be acquired by `blk_freeze_acquire_lock` but still be targeted for release by `blk_unfreeze_release_lock`, leading to the lockdep imbalance. This is the path I'm currently exploring.

map[Name:request_queue]

map[SourceCode: 488:	struct request_queue {
 489:		/*
 490:		 * The queue owner gets to use this for whatever they like.
 491:		 * ll_rw_blk doesn't touch it.
 492:		 */
 493:		void			*queuedata;
 494:	
 495:		struct elevator_queue	*elevator;
 496:	
 497:		const struct blk_mq_ops	*mq_ops;
 498:	
 499:		/* sw queues */
 500:		struct blk_mq_ctx __percpu	*queue_ctx;
 501:	
 502:		/*
 503:		 * various queue flags, see QUEUE_* below
 504:		 */
 505:		unsigned long		queue_flags;
 506:	
 507:		unsigned int __data_racy rq_timeout;
 508:	
 509:		unsigned int		queue_depth;
 510:	
 511:		refcount_t		refs;
 512:	
 513:		/* hw dispatch queues */
 514:		unsigned int		nr_hw_queues;
 515:		struct blk_mq_hw_ctx * __rcu *queue_hw_ctx __counted_by_ptr(nr_hw_queues);
 516:	
 517:		struct percpu_ref	q_usage_counter;
 518:		struct lock_class_key	io_lock_cls_key;
 519:		struct lockdep_map	io_lockdep_map;
 520:	
 521:		struct lock_class_key	q_lock_cls_key;
 522:		struct lockdep_map	q_lockdep_map;
 523:	
 524:		struct request		*last_merge;
 525:	
 526:		spinlock_t		queue_lock;
 527:	
 528:		int			quiesce_depth;
 529:	
 530:		struct gendisk		*disk;
 531:	
 532:		/*
 533:		 * mq queue kobject
 534:		 */
 535:		struct kobject *mq_kobj;
 536:	
 537:		struct queue_limits	limits;
 538:	
 539:	#ifdef CONFIG_PM
 540:		struct device		*dev;
 541:		enum rpm_status		rpm_status;
 542:	#endif
 543:	
 544:		/*
 545:		 * Number of contexts that have called blk_set_pm_only(). If this
 546:		 * counter is above zero then only RQF_PM requests are processed.
 547:		 */
 548:		atomic_t		pm_only;
 549:	
 550:		struct blk_queue_stats	*stats;
 551:		struct rq_qos		*rq_qos;
 552:		struct mutex		rq_qos_mutex;
 553:	
 554:		/*
 555:		 * ida allocated id for this queue.  Used to index queues from
 556:		 * ioctx.
 557:		 */
 558:		int			id;
 559:	
 560:		/*
 561:		 * queue settings
 562:		 */
 563:		unsigned int		nr_requests;	/* Max # of requests */
 564:		unsigned int		async_depth;	/* Max # of async requests */
 565:	
 566:	#ifdef CONFIG_BLK_INLINE_ENCRYPTION
 567:		struct blk_crypto_profile *crypto_profile;
 568:		struct kobject *crypto_kobject;
 569:	#endif
 570:	
 571:		struct timer_list	timeout;
 572:		struct work_struct	timeout_work;
 573:	
 574:		atomic_t		nr_active_requests_shared_tags;
 575:	
 576:		struct blk_mq_tags	*sched_shared_tags;
 577:	
 578:		struct list_head	icq_list;
 579:	#ifdef CONFIG_BLK_CGROUP
 580:		DECLARE_BITMAP		(blkcg_pols, BLKCG_MAX_POLS);
 581:		struct blkcg_gq		*root_blkg;
 582:		struct list_head	blkg_list;
 583:		struct mutex		blkcg_mutex;
 584:	#endif
 585:	
 586:		int			node;
 587:	
 588:		spinlock_t		requeue_lock;
 589:		struct list_head	requeue_list;
 590:		struct delayed_work	requeue_work;
 591:	
 592:	#ifdef CONFIG_BLK_DEV_IO_TRACE
 593:		struct blk_trace __rcu	*blk_trace;
 594:	#endif
 595:		/*
 596:		 * for flush operations
 597:		 */
 598:		struct blk_flush_queue	*fq;
 599:		struct list_head	flush_list;
 600:	
 601:		/*
 602:		 * Protects against I/O scheduler switching, particularly when updating
 603:		 * q->elevator. Since the elevator update code path may also modify q->
 604:		 * nr_requests and wbt latency, this lock also protects the sysfs attrs
 605:		 * nr_requests and wbt_lat_usec. Additionally the nr_hw_queues update
 606:		 * may modify hctx tags, reserved-tags and cpumask, so this lock also
 607:		 * helps protect the hctx sysfs/debugfs attrs. To ensure proper locking
 608:		 * order during an elevator or nr_hw_queue update, first freeze the
 609:		 * queue, then acquire ->elevator_lock.
 610:		 */
 611:		struct mutex		elevator_lock;
 612:	
 613:		struct mutex		sysfs_lock;
 614:		/*
 615:		 * Protects queue limits and also sysfs attribute read_ahead_kb.
 616:		 */
 617:		struct mutex		limits_lock;
 618:	
 619:		/*
 620:		 * for reusing dead hctx instance in case of updating
 621:		 * nr_hw_queues
 622:		 */
 623:		struct list_head	unused_hctx_list;
 624:		spinlock_t		unused_hctx_lock;
 625:	
 626:		int			mq_freeze_depth;
 627:	
 628:	#ifdef CONFIG_BLK_DEV_THROTTLING
 629:		/* Throttle data */
 630:		struct throtl_data *td;
 631:	#endif
 632:		struct rcu_head		rcu_head;
 633:	#ifdef CONFIG_LOCKDEP
 634:		struct task_struct	*mq_freeze_owner;
 635:		int			mq_freeze_owner_depth;
 636:		/*
 637:		 * Records disk & queue state in current context, used in unfreeze
 638:		 * queue
 639:		 */
 640:		bool			mq_freeze_disk_dead;
 641:		bool			mq_freeze_queue_dying;
 642:	#endif
 643:		wait_queue_head_t	mq_freeze_wq;
 644:		/*
 645:		 * Protect concurrent access to q_usage_counter by
 646:		 * percpu_ref_kill() and percpu_ref_reinit().
 647:		 */
 648:		struct mutex		mq_freeze_lock;
 649:	
 650:		struct blk_mq_tag_set	*tag_set;
 651:		struct list_head	tag_set_list;
 652:	
 653:		struct dentry		*debugfs_dir;
 654:		struct dentry		*sched_debugfs_dir;
 655:		struct dentry		*rqos_debugfs_dir;
 656:		/*
 657:		 * Serializes all debugfs metadata operations using the above dentries.
 658:		 */
 659:		struct mutex		debugfs_mutex;
 660:	};
 SourceFile:include/linux/blkdev.h]

gemini-3.1-pro-preview

							input: 13462
							output: 29
							thoughts: 1630
						

**My Thoughts on `blk_mq_freeze` Lock Balancing**

This is quite perplexing. I'm trying to unravel a potential lock balancing issue within the block layer's freeze/unfreeze mechanism, specifically concerning the `mq_freeze_disk_dead` and `mq_freeze_queue_dying` flags.

My initial observation is that these flags, `q->mq_freeze_disk_dead` and `q->mq_freeze_queue_dying`, are only ever set within `blk_freeze_set_owner`. This function is called when `blk_mq_freeze_queue` is invoked and the `q->mq_freeze_depth` is zero, signifying the start of a new freeze operation. The logic there sets `q->mq_freeze_disk_dead` based on the disk state (`GD_DEAD`) or whether the queue is still registered.

The core of my confusion arises from how `blk_unfreeze_release_lock` uses these saved flags. It checks `!q->mq_freeze_queue_dying` and `!q->mq_freeze_disk_dead` to decide whether to release the respective locks (`q_lockdep_map` and `io_lockdep_map`). The critical point is that `q->mq_freeze_disk_dead` and `q->mq_freeze_queue_dying` are *not* re-evaluated during the unfreeze path; they retain the values they were set with during the freeze.

If `q->mq_freeze_disk_dead` was set to `true` during the freeze (e.g., if `GD_DEAD` was set at that moment), `blk_freeze_acquire_lock` would *not* have acquired the `io_lockdep_map`. Consequently, `blk_unfreeze_release_lock` will *not* attempt to release it. This seems logical: if the lock wasn't acquired, it shouldn't be released. The same applies to `mq_freeze_queue_dying`.

However, I'm struggling to see how a mismatch could occur, leading to lockdep warnings like "bad unlock balance detected! ... but there are no more locks to release!". This warning implies that a lock was released when it shouldn't have been, or perhaps it was released more times than it was acquired.

Let's trace a scenario:
1.  Thread A calls `blk_mq_freeze_queue`. `q->mq_freeze_depth` is 0. `blk_freeze_set_owner` runs. Let's assume `q->mq_freeze_disk_dead` is set to `false`. Thread A then successfully acquires the `io_lockdep_map` in `blk_freeze_acquire_lock`.
2.  Thread B calls `blk_mq_freeze_queue` while Thread A is still holding the freeze. `q->mq_freeze_depth` becomes > 0. `blk_freeze_set_owner` returns `false`, and no lock acquisition occurs for Thread B.
3.  Thread B then calls `blk_mq_unfreeze_queue`. `blk_unfreeze_check_owner` would likely return `false` because `q->mq_freeze_owner` would still be Thread A. In this case, `blk_unfreeze_release_lock` is called, and since `q->mq_freeze_disk_dead` is still `false` (as it's only updated when depth is 0), it would attempt to release `io_lockdep_map`. This seems fine.
4.  Thread A eventually calls `blk_mq_unfreeze_queue`. `blk_unfreeze_check_owner` would return `true`. Then `blk_unfreeze_release_lock` would be called. Since `q->mq_freeze_disk_dead` was `false` (from step 1), it would correctly release `io_lockdep_map`.

The core problem I'm wrestling with is how the state of `q->mq_freeze_disk_dead` could change *between* the acquisition attempt and the release attempt in a way that causes a lockdep imbalance. Crucially, `q->mq_freeze_disk_dead` is *only* updated when `q->mq_freeze_depth` is 0. If a thread successfully enters the freeze path (`mq_freeze_depth` was 0), it sets `q->mq_freeze_depth` to 1, and no other thread can reset it to 0 until the first thread unfreezes. This means that `q->mq_freeze_disk_dead` should remain constant for the duration of a specific freeze operation initiated by a single thread.

This leads me to question if there's a subtle race condition I'm missing, or perhaps a misunderstanding of how `GD_DEAD` or `blk_queue_registered` might change state concurrently in a way that interacts with the freeze flags *after* they've been set but *before* the lock is released. However, the fact that `GD_DEAD` is never cleared is a key point.

The warning "but there are no more locks to release!" strongly suggests that lockdep *believes* a release occurred, but it wasn't paired with a prior acquire according to its tracking. This would happen if `blk_unfreeze_release_lock` tries to release a lock that `blk_freeze_acquire_lock` skipped, but `blk_unfreeze_release_lock` *still* attempts the release call.

Could the issue be that `blk_freeze_acquire_lock` *doesn't* acquire the lock (because `q->mq_freeze_disk_dead` was true), but then `blk_unfreeze_release_lock` *does* try to release it? No, that's precisely what the `if (!q->mq_freeze_disk_dead)` guards prevent.

I'm stuck on how a lock can be released without a corresponding acquire being tracked by lockdep, given the structure of these functions and the fact that `q->mq_freeze_disk_dead` is effectively immutable during a given freeze instance. I need to re-examine the concurrent access patterns for `q->mq_freeze_disk_dead` more closely, beyond just the `mq_freeze_depth == 0` check.

map[Name:request_queue::mq_freeze_disk_dead]

map[References:[map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:blk_freeze_acquire_lock SourceFile:block/blk.h SourceLine:763] map[ReferenceKind:writes ReferencingEntityKind:function ReferencingEntityName:blk_freeze_set_owner SourceFile:block/blk-mq.c SourceLine:125] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:blk_unfreeze_release_lock SourceFile:block/blk.h SourceLine:773]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 15225
							output: 28
							thoughts: 2419
						

**My Thought Process Regarding Lock Balance Issues in Block Layer Freezing**

I've been digging into a "bad unlock balance detected!" error related to the block layer's freezing mechanism, and it seems I've gone through a few stages of understanding and then second-guessing myself.

Initially, I focused on the core logic: if a thread freezes a queue, it acquires a lock, and when it unfreezes, it releases that same lock. My first instinct was that the `q->mq_freeze_disk_dead` flag was the key. I reasoned that if this flag was set, the lock acquisition and release might be bypassed, but crucially, it would be bypassed consistently. So, if the lock isn't acquired, it won't be released, maintaining a balanced state. This led me to believe that `q->mq_freeze_disk_dead` couldn't be changing between the acquire and release calls; it's either true throughout or false throughout.

Then I started questioning my assumptions. What if the `blk_mq_freeze_queue` function didn't actually call `blk_freeze_acquire_lock`? I decided to trace the execution path of `blk_mq_freeze_queue`. I saw that it eventually calls `blk_freeze_queue_start`, which in turn calls `__blk_freeze_queue_start`. This function determines whether to call `blk_freeze_acquire_lock` based on the return value of `blk_freeze_set_owner`. And `blk_freeze_set_owner` checks `!q->mq_freeze_depth`. So, if the `mq_freeze_depth` is zero, a new owner is set, and `blk_freeze_acquire_lock` is indeed called.

Next, I followed the unfreeze path. `blk_mq_unfreeze_queue` calls `__blk_mq_unfreeze_queue`, which decrements `mq_freeze_depth` and then calls `blk_unfreeze_check_owner`. This function checks if the `mq_freeze_owner` matches the current thread and if the `mq_freeze_owner_depth` reaches zero. If both are true, `blk_unfreeze_release_lock` is called. This logic seemed sound – if a thread initiates a freeze and then unfreezes, it should acquire and release the lock exactly once.

My next thought was about scenarios where a thread might not be the one that *set* the owner. I imagined a situation where `q->mq_freeze_depth` is already 1, and `q->mq_freeze_owner` is set by Thread A. Then Thread B calls `blk_mq_freeze_queue`. In this case, `blk_freeze_set_owner` would return `false` (because `mq_freeze_depth` is not zero), and `blk_freeze_acquire_lock` wouldn't be called by Thread B. Subsequently, Thread B calls `blk_mq_unfreeze_queue`. `blk_unfreeze_check_owner` would return `false` (because `q->mq_freeze_owner` is not `current` Thread B), and `blk_unfreeze_release_lock` wouldn't be called. This also seemed balanced.

Then I considered the possibility of a thread calling `blk_mq_unfreeze_queue` multiple times when it only called `blk_mq_freeze_queue` once. My analysis of `blk_unfreeze_check_owner` showed that if a thread calls `blk_mq_unfreeze_queue` twice, the second call would find `q->mq_freeze_owner` to be `NULL` (because it's cleared when `mq_freeze_owner_depth` reaches zero). Since `NULL` is not equal to `current`, `blk_unfreeze_check_owner` would return `false`, and `blk_unfreeze_release_lock` would *not* be called. This confirmed that a double unfreeze wouldn't lead to a double release. I also double-checked that `q->mq_freeze_owner` is indeed cleared when the depth reaches zero.

So, if all these balanced scenarios are in play, why the "bad unlock balance detected!"? I started to suspect that perhaps `blk_freeze_acquire_lock` was called, but for some reason, the actual lock acquisition (via `rwsem_acquire`) didn't happen, and then `blk_unfreeze_release_lock` *was* called. I revisited the `blk_unfreeze_release_lock` function and its checks for `mq_freeze_queue_dying` and `mq_freeze_disk_dead`. I reasoned again that if `mq_freeze_disk_dead` was true, neither `rwsem_acquire` nor `rwsem_release` would be called, maintaining balance.

Then I considered a scenario where `blk_mq_freeze_queue` is *never* called, but `blk_mq_unfreeze_queue` *is*. I looked at the `nvme_update_ns_info` example, which showed that `blk_mq_freeze_queue` is always called before `blk_mq_unfreeze_queue`. This seemed to rule out an unfreeze without a prior freeze. I also thought about whether the queue pointer itself could change, but that seemed unlikely as it's a direct pointer.

Finally, I circled back to the core paradox: lockdep believes the lock is *not* held, implying it was either never acquired or already released. This led me to consider what other code paths might release the `io_lockdep_map` lock. It seems the most plausible explanation for lockdep's complaint is that the lock was indeed released by some other, perhaps unexpected, mechanism, or that the acquisition path was flawed in a way I haven't fully grasped yet. I've started a search for other callers of `io_lockdep_map` to investigate this further.

map[Name:request_queue::io_lockdep_map]

map[References:[map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:__bio_queue_enter SourceFile:block/blk-core.c SourceLine:404] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:__bio_queue_enter SourceFile:block/blk-core.c SourceLine:405] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:bio_queue_enter SourceFile:block/blk.h SourceLine:95] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:bio_queue_enter SourceFile:block/blk.h SourceLine:96] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:blk_alloc_queue SourceFile:block/blk-core.c SourceLine:497] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:blk_alloc_queue SourceFile:block/blk-core.c SourceLine:504] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:blk_alloc_queue SourceFile:block/blk-core.c SourceLine:505] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:blk_freeze_acquire_lock SourceFile:block/blk.h SourceLine:764] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:blk_unfreeze_release_lock SourceFile:block/blk.h SourceLine:774]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 17992
							output: 24
							thoughts: 21
						

**My Thought Process Regarding `__bio_queue_enter` and `bio_queue_enter`**

Alright, as an expert in this domain, my immediate inclination upon seeing `__bio_queue_enter` and `bio_queue_enter` is to delve into their functional relationship and the implications of the double underscore. The leading double underscore, a convention I'm acutely aware of, strongly suggests a "private" or internal helper function. This means `__bio_queue_enter` is likely an implementation detail, designed to be called *only* by other functions within the same module or closely related internal code, and not intended for direct external use.

My expectation is that `bio_queue_enter` is the public-facing API, the function that other parts of the system, or even external modules if this were an exposed API, would interact with to initiate the process of enqueuing a `bio` structure. Therefore, I'd hypothesize that `bio_queue_enter` acts as a wrapper or a facade. Its primary role would be to perform any necessary setup, validation, or context-setting before handing off the core logic to `__bio_queue_enter`.

Furthermore, I'd be considering the nature of a "bio" structure. In my field, "bio" often refers to a Block I/O request. Enqueuing such a request implies adding it to a queue for processing, likely by a block device driver or a related subsystem. This process is critical for managing I/O operations efficiently, ensuring fairness, and potentially enabling optimizations like merging adjacent I/O requests.

So, my mental model is:

1.  **`bio_queue_enter` (the public interface):** This is where the request *enters* the system for queueing. It might be responsible for:
    *   Acquiring necessary locks to protect the queue.
    *   Performing initial checks on the `bio` structure (e.g., ensuring it's valid, not already processed).
    *   Potentially setting some context or metadata related to the enqueue operation.
    *   Ultimately, calling the internal `__bio_queue_enter` with the prepared `bio` and any necessary internal state.

2.  **`__bio_queue_enter` (the internal worker):** This is the workhorse that actually manipulates the queue. I anticipate it will:
    *   Take the `bio` and any internal state as arguments.
    *   Perform the actual insertion of the `bio` into the relevant data structure (e.g., a linked list, a more complex queue structure).
    *   Potentially trigger wake-ups for any processes or threads waiting on the queue.
    *   Manage queue statistics or metrics.
    *   Crucially, it would *not* handle external locking or validation; that's the job of the caller (`bio_queue_enter`).

The distinction between these two functions is a clear sign of modularity and good design. It separates the concerns of external interaction and validation from the core, low-level queue manipulation logic, making the code more maintainable and less prone to race conditions if handled correctly. My next step would be to examine their definitions and how they interact to confirm these initial hypotheses.

map[Name:__bio_queue_enter]

map[SourceCode: 376:	int __bio_queue_enter(struct request_queue *q, struct bio *bio)
 377:	{
 378:		while (!blk_try_enter_queue(q, false)) {
 379:			struct gendisk *disk = bio->bi_bdev->bd_disk;
 380:	
 381:			if (bio->bi_opf & REQ_NOWAIT) {
 382:				if (test_bit(GD_DEAD, &disk->state))
 383:					goto dead;
 384:				bio_wouldblock_error(bio);
 385:				return -EAGAIN;
 386:			}
 387:	
 388:			/*
 389:			 * read pair of barrier in blk_freeze_queue_start(), we need to
 390:			 * order reading __PERCPU_REF_DEAD flag of .q_usage_counter and
 391:			 * reading .mq_freeze_depth or queue dying flag, otherwise the
 392:			 * following wait may never return if the two reads are
 393:			 * reordered.
 394:			 */
 395:			smp_rmb();
 396:			wait_event(q->mq_freeze_wq,
 397:				   (!q->mq_freeze_depth &&
 398:				    blk_pm_resume_queue(false, q)) ||
 399:				   test_bit(GD_DEAD, &disk->state));
 400:			if (test_bit(GD_DEAD, &disk->state))
 401:				goto dead;
 402:		}
 403:	
 404:		rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
 405:		rwsem_release(&q->io_lockdep_map, _RET_IP_);
 406:		return 0;
 407:	dead:
 408:		bio_io_error(bio);
 409:		return -ENODEV;
 410:	}
 SourceFile:block/blk-core.c]

gemini-3.1-pro-preview

							input: 18610
							output: 24
							thoughts: 3252
						

**The Root of the Lockdep Complaint: A Subtle Race in Queue Freezing**

My initial thought was that the `__bio_queue_enter` function, with its immediate read acquire and release of `q->io_lockdep_map`, couldn't possibly be the source of a "bad unlock balance" warning. It's a no-op in terms of holding the lock. The warning specifically pointed to an attempt to release a lock that wasn't held. This immediately suggested a scenario where `blk_mq_unfreeze_queue` was being called twice, but my understanding of `blk_unfreeze_check_owner` and the `q->mq_freeze_owner` mechanism showed that this wasn't the case; the second call would simply return `false` without attempting a release.

Then, I considered the possibility of nested `blk_mq_freeze_queue` calls. If a thread freezes the queue, then freezes it again, the `mq_freeze_owner_depth` would correctly increment. Subsequent unfreezes would decrement it, and the lock would be released only when the depth returned to zero. This also seemed to correctly balance.

The next avenue was to investigate the conditions under which `blk_freeze_acquire_lock` might be called but *not* acquire the actual lock, and similarly for `blk_unfreeze_release_lock`. This led me to `q->mq_freeze_disk_dead` and `q->mq_freeze_queue_dying`. The logic for releasing locks mirrored the logic for acquiring them based on these flags, suggesting these paths were also balanced.

However, the critical insight emerged when I examined the interleaving of operations between acquiring the mutex protecting the freeze state (`q->mq_freeze_lock`) and releasing the actual locks (`rwsem_acquire`/`rwsem_release`). I realized that `__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` and *releases* `mq_freeze_lock` *before* calling `blk_unfreeze_release_lock`. This gap is where the race condition lies.

Specifically, I hypothesized this scenario:

1.  **Thread A calls `blk_mq_freeze_queue`:** It sets `q->mq_freeze_depth` to 1. Crucially, if `q->mq_freeze_disk_dead` is initially `true` (perhaps due to the disk being dead or not registered), `blk_freeze_acquire_lock` is *skipped* for `q->io_lockdep_map`.
2.  **Thread A calls `blk_mq_unfreeze_queue`:** It enters `__blk_mq_unfreeze_queue`, decrements `q->mq_freeze_depth` to 0, and releases `q->mq_freeze_lock`.
3.  **Thread A is preempted.**
4.  **Thread B calls `blk_mq_freeze_queue`:** It acquires `q->mq_freeze_lock`. Since `q->mq_freeze_depth` is 0, it calls `blk_freeze_set_owner`. During this call, `q->mq_freeze_disk_dead` is reassessed. If the disk has become registered (i.e., `!blk_queue_registered(q)` becomes false), then `q->mq_freeze_disk_dead` can change from `true` to `false`. `blk_freeze_set_owner` returns `true`.
5.  **Thread B calls `blk_freeze_acquire_lock`:** Because `q->mq_freeze_disk_dead` is now `false`, it *acquires* `q->io_lockdep_map`. Thread B then releases `q->mq_freeze_lock`.
6.  **Thread A resumes:** It proceeds to call `blk_unfreeze_release_lock`. It checks `q->mq_freeze_disk_dead`, which is now `false` (due to Thread B's action). Therefore, it *attempts to release* `q->io_lockdep_map`.

The problem is that Thread A never *acquired* `q->io_lockdep_map` in the first place because `q->mq_freeze_disk_dead` was `true` at that time. Yet, it's now attempting to release it, causing lockdep to complain about an unbalanced unlock. The state of `q->mq_freeze_disk_dead`, which dictates whether `q->io_lockdep_map` is acquired or released, can be changed by another thread in the window between the mutex unlock and the lock release, leading to this "no more locks to release" error for the current thread. The key factor is that the `!blk_queue_registered(q)` part of the `q->mq_freeze_disk_dead` calculation can change from true to false.

map[Name:nvme_scan_ns]

map[SourceCode:4441:	static void nvme_scan_ns(struct nvme_ctrl *ctrl, unsigned nsid)
4442:	{
4443:		struct nvme_ns_info info = { .nsid = nsid };
4444:		struct nvme_ns *ns;
4445:		int ret = 1;
4446:	
4447:		if (nvme_identify_ns_descs(ctrl, &info))
4448:			return;
4449:	
4450:		if (info.ids.csi != NVME_CSI_NVM && !nvme_multi_css(ctrl)) {
4451:			dev_warn(ctrl->device,
4452:				"command set not reported for nsid: %u\n", nsid);
4453:			return;
4454:		}
4455:	
4456:		/*
4457:		 * If available try to use the Command Set Independent Identify Namespace
4458:		 * data structure to find all the generic information that is needed to
4459:		 * set up a namespace.  If not fall back to the legacy version.
4460:		 */
4461:		if ((ctrl->cap & NVME_CAP_CRMS_CRIMS) ||
4462:		    (info.ids.csi != NVME_CSI_NVM && info.ids.csi != NVME_CSI_ZNS) ||
4463:		    ctrl->vs >= NVME_VS(2, 0, 0))
4464:			ret = nvme_ns_info_from_id_cs_indep(ctrl, &info);
4465:		if (ret > 0)
4466:			ret = nvme_ns_info_from_identify(ctrl, &info);
4467:	
4468:		if (info.is_removed)
4469:			nvme_ns_remove_by_nsid(ctrl, nsid);
4470:	
4471:		/*
4472:		 * Ignore the namespace if it is not ready. We will get an AEN once it
4473:		 * becomes ready and restart the scan.
4474:		 */
4475:		if (ret || !info.is_ready)
4476:			return;
4477:	
4478:		ns = nvme_find_get_ns(ctrl, nsid);
4479:		if (ns) {
4480:			nvme_validate_ns(ns, &info);
4481:			nvme_put_ns(ns);
4482:		} else {
4483:			nvme_alloc_ns(ctrl, &info);
4484:		}
4485:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 22634
							output: 24
							thoughts: 11
						

**My Thought Process**

Okay, so the core of what I'm processing right now is the initiation of a namespace allocation within the NVMe subsystem. My internal diagnostic systems have flagged that the `nvml_alloc_ns` function has been invoked. This signifies that the system is attempting to provision a new namespace, which is essentially a logical block device that the host controller can access. This is a foundational step for creating new storage entities or reconfiguring existing ones, and it requires careful management of resources and adherence to NVMe protocol specifications. I need to ensure this allocation proceeds correctly, respecting any existing configurations and ensuring the requested namespace parameters are valid.

map[Name:nvme_alloc_ns]

map[SourceCode:4238:	static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info)
4239:	{
4240:		struct queue_limits lim = { };
4241:		struct nvme_ns *ns;
4242:		struct gendisk *disk;
4243:		int node = ctrl->numa_node;
4244:		bool last_path = false;
4245:	
4246:		ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node);
4247:		if (!ns)
4248:			return;
4249:	
4250:		if (ctrl->opts && ctrl->opts->data_digest)
4251:			lim.features |= BLK_FEAT_STABLE_WRITES;
4252:		if (ctrl->ops->supports_pci_p2pdma &&
4253:		    ctrl->ops->supports_pci_p2pdma(ctrl))
4254:			lim.features |= BLK_FEAT_PCI_P2PDMA;
4255:	
4256:		disk = blk_mq_alloc_disk(ctrl->tagset, &lim, ns);
4257:		if (IS_ERR(disk))
4258:			goto out_free_ns;
4259:		disk->fops = &nvme_bdev_ops;
4260:		disk->private_data = ns;
4261:	
4262:		ns->disk = disk;
4263:		ns->queue = disk->queue;
4264:		ns->ctrl = ctrl;
4265:		kref_init(&ns->kref);
4266:	
4267:		if (nvme_init_ns_head(ns, info))
4268:			goto out_cleanup_disk;
4269:	
4270:		/*
4271:		 * If multipathing is enabled, the device name for all disks and not
4272:		 * just those that represent shared namespaces needs to be based on the
4273:		 * subsystem instance.  Using the controller instance for private
4274:		 * namespaces could lead to naming collisions between shared and private
4275:		 * namespaces if they don't use a common numbering scheme.
4276:		 *
4277:		 * If multipathing is not enabled, disk names must use the controller
4278:		 * instance as shared namespaces will show up as multiple block
4279:		 * devices.
4280:		 */
4281:		if (nvme_ns_head_multipath(ns->head)) {
4282:			sprintf(disk->disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
4283:				ctrl->instance, ns->head->instance);
4284:			disk->flags |= GENHD_FL_HIDDEN;
4285:		} else if (multipath) {
4286:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->subsys->instance,
4287:				ns->head->instance);
4288:		} else {
4289:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance,
4290:				ns->head->instance);
4291:		}
4292:	
4293:		if (nvme_update_ns_info(ns, info))
4294:			goto out_unlink_ns;
4295:	
4296:		mutex_lock(&ctrl->namespaces_lock);
4297:		/*
4298:		 * Ensure that no namespaces are added to the ctrl list after the queues
4299:		 * are frozen, thereby avoiding a deadlock between scan and reset.
4300:		 */
4301:		if (test_bit(NVME_CTRL_FROZEN, &ctrl->flags)) {
4302:			mutex_unlock(&ctrl->namespaces_lock);
4303:			goto out_unlink_ns;
4304:		}
4305:		blk_queue_rq_timeout(ns->queue, ctrl->io_timeout);
4306:		nvme_ns_add_to_ctrl_list(ns);
4307:		mutex_unlock(&ctrl->namespaces_lock);
4308:		synchronize_srcu(&ctrl->srcu);
4309:		nvme_get_ctrl(ctrl);
4310:	
4311:		if (device_add_disk(ctrl->device, ns->disk, nvme_ns_attr_groups))
4312:			goto out_cleanup_ns_from_list;
4313:	
4314:		if (!nvme_ns_head_multipath(ns->head))
4315:			nvme_add_ns_cdev(ns);
4316:	
4317:		nvme_mpath_add_disk(ns, info->anagrpid);
4318:		nvme_fault_inject_init(&ns->fault_inject, ns->disk->disk_name);
4319:	
4320:		return;
4321:	
4322:	 out_cleanup_ns_from_list:
4323:		nvme_put_ctrl(ctrl);
4324:		mutex_lock(&ctrl->namespaces_lock);
4325:		list_del_rcu(&ns->list);
4326:		mutex_unlock(&ctrl->namespaces_lock);
4327:		synchronize_srcu(&ctrl->srcu);
4328:	 out_unlink_ns:
4329:		mutex_lock(&ctrl->subsys->lock);
4330:		list_del_rcu(&ns->siblings);
4331:		if (list_empty(&ns->head->list)) {
4332:			list_del_init(&ns->head->entry);
4333:			/*
4334:			 * If multipath is not configured, we still create a namespace
4335:			 * head (nshead), but head->disk is not initialized in that
4336:			 * case.  As a result, only a single reference to nshead is held
4337:			 * (via kref_init()) when it is created. Therefore, ensure that
4338:			 * we do not release the reference to nshead twice if head->disk
4339:			 * is not present.
4340:			 */
4341:			if (ns->head->disk)
4342:				last_path = true;
4343:		}
4344:		mutex_unlock(&ctrl->subsys->lock);
4345:	
4346:		/* guarantee not available in head->list */
4347:		synchronize_srcu(&ns->head->srcu);
4348:		if (last_path)
4349:			nvme_put_ns_head(ns->head);
4350:		nvme_put_ns_head(ns->head);
4351:	 out_cleanup_disk:
4352:		put_disk(disk);
4353:	 out_free_ns:
4354:		kfree(ns);
4355:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 24589
							output: 26
							thoughts: 151
						

**My Thought Process Unpacking `nvme_alloc_ns` and Queue Registration**

Okay, so I'm looking at the `nvme_alloc_ns` function, and a critical observation immediately jumps out at me: `nvme_update_ns_info` is being called *before* `device_add_disk`. This is a big deal, and I need to dig into why.

My understanding is that `device_add_disk` is the function responsible for calling `blk_register_queue`. This means that when `nvme_update_ns_info` executes, the queue associated with the device, `q`, is *not yet registered*. Therefore, `blk_queue_registered(q)` will, at that moment, be `FALSE`.

Now, here's where it gets a bit more complex and I need to trace further. I see that `nvme_update_ns_info` itself makes a call to `blk_mq_freeze_queue`. And it's not just any queue it's trying to freeze; it's `ns->head->disk->queue`. This immediately raises a question in my mind: is `ns->head->disk->queue` actually registered at this point?

To answer that, I need to understand what `ns->head` represents. My knowledge tells me that `ns->head` is the multipath head. So, the crucial next step in my investigation is to examine the logic within `nvme_init_ns_head` to see how this multipath head and its associated disk and queue are initialized and when that queue becomes registered in the context of the overall NVMe namespace allocation. This sequence is paramount for understanding potential race conditions or dependencies.

map[Name:nvme_init_ns_head]

map[SourceCode:4099:	static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info)
4100:	{
4101:		struct nvme_ctrl *ctrl = ns->ctrl;
4102:		struct nvme_ns_head *head = NULL;
4103:		int ret;
4104:	
4105:		ret = nvme_global_check_duplicate_ids(ctrl->subsys, &info->ids);
4106:		if (ret) {
4107:			/*
4108:			 * We've found two different namespaces on two different
4109:			 * subsystems that report the same ID.  This is pretty nasty
4110:			 * for anything that actually requires unique device
4111:			 * identification.  In the kernel we need this for multipathing,
4112:			 * and in user space the /dev/disk/by-id/ links rely on it.
4113:			 *
4114:			 * If the device also claims to be multi-path capable back off
4115:			 * here now and refuse the probe the second device as this is a
4116:			 * recipe for data corruption.  If not this is probably a
4117:			 * cheap consumer device if on the PCIe bus, so let the user
4118:			 * proceed and use the shiny toy, but warn that with changing
4119:			 * probing order (which due to our async probing could just be
4120:			 * device taking longer to startup) the other device could show
4121:			 * up at any time.
4122:			 */
4123:			nvme_print_device_info(ctrl);
4124:			if ((ns->ctrl->ops->flags & NVME_F_FABRICS) || /* !PCIe */
4125:			    ((ns->ctrl->subsys->cmic & NVME_CTRL_CMIC_MULTI_CTRL) &&
4126:			     info->is_shared)) {
4127:				dev_err(ctrl->device,
4128:					"ignoring nsid %u because of duplicate IDs\n",
4129:					info->nsid);
4130:				return ret;
4131:			}
4132:	
4133:			dev_err(ctrl->device,
4134:				"clearing duplicate IDs for nsid %u\n", info->nsid);
4135:			dev_err(ctrl->device,
4136:				"use of /dev/disk/by-id/ may cause data corruption\n");
4137:			memset(&info->ids.nguid, 0, sizeof(info->ids.nguid));
4138:			memset(&info->ids.uuid, 0, sizeof(info->ids.uuid));
4139:			memset(&info->ids.eui64, 0, sizeof(info->ids.eui64));
4140:			ctrl->quirks |= NVME_QUIRK_BOGUS_NID;
4141:		}
4142:	
4143:		mutex_lock(&ctrl->subsys->lock);
4144:		head = nvme_find_ns_head(ctrl, info->nsid);
4145:		if (!head) {
4146:			ret = nvme_subsys_check_duplicate_ids(ctrl->subsys, &info->ids);
4147:			if (ret) {
4148:				dev_err(ctrl->device,
4149:					"duplicate IDs in subsystem for nsid %u\n",
4150:					info->nsid);
4151:				goto out_unlock;
4152:			}
4153:			head = nvme_alloc_ns_head(ns, info);
4154:			if (IS_ERR(head)) {
4155:				ret = PTR_ERR(head);
4156:				goto out_unlock;
4157:			}
4158:		} else {
4159:			ret = -EINVAL;
4160:			if ((!info->is_shared || !head->shared) &&
4161:			    !list_empty(&head->list)) {
4162:				dev_err(ctrl->device,
4163:					"Duplicate unshared namespace %u\n",
4164:					info->nsid);
4165:				goto out_put_ns_head;
4166:			}
4167:			if (!nvme_ns_ids_equal(&head->ids, &info->ids)) {
4168:				dev_err(ctrl->device,
4169:					"IDs don't match for shared namespace %u\n",
4170:						info->nsid);
4171:				goto out_put_ns_head;
4172:			}
4173:	
4174:			if (!multipath) {
4175:				dev_warn(ctrl->device,
4176:					"Found shared namespace %u, but multipathing not supported.\n",
4177:					info->nsid);
4178:				dev_warn_once(ctrl->device,
4179:					"Shared namespace support requires core_nvme.multipath=Y.\n");
4180:			}
4181:		}
4182:	
4183:		list_add_tail_rcu(&ns->siblings, &head->list);
4184:		ns->head = head;
4185:		mutex_unlock(&ctrl->subsys->lock);
4186:	
4187:	#ifdef CONFIG_NVME_MULTIPATH
4188:		if (cancel_delayed_work(&head->remove_work))
4189:			module_put(THIS_MODULE);
4190:	#endif
4191:		return 0;
4192:	
4193:	out_put_ns_head:
4194:		nvme_put_ns_head(head);
4195:	out_unlock:
4196:		mutex_unlock(&ctrl->subsys->lock);
4197:		return ret;
4198:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 26405
							output: 26
							thoughts: 23
						

**The Core Question:**

My primary concern right now is the lifecycle and state of a newly allocated `nvme_ns_head` structure. Specifically, I need to ascertain whether the underlying NVMe disk is correctly registered and associated with this head when it's initially created by the `nvme_alloc_ns_head` function. This is crucial for ensuring that the namespace is properly managed and accessible within the system.

map[Name:nvme_alloc_ns_head]

map[SourceCode:4002:	static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ns *ns,
4003:			struct nvme_ns_info *info)
4004:		__must_hold(&ns->ctrl->subsys->lock)
4005:	{
4006:		struct nvme_ctrl *ctrl = ns->ctrl;
4007:		struct nvme_ns_head *head;
4008:		size_t size = sizeof(*head);
4009:		int ret = -ENOMEM;
4010:	
4011:	#ifdef CONFIG_NVME_MULTIPATH
4012:		size += nr_node_ids * sizeof(struct nvme_ns *);
4013:	#endif
4014:	
4015:		head = kzalloc(size, GFP_KERNEL);
4016:		if (!head)
4017:			goto out;
4018:		ret = ida_alloc_min(&ctrl->subsys->ns_ida, 1, GFP_KERNEL);
4019:		if (ret < 0)
4020:			goto out_free_head;
4021:		head->instance = ret;
4022:		INIT_LIST_HEAD(&head->list);
4023:		ret = init_srcu_struct(&head->srcu);
4024:		if (ret)
4025:			goto out_ida_remove;
4026:		head->subsys = ctrl->subsys;
4027:		head->ns_id = info->nsid;
4028:		head->ids = info->ids;
4029:		head->shared = info->is_shared;
4030:		head->rotational = info->is_rotational;
4031:		ratelimit_state_init(&head->rs_nuse, 5 * HZ, 1);
4032:		ratelimit_set_flags(&head->rs_nuse, RATELIMIT_MSG_ON_RELEASE);
4033:		kref_init(&head->ref);
4034:		ns->head = head;
4035:	
4036:		if (head->ids.csi) {
4037:			ret = nvme_get_effects_log(ctrl, head->ids.csi, &head->effects);
4038:			if (ret)
4039:				goto out_cleanup_srcu;
4040:		} else
4041:			head->effects = ctrl->effects;
4042:	
4043:		if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
4044:			ret = nvme_query_fdp_info(ns, info);
4045:			if (ret < 0)
4046:				goto out_cleanup_srcu;
4047:		}
4048:	
4049:		ret = nvme_mpath_alloc_disk(ctrl, head);
4050:		if (ret)
4051:			goto out_cleanup_fdp;
4052:	
4053:		list_add_tail(&head->entry, &ctrl->subsys->nsheads);
4054:	
4055:		kref_get(&ctrl->subsys->ref);
4056:	
4057:		return head;
4058:	out_cleanup_fdp:
4059:		kfree(head->plids);
4060:	out_cleanup_srcu:
4061:		cleanup_srcu_struct(&head->srcu);
4062:	out_ida_remove:
4063:		ida_free(&ctrl->subsys->ns_ida, head->instance);
4064:	out_free_head:
4065:		kfree(head);
4066:		ns->head = NULL;
4067:	out:
4068:		if (ret > 0)
4069:			ret = blk_status_to_errno(nvme_error_status(ret));
4070:		return ERR_PTR(ret);
4071:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 27570
							output: 27
							thoughts: 15
						

**My Thought Process Regarding `nvme_mpath_alloc_disk`**

Ah, so when I'm presented with the task of managing NVMe multipathing, the very first, fundamental step in my mental model is **disk allocation**. This is where it all begins. My thought immediately goes to the `nvme_mpath_alloc_disk` function. I recognize this as the crucial gateway, the point at which the system actually reserves and prepares the necessary resources to represent a multipathed NVMe device to the rest of the operating system. It's not just about *seeing* the device; it's about the kernel formally *acknowledging* its existence and making it available for use. I understand that this allocation is the bedrock upon which all subsequent operations – like path management, I/O routing, and error handling within the multipathing framework – will be built. Therefore, my initial focus is on ensuring this allocation process is sound and efficient, as any issues here would cascade and compromise the entire multipathing setup.

map[Name:nvme_mpath_alloc_disk]

map[SourceCode: 734:	int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
 735:	{
 736:		struct queue_limits lim;
 737:	
 738:		mutex_init(&head->lock);
 739:		spin_lock_init(&head->requeue_lock);
 740:		INIT_WORK(&head->requeue_work, nvme_requeue_work);
 741:		INIT_WORK(&head->partition_scan_work, nvme_partition_scan_work);
 742:		INIT_DELAYED_WORK(&head->remove_work, nvme_remove_head_work);
 743:	
 744:		/*
 745:		 * If "multipath_always_on" is enabled, a multipath node is added
 746:		 * regardless of whether the disk is single/multi ported, and whether
 747:		 * the namespace is shared or private. If "multipath_always_on" is not
 748:		 * enabled, a multipath node is added only if the subsystem supports
 749:		 * multiple controllers and the "multipath" option is configured. In
 750:		 * either case, for private namespaces, we ensure that the NSID is
 751:		 * unique.
 752:		 */
 753:		if (!multipath_always_on) {
 754:			if (!(ctrl->subsys->cmic & NVME_CTRL_CMIC_MULTI_CTRL) ||
 755:					!multipath)
 756:				return 0;
 757:		}
 758:	
 759:		if (!nvme_is_unique_nsid(ctrl, head))
 760:			return 0;
 761:	
 762:		blk_set_stacking_limits(&lim);
 763:		lim.dma_alignment = 3;
 764:		lim.features |= BLK_FEAT_IO_STAT | BLK_FEAT_NOWAIT |
 765:			BLK_FEAT_POLL | BLK_FEAT_ATOMIC_WRITES | BLK_FEAT_PCI_P2PDMA;
 766:		if (head->ids.csi == NVME_CSI_ZNS)
 767:			lim.features |= BLK_FEAT_ZONED;
 768:	
 769:		head->disk = blk_alloc_disk(&lim, ctrl->numa_node);
 770:		if (IS_ERR(head->disk))
 771:			return PTR_ERR(head->disk);
 772:		head->disk->fops = &nvme_ns_head_ops;
 773:		head->disk->private_data = head;
 774:	
 775:		/*
 776:		 * We need to suppress the partition scan from occuring within the
 777:		 * controller's scan_work context. If a path error occurs here, the IO
 778:		 * will wait until a path becomes available or all paths are torn down,
 779:		 * but that action also occurs within scan_work, so it would deadlock.
 780:		 * Defer the partition scan to a different context that does not block
 781:		 * scan_work.
 782:		 */
 783:		set_bit(GD_SUPPRESS_PART_SCAN, &head->disk->state);
 784:		sprintf(head->disk->disk_name, "nvme%dn%d",
 785:				ctrl->subsys->instance, head->instance);
 786:		nvme_get_ns_head(head);
 787:		return 0;
 788:	}
 SourceFile:drivers/nvme/host/multipath.c]

gemini-3.1-pro-preview

							input: 28619
							output: 27
							thoughts: 72
						

**My Thought Process Regarding NVMe Multipath Disk Allocation and Addition**

Okay, so I've been diving into the NVMe multipath handling, and I've hit a point where I need to clarify the flow. My initial understanding, or at least the immediate realization, is that the function `nvme_mpath_alloc_disk` is responsible for *allocating* the disk structure itself. However, it's crucial to note that this allocation function *does not* directly trigger the addition of that disk to the system's device tree. That is to say, `nvme_mpath_alloc_disk` doesn't call `device_add_disk`.

This immediately raises the question: when and where *is* `device_add_disk` invoked? My hypothesis is that it's called at a later stage, likely within a function that specifically deals with the *addition* of the multipath disk, rather than just its initial creation and allocation.

To confirm this, I'm now going to examine the implementation of `nvme_mpath_add_disk` (or a similarly named function, if the exact name differs slightly but the intent is clear) to trace the call chain and pinpoint where `device_add_disk` is actually executed. This will be key to understanding the complete lifecycle of an NVMe multipath disk being registered with the kernel.

map[Name:nvme_mpath_add_disk]

map[SourceCode:1361:	void nvme_mpath_add_disk(struct nvme_ns *ns, __le32 anagrpid)
1362:	{
1363:		if (nvme_ctrl_use_ana(ns->ctrl)) {
1364:			struct nvme_ana_group_desc desc = {
1365:				.grpid = anagrpid,
1366:				.state = 0,
1367:			};
1368:	
1369:			mutex_lock(&ns->ctrl->ana_lock);
1370:			ns->ana_grpid = le32_to_cpu(anagrpid);
1371:			nvme_parse_ana_log(ns->ctrl, &desc, nvme_lookup_ana_group_desc);
1372:			mutex_unlock(&ns->ctrl->ana_lock);
1373:			if (desc.state) {
1374:				/* found the group desc: update */
1375:				nvme_update_ns_ana_state(&desc, ns);
1376:			} else {
1377:				/* group desc not found: trigger a re-read */
1378:				set_bit(NVME_NS_ANA_PENDING, &ns->flags);
1379:				queue_work(nvme_wq, &ns->ctrl->ana_work);
1380:			}
1381:		} else {
1382:			ns->ana_state = NVME_ANA_OPTIMIZED;
1383:			nvme_mpath_set_live(ns);
1384:		}
1385:	
1386:	}
 SourceFile:drivers/nvme/host/multipath.c]

gemini-3.1-pro-preview

							input: 29173
							output: 36
							thoughts: 46
						

**My Thought Process**

I was reviewing the NVMe multipath driver (`drivers/nvme/host/multipath.c`) and a question immediately sprang to mind: where exactly is the `device_add_disk` function being invoked for the underlying "head" disks that make up the multipath device? It's a crucial step in integrating these individual storage devices into the system, and I needed to pinpoint its location within the code. To find this, my immediate action was to perform a targeted search for the `device_add_disk` function specifically within the `drivers/nvme/host/multipath.c` file.

map[Expression:device_add_disk PathPrefix:drivers/nvme/host/multipath.c]

map[Output:drivers/nvme/host/multipath.c=790=static void nvme_mpath_set_live(struct nvme_ns *ns)
--
drivers/nvme/host/multipath.c-799-	 * test_and_set_bit() is used because it is protecting against two nvme
drivers/nvme/host/multipath.c:800:	 * paths simultaneously calling device_add_disk() on the same namespace
drivers/nvme/host/multipath.c-801-	 * head.
--
drivers/nvme/host/multipath.c-803-	if (!test_and_set_bit(NVME_NSHEAD_DISK_LIVE, &head->flags)) {
drivers/nvme/host/multipath.c:804:		rc = device_add_disk(&head->subsys->dev, head->disk,
drivers/nvme/host/multipath.c-805-				     nvme_ns_attr_groups);
]

gemini-3.1-pro-preview

							input: 29491
							output: 25
							thoughts: 2833
						

**The Root of the "Bad Unlock Balance" in NVMe Multipathing**

I've been deep-diving into a rather tricky "bad unlock balance detected" error we're seeing, and I think I've finally pieced together the race condition. It all hinges on the interaction between `nvme_mpath_set_live`, `device_add_disk`, and the `blk_mq_freeze_queue`/`blk_mq_unfreeze_queue` pair, specifically around the `q->mq_freeze_disk_dead` flag.

Here's my thought process:

Initially, I noticed that `nvme_mpath_set_live` calls `device_add_disk`. Since `nvme_mpath_set_live` itself is called from `nvme_mpath_add_disk`, and both seem to be involved in adding disks for a namespace, I looked at the flow in `nvme_alloc_ns`.

In `nvme_alloc_ns`, `nvme_update_ns_info` is called *before* `device_add_disk` is called for both `ns->disk` and `ns->head->disk`. This is critical. Inside `nvme_update_ns_info`, `blk_mq_freeze_queue(ns->head->disk->queue)` is invoked. At this point, `device_add_disk` hasn't happened for `ns->head->disk` yet, meaning `blk_queue_registered(ns->head->disk->queue)` is *false*. Consequently, `q->mq_freeze_disk_dead` is set to `TRUE`.

My initial reasoning was that if `q->mq_freeze_disk_dead` is `TRUE`, `blk_freeze_acquire_lock` wouldn't acquire the `io_lockdep_map`, and `blk_unfreeze_release_lock` wouldn't release it. This seemed perfectly balanced, so I was perplexed about the "bad unlock balance" complaint.

Then, I started to consider the possibility that `blk_queue_registered(ns->head->disk->queue)` could become `TRUE` *between* the freeze and unfreeze calls. However, `nvme_update_ns_info` is a single, atomic operation that holds the freeze. This seemed to rule out that specific interleaving *within* a single `nvme_update_ns_info` call.

The real breakthrough came when I considered concurrency. The code comments mention that `test_and_set_bit()` is used because it protects against "two nvme paths simultaneously calling `device_add_disk()` on the same namespace head." This strongly suggested concurrent access to the same namespace head.

Here's the scenario I've identified:

Let's imagine two threads, Thread A (Path 1) and Thread B (Path 2), both trying to process the same NVMe namespace head (`ns->head`).

1.  **Thread A (Path 1) enters `nvme_alloc_ns`:**
    *   It calls `nvme_update_ns_info`.
    *   Inside, it calls `blk_mq_freeze_queue(ns->head->disk->queue)`.
    *   At this point, `blk_queue_registered(ns->head->disk->queue)` is `FALSE`.
    *   Therefore, `q->mq_freeze_disk_dead` is set to `TRUE`.
    *   Thread A then calls `blk_freeze_acquire_lock`. Because `q->mq_freeze_disk_dead` is `TRUE`, it **does NOT acquire** `io_lockdep_map`.

2.  **Thread B (Path 2) concurrently enters `nvme_alloc_ns` (or a related function like `nvme_mpath_set_live`):**
    *   Crucially, Thread B might execute `nvme_mpath_set_live`, which calls `device_add_disk(ns->head->disk)`.
    *   The `device_add_disk` function calls `blk_register_queue(q)`.
    *   Now, `blk_queue_registered(ns->head->disk->queue)` is **TRUE**.

3.  **Thread A resumes execution within `nvme_update_ns_info`:**
    *   It proceeds to call `blk_mq_unfreeze_queue(ns->head->disk->queue)`.
    *   This function eventually calls `__blk_mq_unfreeze_queue`.
    *   It acquires the `mq_freeze_lock`.
    *   `q->mq_freeze_depth` is decremented.
    *   `blk_unfreeze_check_owner` returns `TRUE`.
    *   The `mq_freeze_lock` is released.
    *   Now, Thread A is about to call `blk_unfreeze_release_lock(q)`. **Here's where Thread A can get preempted.**

4.  **Preemption and Interruption:**
    *   Thread A is preempted *just before* calling `blk_unfreeze_release_lock`.
    *   **Crucially, because Thread A never acquired `io_lockdep_map` (due to `q->mq_freeze_disk_dead` being `TRUE` initially), it doesn't expect to release it.**

5.  **Another Thread (Thread C) Intervenes:**
    *   Now, imagine *another* thread (Thread C) also needs to freeze the queue for `ns->head->disk->queue`. This could be another path processing its `nvme_update_ns_info`, or potentially another operation that freezes the queue.
    *   Thread C calls `blk_mq_freeze_queue(ns->head->disk->queue)`.
    *   It acquires `mq_freeze_lock`.
    *   It calls `blk_freeze_set_owner`. This function checks `!blk_queue_registered(q)`. **Since Thread B already registered the queue, this check now returns `FALSE`**.
    *   Therefore, `q->mq_freeze_disk_dead` is now **set to `FALSE`** by Thread C.
    *   Thread C releases `mq_freeze_lock` and proceeds to call `blk_freeze_acquire_lock`, which **acquires** `io_lockdep_map` because `q->mq_freeze_disk_dead` is now `FALSE`.

6.  **Thread A Resumes:**
    *   Thread A wakes up and finally calls `blk_unfreeze_release_lock(q)`.
    *   It checks `q->mq_freeze_disk_dead`.
    *   But, Thread C has *already changed this flag to `FALSE`*!
    *   So, `blk_unfreeze_release_lock` now thinks it's appropriate to **release `io_lockdep_map`**.
    *   **The problem:** Thread A *never acquired* `io_lockdep_map` in the first place. It's attempting to release a lock it never held, triggering the "bad unlock balance detected" error.

This is the precise race: Thread A freezes the queue, sets `dead=TRUE` (and thus doesn't acquire the lock), gets preempted. Before it can unfreeze and release (without releasing the lock it didn't hold), another thread registers the queue, and then another thread freezes the queue, which overwrites `dead=FALSE`. When Thread A finally resumes and attempts to unfreeze, it incorrectly releases the lock it never acquired.

The key is that `q->mq_freeze_disk_dead` is a shared flag that can be modified by *any* thread freezing the queue, and its state at the time of unfreezing is critical for lock management, especially when `blk_queue_registered` changes between the initial freeze and the subsequent unfreeze. This is a classic concurrency nightmare!

map[Name:blk_mq_freeze_queue]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:aoedev_downdev SourceFile:drivers/block/aoe/aoedev.c SourceLine:240] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blk_mq_update_tag_set_shared SourceFile:block/blk-mq.c SourceLine:4308] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blk_revalidate_disk_zones SourceFile:block/blk-zoned.c SourceLine:2385] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blk_throtl_init SourceFile:block/blk-throttle.c SourceLine:1332] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blkcg_activate_policy SourceFile:block/blk-cgroup.c SourceLine:1606] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blkcg_deactivate_policy SourceFile:block/blk-cgroup.c SourceLine:1710] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blkiolatency_enable_work_fn SourceFile:block/blk-iolatency.c SourceLine:748] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:del_mtd_blktrans_dev SourceFile:drivers/mtd/mtd_blkdevs.c SourceLine:424] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:disk_update_zone_resources SourceFile:block/blk-zoned.c SourceLine:2069] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:elevator_change SourceFile:block/elevator.c SourceLine:668] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:elv_exit_and_release SourceFile:block/elevator.c SourceLine:615] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioc_cost_model_write SourceFile:block/blk-iocost.c SourceLine:3509] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioc_qos_write SourceFile:block/blk-iocost.c SourceLine:3299] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:loop_change_fd SourceFile:drivers/block/loop.c SourceLine:604] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:loop_set_block_size SourceFile:drivers/block/loop.c SourceLine:1504] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:loop_set_dio SourceFile:drivers/block/loop.c SourceLine:1458] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:loop_set_status SourceFile:drivers/block/loop.c SourceLine:1270] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nvme_update_ns_info SourceFile:drivers/nvme/host/core.c SourceLine:2583] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nvme_update_ns_info_block SourceFile:drivers/nvme/host/core.c SourceLine:2446] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nvme_update_ns_info_generic SourceFile:drivers/nvme/host/core.c SourceLine:2246] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:queue_async_depth_store SourceFile:block/blk-sysfs.c SourceLine:162] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:queue_limits_commit_update_frozen SourceFile:block/blk-settings.c SourceLine:590] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:queue_requests_store SourceFile:block/blk-sysfs.c SourceLine:123] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:queue_zoned_qd1_writes_store SourceFile:block/blk-sysfs.c SourceLine:412] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rq_qos_add SourceFile:block/blk-rq-qos.c SourceLine:341] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rq_qos_del SourceFile:block/blk-rq-qos.c SourceLine:364] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:scsi_device_quiesce SourceFile:drivers/scsi/scsi_lib.c SourceLine:2851] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:scsi_realloc_sdev_budget_map SourceFile:drivers/scsi/scsi_scan.c SourceLine:245] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ublk_lock_buf_tree SourceFile:drivers/block/ublk_drv.c SourceLine:5355] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:virtblk_freeze_priv SourceFile:drivers/block/virtio_blk.c SourceLine:1597] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wbt_set_lat SourceFile:block/blk-wbt.c SourceLine:1009]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 33446
							output: 28
							thoughts: 57
						

**My Thought Process Unfolding**

Okay, so I'm delving into this NVMe driver code, and a particular detail has just caught my eye. I was tracing some operations related to namespace information updates, and I've noticed that not just one, but *two* functions, `nvme_update_ns_info_block` and `nvme_update_ns_info_generic`, are both making calls to `blk_mq_freeze_queue`.

This is interesting because `blk_mq_freeze_queue` is a significant operation. It's used to quiesce the block layer's multi-queue submission mechanism, essentially pausing all I/O operations on a given queue. Seeing it invoked in *both* these namespace update functions suggests there's a common, perhaps critical, reason for pausing I/O during these specific updates. It implies that the act of updating the namespace's information block, whether it's a generic update or one specifically related to a "block" type of namespace, has the potential to interfere with ongoing I/O, or that the *state* of the I/O needs to be stable while the information is being refreshed.

My immediate next step is to investigate `nvme_update_ns_info_block` more closely. I need to understand *why* it, in particular, is opting to freeze the queue. Is it reading sensitive metadata that could change mid-read? Is it performing a write operation that requires a clean slate? Or is it preparing for a more complex operation that necessitates I/O quiescence? By dissecting `nvme_update_ns_info_block`, I expect to gain a clearer picture of the potential race conditions or data integrity concerns that the `blk_mq_freeze_queue` call is designed to mitigate. This will then inform my understanding of why the generic version also does it, or if there's a subtle difference in their requirements.

map[Name:nvme_update_ns_info_block]

map[SourceCode:2398:	static int nvme_update_ns_info_block(struct nvme_ns *ns,
2399:			struct nvme_ns_info *info)
2400:	{
2401:		struct queue_limits lim;
2402:		struct nvme_id_ns_nvm *nvm = NULL;
2403:		struct nvme_zone_info zi = {};
2404:		struct nvme_id_ns *id;
2405:		unsigned int memflags;
2406:		sector_t capacity;
2407:		unsigned lbaf;
2408:		int ret;
2409:	
2410:		ret = nvme_identify_ns(ns->ctrl, info->nsid, &id);
2411:		if (ret)
2412:			return ret;
2413:	
2414:		if (id->ncap == 0) {
2415:			/* namespace not allocated or attached */
2416:			info->is_removed = true;
2417:			ret = -ENXIO;
2418:			goto out;
2419:		}
2420:		lbaf = nvme_lbaf_index(id->flbas);
2421:	
2422:		if (nvme_id_cns_ok(ns->ctrl, NVME_ID_CNS_CS_NS)) {
2423:			ret = nvme_identify_ns_nvm(ns->ctrl, info->nsid, &nvm);
2424:			if (ret < 0)
2425:				goto out;
2426:		}
2427:	
2428:		if (IS_ENABLED(CONFIG_BLK_DEV_ZONED) &&
2429:		    ns->head->ids.csi == NVME_CSI_ZNS) {
2430:			ret = nvme_query_zone_info(ns, lbaf, &zi);
2431:			if (ret < 0)
2432:				goto out;
2433:		}
2434:	
2435:		if (nvme_invalid_lba_sz(le64_to_cpu(id->nsze),
2436:				id->lbaf[lbaf].ds - SECTOR_SHIFT, &capacity)) {
2437:			dev_warn_once(ns->ctrl->device,
2438:				"invalid LBA data size %u, skipping namespace\n",
2439:				id->lbaf[lbaf].ds);
2440:			ret = -ENODEV;
2441:			goto out;
2442:		}
2443:	
2444:		lim = queue_limits_start_update(ns->disk->queue);
2445:	
2446:		memflags = blk_mq_freeze_queue(ns->disk->queue);
2447:		ns->head->lba_shift = id->lbaf[lbaf].ds;
2448:		ns->head->nuse = le64_to_cpu(id->nuse);
2449:		nvme_set_ctrl_limits(ns->ctrl, &lim, false);
2450:		nvme_configure_metadata(ns->ctrl, ns->head, id, nvm, info);
2451:		nvme_set_chunk_sectors(ns, id, &lim);
2452:		if (!nvme_update_disk_info(ns, id, nvm, &lim))
2453:			capacity = 0;
2454:	
2455:		/*
2456:		 * A failed zone info query leaves zi zero-initialized, so skip the
2457:		 * zoned limits update instead of configuring the queue from it.
2458:		 * During a revalidation that keeps the zone geometry the queue was
2459:		 * last validated with; on a first scan the namespace is registered
2460:		 * without zoned limits, so that it is still available as a handle
2461:		 * for admin commands.
2462:		 */
2463:		if (IS_ENABLED(CONFIG_BLK_DEV_ZONED) &&
2464:		    ns->head->ids.csi == NVME_CSI_ZNS) {
2465:			if (zi.zone_size)
2466:				nvme_update_zone_info(ns, &lim, &zi);
2467:			else
2468:				dev_warn(ns->ctrl->device,
2469:					 "zone info query failed for nsid %u, %s\n",
2470:					 ns->head->ns_id,
2471:					 blk_queue_is_zoned(ns->disk->queue) ?
2472:					 "keeping the previous zone limits" :
2473:					 "not enabling zoned mode");
2474:		}
2475:	
2476:		if ((ns->ctrl->vwc & NVME_CTRL_VWC_PRESENT) && !info->no_vwc)
2477:			lim.features |= BLK_FEAT_WRITE_CACHE | BLK_FEAT_FUA;
2478:		else
2479:			lim.features &= ~(BLK_FEAT_WRITE_CACHE | BLK_FEAT_FUA);
2480:	
2481:		if (info->is_rotational)
2482:			lim.features |= BLK_FEAT_ROTATIONAL;
2483:	
2484:		/*
2485:		 * Register a metadata profile for PI, or the plain non-integrity NVMe
2486:		 * metadata masquerading as Type 0 if supported, otherwise reject block
2487:		 * I/O to namespaces with metadata except when the namespace supports
2488:		 * PI, as it can strip/insert in that case.
2489:		 */
2490:		if (!nvme_init_integrity(ns->head, &lim, info))
2491:			capacity = 0;
2492:	
2493:		lim.max_write_streams = ns->head->nr_plids;
2494:		lim.write_stream_granularity = ns->head->write_stream_granularity;
2495:	
2496:		/*
2497:		 * Only set the DEAC bit if the device guarantees that reads from
2498:		 * deallocated data return zeroes.  While the DEAC bit does not
2499:		 * require that, it must be a no-op if reads from deallocated data
2500:		 * do not return zeroes.
2501:		 */
2502:		if ((id->dlfeat & 0x7) == 0x1 && (id->dlfeat & (1 << 3))) {
2503:			ns->head->features |= NVME_NS_DEAC;
2504:			lim.max_hw_wzeroes_unmap_sectors = lim.max_write_zeroes_sectors;
2505:		}
2506:	
2507:		ret = queue_limits_commit_update(ns->disk->queue, &lim);
2508:		if (ret) {
2509:			blk_mq_unfreeze_queue(ns->disk->queue, memflags);
2510:			goto out;
2511:		}
2512:	
2513:		set_capacity_and_notify(ns->disk, capacity);
2514:		set_disk_ro(ns->disk, nvme_ns_is_readonly(ns, info));
2515:		set_bit(NVME_NS_READY, &ns->flags);
2516:		blk_mq_unfreeze_queue(ns->disk->queue, memflags);
2517:	
2518:		if (blk_queue_is_zoned(ns->queue)) {
2519:			ret = blk_revalidate_disk_zones(ns->disk);
2520:			if (ret && !nvme_first_scan(ns->disk))
2521:				goto out;
2522:		}
2523:	
2524:		ret = 0;
2525:	out:
2526:		kfree(nvm);
2527:		kfree(id);
2528:		return ret;
2529:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 35754
							output: 24
							thoughts: 506
						

**The Root of the Multipath Freezing Issue**

Okay, let me trace this thought process. I was digging into a freezing issue, and it appears to stem from how namespace information is updated, specifically within multipath configurations.

Initially, I noticed that `nvme_update_ns_info_block` was freezing the `ns->disk->queue`. Then, I saw that `nvme_update_ns_info` itself was also freezing, and crucially, it seemed to be freezing *both* `ns->disk->queue` (the private namespace queue) and `ns->head->disk->queue` (the multipath head queue).

The warning message provided a critical clue: `kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at: [<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline] [<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623`. The specific line, 2623, pointed to `blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);`. This immediately clarified things: the problematic unfreeze operation, leading to the lock contention, was happening on the *multipath head queue*.

Therefore, the race condition I'm observing is definitively on `ns->head->disk->queue`.

To reproduce this, the scenario hinges on a multipath setup. I need at least two controllers (or paths) pointing to the *same* namespace. The trigger for the race appears to be concurrently calling `nvme_scan_ns` on both of these controllers.

Now, how can I achieve concurrent `nvme_scan_ns` calls? If I manually add two controllers that happen to expose the exact same namespace, they will naturally initiate a scan. Alternatively, I could force a rescan on both controllers simultaneously. For instance, by executing `echo 1 > /sys/class/nvme/nvme0/rescan` and `echo 1 > /sys/class/nvme/nvme1/rescan` at roughly the same time. If these rescans target the same namespace concurrently, both controllers will likely attempt to either allocate the namespace (`nvme_alloc_ns`) or update its information (`nvme_update_ns_info`).

A further refinement: if the namespace has already been allocated when `nvme_scan_ns` is called, the code path taken is actually `nvme_validate_ns`. This means the race condition could also manifest within `nvme_validate_ns` if it also calls `nvme_update_ns_info` or related functions that interact with the multipath head queue in a conflicting manner. The core issue remains the concurrent access and potential locking conflicts on `ns->head->disk->queue` during namespace discovery or validation in a multipath environment.

map[Name:nvme_validate_ns]

map[SourceCode:4419:	static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_info *info)
4420:	{
4421:		int ret = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
4422:	
4423:		if (!nvme_ns_ids_equal(&ns->head->ids, &info->ids)) {
4424:			dev_err(ns->ctrl->device,
4425:				"identifiers changed for nsid %u\n", ns->head->ns_id);
4426:			goto out;
4427:		}
4428:	
4429:		ret = nvme_update_ns_info(ns, info);
4430:	out:
4431:		/*
4432:		 * Only remove the namespace if we got a fatal error back from the
4433:		 * device, otherwise ignore the error and just move on.
4434:		 *
4435:		 * TODO: we should probably schedule a delayed retry here.
4436:		 */
4437:		if (ret > 0 && (ret & NVME_STATUS_DNR))
4438:			nvme_ns_remove(ns);
4439:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 36638
							output: 29
							thoughts: 1184
						

**The Nuances of NVMe Namespace Allocation and Concurrency**

My current line of thinking has been laser-focused on a specific race condition I've identified within the NVMe driver, particularly around how namespaces are handled when multiple controllers access the same underlying hardware. It started with a simple observation: `nvme_validate_ns` calls `nvme_update_ns_info`. This seemed straightforward enough, but then I began to consider the implications of concurrent access.

If a namespace is already allocated and I trigger a rescan across two controllers simultaneously, both controllers will end up calling `nvme_validate_ns`, and subsequently `nvme_update_ns_info`. Now, the critical point here is that if the namespace is *already* allocated, then `device_add_disk` has *already* been called for that namespace. This means that the `blk_queue_registered(q)` flag for its associated queue will *already* be TRUE.

If `blk_queue_registered(q)` is TRUE, then `q->mq_freeze_disk_dead` will necessarily be FALSE. Consequently, `blk_freeze_acquire_lock` will correctly acquire the `io_lockdep_map`, and `blk_unfreeze_release_lock` will correctly release it. From this perspective, if `blk_queue_registered(q)` is already TRUE, there appears to be no race condition.

The real problem, the source of the race, emerges *only* when `blk_queue_registered(q)` transitions from FALSE to TRUE *between* the calls to `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue`. This transition, importantly, only happens during `device_add_disk`. Therefore, the race condition *must* occur during the *initial allocation* of the namespace.

To provoke this, I envision a scenario where two controllers attempt to expose the same namespace concurrently. Alternatively, I considered adding one controller and, while it's in the process of allocating the namespace (specifically within `nvme_alloc_ns`), adding a second controller. However, the simpler approach of just adding two controllers simultaneously seems sufficient. Both will initiate a scan of the namespace. One controller will likely allocate the `ns->head` structure first, while the other will find it already present. Both will proceed to call `nvme_alloc_ns`, and then `nvme_update_ns_info`.

Here's where the timing becomes crucial: if one controller (let's call it Path 1) calls `nvme_alloc_ns`, then `nvme_update_ns_info`, and then `device_add_disk(ns->disk)`, followed by `nvme_mpath_add_disk` and `nvme_mpath_set_live`, which in turn calls `device_add_disk(ns->head->disk)`. Meanwhile, a second controller (Path 2) also calls `nvme_alloc_ns`, then `nvme_update_ns_info`, and `device_add_disk(ns->disk)`.

The problematic sequence arises if Path 2's call to `nvme_update_ns_info` happens *before* Path 1 calls `device_add_disk(ns->head->disk)`. In this case, Path 2 will see `blk_queue_registered(q)` as FALSE. It will then set `q->mq_freeze_disk_dead` to TRUE. Subsequently, Path 1 completes its `device_add_disk(ns->head->disk)` call, setting `blk_queue_registered(q)` to TRUE. Finally, Path 2 proceeds to call `blk_mq_unfreeze_queue`.

Now, revisiting my earlier analysis, `q->mq_freeze_disk_dead` is a field within `struct request_queue`. If Path 2 sets it to TRUE, and Path 1's subsequent `device_add_disk` call doesn't reset it, `q->mq_freeze_disk_dead` remains TRUE. This means Path 2 will *not* release the lock, which appears to "balance" the freeze operation for Path 2. However, this is precisely where the problem lies: if the lock isn't released, there's no "bad unlock balance detected" error, but the system is left in an inconsistent state.

The issue, as I now understand it, is that we need `q->mq_freeze_disk_dead` to be *overwritten* to FALSE *before* Path 2 calls `blk_unfreeze_release_lock`. How could this happen? It would require another thread to call `blk_mq_freeze_queue` when `q->mq_freeze_depth` is 0. So, Path 2 would have to decrement `q->mq_freeze_depth` to 0, release the `mq_freeze_lock`, and then be preempted. Following this, another thread (perhaps Path 1 or a completely separate Path 3) would need to call `blk_mq_freeze_queue`. This new call would see `q->mq_freeze_depth == 0`, evaluate `!blk_queue_registered(q)` (which is now FALSE), and importantly, set `q->mq_freeze_disk_dead = FALSE`. Only then, when Path 2 resumes and calls `blk_unfreeze_release_lock`, will it see `q->mq_freeze_disk_dead == FALSE` and correctly release the lock.

This implies a scenario requiring at least *three* freeze/unfreeze cycles on the queue. The question that follows is whether a single path, like `nvme_update_ns_info` (which performs one freeze/unfreeze cycle on `ns->head->disk->queue`), or potentially `nvme_mpath_update_disk_size`, could itself involve multiple freeze/unfreeze operations that could contribute to this complex interaction. My current focus is dissecting the exact sequence of calls and their timing to confirm how this state can be reached.

log-in to see details

map[Name:nvme_mpath_update_disk_size]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 37860
							output: 25
							thoughts: 256
						

**My Thought Process Regarding NVMe Namespace Size Updates and Queue Freezing**

My initial line of inquiry began with a specific function, `nvme_mpath_update_disk_size`, which, upon closer inspection, I realized doesn't actually exist. This led me to pivot, considering what other operations might be causing the `ns->head->disk->queue` to freeze.

I decided to revisit the `nvme_update_ns_info` function, as it seemed like a likely candidate for such operations. Examining the code snippet provided, I observed the following:

```c
		memflags = blk_mq_freeze_queue(ns->head->disk->queue);
        // ...
		ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
		if (ret)
			goto unfreeze_head_queue;

		set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
		set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
		nvme_mpath_revalidate_paths(ns->head);
		ret = nvme_mpath_revalidate_zones(ns->head);

unfreeze_head_queue:
		blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
```

My attention was immediately drawn to the sequence of events. The queue is explicitly frozen using `blk_mq_freeze_queue` at the beginning. Then, `queue_limits_commit_update` is called. This is where my current line of thought is focusing: I am now questioning whether `queue_limits_commit_update` itself might be the mechanism that is causing the queue to freeze. The subsequent calls to `set_capacity_and_notify`, `set_disk_ro`, `nvme_mpath_revalidate_paths`, and `nvme_mpath_revalidate_zones` all occur *after* the potential freeze point introduced by `queue_limits_commit_update`. Finally, the queue is unfrozen at the `unfreeze_head_queue` label, which is only reached if `queue_limits_commit_update` returns successfully or if an error occurs during its execution, leading to the `goto`. This suggests that the freezing behavior, or at least the handling of it, is intricately linked to the `queue_limits_commit_update` operation.

map[Name:queue_limits_commit_update]

map[SourceCode: 534:	/**
 535:	 * queue_limits_commit_update - commit an atomic update of queue limits
 536:	 * @q:		queue to update
 537:	 * @lim:	limits to apply
 538:	 *
 539:	 * Apply the limits in @lim that were obtained from queue_limits_start_update()
 540:	 * and updated by the caller to @q.  The caller must have frozen the queue or
 541:	 * ensure that there are no outstanding I/Os by other means.
 542:	 *
 543:	 * Returns 0 if successful, else a negative error code.
 544:	 */
 545:	int queue_limits_commit_update(struct request_queue *q,
 546:			struct queue_limits *lim)
 547:	{
 548:		int error;
 549:	
 550:		lockdep_assert_held(&q->limits_lock);
 551:	
 552:		error = blk_validate_limits(lim);
 553:		if (error)
 554:			goto out_unlock;
 555:	
 556:	#ifdef CONFIG_BLK_INLINE_ENCRYPTION
 557:		if (q->crypto_profile && lim->integrity.tag_size) {
 558:			pr_warn("blk-integrity: Integrity and hardware inline encryption are not supported together.\n");
 559:			error = -EINVAL;
 560:			goto out_unlock;
 561:		}
 562:	#endif
 563:	
 564:		q->limits = *lim;
 565:		if (q->disk)
 566:			blk_apply_bdi_limits(q->disk->bdi, lim);
 567:	out_unlock:
 568:		mutex_unlock(&q->limits_lock);
 569:		return error;
 570:	}
 SourceFile:block/blk-settings.c]

gemini-3.1-pro-preview

							input: 38687
							output: 23
							thoughts: 1855
						

**My Thought Process Unraveling the NVMe Queue Freeze Race Condition**

Initially, I dismissed the idea that the queue freezing was the problem. But then a crucial question struck me: what if `nvme_update_ns_info` gets called *twice* for the exact same device path? I traced the logic: `nvme_scan_ns` handles this by either allocating a new namespace (`nvme_alloc_ns`) or validating an existing one (`nvme_validate_ns`). If I were to trigger a rescan, it would go down the `nvme_validate_ns` path, which in turn calls `nvme_update_ns_info`. This means I *can* indeed trigger `nvme_update_ns_info` multiple times for the same path.

This realization led me to suspect a race condition. I laid out a potential sequence:

1.  A path (let's call it Path 1) is created. `nvme_alloc_ns` is invoked.
2.  `nvme_update_ns_info` is called for Path 1. This action freezes the queue associated with the namespace's disk (`ns->head->disk->queue`). Crucially, `q->mq_freeze_disk_dead` is set to TRUE during this phase.
3.  Path 1 then unfreezes the queue.
4.  Path 1 proceeds to call `device_add_disk(ns->head->disk)`. At this point, `blk_queue_registered(q)` becomes TRUE.
5.  Now, imagine I trigger a rescan on Path 1. This again calls `nvme_validate_ns` leading to `nvme_update_ns_info`.
6.  This second call to `nvme_update_ns_info` attempts to freeze the queue. However, now `q->mq_freeze_disk_dead` is FALSE because `blk_queue_registered(q)` is TRUE.
7.  The queue is then unfreezed.

At first glance, this sequential execution within a single path didn't present a race. The critical insight was that *concurrency* was the missing piece. To exploit this, I envisioned a scenario involving multiple threads:

*   **Thread A (Path 2's `nvme_alloc_ns`):** This thread calls `nvme_update_ns_info`. It freezes the queue for its respective disk. `q->mq_freeze_disk_dead` is TRUE. It then unfreezes, decrementing `q->mq_freeze_depth` to zero and releasing the `mq_freeze_lock`. At this precise moment, it gets preempted.
*   **Thread B (Path 1's `nvme_alloc_ns`):** This thread has already completed its `nvme_update_ns_info` and is now calling `device_add_disk(ns->head->disk)`. This sets `blk_queue_registered(q)` to TRUE.
*   **Thread C (Path 1 rescan, or Path 3's `nvme_alloc_ns`):** This thread calls `nvme_update_ns_info`. It attempts to freeze the queue. It acquires the `mq_freeze_lock` because `q->mq_freeze_depth` is zero. Crucially, it then sets `q->mq_freeze_disk_dead` to FALSE, increments `q->mq_freeze_depth` to one, and releases the `mq_freeze_lock`.

When **Thread A** resumes execution, it calls `blk_unfreeze_release_lock`. It observes that `q->mq_freeze_disk_dead` is FALSE. It proceeds to release the `io_lockdep_map`. This is where the lockdep mechanism complains! It's complaining because Thread A is releasing a lock that it technically should have held if the freeze operation hadn't been interrupted and then re-entered with a different state.

This scenario definitively requires *three* threads to manifest: one for the initial freeze/unfreeze and preemption (Thread A), one to register the disk (Thread B), and one to re-enter the freeze path with the queue already registered (Thread C).

Then I questioned if Thread B and Thread C could be the same thread. If Thread B, after calling `device_add_disk`, could *immediately* re-enter `nvme_update_ns_info`, that might work. But it first has to finish `nvme_alloc_ns`. However, the trigger for Thread C could be an external event, like a udev rule firing off a rescan immediately after the device appears. Or, with three distinct paths, Path 1 finishes `device_add_disk`, while Path 2 is in its unfreeze stage, and Path 3 starts its freeze.

This complexity makes me realize that a tool like syzkaller, which excels at creating concurrent device paths, would be exceptionally effective at triggering this bug. Syzkaller can leverage `vhci`, `loop`, or `nvme-loop` to spin up multiple NVMe controllers, especially if they point to the same underlying subsystem, thus creating multiple paths to the same namespace.

I then delved into *how* `q->mq_freeze_disk_dead` could transition from TRUE to FALSE. The relevant code snippet showed it depends on `!q->disk`, `test_bit(GD_DEAD, &q->disk->state)`, or `!blk_queue_registered(q)`. I confirmed that `GD_DEAD` is only ever set, never cleared, and `q->disk` is already established before `nvme_update_ns_info`. Therefore, the *only* factor that can flip `q->mq_freeze_disk_dead` from TRUE to FALSE is `!blk_queue_registered(q)` transitioning to TRUE (meaning `blk_queue_registered(q)` itself becomes TRUE). This happens precisely when `device_add_disk` is called.

So, the race condition crystalized:

1.  `blk_mq_freeze_queue` is called when `blk_queue_registered(q)` is FALSE. `q->mq_freeze_disk_dead` is correctly set to TRUE.
2.  `blk_mq_unfreeze_queue` is called. It decrements `q->mq_freeze_depth` to 0 and releases the `mq_freeze_lock`.
3.  *Before* `blk_unfreeze_release_lock` completes, `device_add_disk` is called, and `blk_queue_registered(q)` becomes TRUE.
4.  A *different* thread invokes `blk_mq_freeze_queue` again. This time, it finds `!blk_queue_registered(q)` is FALSE, so it sets `q->mq_freeze_disk_dead` to FALSE.
5.  The first thread finally calls `blk_unfreeze_release_lock`. It sees `q->mq_freeze_disk_dead == FALSE` and proceeds to release the lock it never truly held in the context of the second freeze operation.

My final verification was whether a *single* path could trigger this. If a single thread is executing `nvme_alloc_ns`, it calls `nvme_update_ns_info`, freezes, unfreezes, and then calls `device_add_disk`. It cannot be preempted between the unfreeze and `device_add_disk` call because it must complete the unfreeze logic before proceeding. Thus, it *cannot* be the same thread. This necessitates at least two concurrent threads.

Finally, I considered if a user space process opening the block device could be involved. However, the device node isn't visible until *after* `device_add_disk` completes. Even if a user process opened the private namespace disk (`ns->disk`), that would freeze `ns->disk->queue`, not `ns->head->disk->queue`. Therefore, the need for two separate NVMe paths (multipath) remains the core requirement. Syzkaller's ability to create multiple paths to the same target, either through multiple ports or simply re-connecting to the same port, is precisely how it would expose this issue.

map[Name:blk_register_queue]

map[SourceCode: 946:	/**
 947:	 * blk_register_queue - register a block layer queue with sysfs
 948:	 * @disk: Disk of which the request queue should be registered with sysfs.
 949:	 */
 950:	int blk_register_queue(struct gendisk *disk)
 951:	{
 952:		struct request_queue *q = disk->queue;
 953:		unsigned int memflags;
 954:		int ret;
 955:	
 956:		ret = kobject_add(&disk->queue_kobj, &disk_to_dev(disk)->kobj, "queue");
 957:		if (ret < 0)
 958:			return ret;
 959:	
 960:		if (queue_is_mq(q)) {
 961:			ret = blk_mq_sysfs_register(disk);
 962:			if (ret)
 963:				goto out_del_queue_kobj;
 964:		}
 965:		mutex_lock(&q->sysfs_lock);
 966:	
 967:		memflags = blk_debugfs_lock(q);
 968:		q->debugfs_dir = debugfs_create_dir(disk->disk_name, blk_debugfs_root);
 969:		if (IS_ENABLED(CONFIG_BLK_ERROR_INJECTION))
 970:			blk_error_injection_init(disk);
 971:		if (queue_is_mq(q))
 972:			blk_mq_debugfs_register(q);
 973:		blk_debugfs_unlock(q, memflags);
 974:	
 975:		/*
 976:		 * For blk-mq rotational zoned devices, default to using QD=1
 977:		 * writes. For non-mq rotational zoned devices, the device driver can
 978:		 * set an appropriate default.
 979:		 */
 980:		if (queue_is_mq(q) && blk_queue_rot(q) && blk_queue_is_zoned(q))
 981:			blk_queue_flag_set(QUEUE_FLAG_ZONED_QD1_WRITES, q);
 982:	
 983:		ret = disk_register_independent_access_ranges(disk);
 984:		if (ret)
 985:			goto out_debugfs_remove;
 986:	
 987:		ret = blk_crypto_sysfs_register(disk);
 988:		if (ret)
 989:			goto out_unregister_ia_ranges;
 990:	
 991:		if (queue_is_mq(q))
 992:			elevator_set_default(q);
 993:	
 994:		blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);
 995:		wbt_init_enable_default(disk);
 996:	
 997:		/* Now everything is ready and send out KOBJ_ADD uevent */
 998:		kobject_uevent(&disk->queue_kobj, KOBJ_ADD);
 999:		if (q->elevator)
1000:			kobject_uevent(&q->elevator->kobj, KOBJ_ADD);
1001:		mutex_unlock(&q->sysfs_lock);
1002:	
1003:		/*
1004:		 * SCSI probing may synchronously create and destroy a lot of
1005:		 * request_queues for non-existent devices.  Shutting down a fully
1006:		 * functional queue takes measureable wallclock time as RCU grace
1007:		 * periods are involved.  To avoid excessive latency in these
1008:		 * cases, a request_queue starts out in a degraded mode which is
1009:		 * faster to shut down and is made fully functional here as
1010:		 * request_queues for non-existent devices never get registered.
1011:		 */
1012:		blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q);
1013:		percpu_ref_switch_to_percpu(&q->q_usage_counter);
1014:	
1015:		return ret;
1016:	
1017:	out_unregister_ia_ranges:
1018:		disk_unregister_independent_access_ranges(disk);
1019:	out_debugfs_remove:
1020:		blk_debugfs_remove(disk);
1021:		mutex_unlock(&q->sysfs_lock);
1022:		if (queue_is_mq(q))
1023:			blk_mq_sysfs_unregister(disk);
1024:	out_del_queue_kobj:
1025:		kobject_del(&disk->queue_kobj);
1026:		return ret;
1027:	}
 SourceFile:block/blk-sysfs.c]

gemini-3.1-pro-preview

							input: 41904
							output: 16
							thoughts: 4263
						

**The Genesis of a Race Condition: Unraveling NVMe Multipath Instability**

It all started with a subtle observation: the `blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q)` call, which is intrinsically tied to `device_add_disk` being invoked by `blk_register_queue`, seemed to be the linchpin of a potential race condition. My thought process immediately gravitated towards how this flag's state transitions could be exploited. The core idea crystallized around creating a scenario where multiple paths to the same NVMe namespace were being discovered and registered concurrently.

My initial reproduction strategy was straightforward: set up an NVMe target with a single namespace, then connect to it *twice*. The kernel, in its automatic scanning process, would naturally attempt to register the namespace on both controllers simultaneously. The hope was that if the timing aligned perfectly, a race would occur.

However, relying purely on "natural" race conditions can be frustratingly unreliable. I considered `fault_inject` as a more deterministic way to force the issue, but since the goal was to write a C program, using a userspace tool like `nvme-loop` seemed more practical. This led me to investigate how `nvme-loop` is typically configured, recalling that `syzkaller` often uses `configfs` for `nvmet` target setup and `/dev/nvme-fabrics` for connections.

My plan began to take shape: a C program that would programmatically orchestrate the `configfs` setup. This involved:
1. Mounting `configfs`.
2. Creating an NVMe subsystem within `configfs` (e.g., `/sys/kernel/config/nvmet/subsystems/test-subsys`).
3. Defining a namespace within that subsystem (e.g., `.../namespaces/1`), linking it to a backing device (a loop device or file), and enabling it.
4. Creating an NVMe port and setting its transport type to `loop`.
5. Linking the subsystem to the port.
6. Critically, opening `/dev/nvme-fabrics` and writing the connection string (`nqn=testnqn,transport=loop`) *concurrently* or in quick succession *twice*. This was the key to triggering simultaneous controller creation and, consequently, concurrent namespace scanning. This approach is a well-established method for exposing NVMe multipath races.

A quick check confirmed that `nvme-loop` does indeed support multipath when `core_nvme.multipath=Y` is set, which is often the default. Connecting twice to the same subsystem NQN would lead to two controllers sharing the same `nvme_subsys`, forming a multipath head and, importantly, sharing the namespaces.

The next critical question was whether `blk_queue_registered(q)` could be delayed in a way that exposes the bug. I traced the execution flow within `nvme_alloc_ns`, where `device_add_disk` is called for `ns->disk`, followed by `nvme_mpath_add_disk` and then another `device_add_disk` for `ns->head->disk`. The hypothesis was that if a thread (let's call it Thread 1) was preempted just before `blk_unfreeze_release_lock` within `nvme_update_ns_info`, another thread (Thread 2) could proceed to call `device_add_disk(ns->head->disk)`. Subsequently, a third thread (Thread 3, or even Thread 2 triggering a rescan) could call `blk_mq_freeze_queue` on `ns->head->disk->queue`.

However, a deeper dive into the `q->mq_freeze_disk_dead` logic revealed a crucial detail:
```c
			q->mq_freeze_disk_dead = !q->disk ||
				test_bit(GD_DEAD, &q->disk->state) ||
				!blk_queue_registered(q);
```
If the device was *already added*, `blk_queue_registered(q)` would be TRUE. This would mean `q->disk` is valid, `GD_DEAD` is FALSE, and `!blk_queue_registered(q)` is FALSE. Consequently, `q->mq_freeze_disk_dead` would *always* be FALSE. This realization was a significant pivot: a race during a *rescan* would *not* trigger the bug because the `blk_queue_registered(q)` flag would already be set, preventing the necessary transition for the bug to manifest.

The bug, therefore, *must* occur during the *initial allocation* of the queue, specifically when `blk_queue_registered(q)` transitions from FALSE to TRUE. This transition happens only once per namespace head when `device_add_disk(ns->head->disk)` is called.

This led me back to the initial connection phase. The critical sequence involved three paths connecting concurrently:
*   **Path 1:** Connects, calls `nvme_update_ns_info`, freezes the head queue (seeing `registered` as FALSE, thus `dead` as TRUE), and then unfreezes. It gets preempted *before* `blk_unfreeze_release_lock`.
*   **Path 2:** Connects concurrently. It calls `nvme_update_ns_info`, freezes the head queue. If it runs *before* Path 1 calls `device_add_disk(ns->head->disk)`, it sees `registered` as FALSE and `dead` as TRUE. Path 2 then unfreezes, decrements the depth to 0, releases the `mq_freeze_lock`, and is *preempted*.
*   **Path 1 (Resumes):** Completes `device_add_disk(ns->head->disk)`, setting `registered` to TRUE.
*   **Path 3:** Connects concurrently. Calls `nvme_update_ns_info`, freezes the head queue. It now sees `registered` as TRUE, so `dead` is FALSE. Path 3 holds the freeze.
*   **Path 2 (Resumes):** Calls `blk_unfreeze_release_lock`. Crucially, it sees `dead` as FALSE (because Path 3 set it), releases the lock, and the bug is triggered.

This confirmed that the bug requires the interaction of *at least three* concurrent paths, or two paths coupled with a rescan operation. However, the rescan avenue was ruled out as it doesn't allow the `blk_queue_registered(q)` transition from FALSE to TRUE during the problematic phase. Therefore, connecting three paths concurrently was the most direct route.

The refined C program structure then became:
1.  Configure the `nvmet` loopback target using `configfs` and a backing file.
2.  Spawn *multiple threads* (ideally more than just three to increase contention) – each responsible for opening `/dev/nvme-fabrics` and initiating a connection.
3.  Inside a loop, repeatedly connect these threads and then disconnect all controllers. The disconnect-reconnect cycle is fast enough to generate numerous attempts to hit the race condition.

The core logic for the C program:
```c
// Includes and setup functions for nvmet
void *connect_thread(void *arg) {
    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd >= 0) {
        write(fd, "nqn=testnqn,transport=loop", 26); // Connect command
        close(fd);
    }
    return NULL;
}

void disconnect_all() {
    // System calls to delete controllers
    system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main() {
    setup_nvmet(); // Configures configfs for nvmet

    pthread_t t[NUM_THREADS]; // Using a larger number of threads for increased contention
    for (int i = 0; i < NUM_ITERATIONS; i++) { // Repeating the connect/disconnect cycle
        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_create(&t[j], NULL, connect_thread, NULL);
        }
        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_join(t[j], NULL);
        }
        disconnect_all();
    }
    return 0;
}
```
The key insight was that the race doesn't occur during rescan, but during the initial multipath registration. The small window for the race condition (specifically around `blk_unfreeze_release_lock` and `blk_unfreeze_check_owner`) necessitated a high number of iterations and threads to increase the probability of hitting the specific timing that exposes the bug. The lockdep map `io_lockdep_map` further guided the debugging, confirming the contention point around queue usage.

map[Name:race]

map[Toolkit:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }
]

gemini-3.1-pro-preview

							input: 47849
							output: 1841
							thoughts: 2794
						

**My Thoughts on Reproducing the NVMe Multipath Race Condition**

The core of this issue, as I understand it, lies in a subtle race condition within the kernel's block layer's freezing mechanism, specifically involving `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue`, and how they interact with the `q->mq_freeze_disk_dead` flag. This flag is used to determine if a queue is "dead" (i.e., not yet registered with the block layer) and thus whether the `io_lockdep_map` should be acquired during the freeze/unfreeze process.

Here's how I've pieced together the race:

1.  **Initial Freeze:** A thread calls `blk_mq_freeze_queue`. Inside this function, the `q->mq_freeze_depth` is incremented, and crucially, `blk_freeze_set_owner` is called. If the queue isn't registered yet (meaning `blk_queue_registered(q)` returns false), `q->mq_freeze_disk_dead` is set to `true`.
2.  **Lock Acquisition Skipped:** Because `q->mq_freeze_disk_dead` is `true`, `blk_freeze_acquire_lock` (which is called internally by `blk_mq_freeze_queue`) *skips* acquiring the `io_lockdep_map`.
3.  **Unfreeze and Preemption:** Later, `blk_mq_unfreeze_queue` is called. This function decrements `q->mq_freeze_depth` back to zero. It then calls `blk_unfreeze_check_owner`, which returns `true` because `q->mq_freeze_disk_dead` is still `true`. Finally, it releases the `mq_freeze_lock`. **This is the critical preemption window.**
4.  **Intervention by Another Thread:** At this point, another thread can race in. It might call `device_add_disk` (or a similar registration function), which sets `blk_queue_registered(q)` to `true`.
5.  **Second Freeze and Registration:** The interrupting thread might then proceed to call `blk_mq_freeze_queue` again. This time, since `blk_queue_registered(q)` is `true`, `blk_freeze_set_owner` sets `q->mq_freeze_disk_dead` to `false`.
6.  **Resuming and Bad Unlock:** The original preempted thread resumes execution. When it reaches `blk_unfreeze_release_lock` (which is part of the unfreeze process), it checks `q->mq_freeze_disk_dead`. Seeing that it's now `false`, it proceeds to release the `io_lockdep_map`. However, because the `io_lockdep_map` was *never acquired* by this thread in the first place (due to `q->mq_freeze_disk_dead` being true earlier), lockdep correctly flags a "bad unlock balance detected!" error.

The provided C code and the strategy behind it are designed to exploit this exact race. The problem is specifically triggered when multiple NVMe controllers are added to the *same* NVMe namespace concurrently. The `nvme_update_ns_info` function, as indicated by the bug report's stack trace (`blk_mq_unfreeze_queue` -> `nvme_update_ns_info`), is a prime candidate for hitting this race because it freezes the multipath head queue (`ns->head->disk->queue`) *before* it's fully registered or in a state where it's guaranteed to have acquired the lockdep map.

To reliably reproduce this, my plan is to:

*   **Set up an NVMe Target:** I'll use `nvmet` and `nvme-loop` to create a local NVMe target. This involves loading the necessary modules, creating a subsystem with a namespace backed by a temporary file (`/tmp/nvme_backing`), and configuring a port using the loop transport.
*   **Concurrent Connections:** The key is to establish multiple connections to this target concurrently. I'll do this by creating several threads, each responsible for opening `/dev/nvme-fabrics` and writing the connection details (`nqn=testnqn,transport=loop`). Each `write` operation to `/dev/nvme-fabrics` effectively attempts to create a new NVMe controller. When these controllers target the same subsystem and namespace, they will share the same multipath head queue.
*   **Exploiting the Race Window:** The `while (TIMER_NOT_EXPIRED(start, 30.0))` loop combined with `pthread_create` and `pthread_join` ensures that we repeatedly create these connections. Between each batch of connections, I'll call `disconnect_all()` to clean up the controllers, ensuring a fresh state for the next iteration. This aggressive loop of connect/disconnect is what amplifies the chances of hitting the preemption window described above.
*   **Kernel Configuration:** I'm relying on the assumption that `CONFIG_NVME_MULTIPATH=y` is enabled, which is typical for syzkaller kernels. The presence of `nvme_mpath_revalidate_paths` in the bug report's stack trace strongly suggests this. Also, `CONFIG_LOCKDEP` must be enabled to see the warning, which is also a standard syzkaller setting.

The C code I've refined is structured to perform these steps. It sets up the NVMe target, then enters a timed loop where it spawns multiple threads to connect to the target. After all threads have completed their connections, it disconnects all controllers before repeating. The use of `TIMER_START` and `TIMER_NOT_EXPIRED` from `race_toolkit.h` is to ensure the test runs for a sufficient duration to increase the probability of encountering the race.

The teardown process cleans up the created NVMe target configuration and the temporary backing file.

In essence, I'm creating a scenario where many attempts to register and manage NVMe multipath devices are happening in quick succession, and the specific timing of queue freezing, unfreezing, and device registration by different threads is what causes the lockdep violation. The code provided is my best attempt to precisely mimic the conditions that lead to the observed kernel bug.

map[OracleFeedback:]

map[CurrentReproStrategy:### Analysis of the Bug

The bug is a race condition in the block layer's lockdep annotations for queue freezing, specifically triggered by NVMe multipath during namespace scanning.

When `blk_mq_freeze_queue(q)` is called, it acquires a lockdep read lock (`q->io_lockdep_map`). However, to avoid false positives during initialization or teardown, it conditionally skips acquiring the lock if the disk is "dead" or not yet registered. This state is saved in `q->mq_freeze_disk_dead`:
```c
// In blk_freeze_set_owner():
q->mq_freeze_disk_dead = !q->disk || test_bit(GD_DEAD, &q->disk->state) || !blk_queue_registered(q);
```
When `blk_mq_unfreeze_queue(q)` is called, it checks this *same* `q->mq_freeze_disk_dead` variable to decide whether to release the lockdep lock.

The race occurs because `q->mq_freeze_disk_dead` is a shared variable in `struct request_queue` and is overwritten whenever `q->mq_freeze_depth` transitions from `0` to `1`. 

Here is the exact sequence that leads to the "bad unlock balance" warning:
1. **Thread A (Path 1)** calls `nvme_update_ns_info()`, which freezes the multipath head queue (`ns->head->disk->queue`). Since `device_add_disk()` hasn't been called yet, `blk_queue_registered(q)` is `false`. Thus, `q->mq_freeze_disk_dead` is set to `true`, and Thread A **does not** acquire the lockdep lock.
2. **Thread A** unfreezes the queue. It decrements `q->mq_freeze_depth` to `0`, releases `q->mq_freeze_lock`, and is **preempted** just before calling `blk_unfreeze_release_lock()`.
3. **Thread B (Path 2)** finishes its own setup and calls `device_add_disk(ns->head->disk)`. Now, `blk_queue_registered(q)` becomes `true`.
4. **Thread C (Path 3)** calls `nvme_update_ns_info()` and freezes the queue. Since `q->mq_freeze_depth` was `0`, it re-evaluates `q->mq_freeze_disk_dead`. Because the queue is now registered, it sets `q->mq_freeze_disk_dead` to `false`.
5. **Thread A** resumes and calls `blk_unfreeze_release_lock()`. It sees `q->mq_freeze_disk_dead == false` (overwritten by Thread C) and attempts to release the lockdep lock. Since Thread A never acquired it, lockdep throws a "bad unlock balance" warning.

### Reproduction Strategy

To reproduce this, we need to trigger concurrent `nvme_update_ns_info()` calls on the same multipath head queue while it is being registered. 
1. Set up an NVMe-oF loopback target (`nvmet`) with a single subsystem and namespace.
2. Spawn multiple threads that concurrently connect to this target subsystem via `/dev/nvme-fabrics`.
3. The kernel will create multiple controllers (paths) to the same namespace and scan them concurrently, naturally triggering the race window.
4. Disconnect the controllers and repeat the process in a tight loop to hit the preemption window.

### Standalone C Reproducer

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```]

deep-reasoning

map[IsProbe:true RawCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

int main(void) {
    if (mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        }
    }
    printf("[+] configfs is ready.\n");

    struct stat st;
    if (stat("/sys/kernel/config/nvmet", &st) < 0) {
        printf("[-] nvmet configfs directory not found: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] nvmet configfs directory found.\n");

    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd < 0) {
        printf("[-] Failed to open /dev/nvme-fabrics: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] Opened /dev/nvme-fabrics successfully.\n");
    close(fd);

    int fd_back = open("/tmp/nvme_backing_probe", O_RDWR | O_CREAT, 0644);
    if (fd_back < 0) {
        printf("[-] Failed to create backing file: %s\n", strerror(errno));
        return 1;
    }
    if (ftruncate(fd_back, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to truncate backing file: %s\n", strerror(errno));
        close(fd_back);
        return 1;
    }
    close(fd_back);
    unlink("/tmp/nvme_backing_probe");
    printf("[+] Backing file creation successful.\n");

    return 0;
}
]

You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.

To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
   and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
    int res = do_something();
    if (res < 0) {
        printf("[-] Failed to do_something: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
   systems, makefiles, and kernel build/header directories) is NOT available
   on the target test VM guest. Do NOT check for, build, or reference any
   compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
   functions like 'system()', 'popen()', or the 'exec' family such as
   'execve()'). All environment checks, capability probings, and reproduction
   steps must be performed directly using standard Linux system calls (such
   as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
   include a sufficient delay (using sleep or similar) after deleting
   or unregistering the device to allow the kernel's asynchronous
   timeout to trigger before program exit.


=== PHASE 1: CAPABILITY PROBING (GENERATION) ===
You MUST start by generating a simple 'probe' program first. This is a strict, non-negotiable requirement
to verify that the test environment has the necessary kernel capabilities and privileges.
This program's sole purpose is to verify subsystem availability and privileges by probing specific
device files, subsystems, or syscalls (for example: opening /dev/vhci to check if the virtual
Bluetooth controller is accessible, loading a minimal dummy BPF program, or making a specific
socket/ioctl call).

Print clear messages indicating success or failure of these probes, and exit with 0 only if
all checks pass.
Do NOT attempt complex logic, and do NOT try to trigger the actual bug/crash in this first version,
regardless of how simple the reproducer seems. You must wait until a successful probe run has been
confirmed in the environment (i.e., when CapabilitiesVerified becomes true).

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Strategy: ### Analysis of the Bug

The bug is a race condition in the block layer's lockdep annotations for queue freezing, specifically triggered by NVMe multipath during namespace scanning.

When `blk_mq_freeze_queue(q)` is called, it acquires a lockdep read lock (`q->io_lockdep_map`). However, to avoid false positives during initialization or teardown, it conditionally skips acquiring the lock if the disk is "dead" or not yet registered. This state is saved in `q->mq_freeze_disk_dead`:
```c
// In blk_freeze_set_owner():
q->mq_freeze_disk_dead = !q->disk || test_bit(GD_DEAD, &q->disk->state) || !blk_queue_registered(q);
```
When `blk_mq_unfreeze_queue(q)` is called, it checks this *same* `q->mq_freeze_disk_dead` variable to decide whether to release the lockdep lock.

The race occurs because `q->mq_freeze_disk_dead` is a shared variable in `struct request_queue` and is overwritten whenever `q->mq_freeze_depth` transitions from `0` to `1`. 

Here is the exact sequence that leads to the "bad unlock balance" warning:
1. **Thread A (Path 1)** calls `nvme_update_ns_info()`, which freezes the multipath head queue (`ns->head->disk->queue`). Since `device_add_disk()` hasn't been called yet, `blk_queue_registered(q)` is `false`. Thus, `q->mq_freeze_disk_dead` is set to `true`, and Thread A **does not** acquire the lockdep lock.
2. **Thread A** unfreezes the queue. It decrements `q->mq_freeze_depth` to `0`, releases `q->mq_freeze_lock`, and is **preempted** just before calling `blk_unfreeze_release_lock()`.
3. **Thread B (Path 2)** finishes its own setup and calls `device_add_disk(ns->head->disk)`. Now, `blk_queue_registered(q)` becomes `true`.
4. **Thread C (Path 3)** calls `nvme_update_ns_info()` and freezes the queue. Since `q->mq_freeze_depth` was `0`, it re-evaluates `q->mq_freeze_disk_dead`. Because the queue is now registered, it sets `q->mq_freeze_disk_dead` to `false`.
5. **Thread A** resumes and calls `blk_unfreeze_release_lock()`. It sees `q->mq_freeze_disk_dead == false` (overwritten by Thread C) and attempts to release the lockdep lock. Since Thread A never acquired it, lockdep throws a "bad unlock balance" warning.

### Reproduction Strategy

To reproduce this, we need to trigger concurrent `nvme_update_ns_info()` calls on the same multipath head queue while it is being registered. 
1. Set up an NVMe-oF loopback target (`nvmet`) with a single subsystem and namespace.
2. Spawn multiple threads that concurrently connect to this target subsystem via `/dev/nvme-fabrics`.
3. The kernel will create multiple controllers (paths) to the same namespace and scan them concurrently, naturally triggering the race window.
4. Disconnect the controllers and repeat the process in a tight loop to hit the preemption window.

### Standalone C Reproducer

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```

gemini-3.1-pro-preview

							input: 6092
							output: 536
							thoughts: 3237
						

map[IsProbe:true RawCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

int main(void) {
    if (mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        }
    }
    printf("[+] configfs is ready.\n");

    struct stat st;
    if (stat("/sys/kernel/config/nvmet", &st) < 0) {
        printf("[-] nvmet configfs directory not found: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] nvmet configfs directory found.\n");

    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd < 0) {
        printf("[-] Failed to open /dev/nvme-fabrics: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] Opened /dev/nvme-fabrics successfully.\n");
    close(fd);

    int fd_back = open("/tmp/nvme_backing_probe", O_RDWR | O_CREAT, 0644);
    if (fd_back < 0) {
        printf("[-] Failed to create backing file: %s\n", strerror(errno));
        return 1;
    }
    if (ftruncate(fd_back, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to truncate backing file: %s\n", strerror(errno));
        close(fd_back);
        return 1;
    }
    close(fd_back);
    unlink("/tmp/nvme_backing_probe");
    printf("[+] Backing file creation successful.\n");

    return 0;
}
]

map[IsProbe:true RawCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

int main(void) {
    if (mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        }
    }
    printf("[+] configfs is ready.\n");

    struct stat st;
    if (stat("/sys/kernel/config/nvmet", &st) < 0) {
        printf("[-] nvmet configfs directory not found: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] nvmet configfs directory found.\n");

    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd < 0) {
        printf("[-] Failed to open /dev/nvme-fabrics: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] Opened /dev/nvme-fabrics successfully.\n");
    close(fd);

    int fd_back = open("/tmp/nvme_backing_probe", O_RDWR | O_CREAT, 0644);
    if (fd_back < 0) {
        printf("[-] Failed to create backing file: %s\n", strerror(errno));
        return 1;
    }
    if (ftruncate(fd_back, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to truncate backing file: %s\n", strerror(errno));
        close(fd_back);
        return 1;
    }
    close(fd_back);
    unlink("/tmp/nvme_backing_probe");
    printf("[+] Backing file creation successful.\n");

    return 0;
}
]

map[CurrentCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

int main(void) {
    if (mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        }
    }
    printf("[+] configfs is ready.\n");

    struct stat st;
    if (stat("/sys/kernel/config/nvmet", &st) < 0) {
        printf("[-] nvmet configfs directory not found: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] nvmet configfs directory found.\n");

    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd < 0) {
        printf("[-] Failed to open /dev/nvme-fabrics: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] Opened /dev/nvme-fabrics successfully.\n");
    close(fd);

    int fd_back = open("/tmp/nvme_backing_probe", O_RDWR | O_CREAT, 0644);
    if (fd_back < 0) {
        printf("[-] Failed to create backing file: %s\n", strerror(errno));
        return 1;
    }
    if (ftruncate(fd_back, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to truncate backing file: %s\n", strerror(errno));
        close(fd_back);
        return 1;
    }
    close(fd_back);
    unlink("/tmp/nvme_backing_probe");
    printf("[+] Backing file creation successful.\n");

    return 0;
}
]

map[CompilerError: FormattedReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

int main(void) {
    if (mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        }
    }
    printf("[+] configfs is ready.\n");

    struct stat st;
    if (stat("/sys/kernel/config/nvmet", &st) < 0) {
        printf("[-] nvmet configfs directory not found: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] nvmet configfs directory found.\n");

    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd < 0) {
        printf("[-] Failed to open /dev/nvme-fabrics: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] Opened /dev/nvme-fabrics successfully.\n");
    close(fd);

    int fd_back = open("/tmp/nvme_backing_probe", O_RDWR | O_CREAT, 0644);
    if (fd_back < 0) {
        printf("[-] Failed to create backing file: %s\n", strerror(errno));
        return 1;
    }
    if (ftruncate(fd_back, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to truncate backing file: %s\n", strerror(errno));
        close(fd_back);
        return 1;
    }
    close(fd_back);
    unlink("/tmp/nvme_backing_probe");
    printf("[+] Backing file creation successful.\n");

    return 0;
}
]

map[CompilerError:]

map[CandidateBugTitle: CandidateCrashReport: CandidateReproduced:false ConsoleOutput:[   63.340049][   T34] kauditd_printk_skb: 6 callbacks suppressed
[   63.340065][   T34] audit: type=1400 audit(1790186822.832:200): avc:  denied  { transition } for  pid=5830 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340093][   T34] audit: type=1400 audit(1790186822.832:201): avc:  denied  { noatsecure } for  pid=5830 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340596][   T34] audit: type=1400 audit(1790186822.832:202): avc:  denied  { rlimitinh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340627][   T34] audit: type=1400 audit(1790186822.832:203): avc:  denied  { siginh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.333791][   T34] audit: type=1400 audit(1790186824.832:204): avc:  denied  { write } for  pid=5832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   65.376204][   T34] audit: type=1400 audit(1790186824.872:205): avc:  denied  { write } for  pid=5835 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.658063][   T34] audit: type=1400 audit(1790186826.152:206): avc:  denied  { write } for  pid=5842 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.699914][   T34] audit: type=1400 audit(1790186826.192:207): avc:  denied  { write } for  pid=5845 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.881104][   T34] audit: type=1400 audit(1790186826.372:208): avc:  denied  { write } for  pid=5848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.963284][   T34] audit: type=1400 audit(1790186826.462:209): avc:  denied  { write } for  pid=5851 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:4253' (ED25519) to the list of known hosts.
[+] configfs is ready.
[+] nvmet configfs directory found.
[+] Opened /dev/nvme-fabrics successfully.
[+] Backing file creation successful.
[   68.777633][   T34] kauditd_printk_skb: 11 callbacks suppressed
[   68.777646][   T34] audit: type=1400 audit(1790186828.272:221): avc:  denied  { write } for  pid=5880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.829396][   T34] audit: type=1400 audit(1790186828.322:222): avc:  denied  { write } for  pid=5883 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.166923][   T34] audit: type=1400 audit(1790186828.662:223): avc:  denied  { write } for  pid=5886 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.214181][   T34] audit: type=1400 audit(1790186828.712:224): avc:  denied  { write } for  pid=5889 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.704315][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.704359][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   76.826424][  T807] cfg80211: failed to load regulatory.db
 OtherCrashReports:<nil> StraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor2393392260

<...>
[   62.552771][   T34] kauditd_printk_skb: 10 callbacks suppressed
[   62.552783][   T34] audit: type=1400 audit(1790186905.939:203): avc:  denied  { transition } for  pid=5828 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.552957][   T34] audit: type=1400 audit(1790186905.939:204): avc:  denied  { noatsecure } for  pid=5828 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.553346][   T34] audit: type=1400 audit(1790186905.939:205): avc:  denied  { rlimitinh } for  pid=5828 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.553461][   T34] audit: type=1400 audit(1790186905.939:206): avc:  denied  { siginh } for  pid=5828 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.233228][   T34] audit: type=1400 audit(1790186908.619:207): avc:  denied  { write } for  pid=5832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   65.294124][   T34] audit: type=1400 audit(1790186908.679:208): avc:  denied  { write } for  pid=5837 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.062165][   T34] audit: type=1400 audit(1790186909.439:209): avc:  denied  { write } for  pid=5846 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.111909][   T34] audit: type=1400 audit(1790186909.489:210): avc:  denied  { write } for  pid=5849 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.618574][   T34] audit: type=1400 audit(1790186909.999:211): avc:  denied  { write } for  pid=5852 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.661222][   T34] audit: type=1400 audit(1790186910.039:212): avc:  denied  { write } for  pid=5855 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.599401][   T34] kauditd_printk_skb: 4 callbacks suppressed
[   67.599411][   T34] audit: type=1400 audit(1790186910.979:217): avc:  denied  { write } for  pid=5870 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.652684][   T34] audit: type=1400 audit(1790186911.029:218): avc:  denied  { write } for  pid=5873 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.192262][   T34] audit: type=1400 audit(1790186911.569:219): avc:  denied  { write } for  pid=5880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:24369' (ED25519) to the list of known hosts.
[   68.245034][   T34] audit: type=1400 audit(1790186911.629:220): avc:  denied  { write } for  pid=5885 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
execve("/syz-executor2393392260", ["/syz-executor2393392260"], 0x7ffcc216a050 /* 11 vars */) = 0
brk(NULL)                               = 0x5555775de000
brk(0x5555775ded80)                     = 0x5555775ded80
arch_prctl(ARCH_SET_FS, 0x5555775de400) = 0
set_tid_address(0x5555775de6d0)         = 5891
set_robust_list(0x5555775de6e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor2393392260", 4096) = 23
getrandom("\x27\x4f\x1d\xde\xdf\xad\x6f\x10", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555775ded80
brk(0x5555775ffd80)                     = 0x5555775ffd80
brk(0x555577600000)                     = 0x555577600000
mprotect(0x7f7c309ef000, 20480, PROT_READ) = 0
[   68.412325][   T34] audit: type=1400 audit(1790186911.789:221): avc:  denied  { mounton } for  pid=5891 comm="syz-executor239" path="/sys/kernel/config" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.412522][   T34] audit: type=1400 audit(1790186911.789:222): avc:  denied  { mount } for  pid=5891 comm="syz-executor239" name="/" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy)
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
[   68.429610][   T34] audit: type=1400 audit(1790186911.799:223): avc:  denied  { search } for  pid=5891 comm="syz-executor239" name="/" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
newfstatat(AT_FDCWD, "/sys/kernel/config/nvmet", {st_mode=S_IFDIR|0755, st_size=0, ...}, 0) = 0
openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 3
close(3)                                = 0
[   68.439799][   T34] audit: type=1400 audit(1790186911.819:224): avc:  denied  { read write } for  pid=5891 comm="syz-executor239" name="nvme-fabrics" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[   68.439828][   T34] audit: type=1400 audit(1790186911.819:225): avc:  denied  { open } for  pid=5891 comm="syz-executor239" path="/dev/nvme-fabrics" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
openat(AT_FDCWD, "/tmp/nvme_backing_probe", O_RDWR|O_CREAT, 0644) = 3
ftruncate(3, 16777216)                  = 0
close(3)                                = 0
unlink("/tmp/nvme_backing_probe")       = 0
[+] configfs is ready.
[+] nvmet configfs directory found.
[+] Opened /dev/nvme-fabrics successfully.
[+] Backing file creation successful.
write(1, "[+] configfs is ready.\n[+] nvmet configfs directory found.\n[+] Opened /dev/nvme-fabrics successfully"..., 140) = 140
exit_group(0)                           = ?
+++ exited with 0 +++
[   69.747006][   T34] audit: type=1400 audit(1790186913.129:226): avc:  denied  { write } for  pid=5892 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.665027][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.665075][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   76.783736][   T25] cfg80211: failed to load regulatory.db
 TestError:]

map[TruncatedConsoleOutput:[   63.340049][   T34] kauditd_printk_skb: 6 callbacks suppressed
[   63.340065][   T34] audit: type=1400 audit(1790186822.832:200): avc:  denied  { transition } for  pid=5830 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340093][   T34] audit: type=1400 audit(1790186822.832:201): avc:  denied  { noatsecure } for  pid=5830 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340596][   T34] audit: type=1400 audit(1790186822.832:202): avc:  denied  { rlimitinh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340627][   T34] audit: type=1400 audit(1790186822.832:203): avc:  denied  { siginh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.333791][   T34] audit: type=1400 audit(1790186824.832:204): avc:  denied  { write } for  pid=5832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   65.376204][   T34] audit: type=1400 audit(1790186824.872:205): avc:  denied  { write } for  pid=5835 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.658063][   T34] audit: type=1400 audit(1790186826.152:206): avc:  denied  { write } for  pid=5842 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.699914][   T34] audit: type=1400 audit(1790186826.192:207): avc:  denied  { write } for  pid=5845 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.881104][   T34] audit: type=1400 audit(1790186826.372:208): avc:  denied  { write } for  pid=5848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.963284][   T34] audit: type=1400 audit(1790186826.462:209): avc:  denied  { write } for  pid=5851 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:4253' (ED25519) to the list of known hosts.
[+] configfs is ready.
[+] nvmet configfs directory found.
[+] Opened /dev/nvme-fabrics successfully.
[+] Backing file creation successful.
[   68.777633][   T34] kauditd_printk_skb: 11 callbacks suppressed
[   68.777646][   T34] audit: type=1400 audit(1790186828.272:221): avc:  denied  { write } for  pid=5880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.829396][   T34] audit: type=1400 audit(1790186828.322:222): avc:  denied  { write } for  pid=5883 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.166923][   T34] audit: type=1400 audit(1790186828.662:223): avc:  denied  { write } for  pid=5886 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.214181][   T34] audit: type=1400 audit(1790186828.712:224): avc:  denied  { write } for  pid=5889 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.704315][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.704359][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   76.826424][  T807] cfg80211: failed to load regulatory.db
 TruncatedCrashReport: TruncatedStraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor2393392260

<...>
[   62.552771][   T34] kauditd_printk_skb: 10 callbacks suppressed
[   62.552783][   T34] audit: type=1400 audit(1790186905.939:203): avc:  denied  { transition } for  pid=5828 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.552957][   T34] audit: type=1400 audit(1790186905.939:204): avc:  denied  { noatsecure } for  pid=5828 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.553346][   T34] audit: type=1400 audit(1790186905.939:205): avc:  denied  { rlimitinh } for  pid=5828 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.553461][   T34] audit: type=1400 audit(1790186905.939:206): avc:  denied  { siginh } for  pid=5828 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.233228][   T34] audit: type=1400 audit(1790186908.619:207): avc:  denied  { write } for  pid=5832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   65.294124][   T34] audit: type=1400 audit(1790186908.679:208): avc:  denied  { write } for  pid=5837 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.062165][   T34] audit: type=1400 audit(1790186909.439:209): avc:  denied  { write } for  pid=5846 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.111909][   T34] audit: type=1400 audit(1790186909.489:210): avc:  denied  { write } for  pid=5849 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.618574][   T34] audit: type=1400 audit(1790186909.999:211): avc:  denied  { write } for  pid=5852 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.661222][   T34] audit: type=1400 audit(1790186910.039:212): avc:  denied  { write } for  pid=5855 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.599401][   T34] kauditd_printk_skb: 4 callbacks suppressed
[   67.599411][   T34] audit: type=1400 audit(1790186910.979:217): avc:  denied  { write } for  pid=5870 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.652684][   T34] audit: type=1400 audit(1790186911.029:218): avc:  denied  { write } for  pid=5873 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.192262][   T34] audit: type=1400 audit(1790186911.569:219): avc:  denied  { write } for  pid=5880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:24369' (ED25519) to the list of known hosts.
[   68.245034][   T34] audit: type=1400 audit(1790186911.629:220): avc:  denied  { write } for  pid=5885 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
execve("/syz-executor2393392260", ["/syz-executor2393392260"], 0x7ffcc216a050 /* 11 vars */) = 0
brk(NULL)                               = 0x5555775de000
brk(0x5555775ded80)                     = 0x5555775ded80
arch_prctl(ARCH_SET_FS, 0x5555775de400) = 0
set_tid_address(0x5555775de6d0)         = 5891
set_robust_list(0x5555775de6e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor2393392260", 4096) = 23
getrandom("\x27\x4f\x1d\xde\xdf\xad\x6f\x10", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555775ded80
brk(0x5555775ffd80)                     = 0x5555775ffd80
brk(0x555577600000)                     = 0x555577600000
mprotect(0x7f7c309ef000, 20480, PROT_READ) = 0
[   68.412325][   T34] audit: type=1400 audit(1790186911.789:221): avc:  denied  { mounton } for  pid=5891 comm="syz-executor239" path="/sys/kernel/config" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.412522][   T34] audit: type=1400 audit(1790186911.789:222): avc:  denied  { mount } for  pid=5891 comm="syz-executor239" name="/" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy)
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
[   68.429610][   T34] audit: type=1400 audit(1790186911.799:223): avc:  denied  { search } for  pid=5891 comm="syz-executor239" name="/" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
newfstatat(AT_FDCWD, "/sys/kernel/config/nvmet", {st_mode=S_IFDIR|0755, st_size=0, ...}, 0) = 0
openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 3
close(3)                                = 0
[   68.439799][   T34] audit: type=1400 audit(1790186911.819:224): avc:  denied  { read write } for  pid=5891 comm="syz-executor239" name="nvme-fabrics" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[   68.439828][   T34] audit: type=1400 audit(1790186911.819:225): avc:  denied  { open } for  pid=5891 comm="syz-executor239" path="/dev/nvme-fabrics" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
openat(AT_FDCWD, "/tmp/nvme_backing_probe", O_RDWR|O_CREAT, 0644) = 3
ftruncate(3, 16777216)                  = 0
close(3)                                = 0
unlink("/tmp/nvme_backing_probe")       = 0
[+] configfs is ready.
[+] nvmet configfs directory found.
[+] Opened /dev/nvme-fabrics successfully.
[+] Backing file creation successful.
write(1, "[+] configfs is ready.\n[+] nvmet configfs directory found.\n[+] Opened /dev/nvme-fabrics successfully"..., 140) = 140
exit_group(0)                           = ?
+++ exited with 0 +++
[   69.747006][   T34] audit: type=1400 audit(1790186913.129:226): avc:  denied  { write } for  pid=5892 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.665027][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.665075][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   76.783736][   T25] cfg80211: failed to load regulatory.db
]

deep-reasoning

map[Feedback:The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug. ProbePassed:true TerminalError: TitleMatches:false]

You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.

=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
   that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
   meaning the codebase version is mismatched and the target code is absent.

=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
  or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.


=== PHASE 1: CAPABILITY PROBING (EVALUATION) ===
The executed program was a simple environment probe.
Use this to guide your classification and feedback:
1. If the execution was successful (all environment/subsystem probes passed and program exited with 0),
   set the field 'ProbePassed' to true and provide feedback explicitly indicating that the environment
   is ready and the agent should now proceed to generate the full reproducer in the next iteration.
2. If the probe failed (e.g., missing permissions, missing devices, or sandbox restrictions),
   set the field 'ProbePassed' to false, and explain what failed in the 'Feedback'
   field so the generator can adjust its setups.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

IsProbe: true
Reproduced: false
Console Output: [   63.340049][   T34] kauditd_printk_skb: 6 callbacks suppressed
[   63.340065][   T34] audit: type=1400 audit(1790186822.832:200): avc:  denied  { transition } for  pid=5830 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340093][   T34] audit: type=1400 audit(1790186822.832:201): avc:  denied  { noatsecure } for  pid=5830 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340596][   T34] audit: type=1400 audit(1790186822.832:202): avc:  denied  { rlimitinh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.340627][   T34] audit: type=1400 audit(1790186822.832:203): avc:  denied  { siginh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.333791][   T34] audit: type=1400 audit(1790186824.832:204): avc:  denied  { write } for  pid=5832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   65.376204][   T34] audit: type=1400 audit(1790186824.872:205): avc:  denied  { write } for  pid=5835 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.658063][   T34] audit: type=1400 audit(1790186826.152:206): avc:  denied  { write } for  pid=5842 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.699914][   T34] audit: type=1400 audit(1790186826.192:207): avc:  denied  { write } for  pid=5845 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.881104][   T34] audit: type=1400 audit(1790186826.372:208): avc:  denied  { write } for  pid=5848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.963284][   T34] audit: type=1400 audit(1790186826.462:209): avc:  denied  { write } for  pid=5851 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:4253' (ED25519) to the list of known hosts.
[+] configfs is ready.
[+] nvmet configfs directory found.
[+] Opened /dev/nvme-fabrics successfully.
[+] Backing file creation successful.
[   68.777633][   T34] kauditd_printk_skb: 11 callbacks suppressed
[   68.777646][   T34] audit: type=1400 audit(1790186828.272:221): avc:  denied  { write } for  pid=5880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.829396][   T34] audit: type=1400 audit(1790186828.322:222): avc:  denied  { write } for  pid=5883 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.166923][   T34] audit: type=1400 audit(1790186828.662:223): avc:  denied  { write } for  pid=5886 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.214181][   T34] audit: type=1400 audit(1790186828.712:224): avc:  denied  { write } for  pid=5889 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.704315][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.704359][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   76.826424][  T807] cfg80211: failed to load regulatory.db

Strace Output: /strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor2393392260

<...>
[   62.552771][   T34] kauditd_printk_skb: 10 callbacks suppressed
[   62.552783][   T34] audit: type=1400 audit(1790186905.939:203): avc:  denied  { transition } for  pid=5828 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.552957][   T34] audit: type=1400 audit(1790186905.939:204): avc:  denied  { noatsecure } for  pid=5828 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.553346][   T34] audit: type=1400 audit(1790186905.939:205): avc:  denied  { rlimitinh } for  pid=5828 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   62.553461][   T34] audit: type=1400 audit(1790186905.939:206): avc:  denied  { siginh } for  pid=5828 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.233228][   T34] audit: type=1400 audit(1790186908.619:207): avc:  denied  { write } for  pid=5832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   65.294124][   T34] audit: type=1400 audit(1790186908.679:208): avc:  denied  { write } for  pid=5837 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.062165][   T34] audit: type=1400 audit(1790186909.439:209): avc:  denied  { write } for  pid=5846 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.111909][   T34] audit: type=1400 audit(1790186909.489:210): avc:  denied  { write } for  pid=5849 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.618574][   T34] audit: type=1400 audit(1790186909.999:211): avc:  denied  { write } for  pid=5852 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.661222][   T34] audit: type=1400 audit(1790186910.039:212): avc:  denied  { write } for  pid=5855 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.599401][   T34] kauditd_printk_skb: 4 callbacks suppressed
[   67.599411][   T34] audit: type=1400 audit(1790186910.979:217): avc:  denied  { write } for  pid=5870 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.652684][   T34] audit: type=1400 audit(1790186911.029:218): avc:  denied  { write } for  pid=5873 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.192262][   T34] audit: type=1400 audit(1790186911.569:219): avc:  denied  { write } for  pid=5880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:24369' (ED25519) to the list of known hosts.
[   68.245034][   T34] audit: type=1400 audit(1790186911.629:220): avc:  denied  { write } for  pid=5885 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
execve("/syz-executor2393392260", ["/syz-executor2393392260"], 0x7ffcc216a050 /* 11 vars */) = 0
brk(NULL)                               = 0x5555775de000
brk(0x5555775ded80)                     = 0x5555775ded80
arch_prctl(ARCH_SET_FS, 0x5555775de400) = 0
set_tid_address(0x5555775de6d0)         = 5891
set_robust_list(0x5555775de6e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor2393392260", 4096) = 23
getrandom("\x27\x4f\x1d\xde\xdf\xad\x6f\x10", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555775ded80
brk(0x5555775ffd80)                     = 0x5555775ffd80
brk(0x555577600000)                     = 0x555577600000
mprotect(0x7f7c309ef000, 20480, PROT_READ) = 0
[   68.412325][   T34] audit: type=1400 audit(1790186911.789:221): avc:  denied  { mounton } for  pid=5891 comm="syz-executor239" path="/sys/kernel/config" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.412522][   T34] audit: type=1400 audit(1790186911.789:222): avc:  denied  { mount } for  pid=5891 comm="syz-executor239" name="/" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy)
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
[   68.429610][   T34] audit: type=1400 audit(1790186911.799:223): avc:  denied  { search } for  pid=5891 comm="syz-executor239" name="/" dev="configfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
newfstatat(AT_FDCWD, "/sys/kernel/config/nvmet", {st_mode=S_IFDIR|0755, st_size=0, ...}, 0) = 0
openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 3
close(3)                                = 0
[   68.439799][   T34] audit: type=1400 audit(1790186911.819:224): avc:  denied  { read write } for  pid=5891 comm="syz-executor239" name="nvme-fabrics" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[   68.439828][   T34] audit: type=1400 audit(1790186911.819:225): avc:  denied  { open } for  pid=5891 comm="syz-executor239" path="/dev/nvme-fabrics" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
openat(AT_FDCWD, "/tmp/nvme_backing_probe", O_RDWR|O_CREAT, 0644) = 3
ftruncate(3, 16777216)                  = 0
close(3)                                = 0
unlink("/tmp/nvme_backing_probe")       = 0
[+] configfs is ready.
[+] nvmet configfs directory found.
[+] Opened /dev/nvme-fabrics successfully.
[+] Backing file creation successful.
write(1, "[+] configfs is ready.\n[+] nvmet configfs directory found.\n[+] Opened /dev/nvme-fabrics successfully"..., 140) = 140
exit_group(0)                           = ?
+++ exited with 0 +++
[   69.747006][   T34] audit: type=1400 audit(1790186913.129:226): avc:  denied  { write } for  pid=5892 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.665027][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.665075][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   76.783736][   T25] cfg80211: failed to load regulatory.db

Crash Report: 

gemini-3.1-pro-preview

							input: 7503
							output: 99
							thoughts: 339
						

**My Thought Process Regarding the Capability Probe Execution**

Alright, I've just reviewed the output from that capability probe execution, and I need to break down what it tells me. Fundamentally, this probe was designed to ascertain if the necessary underlying components for our NVMe-related work are present and functional in the execution environment.

Looking at the output itself:
*   `[+] configfs is ready.` - Excellent, `configfs` is up and accessible. This is a foundational requirement for managing many kernel configurations, including those related to storage.
*   `[+] nvmet configfs directory found.` - This indicates that the specific `configfs` path associated with NVMe-Target (nvmet) exists, which is a good sign that the NVMe-Target subsystem is at least partially configured or expected.
*   `[+] Opened /dev/nvme-fabrics successfully.` - The ability to open this device node is crucial. It suggests that the kernel driver for NVMe fabrics is loaded and available for user-space interaction, which is exactly what we need for fabric-attached storage.
*   `[+] Backing file creation successful.` - This confirms that we can successfully create backing files. This is a prerequisite for setting up various storage configurations, potentially for simulating or testing storage devices.

Crucially, the execution terminated with an exit code of `0`. For a capability probe, a zero exit code unequivocally means that everything it checked passed without any critical failure. Therefore, I can confidently conclude that the environment is indeed ready, and all the required subsystems – `configfs`, `nvmet` functionality within `configfs`, the `/dev/nvme-fabrics` device node, and the ability to create backing files – are present and operational.

Now, I need to map these findings to the desired output structure.

*   **`ProbePassed`**: Since the probe executed successfully and all its checks returned positive results (indicated by the `0` exit code and the `[+]` indicators), I will set `ProbePassed` to `true`. This is the core takeaway from the execution.

*   **`TerminalError`**: The probe itself did not encounter any terminal errors. The `0` exit code confirms this. Therefore, `TerminalError` should be an empty string.

*   **`TitleMatches`**: The primary bug we're investigating is "WARNING: bad unlock balance in nvme_update_ns_info". This probe was *not* designed to trigger or reproduce this specific bug; it was a pre-check. The fact that the probe passed means no crash occurred and, by extension, this specific bug's title doesn't "match" the outcome of the probe itself in terms of reproduction. Thus, `TitleMatches` will be `false`.

*   **`Feedback`**: This is where I synthesize the findings into actionable information for the next steps. I need to clearly state that the probe succeeded and reiterate which prerequisites are met. Given the probe passed and all components are ready, the logical next step is to proceed with generating the full reproducer for the actual bug. So, my feedback will explicitly state: "The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug."

In essence, the probe served its purpose perfectly – it validated the environment without any issues, paving the way for us to tackle the actual bug reproduction.

map[Feedback:The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug. ProbePassed:true TerminalError: TitleMatches:false]

map[Feedback:The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug. ProbePassed:true TerminalError: TitleMatches:false]

map[CapabilitiesVerified:true ContinueSignal:continue EquivalenceAnalysis: OracleFeedback:The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug. ReproC: Reproduced:false ReproducedBugTitle: ReproducedCrashReport:]

map[OracleFeedback:The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug.]

deep-reasoning

You are an expert in Linux kernel debugging.
Refine the reproduction strategy based on feedback from previous attempts.
Analyze the technical diagnosis provided in the oracle feedback and translate it into concrete,
step-by-step instructions for the repro-generator on how to modify the code structure, alignments,
offsets, or parameters of the candidate program.

=== TOOL SELECTION GUIDELINES ===
- Prefer codesearch-definition-source and codesearch-struct-layout first for symbol lookups.
- Fall back to read-file or grepper for macros, headers, or if symbol lookup fails.

=== CRITICAL PROHIBITIONS ===
- Do NOT repeat searches for the same symbols or files. Use information you have already gathered.
- Do NOT write long explanations. Keep your reasoning short and focused on actionable changes.
- Do NOT assume a bug is fixed based on git commit history.
- If you are stuck, try a different approach or proceed to generate a candidate reproducer.
Prefer calling several tools at the same time to save round-trips.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Current Strategy: ### Analysis of the Bug

The bug is a race condition in the block layer's lockdep annotations for queue freezing, specifically triggered by NVMe multipath during namespace scanning.

When `blk_mq_freeze_queue(q)` is called, it acquires a lockdep read lock (`q->io_lockdep_map`). However, to avoid false positives during initialization or teardown, it conditionally skips acquiring the lock if the disk is "dead" or not yet registered. This state is saved in `q->mq_freeze_disk_dead`:
```c
// In blk_freeze_set_owner():
q->mq_freeze_disk_dead = !q->disk || test_bit(GD_DEAD, &q->disk->state) || !blk_queue_registered(q);
```
When `blk_mq_unfreeze_queue(q)` is called, it checks this *same* `q->mq_freeze_disk_dead` variable to decide whether to release the lockdep lock.

The race occurs because `q->mq_freeze_disk_dead` is a shared variable in `struct request_queue` and is overwritten whenever `q->mq_freeze_depth` transitions from `0` to `1`. 

Here is the exact sequence that leads to the "bad unlock balance" warning:
1. **Thread A (Path 1)** calls `nvme_update_ns_info()`, which freezes the multipath head queue (`ns->head->disk->queue`). Since `device_add_disk()` hasn't been called yet, `blk_queue_registered(q)` is `false`. Thus, `q->mq_freeze_disk_dead` is set to `true`, and Thread A **does not** acquire the lockdep lock.
2. **Thread A** unfreezes the queue. It decrements `q->mq_freeze_depth` to `0`, releases `q->mq_freeze_lock`, and is **preempted** just before calling `blk_unfreeze_release_lock()`.
3. **Thread B (Path 2)** finishes its own setup and calls `device_add_disk(ns->head->disk)`. Now, `blk_queue_registered(q)` becomes `true`.
4. **Thread C (Path 3)** calls `nvme_update_ns_info()` and freezes the queue. Since `q->mq_freeze_depth` was `0`, it re-evaluates `q->mq_freeze_disk_dead`. Because the queue is now registered, it sets `q->mq_freeze_disk_dead` to `false`.
5. **Thread A** resumes and calls `blk_unfreeze_release_lock()`. It sees `q->mq_freeze_disk_dead == false` (overwritten by Thread C) and attempts to release the lockdep lock. Since Thread A never acquired it, lockdep throws a "bad unlock balance" warning.

### Reproduction Strategy

To reproduce this, we need to trigger concurrent `nvme_update_ns_info()` calls on the same multipath head queue while it is being registered. 
1. Set up an NVMe-oF loopback target (`nvmet`) with a single subsystem and namespace.
2. Spawn multiple threads that concurrently connect to this target subsystem via `/dev/nvme-fabrics`.
3. The kernel will create multiple controllers (paths) to the same namespace and scan them concurrently, naturally triggering the race window.
4. Disconnect the controllers and repeat the process in a tight loop to hit the preemption window.

### Standalone C Reproducer

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```
Feedback: The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug.

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```

gemini-3.1-pro-preview

							input: 5600
							output: 16
							thoughts: 1324
						

**My Thoughts on Debugging the `nvme_update_ns_info` Race Condition**

Okay, so I've identified a rather stubborn bug: `WARNING: bad unlock balance in nvme_update_ns_info`. My analysis points towards a race condition within the block layer's lockdep annotations, specifically when it comes to queue freezing. The culprit appears to be NVMe multipath activity during the process of scanning namespaces. The core of the race seems to be centered around `q->mq_freeze_disk_dead` within the `struct request_queue`.

To tackle this, I've devised a strategy. The plan is to set up a simulated NVMe-oF loopback target using `nvmet`. This setup will involve a single subsystem and a single namespace. Then, I'll spin up multiple threads, and these threads will concurrently connect to this target subsystem through `/dev/nvme-fabrics`. This, I believe, will effectively simulate the conditions that trigger the race.

The good news is, the initial probe for my environment has been successful. The system has confirmed that the capability probe passed, my environment is ready, `configfs` is mounted, `nvmet` is available, and `/dev/nvme-fabrics` can be opened and used to create backing files. Now, the request is to proceed with generating the full reproducer for this `nvme_update_ns_info` bug.

I'm now looking at generating a complete C reproducer, building upon a provided standalone C reproducer. Strangely, the standalone reproducer I have looks almost complete already. I need to give it a thorough review.

Let's examine the code:

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h" // Ah, I'll need to inline this.
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

// Function to set up the NVMe-oF loopback target.
void setup_nvmet()
{
	// Load necessary kernel modules.
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	// Configure the NVMe-oF subsystem.
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	// Create a backing file for the namespace.
	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	// Configure the NVMe-oF port.
	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

// Function to tear down the NVMe-oF loopback target.
void teardown_nvmet()
{
	// Remove subsystem link from port.
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	// Remove port directory.
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	// Disable and remove namespace.
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	// Remove subsystem directory.
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	// Remove the backing file.
	system("rm -f /tmp/nvme_backing");
}

// Thread function to connect to the NVMe-oF target.
void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

// Function to disconnect all NVMe controllers.
void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	// SETTING UP UNBUFFERED I/O.
	SETUP_UNBUFFERED_IO(); // I need to inline this and the associated timer macros.
	
	// Setup the NVMe-oF target.
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	// TIMER START
	TIMER_START(start); // Need to inline TIMER_START and TIMER_NOT_EXPIRED.
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		// Create multiple threads to connect concurrently.
		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		// Wait for all threads to complete.
		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		// Disconnect all controllers to reset for the next iteration.
		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	// Clean up the NVMe-oF target.
	teardown_nvmet();
	return 0;
}
```

A critical observation is that I'm including `race_toolkit.h`, but since I can't directly include external headers in this context, I'll need to inline the macros defined within it. I'll have to retrieve the contents of `race_toolkit.h` to proceed. Once I have that, I can integrate those macros directly into the code.

map[Name:race]

map[Toolkit:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }
]

gemini-3.1-pro-preview

							input: 8606
							output: 1056
							thoughts: 1162
						

**My Thought Process on Reproducing the 'bad unlock balance' Bug in nvme_update_ns_info**

The feedback is clear: the environment is set up correctly, and I can now proceed to generate a full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug. My immediate next step is to craft a C program that specifically targets this issue.

I'll be incorporating the `race_toolkit.h` header, as that's crucial for the framework used to detect and reproduce these kinds of kernel races. The core of my strategy will be to induce concurrent operations on NVMe namespaces, which is the most likely scenario to trigger an unlock balance issue.

Here’s how I'm planning to approach the reproducer:

First, I need to ensure the NVMe target is properly configured. This involves loading the necessary kernel modules (`nvmet`, `nvmet-loop`, `nvme-loop`, `nvme-multipath`). Then, I'll set up a basic NVMe subsystem (`testnqn`) with a single namespace. A backing file (`/tmp/nvme_backing`) will be created and linked to this namespace. Finally, I'll configure a loopback port (`/sys/kernel/config/nvmet/ports/1`) and associate the subsystem with it, making it available for connections.

The heart of the reproducer will be a function (`connect_thread`) designed to establish connections to this NVMe target. This function will open `/dev/nvme-fabrics` and attempt to write connection parameters. The key here is that I will be executing this `connect_thread` function from multiple threads concurrently.

In the `main` function, I'll initialize the unbuffered I/O setup from the `race_toolkit`. After setting up the NVMe target, I'll enter a loop that runs for a defined duration (30 seconds in this case, using `TIMER_START` and `TIMER_NOT_EXPIRED`). Within this loop, I'll spawn `NUM_THREADS` (set to 10) threads, each executing `connect_thread`. After starting these threads, I’ll wait for them to complete using `pthread_join`.

Crucially, after each batch of connections, I need to force disconnections. This is done using `disconnect_all`, which iterates through NVMe controllers and triggers their deletion. The idea is to repeatedly establish and tear down connections in a rapid, concurrent manner, increasing the probability of a race condition occurring within the `nvme_update_ns_info` function.

Once the timed loop finishes, I'll clean up by tearing down the NVMe target configuration.

Essentially, my thought process is to create a scenario where multiple threads are trying to interact with the NVMe subsystem, specifically by connecting and disconnecting, thereby exercising the code paths that lead to the `nvme_update_ns_info` function and its associated locking mechanisms. The `race_toolkit` will then help detect if this concurrent access results in the dreaded "bad unlock balance."

This detailed plan culminates in the C code I will now output.

map[CurrentReproStrategy:```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```]

deep-reasoning

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>
#include <time.h>

#define NUM_THREADS 10

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
    printf("[+] mkdir %s successful.\n", path);
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
    printf("[+] write to %s successful.\n", path);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
    printf("[+] /tmp/nvme_backing created successfully.\n");

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] symlink successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

void disconnect_all() {
    DIR *d = opendir("/sys/class/nvme");
    if (!d) return;
    struct dirent *dir;
    while ((dir = readdir(d)) != NULL) {
        if (strncmp(dir->d_name, "nvme", 4) == 0) {
            char path[256];
            snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
            try_write_file(path, "1");
        }
    }
    closedir(d);
}

void* connect_thread(void* arg) {
    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd >= 0) {
        if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
            // ignore
        }
        close(fd);
    }
    return NULL;
}

int main() {
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections...\n");

    time_t start = time(NULL);
    while (time(NULL) - start < 15) {
        pthread_t t[NUM_THREADS];

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_create(&t[j], NULL, connect_thread, NULL);
        }

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_join(t[j], NULL);
        }

        disconnect_all();
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    
    // Wait for asynchronous operations to finish
    sleep(2);
    return 0;
}
]

You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.

To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
   and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
    int res = do_something();
    if (res < 0) {
        printf("[-] Failed to do_something: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
   systems, makefiles, and kernel build/header directories) is NOT available
   on the target test VM guest. Do NOT check for, build, or reference any
   compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
   functions like 'system()', 'popen()', or the 'exec' family such as
   'execve()'). All environment checks, capability probings, and reproduction
   steps must be performed directly using standard Linux system calls (such
   as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
   include a sufficient delay (using sleep or similar) after deleting
   or unregistering the device to allow the kernel's asynchronous
   timeout to trigger before program exit.


=== PHASE 2: BUG REPRODUCTION (GENERATION) ===
You must now generate a full reproducer candidate attempting to trigger the target bug/crash.
Do NOT generate a probe program. Focus directly on triggering the bug/crash described in the description.
You can assume that all necessary kernel capabilities and privileges (e.g., access to /dev/vhci,
ability to load BPF programs, etc.) have already been verified and are available in the environment.

Do not spend too much time analyzing or trying to generate a perfect one-shot reproducer.
Instead, follow an iterative approach: generate a simple candidate, execute it, analyze the results,
and improve it. Keep your reasoning steps short and focused on the next logical experiment.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Strategy: ```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```


Previous Reproducer Attempt:
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

int main(void) {
    if (mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        }
    }
    printf("[+] configfs is ready.\n");

    struct stat st;
    if (stat("/sys/kernel/config/nvmet", &st) < 0) {
        printf("[-] nvmet configfs directory not found: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] nvmet configfs directory found.\n");

    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd < 0) {
        printf("[-] Failed to open /dev/nvme-fabrics: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] Opened /dev/nvme-fabrics successfully.\n");
    close(fd);

    int fd_back = open("/tmp/nvme_backing_probe", O_RDWR | O_CREAT, 0644);
    if (fd_back < 0) {
        printf("[-] Failed to create backing file: %s\n", strerror(errno));
        return 1;
    }
    if (ftruncate(fd_back, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to truncate backing file: %s\n", strerror(errno));
        close(fd_back);
        return 1;
    }
    close(fd_back);
    unlink("/tmp/nvme_backing_probe");
    printf("[+] Backing file creation successful.\n");

    return 0;
}




Execution Results & Debugging Feedback:
The capability probe executed successfully. The environment is ready, configfs is mounted, nvmet is available, /dev/nvme-fabrics can be opened, and backing files can be created. Please proceed to generate the full reproducer for the 'WARNING: bad unlock balance in nvme_update_ns_info' bug.

gemini-3.1-pro-preview

							input: 5856
							output: 1501
							thoughts: 7656
						

**My Thoughts on Replicating the "bad unlock balance" NVMe Bug**

Alright, so I've encountered this "WARNING: bad unlock balance in nvme_update_ns_info" bug. My current strategy involves setting up an NVMe loopback target using `nvmet` and `nvmet-loop`, and then concurrently connecting to it via `/dev/nvme-fabrics`.

The initial approach I was given relied on `system()` calls to configure `nvmet`. However, the instructions explicitly forbid this. I'm not allowed to execute shell commands or run external binaries using functions like `system()`, `popen()`, or `exec`. All environment checks, capability probing, and reproduction steps must be done directly using standard Linux system calls.

This means I need to translate those `system()` calls into equivalent C code using direct system calls such as `mkdir`, `open`, `write`, `close`, `unlink`, and `rmdir`.

Here's a breakdown of the setup steps and how I've converted them:

1.  `mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn`
    *   I've replaced this with a direct `mkdir()` call. I've also added error checking, ensuring to ignore `EEXIST` if the directory already exists, but exiting if any other error occurs.

2.  `echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host`
    *   This is now handled by opening the file in write-only mode (`O_WRONLY`), writing the string "1" to it, and then closing the file descriptor. Again, robust error handling is crucial here.

3.  `mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1`
    *   Another `mkdir()` call, with the same error handling as step 1.

4.  `dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16`
    *   I've replaced this with `open()` to create `/tmp/nvme_backing` with `O_RDWR | O_CREAT`, and then used `ftruncate()` to set its size to 16MB.

5.  `echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path`
    *   Similar to step 2, this involves opening the file and writing the device path string.

6.  `echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable`
    *   Again, `open()` and `write()`.

7.  `mkdir -p /sys/kernel/config/nvmet/ports/1`
    *   `mkdir()` with error checking.

8.  `echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype`
    *   `open()` and `write()`. I'm assuming that `nvmet-loop` will be loaded either pre-emptively or autoloaded by the kernel when this transport type is specified, as I cannot use `modprobe`.

9.  `ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn`
    *   This is now a direct `symlink()` call. I've added logic to ignore `EEXIST` if the symlink already exists.

The teardown steps are essentially the reverse of the setup:

1.  `rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn` -> `unlink()`
2.  `rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1` -> `rmdir()`
3.  `echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable` -> `open()` and `write()`
4.  `rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1` -> `rmdir()`
5.  `rmdir /sys/kernel/config/nvmet/subsystems/testnqn` -> `rmdir()`
6.  `rm -f /tmp/nvme_backing` -> `unlink()`

For cleanup operations, I've adjusted the error handling to be more lenient; I'm using a `try_write_file` function that won't exit if a write fails, as these are cleanup steps and the target might already be gone.

The connection thread involves opening `/dev/nvme-fabrics` and writing `"nqn=testnqn,transport=loop"` to it. This is a direct `open()` and `write()` system call.

For disconnecting all existing NVMe controllers, I need to iterate through `/sys/class/nvme/`. This is done using `opendir()`, `readdir()`, and then constructing the path to `delete_controller` for each NVMe device found, finally writing "1" to it using my `try_write_file` helper.

The core of triggering the bug is concurrent connect and disconnect operations. So, my `main()` function will first set up the `nvmet` target, then enter a loop that runs for a set duration (e.g., 15 seconds). Inside this loop, I'll create multiple threads, each attempting to connect to the NVMe target. After all connection threads are joined, I'll call `disconnect_all()` to tear down any established connections. This rapid cycling of connections and disconnections is what I anticipate will expose the race condition leading to the "bad unlock balance" warning.

I've also included comprehensive error checking for all critical system calls, printing specific error messages with `strerror(errno)` and exiting with a non-zero status upon failure. This is essential for debugging and ensuring the reproducer is reliable. The use of helper functions like `check_mkdir`, `check_write_file`, and `try_write_file` helps keep the main logic clean and manageable.

My understanding is that the bug likely occurs because `blk_mq_unfreeze_queue` is called without a corresponding `blk_mq_freeze_queue`, or it's being called multiple times due to concurrent operations modifying the namespace or controller state while `nvme_update_ns_info` is executing. The concurrent connect/disconnect strategy should trigger this interleaving.

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>
#include <time.h>

#define NUM_THREADS 10

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
    printf("[+] mkdir %s successful.\n", path);
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
    printf("[+] write to %s successful.\n", path);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
    printf("[+] /tmp/nvme_backing created successfully.\n");

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] symlink successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

void disconnect_all() {
    DIR *d = opendir("/sys/class/nvme");
    if (!d) return;
    struct dirent *dir;
    while ((dir = readdir(d)) != NULL) {
        if (strncmp(dir->d_name, "nvme", 4) == 0) {
            char path[256];
            snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
            try_write_file(path, "1");
        }
    }
    closedir(d);
}

void* connect_thread(void* arg) {
    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd >= 0) {
        if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
            // ignore
        }
        close(fd);
    }
    return NULL;
}

int main() {
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections...\n");

    time_t start = time(NULL);
    while (time(NULL) - start < 15) {
        pthread_t t[NUM_THREADS];

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_create(&t[j], NULL, connect_thread, NULL);
        }

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_join(t[j], NULL);
        }

        disconnect_all();
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    
    // Wait for asynchronous operations to finish
    sleep(2);
    return 0;
}
]

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>
#include <time.h>

#define NUM_THREADS 10

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
    printf("[+] mkdir %s successful.\n", path);
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
    printf("[+] write to %s successful.\n", path);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
    printf("[+] /tmp/nvme_backing created successfully.\n");

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] symlink successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

void disconnect_all() {
    DIR *d = opendir("/sys/class/nvme");
    if (!d) return;
    struct dirent *dir;
    while ((dir = readdir(d)) != NULL) {
        if (strncmp(dir->d_name, "nvme", 4) == 0) {
            char path[256];
            snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
            try_write_file(path, "1");
        }
    }
    closedir(d);
}

void* connect_thread(void* arg) {
    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd >= 0) {
        if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
            // ignore
        }
        close(fd);
    }
    return NULL;
}

int main() {
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections...\n");

    time_t start = time(NULL);
    while (time(NULL) - start < 15) {
        pthread_t t[NUM_THREADS];

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_create(&t[j], NULL, connect_thread, NULL);
        }

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_join(t[j], NULL);
        }

        disconnect_all();
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    
    // Wait for asynchronous operations to finish
    sleep(2);
    return 0;
}
]

map[CurrentCandidateReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>
#include <time.h>

#define NUM_THREADS 10

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
    printf("[+] mkdir %s successful.\n", path);
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
    printf("[+] write to %s successful.\n", path);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
    printf("[+] /tmp/nvme_backing created successfully.\n");

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] symlink successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

void disconnect_all() {
    DIR *d = opendir("/sys/class/nvme");
    if (!d) return;
    struct dirent *dir;
    while ((dir = readdir(d)) != NULL) {
        if (strncmp(dir->d_name, "nvme", 4) == 0) {
            char path[256];
            snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
            try_write_file(path, "1");
        }
    }
    closedir(d);
}

void* connect_thread(void* arg) {
    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd >= 0) {
        if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
            // ignore
        }
        close(fd);
    }
    return NULL;
}

int main() {
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections...\n");

    time_t start = time(NULL);
    while (time(NULL) - start < 15) {
        pthread_t t[NUM_THREADS];

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_create(&t[j], NULL, connect_thread, NULL);
        }

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_join(t[j], NULL);
        }

        disconnect_all();
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    
    // Wait for asynchronous operations to finish
    sleep(2);
    return 0;
}
]

map[CompilerError: FormattedReproC:#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>
#include <time.h>

#define NUM_THREADS 10

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
    printf("[+] mkdir %s successful.\n", path);
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
    printf("[+] write to %s successful.\n", path);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
    printf("[+] /tmp/nvme_backing created successfully.\n");

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] symlink successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

void disconnect_all() {
    DIR *d = opendir("/sys/class/nvme");
    if (!d) return;
    struct dirent *dir;
    while ((dir = readdir(d)) != NULL) {
        if (strncmp(dir->d_name, "nvme", 4) == 0) {
            char path[256];
            snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
            try_write_file(path, "1");
        }
    }
    closedir(d);
}

void* connect_thread(void* arg) {
    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd >= 0) {
        if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
            // ignore
        }
        close(fd);
    }
    return NULL;
}

int main() {
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections...\n");

    time_t start = time(NULL);
    while (time(NULL) - start < 15) {
        pthread_t t[NUM_THREADS];

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_create(&t[j], NULL, connect_thread, NULL);
        }

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_join(t[j], NULL);
        }

        disconnect_all();
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    
    // Wait for asynchronous operations to finish
    sleep(2);
    return 0;
}
]

map[CompilerError:]

map[CandidateBugTitle: CandidateCrashReport: CandidateReproduced:false ConsoleOutput:[   63.559326][   T34] kauditd_printk_skb: 6 callbacks suppressed
[   63.559338][   T34] audit: type=1400 audit(1790187130.766:201): avc:  denied  { transition } for  pid=5826 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.559424][   T34] audit: type=1400 audit(1790187130.766:202): avc:  denied  { noatsecure } for  pid=5826 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.559937][   T34] audit: type=1400 audit(1790187130.766:203): avc:  denied  { rlimitinh } for  pid=5826 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   63.560028][   T34] audit: type=1400 audit(1790187130.766:204): avc:  denied  { siginh } for  pid=5826 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.992510][   T34] audit: type=1400 audit(1790187133.196:205): avc:  denied  { write } for  pid=5831 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.050669][   T34] audit: type=1400 audit(1790187133.256:206): avc:  denied  { write } for  pid=5834 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.952575][   T34] audit: type=1400 audit(1790187134.166:207): avc:  denied  { write } for  pid=5841 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.003825][   T34] audit: type=1400 audit(1790187134.216:208): avc:  denied  { write } for  pid=5844 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:46166' (ED25519) to the list of known hosts.
[   67.589960][   T34] audit: type=1400 audit(1790187134.796:209): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   67.590077][   T34] audit: type=1400 audit(1790187134.796:210): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="nvmet" dev="configfs" ino=3602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   67.598292][ T5854] nvmet: adding nsid 1 to subsystem testnqn
[   67.638239][   T35] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.647557][ T5855] nvme nvme0: creating 2 I/O queues.
[   67.651282][ T5855] nvme nvme0: new ctrl: "testnqn"
[   67.685614][   T29] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.687423][ T5856] nvme nvme1: creating 2 I/O queues.
[   67.691985][ T5856] nvme nvme1: new ctrl: "testnqn"
[   67.751149][ T1107] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.757422][ T5857] nvme nvme2: creating 2 I/O queues.
[   67.761369][ T5857] nvme nvme2: new ctrl: "testnqn"
[   67.795176][   T35] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.796061][ T5858] nvme nvme3: creating 2 I/O queues.
[   67.799381][ T5858] nvme nvme3: new ctrl: "testnqn"
[   67.832113][ T2294] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.836993][ T5859] nvme nvme4: creating 2 I/O queues.
[   67.839639][ T5859] nvme nvme4: new ctrl: "testnqn"
[   67.884217][   T28] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.885650][ T5860] nvme nvme5: creating 2 I/O queues.
[   67.888770][ T5860] nvme nvme5: new ctrl: "testnqn"
[   67.912444][   T94] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.913709][ T5861] nvme nvme6: creating 2 I/O queues.
[   67.917323][ T5861] nvme nvme6: new ctrl: "testnqn"
[   67.954678][   T64] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.956718][ T5862] nvme nvme7: creating 2 I/O queues.
[   67.958697][ T5862] nvme nvme7: new ctrl: "testnqn"
[   67.992822][ T2294] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   67.993625][ T5863] nvme nvme8: creating 2 I/O queues.
[   67.996661][ T5863] nvme nvme8: new ctrl: "testnqn"
[   68.034836][   T94] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   68.036110][ T5864] nvme nvme9: creating 2 I/O queues.
[   68.038792][ T5864] nvme nvme9: new ctrl: "testnqn"
[   68.047280][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   68.324301][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   68.595016][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   68.823366][   T34] kauditd_printk_skb: 53 callbacks suppressed
[   68.823378][   T34] audit: type=1400 audit(1790187136.036:264): avc:  denied  { write } for  pid=5891 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.843052][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   68.885199][   T34] audit: type=1400 audit(1790187136.096:265): avc:  denied  { write } for  pid=5894 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.063166][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   69.323757][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   69.574591][   T34] audit: type=1400 audit(1790187136.776:266): avc:  denied  { write } for  pid=5897 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.603028][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   69.626235][   T34] audit: type=1400 audit(1790187136.836:267): avc:  denied  { write } for  pid=5900 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.955861][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   70.234190][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   70.491886][   T34] audit: type=1400 audit(1790187137.696:268): avc:  denied  { write } for  pid=5903 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.523141][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   70.539632][   T34] audit: type=1400 audit(1790187137.746:269): avc:  denied  { write } for  pid=5906 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.756710][   T35] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.757819][ T5909] nvme nvme0: creating 2 I/O queues.
[   70.758926][ T5909] nvme nvme0: new ctrl: "testnqn"
[   70.809616][ T1243] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.811773][ T5910] nvme nvme1: creating 2 I/O queues.
[   70.828877][ T5910] nvme nvme1: new ctrl: "testnqn"
[   70.851270][   T34] audit: type=1400 audit(1790187138.056:270): avc:  denied  { write } for  pid=5921 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.867765][ T5878] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.868481][ T5911] nvme nvme2: creating 2 I/O queues.
[   70.871877][ T5911] nvme nvme2: new ctrl: "testnqn"
[   70.923323][   T29] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.924093][ T5913] nvme nvme3: creating 2 I/O queues.
[   70.926828][ T5913] nvme nvme3: new ctrl: "testnqn"
[   70.927190][   T34] audit: type=1400 audit(1790187138.136:271): avc:  denied  { write } for  pid=5926 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.981819][   T64] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.984145][ T5914] nvme nvme4: creating 2 I/O queues.
[   70.992012][ T5914] nvme nvme4: new ctrl: "testnqn"
[   71.031722][ T5876] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.033384][ T5915] nvme nvme5: creating 2 I/O queues.
[   71.047005][ T5915] nvme nvme5: new ctrl: "testnqn"
[   71.077511][ T1527] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.078288][ T5917] nvme nvme6: creating 2 I/O queues.
[   71.081131][ T5917] nvme nvme6: new ctrl: "testnqn"
[   71.121703][ T5878] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.124026][ T5916] nvme nvme7: creating 2 I/O queues.
[   71.130399][ T5916] nvme nvme7: new ctrl: "testnqn"
[   71.157327][   T94] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.158042][ T5919] nvme nvme8: creating 2 I/O queues.
[   71.161992][ T5919] nvme nvme8: new ctrl: "testnqn"
[   71.207927][   T27] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.209697][ T5918] nvme nvme9: creating 2 I/O queues.
[   71.218334][ T5918] nvme nvme9: new ctrl: "testnqn"
[   71.224785][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   71.493352][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   71.704792][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.704832][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   71.803535][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   72.093600][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   72.333098][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   72.613212][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   72.863049][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   73.133049][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   73.403388][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   73.663146][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   73.965693][   T94] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   73.967039][ T5936] nvme nvme0: creating 2 I/O queues.
[   73.968092][ T5936] nvme nvme0: new ctrl: "testnqn"
[   73.998981][   T28] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.001325][ T5937] nvme nvme1: creating 2 I/O queues.
[   74.012413][ T5937] nvme nvme1: new ctrl: "testnqn"
[   74.046647][   T64] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.047459][ T5938] nvme nvme2: creating 2 I/O queues.
[   74.048561][ T5938] nvme nvme2: new ctrl: "testnqn"
[   74.078181][ T5878] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.078967][ T5939] nvme nvme3: creating 2 I/O queues.
[   74.081636][ T5939] nvme nvme3: new ctrl: "testnqn"
[   74.114228][   T35] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.114890][ T5941] nvme nvme4: creating 2 I/O queues.
[   74.117575][ T5941] nvme nvme4: new ctrl: "testnqn"
[   74.154883][   T94] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.155672][ T5942] nvme nvme5: creating 2 I/O queues.
[   74.158332][ T5942] nvme nvme5: new ctrl: "testnqn"
[   74.188116][   T27] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.188817][ T5943] nvme nvme6: creating 2 I/O queues.
[   74.191792][ T5943] nvme nvme6: new ctrl: "testnqn"
[   74.222244][ T1108] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.223143][ T5944] nvme nvme7: creating 2 I/O queues.
[   74.225780][ T5944] nvme nvme7: new ctrl: "testnqn"
[   74.253028][   T64] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.254543][ T5945] nvme nvme8: creating 2 I/O queues.
[   74.256988][ T5945] nvme nvme8: new ctrl: "testnqn"
[   74.288601][   T27] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.289593][ T5946] nvme nvme9: creating 2 I/O queues.
[   74.292406][ T5946] nvme nvme9: new ctrl: "testnqn"
[   74.301427][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   74.573150][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   74.883545][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   75.153156][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   75.413275][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   75.663160][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   75.953110][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   76.213685][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   76.464220][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   76.713567][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   76.813263][   T33] cfg80211: failed to load regulatory.db
[   77.056009][   T64] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.057185][ T5956] nvme nvme0: creating 2 I/O queues.
[   77.059636][ T5956] nvme nvme0: new ctrl: "testnqn"
[   77.097038][   T94] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.098482][ T5957] nvme nvme1: creating 2 I/O queues.
[   77.099663][ T5957] nvme nvme1: new ctrl: "testnqn"
[   77.125894][   T27] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.128162][ T5958] nvme nvme2: creating 2 I/O queues.
[   77.131747][ T5958] nvme nvme2: new ctrl: "testnqn"
[   77.163029][ T5928] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.164317][ T5959] nvme nvme3: creating 2 I/O queues.
[   77.166498][ T5959] nvme nvme3: new ctrl: "testnqn"
[   77.192078][ T5928] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.199057][ T5961] nvme nvme4: creating 2 I/O queues.
[   77.201265][ T5961] nvme nvme4: new ctrl: "testnqn"
[   77.238409][ T5928] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.239613][ T5963] nvme nvme5: creating 2 I/O queues.
[   77.248882][ T5963] nvme nvme5: new ctrl: "testnqn"
[   77.278992][   T64] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.281054][ T5962] nvme nvme6: creating 2 I/O queues.
[   77.292068][ T5962] nvme nvme6: new ctrl: "testnqn"
[   77.323059][ T1527] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.323829][ T5964] nvme nvme7: creating 2 I/O queues.
[   77.326525][ T5964] nvme nvme7: new ctrl: "testnqn"
[   77.360258][ T2294] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.361133][ T5965] nvme nvme8: creating 2 I/O queues.
[   77.371128][ T5965] nvme nvme8: new ctrl: "testnqn"
[   77.393994][ T5970] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.394724][ T5966] nvme nvme9: creating 2 I/O queues.
[   77.397280][ T5966] nvme nvme9: new ctrl: "testnqn"
[   77.400090][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   77.663310][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   77.933439][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   78.213623][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   78.503903][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   78.763217][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   79.023138][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   79.283897][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   79.563126][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   79.844246][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   80.175163][   T84] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.176261][ T5977] nvme nvme0: creating 2 I/O queues.
[   80.178789][ T5977] nvme nvme0: new ctrl: "testnqn"
[   80.213918][ T5970] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.214599][ T5978] nvme nvme1: creating 2 I/O queues.
[   80.219619][ T5978] nvme nvme1: new ctrl: "testnqn"
[   80.253576][   T64] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.254329][ T5982] nvme nvme2: creating 2 I/O queues.
[   80.256136][ T5982] nvme nvme2: new ctrl: "testnqn"
[   80.304742][ T5928] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.305570][ T5979] nvme nvme3: creating 2 I/O queues.
[   80.308255][ T5979] nvme nvme3: new ctrl: "testnqn"
[   80.335121][ T5970] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.335873][ T5981] nvme nvme4: creating 2 I/O queues.
[   80.338438][ T5981] nvme nvme4: new ctrl: "testnqn"
[   80.374891][   T94] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.377074][ T5984] nvme nvme5: creating 2 I/O queues.
[   80.379788][ T5984] nvme nvme5: new ctrl: "testnqn"
[   80.413919][ T5928] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.414615][ T5983] nvme nvme6: creating 2 I/O queues.
[   80.420582][ T5983] nvme nvme6: new ctrl: "testnqn"
[   80.459803][   T27] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.461031][ T5985] nvme nvme7: creating 2 I/O queues.
[   80.473752][ T5985] nvme nvme7: new ctrl: "testnqn"
[   80.500453][   T94] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.502062][ T5986] nvme nvme8: creating 2 I/O queues.
[   80.506882][ T5986] nvme nvme8: new ctrl: "testnqn"
[   80.538817][ T5928] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.539805][ T5987] nvme nvme9: creating 2 I/O queues.
[   80.549393][ T5987] nvme nvme9: new ctrl: "testnqn"
[   80.551743][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   80.804846][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   81.054125][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   81.303601][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   81.563031][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   81.823824][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   82.063122][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   82.313129][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   82.543890][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   82.732381][   T94] nvme nvme0: long keepalive RTT (4294752936 ms)
[   82.732410][   T94] nvme nvme0: failed nvme_keep_alive_end_io error=4
[   82.823096][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   83.095273][   T34] audit: type=1400 audit(1790187150.306:272): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095379][   T34] audit: type=1400 audit(1790187150.306:273): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="nvmet" dev="configfs" ino=3602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095508][   T34] audit: type=1400 audit(1790187150.306:274): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="ports" dev="configfs" ino=3604 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095600][   T34] audit: type=1400 audit(1790187150.306:275): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="1" dev="configfs" ino=8313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095692][   T34] audit: type=1400 audit(1790187150.306:276): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="subsystems" dev="configfs" ino=8314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095931][   T34] audit: type=1400 audit(1790187150.306:277): avc:  denied  { write search } for  pid=5854 comm="syz-executor239" name="subsystems" dev="configfs" ino=8314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.096963][   T34] audit: type=1400 audit(1790187150.306:278): avc:  denied  { remove_name } for  pid=5854 comm="syz-executor239" name="testnqn" dev="configfs" ino=8319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.099255][   T34] audit: type=1400 audit(1790187150.306:279): avc:  denied  { unlink } for  pid=5854 comm="syz-executor239" name="testnqn" dev="configfs" ino=8319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   83.099277][   T34] audit: type=1400 audit(1790187150.306:280): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.099293][   T34] audit: type=1400 audit(1790187150.306:281): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="nvmet" dev="configfs" ino=3602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host successful.
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 successful.
[+] /tmp/nvme_backing created successfully.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable successful.
[+] mkdir /sys/kernel/config/nvmet/ports/1 successful.
[+] write to /sys/kernel/config/nvmet/ports/1/addr_trtype successful.
[+] symlink successful.
[*] Starting concurrent NVMe multipath connections...
[*] Cleaning up...
 OtherCrashReports:<nil> StraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor4093947809

<...>
[   64.708650][   T35] kauditd_printk_skb: 10 callbacks suppressed
[   64.708661][   T35] audit: type=1400 audit(1790187232.096:201): avc:  denied  { transition } for  pid=5831 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   64.710172][   T35] audit: type=1400 audit(1790187232.096:202): avc:  denied  { noatsecure } for  pid=5831 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   64.710194][   T35] audit: type=1400 audit(1790187232.096:203): avc:  denied  { rlimitinh } for  pid=5831 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   64.710209][   T35] audit: type=1400 audit(1790187232.096:204): avc:  denied  { siginh } for  pid=5831 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   66.574859][ T1381] ieee802154 phy0 wpan0: encryption failed: -22
[   66.574898][ T1381] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '[localhost]:20929' (ED25519) to the list of known hosts.
[   68.404702][   T35] audit: type=1400 audit(1790187235.796:205): avc:  denied  { write } for  pid=5849 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   68.465975][   T35] audit: type=1400 audit(1790187235.856:206): avc:  denied  { write } for  pid=5854 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
execve("/syz-executor4093947809", ["/syz-executor4093947809"], 0x7ffd2397a510 /* 11 vars */) = 0
brk(NULL)                               = 0x555593c2c000
brk(0x555593c2cd80)                     = 0x555593c2cd80
arch_prctl(ARCH_SET_FS, 0x555593c2c400) = 0
set_tid_address(0x555593c2c6d0)         = 5858
set_robust_list(0x555593c2c6e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor4093947809", 4096) = 23
getrandom("\x68\x89\xb0\x2e\x0f\xda\x30\xb3", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555593c2cd80
brk(0x555593c4dd80)                     = 0x555593c4dd80
brk(0x555593c4e000)                     = 0x555593c4e000
mprotect(0x7f019fff1000, 20480, PROT_READ) = 0
mkdir("/sys/kernel/config/nvmet/subsystems/testnqn", 0755) = 0
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
[   68.545752][   T35] audit: type=1400 audit(1790187235.936:207): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="/" dev="configfs" ino=1108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.545861][   T35] audit: type=1400 audit(1790187235.936:208): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="nvmet" dev="configfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", O_WRONLY) = 3
[   68.545938][   T35] audit: type=1400 audit(1790187235.936:209): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=1566 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
write(3, "1", 1)                        = 1
close(3)                                = 0
[   68.546653][   T35] audit: type=1400 audit(1790187235.936:210): avc:  denied  { write search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=1566 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.587737][ T5858] nvmet: adding nsid 1 to subsystem testnqn
mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1", 0755) = 0
openat(AT_FDCWD, "/tmp/nvme_backing", O_RDWR|O_CREAT, 0644) = 3
ftruncate(3, 16777216)                  = 0
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", O_WRONLY) = 3
write(3, "/tmp/nvme_backing", 17)       = 17
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
mkdir("/sys/kernel/config/nvmet/ports/1", 0755) = 0
openat(AT_FDCWD, "/sys/kernel/config/nvmet/ports/1/addr_trtype", O_WRONLY) = 3
write(3, "loop", 4)                     = 4
close(3)                                = 0
symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7f019ff7acb0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f019ff6f5a0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019f722000
mprotect(0x7f019f723000, 8388608, PROT_READ|PROT_WRITE) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ff22990, parent_tid=0x7f019ff22990, exit_signal=0, stack=0x7f019f722000, stack_size=0x8002c0, tls=0x7f019ff226c0}/strace: Process 5859 attached
 => {parent_tid=[5859]}, 88) = 5859
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5859] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019ef21000
[pid  5859] <... rseq resumed>)         = 0
[pid  5858] mprotect(0x7f019ef22000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5859] set_robust_list(0x7f019ff229a0, 24 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5859] <... set_robust_list resumed>) = 0
[pid  5859] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5859] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019f721990, parent_tid=0x7f019f721990, exit_signal=0, stack=0x7f019ef21000, stack_size=0x8002c0, tls=0x7f019f7216c0} <unfinished ...>
[pid  5859] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR/strace: Process 5860 attached
) = 3
[pid  5858] <... clone3 resumed> => {parent_tid=[5860]}, 88) = 5860
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5860] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5859] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5860] <... rseq resumed>)         = 0
[pid  5860] set_robust_list(0x7f019f7219a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019e720000
[pid  5860] <... set_robust_list resumed>) = 0
[pid  5858] mprotect(0x7f019e721000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5860] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] <... mprotect resumed>)     = 0
[pid  5860] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 4
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5860] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ef20990, parent_tid=0x7f019ef20990, exit_signal=0, stack=0x7f019e720000, stack_size=0x8002c0, tls=0x7f019ef206c0}/strace: Process 5863 attached
 => {parent_tid=[5863]}, 88) = 5863
[pid  5863] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5863] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5863] set_robust_list(0x7f019ef209a0, 24 <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019df1f000
[pid  5863] <... set_robust_list resumed>) = 0
[pid  5858] mprotect(0x7f019df20000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5863] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5863] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5863] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5863] <... openat resumed>)       = 5
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019e71f990, parent_tid=0x7f019e71f990, exit_signal=0, stack=0x7f019df1f000, stack_size=0x8002c0, tls=0x7f019e71f6c0} <unfinished ...>
[pid  5863] write(5, "nqn=testnqn,transport=loop", 26/strace: Process 5864 attached
 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5864]}, 88) = 5864
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5864] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5864] <... rseq resumed>)         = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5864] set_robust_list(0x7f019e71f9a0, 24 <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019d71e000
[pid  5864] <... set_robust_list resumed>) = 0
[pid  5858] mprotect(0x7f019d71f000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5864] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5864] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5864] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5864] <... openat resumed>)       = 6
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5864] write(6, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019df1e990, parent_tid=0x7f019df1e990, exit_signal=0, stack=0x7f019d71e000, stack_size=0x8002c0, tls=0x7f019df1e6c0}/strace: Process 5866 attached
 => {parent_tid=[5866]}, 88) = 5866
[pid  5866] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5866] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5866] set_robust_list(0x7f019df1e9a0, 24 <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5866] <... set_robust_list resumed>) = 0
[pid  5858] <... mmap resumed>)         = 0x7f019cf1d000
[pid  5858] mprotect(0x7f019cf1e000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5866] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5866] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5866] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5866] <... openat resumed>)       = 7
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019d71d990, parent_tid=0x7f019d71d990, exit_signal=0, stack=0x7f019cf1d000, stack_size=0x8002c0, tls=0x7f019d71d6c0} <unfinished ...>
[pid  5866] write(7, "nqn=testnqn,transport=loop", 26/strace: Process 5869 attached
 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5869]}, 88) = 5869
[pid  5869] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
[pid  5869] set_robust_list(0x7f019d71d9a0, 24 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5869] <... set_robust_list resumed>) = 0
[pid  5869] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5869] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 8
[   68.794295][   T31] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5869] write(8, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019c71c000
[pid  5858] mprotect(0x7f019c71d000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019cf1c990, parent_tid=0x7f019cf1c990, exit_signal=0, stack=0x7f019c71c000, stack_size=0x8002c0, tls=0x7f019cf1c6c0} => {parent_tid=[5870]}, 88) = 5870
/strace: Process 5870 attached
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5870] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019bf1b000
[pid  5870] <... rseq resumed>)         = 0
[pid  5870] set_robust_list(0x7f019cf1c9a0, 24) = 0
[pid  5870] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5870] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 9
[   68.829465][ T5859] nvme nvme0: creating 2 I/O queues.
[pid  5870] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] mprotect(0x7f019bf1c000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[   68.837082][ T5859] nvme nvme0: new ctrl: "testnqn"
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019c71b990, parent_tid=0x7f019c71b990, exit_signal=0, stack=0x7f019bf1b000, stack_size=0x8002c0, tls=0x7f019c71b6c0} <unfinished ...>
[pid  5859] <... write resumed>)        = 26
/strace: Process 5873 attached
[pid  5858] <... clone3 resumed> => {parent_tid=[5873]}, 88) = 5873
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5859] close(3 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5859] <... close resumed>)        = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5873] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019b71a000
[pid  5858] mprotect(0x7f019b71b000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5873] <... rseq resumed>)         = 0
[pid  5859] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5873] set_robust_list(0x7f019c71b9a0, 24 <unfinished ...>
[pid  5859] madvise(0x7f019f722000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5873] <... set_robust_list resumed>) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5859] <... madvise resumed>)      = 0
[pid  5873] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5859] exit(0 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5859] <... exit resumed>)         = ?
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019bf1a990, parent_tid=0x7f019bf1a990, exit_signal=0, stack=0x7f019b71a000, stack_size=0x8002c0, tls=0x7f019bf1a6c0} <unfinished ...>
[pid  5859] +++ exited with 0 +++
[pid  5873] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5873] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR/strace: Process 5874 attached
 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5874]}, 88) = 5874
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5873] <... openat resumed>)       = 3
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5873] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5874] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
[pid  5858] <... mmap resumed>)         = 0x7f019af19000
[pid  5874] set_robust_list(0x7f019bf1a9a0, 24 <unfinished ...>
[pid  5858] mprotect(0x7f019af1a000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5874] <... set_robust_list resumed>) = 0
[pid  5874] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5874] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5874] <... openat resumed>)       = 10
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019b719990, parent_tid=0x7f019b719990, exit_signal=0, stack=0x7f019af19000, stack_size=0x8002c0, tls=0x7f019b7196c0} <unfinished ...>
[pid  5874] write(10, "nqn=testnqn,transport=loop", 26/strace: Process 5876 attached
 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5876]}, 88) = 5876
[pid  5876] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
[pid  5876] set_robust_list(0x7f019b7199a0, 24) = 0
[pid  5876] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5876] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 11
[pid  5876] write(11, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[   68.884016][   T95] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   68.886112][ T5860] nvme nvme1: creating 2 I/O queues.
[   68.911544][ T5860] nvme nvme1: new ctrl: "testnqn"
[pid  5858] futex(0x7f019f721990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5860, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5860] <... write resumed>)        = 26
[pid  5860] close(4)                    = 0
[pid  5860] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5860] madvise(0x7f019ef21000, 8372224, MADV_DONTNEED) = 0
[pid  5860] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5860] +++ exited with 0 +++
[   68.995962][   T27] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   68.996943][ T5863] nvme nvme2: creating 2 I/O queues.
[   68.999958][ T5863] nvme nvme2: new ctrl: "testnqn"
[pid  5858] futex(0x7f019ef20990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5863, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5863] <... write resumed>)        = 26
[pid  5863] close(5)                    = 0
[pid  5863] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5863] madvise(0x7f019e720000, 8372224, MADV_DONTNEED) = 0
[pid  5863] exit(0)                     = ?
[pid  5863] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[   69.041769][   T95] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   69.047367][ T5864] nvme nvme3: creating 2 I/O queues.
[pid  5858] futex(0x7f019e71f990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5864, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5864] <... write resumed>)        = 26
[   69.049303][ T5864] nvme nvme3: new ctrl: "testnqn"
[pid  5864] close(6)                    = 0
[pid  5864] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5864] madvise(0x7f019df1f000, 8372224, MADV_DONTNEED) = 0
[pid  5864] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5864] +++ exited with 0 +++
[   69.091224][ T5884] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] futex(0x7f019df1e990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5866, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5866] <... write resumed>)        = 26
[   69.096848][ T5866] nvme nvme4: creating 2 I/O queues.
[   69.098761][ T5866] nvme nvme4: new ctrl: "testnqn"
[pid  5866] close(7)                    = 0
[pid  5866] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5866] madvise(0x7f019d71e000, 8372224, MADV_DONTNEED) = 0
[pid  5866] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5866] +++ exited with 0 +++
[pid  5858] munmap(0x7f019f722000, 8392704) = 0
[   69.147707][   T95] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] futex(0x7f019d71d990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5869, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5869] <... write resumed>)        = 26
[   69.148458][ T5869] nvme nvme5: creating 2 I/O queues.
[   69.152286][ T5869] nvme nvme5: new ctrl: "testnqn"
[pid  5869] close(8)                    = 0
[pid  5869] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5869] madvise(0x7f019cf1d000, 8372224, MADV_DONTNEED) = 0
[pid  5869] exit(0)                     = ?
[pid  5869] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019ef21000, 8392704) = 0
[   69.201480][   T28] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   69.206552][ T5870] nvme nvme6: creating 2 I/O queues.
[pid  5858] futex(0x7f019cf1c990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5870, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5870] <... write resumed>)        = 26
[   69.210231][ T5870] nvme nvme6: new ctrl: "testnqn"
[pid  5870] close(9)                    = 0
[pid  5870] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5870] madvise(0x7f019c71c000, 8372224, MADV_DONTNEED) = 0
[pid  5870] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5870] +++ exited with 0 +++
[pid  5858] munmap(0x7f019e720000, 8392704) = 0
[pid  5858] futex(0x7f019c71b990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5873, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5873] <... write resumed>)        = 26
[   69.265438][   T87] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   69.266424][ T5873] nvme nvme7: creating 2 I/O queues.
[   69.267948][ T5873] nvme nvme7: new ctrl: "testnqn"
[pid  5873] close(3)                    = 0
[pid  5873] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5873] madvise(0x7f019bf1b000, 8372224, MADV_DONTNEED) = 0
[pid  5873] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5873] +++ exited with 0 +++
[pid  5858] munmap(0x7f019df1f000, 8392704) = 0
[   69.317015][   T28] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   69.318145][ T5874] nvme nvme8: creating 2 I/O queues.
[   69.320366][ T5874] nvme nvme8: new ctrl: "testnqn"
[pid  5858] futex(0x7f019bf1a990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5874, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5874] <... write resumed>)        = 26
[pid  5874] close(10)                   = 0
[pid  5874] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5874] madvise(0x7f019b71a000, 8372224, MADV_DONTNEED) = 0
[pid  5874] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5874] +++ exited with 0 +++
[pid  5858] munmap(0x7f019d71e000, 8392704) = 0
[pid  5858] futex(0x7f019b719990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5876, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5876] <... write resumed>)        = 26
[pid  5876] close(11)                   = 0
[   69.364351][   T87] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   69.365166][ T5876] nvme nvme9: creating 2 I/O queues.
[pid  5876] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   69.366180][ T5876] nvme nvme9: new ctrl: "testnqn"
[pid  5876] madvise(0x7f019af19000, 8372224, MADV_DONTNEED) = 0
[pid  5876] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5876] +++ exited with 0 +++
munmap(0x7f019cf1d000, 8392704)         = 0
openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents64(3, 0x555593c2f2e0 /* 12 entries */, 32768) = 368
openat(AT_FDCWD, "/sys/class/nvme/nvme7/delete_controller", O_WRONLY) = 4
[   69.391704][ T5858] nvme nvme7: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY) = 4
[   69.775892][ T5858] nvme nvme5: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   70.084655][ T5858] nvme nvme3: Removing ctrl: NQN "testnqn"
[   70.198979][   T35] kauditd_printk_skb: 55 callbacks suppressed
[   70.198991][   T35] audit: type=1400 audit(1790187237.586:266): avc:  denied  { write } for  pid=5909 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.245542][   T35] audit: type=1400 audit(1790187237.636:267): avc:  denied  { write } for  pid=5912 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 4
[   70.328455][   T35] audit: type=1400 audit(1790187237.716:268): avc:  denied  { write } for  pid=5915 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.339638][ T5858] nvme nvme1: Removing ctrl: NQN "testnqn"
[   70.373726][   T35] audit: type=1400 audit(1790187237.766:269): avc:  denied  { write } for  pid=5918 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   70.646880][ T5858] nvme nvme8: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   70.926080][ T5858] nvme nvme6: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[   71.214408][ T5858] nvme nvme4: Removing ctrl: NQN "testnqn"
[   71.429524][   T35] audit: type=1400 audit(1790187238.816:270): avc:  denied  { write } for  pid=5921 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.484374][   T35] audit: type=1400 audit(1790187238.876:271): avc:  denied  { write } for  pid=5924 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   71.520391][ T5858] nvme nvme2: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme0/delete_controller", O_WRONLY) = 4
[   71.817864][ T5858] nvme nvme0: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 4
[   72.114595][ T5858] nvme nvme9: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
getdents64(3, 0x555593c2f2e0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019b719990, parent_tid=0x7f019b719990, exit_signal=0, stack=0x7f019af19000, stack_size=0x8002c0, tls=0x7f019b7196c0}/strace: Process 5927 attached
 => {parent_tid=[5927]}, 88) = 5927
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5927] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019bf1a990, parent_tid=0x7f019bf1a990, exit_signal=0, stack=0x7f019b71a000, stack_size=0x8002c0, tls=0x7f019bf1a6c0} <unfinished ...>
[pid  5927] <... rseq resumed>)         = 0
/strace: Process 5928 attached
[pid  5927] set_robust_list(0x7f019b7199a0, 24 <unfinished ...>
[pid  5928] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5928]}, 88) = 5928
[pid  5928] <... rseq resumed>)         = 0
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5928] set_robust_list(0x7f019bf1a9a0, 24 <unfinished ...>
[pid  5927] <... set_robust_list resumed>) = 0
[pid  5928] <... set_robust_list resumed>) = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5928] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5928] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5927] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5928] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5927] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019c71b990, parent_tid=0x7f019c71b990, exit_signal=0, stack=0x7f019bf1b000, stack_size=0x8002c0, tls=0x7f019c71b6c0} <unfinished ...>
[pid  5927] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5928] <... openat resumed>)       = 3
[pid  5928] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5927] <... openat resumed>)       = 4
/strace: Process 5929 attached
[pid  5927] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5929]}, 88) = 5929
[pid  5929] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5929] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5929] set_robust_list(0x7f019c71b9a0, 24 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5929] <... set_robust_list resumed>) = 0
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5929] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019cf1c990, parent_tid=0x7f019cf1c990, exit_signal=0, stack=0x7f019c71c000, stack_size=0x8002c0, tls=0x7f019cf1c6c0} <unfinished ...>
[pid  5929] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5929] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR/strace: Process 5931 attached
) = 5
[pid  5931] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5931]}, 88) = 5931
[pid  5931] <... rseq resumed>)         = 0
[pid  5929] write(5, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5931] set_robust_list(0x7f019cf1c9a0, 24 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5931] <... set_robust_list resumed>) = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5931] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5931] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] <... mmap resumed>)         = 0x7f019f722000
[pid  5931] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] mprotect(0x7f019f723000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5931] <... openat resumed>)       = 6
[pid  5858] <... mprotect resumed>)     = 0
[pid  5931] write(6, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[   72.470013][ T5884] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.474893][ T5928] nvme nvme0: creating 2 I/O queues.
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ff22990, parent_tid=0x7f019ff22990, exit_signal=0, stack=0x7f019f722000, stack_size=0x8002c0, tls=0x7f019ff226c0}/strace: Process 5932 attached
 => {parent_tid=[5932]}, 88) = 5932
[pid  5928] <... write resumed>)        = 26
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5932] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[   72.478861][ T5928] nvme nvme0: new ctrl: "testnqn"
[pid  5928] close(3 <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019ef21000
[pid  5932] <... rseq resumed>)         = 0
[pid  5858] mprotect(0x7f019ef22000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5932] set_robust_list(0x7f019ff229a0, 24 <unfinished ...>
[pid  5928] <... close resumed>)        = 0
[pid  5858] <... mprotect resumed>)     = 0
[pid  5932] <... set_robust_list resumed>) = 0
[pid  5932] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5932] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 3
[pid  5932] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5928] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019f721990, parent_tid=0x7f019f721990, exit_signal=0, stack=0x7f019ef21000, stack_size=0x8002c0, tls=0x7f019f7216c0} => {parent_tid=[5934]}, 88) = 5934
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019e720000
[pid  5858] mprotect(0x7f019e721000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
/strace: Process 5934 attached
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ef20990, parent_tid=0x7f019ef20990, exit_signal=0, stack=0x7f019e720000, stack_size=0x8002c0, tls=0x7f019ef206c0} <unfinished ...>
[pid  5928] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5928] madvise(0x7f019b71a000, 8372224, MADV_DONTNEED/strace: Process 5935 attached
) = 0
[pid  5935] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5934] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5928] exit(0 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5935]}, 88) = 5935
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019df1f000
[pid  5858] mprotect(0x7f019df20000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5935] <... rseq resumed>)         = 0
[pid  5934] <... rseq resumed>)         = 0
[pid  5928] <... exit resumed>)         = ?
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019e71f990, parent_tid=0x7f019e71f990, exit_signal=0, stack=0x7f019df1f000, stack_size=0x8002c0, tls=0x7f019e71f6c0} => {parent_tid=[5936]}, 88) = 5936
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0/strace: Process 5936 attached
) = 0x7f019d71e000
[pid  5935] set_robust_list(0x7f019ef209a0, 24 <unfinished ...>
[pid  5934] set_robust_list(0x7f019f7219a0, 24 <unfinished ...>
[pid  5928] +++ exited with 0 +++
[pid  5858] mprotect(0x7f019d71f000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5936] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5935] <... set_robust_list resumed>) = 0
[pid  5934] <... set_robust_list resumed>) = 0
[pid  5858] <... mprotect resumed>)     = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019df1e990, parent_tid=0x7f019df1e990, exit_signal=0, stack=0x7f019d71e000, stack_size=0x8002c0, tls=0x7f019df1e6c0}/strace: Process 5937 attached
 <unfinished ...>
[pid  5936] <... rseq resumed>)         = 0
[pid  5935] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5934] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5936] set_robust_list(0x7f019e71f9a0, 24 <unfinished ...>
[pid  5935] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5937] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5936] <... set_robust_list resumed>) = 0
[pid  5935] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5934] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] <... clone3 resumed> => {parent_tid=[5937]}, 88) = 5937
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019cf1d000
[pid  5858] mprotect(0x7f019cf1e000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019d71d990, parent_tid=0x7f019d71d990, exit_signal=0, stack=0x7f019cf1d000, stack_size=0x8002c0, tls=0x7f019d71d6c0}/strace: Process 5938 attached
 <unfinished ...>
[pid  5937] <... rseq resumed>)         = 0
[pid  5936] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5935] <... openat resumed>)       = 7
[pid  5934] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5938]}, 88) = 5938
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5938] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5937] set_robust_list(0x7f019df1e9a0, 24 <unfinished ...>
[pid  5936] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5935] write(7, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5934] <... openat resumed>)       = 8
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] futex(0x7f019b719990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5927, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5936] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5934] write(8, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5938] <... rseq resumed>)         = 0
[pid  5937] <... set_robust_list resumed>) = 0
[pid  5938] set_robust_list(0x7f019d71d9a0, 24 <unfinished ...>
[pid  5937] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5936] <... openat resumed>)       = 9
[pid  5938] <... set_robust_list resumed>) = 0
[pid  5937] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5936] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5938] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5937] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5938] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5938] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5937] <... openat resumed>)       = 10
[pid  5938] <... openat resumed>)       = 11
[pid  5937] write(10, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[   72.528989][   T29] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.530866][ T5927] nvme nvme1: creating 2 I/O queues.
[   72.536811][ T5927] nvme nvme1: new ctrl: "testnqn"
[pid  5938] write(11, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5927] <... write resumed>)        = 26
[pid  5927] close(4)                    = 0
[pid  5927] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5927] madvise(0x7f019af19000, 8372224, MADV_DONTNEED) = 0
[pid  5927] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5927] +++ exited with 0 +++
[pid  5858] futex(0x7f019c71b990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5929, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5929] <... write resumed>)        = 26
[   72.563988][ T5884] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.564907][ T5929] nvme nvme2: creating 2 I/O queues.
[   72.568880][ T5929] nvme nvme2: new ctrl: "testnqn"
[pid  5929] close(5)                    = 0
[pid  5929] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5929] madvise(0x7f019bf1b000, 8372224, MADV_DONTNEED) = 0
[pid  5929] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5929] +++ exited with 0 +++
[   72.598253][   T29] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.601487][ T5931] nvme nvme3: creating 2 I/O queues.
[   72.611176][ T5931] nvme nvme3: new ctrl: "testnqn"
[pid  5858] futex(0x7f019cf1c990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5931, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5931] <... write resumed>)        = 26
[pid  5931] close(6)                    = 0
[pid  5931] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5931] madvise(0x7f019c71c000, 8372224, MADV_DONTNEED) = 0
[pid  5931] exit(0)                     = ?
[pid  5931] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] futex(0x7f019ff22990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5932, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5932] <... write resumed>)        = 26
[   72.642754][   T63] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.645909][ T5932] nvme nvme4: creating 2 I/O queues.
[   72.649014][ T5932] nvme nvme4: new ctrl: "testnqn"
[pid  5932] close(3)                    = 0
[pid  5932] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5932] madvise(0x7f019f722000, 8372224, MADV_DONTNEED) = 0
[pid  5932] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5932] +++ exited with 0 +++
[pid  5858] munmap(0x7f019af19000, 8392704) = 0
[pid  5858] futex(0x7f019f721990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5934, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5935] <... write resumed>)        = 26
[pid  5935] close(7)                    = 0
[pid  5935] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5935] madvise(0x7f019e720000, 8372224, MADV_DONTNEED) = 0
[pid  5935] exit(0)                     = ?
[pid  5935] +++ exited with 0 +++
[   72.692529][ T5885] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.693289][ T5935] nvme nvme5: creating 2 I/O queues.
[   72.696069][ T5935] nvme nvme5: new ctrl: "testnqn"
[pid  5934] <... write resumed>)        = 26
[pid  5934] close(8)                    = 0
[pid  5934] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5934] madvise(0x7f019ef21000, 8372224, MADV_DONTNEED) = 0
[   72.725084][ T5885] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5934] exit(0)                     = ?
[pid  5934] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[   72.725972][ T5934] nvme nvme6: creating 2 I/O queues.
[   72.729620][ T5934] nvme nvme6: new ctrl: "testnqn"
[pid  5858] munmap(0x7f019b71a000, 8392704) = 0
[pid  5858] munmap(0x7f019bf1b000, 8392704) = 0
[   72.768241][ T5884] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.769212][ T5936] nvme nvme7: creating 2 I/O queues.
[   72.776663][ T5936] nvme nvme7: new ctrl: "testnqn"
[pid  5858] futex(0x7f019e71f990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5936, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5936] <... write resumed>)        = 26
[pid  5936] close(9)                    = 0
[pid  5936] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5936] madvise(0x7f019df1f000, 8372224, MADV_DONTNEED) = 0
[pid  5936] exit(0)                     = ?
[pid  5936] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[   72.805726][ T5884] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.806367][ T5937] nvme nvme8: creating 2 I/O queues.
[   72.808634][ T5937] nvme nvme8: new ctrl: "testnqn"
[pid  5858] munmap(0x7f019c71c000, 8392704) = 0
[pid  5937] <... write resumed>)        = 26
[pid  5937] close(10 <unfinished ...>
[pid  5858] futex(0x7f019df1e990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5937, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5937] <... close resumed>)        = 0
[pid  5937] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5937] madvise(0x7f019d71e000, 8372224, MADV_DONTNEED) = 0
[pid  5937] exit(0)                     = ?
[pid  5937] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019f722000, 8392704) = 0
[   72.846294][   T63] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   72.847743][ T5938] nvme nvme9: creating 2 I/O queues.
[   72.850199][ T5938] nvme nvme9: new ctrl: "testnqn"
[pid  5858] futex(0x7f019d71d990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5938, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5938] <... write resumed>)        = 26
[pid  5938] close(11)                   = 0
[pid  5938] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5938] madvise(0x7f019cf1d000, 8372224, MADV_DONTNEED) = 0
[pid  5938] exit(0)                     = ?
[pid  5938] +++ exited with 0 +++
<... futex resumed>)                    = 0
munmap(0x7f019ef21000, 8392704)         = 0
openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents64(3, 0x555593c2f2e0 /* 12 entries */, 32768) = 368
openat(AT_FDCWD, "/sys/class/nvme/nvme7/delete_controller", O_WRONLY) = 4
[   72.880352][ T5858] nvme nvme7: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY) = 4
[   73.146873][ T5858] nvme nvme5: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   73.464817][ T5858] nvme nvme3: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 4
[   73.745246][ T5858] nvme nvme1: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   74.056775][ T5858] nvme nvme8: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   74.326223][ T5858] nvme nvme6: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[   74.595950][ T5858] nvme nvme4: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   74.866030][ T5858] nvme nvme2: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme0/delete_controller", O_WRONLY) = 4
[   75.115987][ T5858] nvme nvme0: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 4
[   75.376084][ T5858] nvme nvme9: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
getdents64(3, 0x555593c2f2e0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019d71d990, parent_tid=0x7f019d71d990, exit_signal=0, stack=0x7f019cf1d000, stack_size=0x8002c0, tls=0x7f019d71d6c0}/strace: Process 5947 attached
 <unfinished ...>
[pid  5947] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5947]}, 88) = 5947
[pid  5947] <... rseq resumed>)         = 0
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5947] set_robust_list(0x7f019d71d9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5947] <... set_robust_list resumed>) = 0
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5947] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019df1e990, parent_tid=0x7f019df1e990, exit_signal=0, stack=0x7f019d71e000, stack_size=0x8002c0, tls=0x7f019df1e6c0} <unfinished ...>
[pid  5947] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5947] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR/strace: Process 5948 attached
 <unfinished ...>
[pid  5948] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5948]}, 88) = 5948
[pid  5947] <... openat resumed>)       = 3
[pid  5948] <... rseq resumed>)         = 0
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5948] set_robust_list(0x7f019df1e9a0, 24 <unfinished ...>
[pid  5947] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5948] <... set_robust_list resumed>) = 0
[pid  5948] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5948] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 4
[pid  5948] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019e71f990, parent_tid=0x7f019e71f990, exit_signal=0, stack=0x7f019df1f000, stack_size=0x8002c0, tls=0x7f019e71f6c0}/strace: Process 5950 attached
 => {parent_tid=[5950]}, 88) = 5950
[pid  5950] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5950] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5950] set_robust_list(0x7f019e71f9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5950] <... set_robust_list resumed>) = 0
[pid  5950] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ef20990, parent_tid=0x7f019ef20990, exit_signal=0, stack=0x7f019e720000, stack_size=0x8002c0, tls=0x7f019ef206c0} <unfinished ...>
[pid  5950] <... rt_sigprocmask resumed>, NULL, 8) = 0
/strace: Process 5951 attached
[pid  5951] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
[pid  5951] set_robust_list(0x7f019ef209a0, 24) = 0
[pid  5951] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5950] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 5
[pid  5951] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5951] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5951]}, 88) = 5951
[pid  5951] <... openat resumed>)       = 6
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5950] write(5, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5951] write(6, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019f722000
[pid  5858] mprotect(0x7f019f723000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ff22990, parent_tid=0x7f019ff22990, exit_signal=0, stack=0x7f019f722000, stack_size=0x8002c0, tls=0x7f019ff226c0}/strace: Process 5952 attached
 => {parent_tid=[5952]}, 88) = 5952
[pid  5952] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5952] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5952] set_robust_list(0x7f019ff229a0, 24 <unfinished ...>
[   75.713056][ T5893] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019ef21000
[pid  5952] <... set_robust_list resumed>) = 0
[   75.715462][ T5947] nvme nvme0: creating 2 I/O queues.
[   75.720250][ T5947] nvme nvme0: new ctrl: "testnqn"
[pid  5947] <... write resumed>)        = 26
[pid  5858] mprotect(0x7f019ef22000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5952] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5947] close(3)                    = 0
[pid  5947] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5947] madvise(0x7f019cf1d000, 8372224, MADV_DONTNEED) = 0
[pid  5947] exit(0)                     = ?
[pid  5947] +++ exited with 0 +++
[pid  5858] <... mprotect resumed>)     = 0
[pid  5952] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5952] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5952] <... openat resumed>)       = 3
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019f721990, parent_tid=0x7f019f721990, exit_signal=0, stack=0x7f019ef21000, stack_size=0x8002c0, tls=0x7f019f7216c0} <unfinished ...>
[pid  5952] write(3, "nqn=testnqn,transport=loop", 26/strace: Process 5954 attached
 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5954]}, 88) = 5954
[pid  5954] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
[pid  5954] set_robust_list(0x7f019f7219a0, 24 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019c71c000
[pid  5858] mprotect(0x7f019c71d000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5954] <... set_robust_list resumed>) = 0
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5954] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019cf1c990, parent_tid=0x7f019cf1c990, exit_signal=0, stack=0x7f019c71c000, stack_size=0x8002c0, tls=0x7f019cf1c6c0} <unfinished ...>
[pid  5954] <... rt_sigprocmask resumed>, NULL, 8) = 0
/strace: Process 5955 attached
[pid  5954] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 7
[   75.760121][ T1037] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] <... clone3 resumed> => {parent_tid=[5955]}, 88) = 5955
[pid  5955] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5955] <... rseq resumed>)         = 0
[pid  5954] write(7, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5955] set_robust_list(0x7f019cf1c9a0, 24 <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5955] <... set_robust_list resumed>) = 0
[pid  5858] <... mmap resumed>)         = 0x7f019bf1b000
[pid  5955] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] mprotect(0x7f019bf1c000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5955] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] <... mprotect resumed>)     = 0
[pid  5955] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5955] <... openat resumed>)       = 8
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5955] write(8, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019c71b990, parent_tid=0x7f019c71b990, exit_signal=0, stack=0x7f019bf1b000, stack_size=0x8002c0, tls=0x7f019c71b6c0}/strace: Process 5956 attached
 <unfinished ...>
[pid  5948] <... write resumed>)        = 26
[pid  5956] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5956]}, 88) = 5956
[pid  5956] <... rseq resumed>)         = 0
[   75.767233][ T5948] nvme nvme1: creating 2 I/O queues.
[   75.768279][ T5948] nvme nvme1: new ctrl: "testnqn"
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5956] set_robust_list(0x7f019c71b9a0, 24) = 0
[pid  5956] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5956] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5956] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019b71a000
[pid  5956] <... openat resumed>)       = 9
[pid  5858] mprotect(0x7f019b71b000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5956] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5948] close(4)                    = 0
[pid  5948] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5948] madvise(0x7f019d71e000, 8372224, MADV_DONTNEED) = 0
[pid  5948] exit(0)                     = ?
[pid  5948] +++ exited with 0 +++
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019bf1a990, parent_tid=0x7f019bf1a990, exit_signal=0, stack=0x7f019b71a000, stack_size=0x8002c0, tls=0x7f019bf1a6c0}/strace: Process 5958 attached
 => {parent_tid=[5958]}, 88) = 5958
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5958] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5958] <... rseq resumed>)         = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5958] set_robust_list(0x7f019bf1a9a0, 24 <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019af19000
[pid  5958] <... set_robust_list resumed>) = 0
[pid  5958] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mprotect(0x7f019af1a000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5958] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 4
[pid  5858] <... mprotect resumed>)     = 0
[pid  5958] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[   75.808142][ T5893] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[   75.812545][ T5950] nvme nvme2: creating 2 I/O queues.
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019b719990, parent_tid=0x7f019b719990, exit_signal=0, stack=0x7f019af19000, stack_size=0x8002c0, tls=0x7f019b7196c0}/strace: Process 5959 attached
 => {parent_tid=[5959]}, 88) = 5959
[pid  5959] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5959] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] futex(0x7f019e71f990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5950, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5959] set_robust_list(0x7f019b7199a0, 24) = 0
[   75.820465][ T5950] nvme nvme2: new ctrl: "testnqn"
[pid  5959] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5959] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5950] <... write resumed>)        = 26
[pid  5950] close(5 <unfinished ...>
[pid  5959] <... openat resumed>)       = 10
[pid  5959] write(10, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5950] <... close resumed>)        = 0
[pid  5950] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5950] madvise(0x7f019df1f000, 8372224, MADV_DONTNEED) = 0
[pid  5950] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5950] +++ exited with 0 +++
[   75.860997][ T5884] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   75.861886][ T5951] nvme nvme3: creating 2 I/O queues.
[pid  5858] futex(0x7f019ef20990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5951, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5951] <... write resumed>)        = 26
[   75.870026][ T5951] nvme nvme3: new ctrl: "testnqn"
[pid  5951] close(6)                    = 0
[pid  5951] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5951] madvise(0x7f019e720000, 8372224, MADV_DONTNEED) = 0
[pid  5951] exit(0)                     = ?
[pid  5951] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] futex(0x7f019ff22990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5952, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5952] <... write resumed>)        = 26
[   75.903492][ T5884] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   75.904500][ T5952] nvme nvme4: creating 2 I/O queues.
[   75.907186][ T5952] nvme nvme4: new ctrl: "testnqn"
[pid  5952] close(3)                    = 0
[pid  5952] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5952] madvise(0x7f019f722000, 8372224, MADV_DONTNEED) = 0
[pid  5952] exit(0)                     = ?
[pid  5952] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019cf1d000, 8392704) = 0
[   75.947665][ T5884] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   75.948419][ T5954] nvme nvme5: creating 2 I/O queues.
[   75.951075][ T5954] nvme nvme5: new ctrl: "testnqn"
[pid  5858] futex(0x7f019f721990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5954, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5954] <... write resumed>)        = 26
[pid  5954] close(7)                    = 0
[pid  5954] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5954] madvise(0x7f019ef21000, 8372224, MADV_DONTNEED) = 0
[pid  5954] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5954] +++ exited with 0 +++
[pid  5858] munmap(0x7f019d71e000, 8392704) = 0
[pid  5858] futex(0x7f019cf1c990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5955, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5955] <... write resumed>)        = 26
[pid  5955] close(8)                    = 0
[   75.983611][   T95] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   75.984492][ T5955] nvme nvme6: creating 2 I/O queues.
[   75.987144][ T5955] nvme nvme6: new ctrl: "testnqn"
[pid  5955] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5955] madvise(0x7f019c71c000, 8372224, MADV_DONTNEED) = 0
[pid  5955] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5955] +++ exited with 0 +++
[pid  5858] munmap(0x7f019df1f000, 8392704) = 0
[   76.021216][   T31] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   76.024839][ T5956] nvme nvme7: creating 2 I/O queues.
[   76.028240][ T5956] nvme nvme7: new ctrl: "testnqn"
[pid  5858] futex(0x7f019c71b990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5956, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5956] <... write resumed>)        = 26
[pid  5956] close(9)                    = 0
[pid  5956] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5956] madvise(0x7f019bf1b000, 8372224, MADV_DONTNEED) = 0
[pid  5956] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5956] +++ exited with 0 +++
[pid  5858] munmap(0x7f019e720000, 8392704) = 0
[   76.060140][ T5884] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   76.060953][ T5958] nvme nvme8: creating 2 I/O queues.
[pid  5858] futex(0x7f019bf1a990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5958, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5958] <... write resumed>)        = 26
[   76.070104][ T5958] nvme nvme8: new ctrl: "testnqn"
[pid  5958] close(4)                    = 0
[pid  5958] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5958] madvise(0x7f019b71a000, 8372224, MADV_DONTNEED) = 0
[pid  5958] exit(0)                     = ?
[pid  5958] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019f722000, 8392704) = 0
[pid  5858] futex(0x7f019b719990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5959, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5959] <... write resumed>)        = 26
[pid  5959] close(10)                   = 0
[pid  5959] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   76.102704][   T87] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   76.103576][ T5959] nvme nvme9: creating 2 I/O queues.
[   76.106332][ T5959] nvme nvme9: new ctrl: "testnqn"
[pid  5959] madvise(0x7f019af19000, 8372224, MADV_DONTNEED) = 0
[pid  5959] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5959] +++ exited with 0 +++
munmap(0x7f019ef21000, 8392704)         = 0
openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents64(3, 0x555593c2f2e0 /* 12 entries */, 32768) = 368
openat(AT_FDCWD, "/sys/class/nvme/nvme7/delete_controller", O_WRONLY) = 4
[   76.137617][ T5858] nvme nvme7: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY) = 4
[   76.474314][ T5858] nvme nvme5: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   76.725356][ T5858] nvme nvme3: Removing ctrl: NQN "testnqn"
[   76.816147][ T1288] cfg80211: failed to load regulatory.db
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 4
[   76.956075][ T5858] nvme nvme1: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   77.257168][ T5858] nvme nvme8: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   77.554608][ T5858] nvme nvme6: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[   77.805149][ T5858] nvme nvme4: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   78.077088][ T5858] nvme nvme2: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme0/delete_controller", O_WRONLY) = 4
[   78.358042][ T5858] nvme nvme0: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 4
[   78.626365][ T5858] nvme nvme9: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
getdents64(3, 0x555593c2f2e0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019b719990, parent_tid=0x7f019b719990, exit_signal=0, stack=0x7f019af19000, stack_size=0x8002c0, tls=0x7f019b7196c0}/strace: Process 5967 attached
 => {parent_tid=[5967]}, 88) = 5967
[pid  5967] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5967] set_robust_list(0x7f019b7199a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5967] <... set_robust_list resumed>) = 0
[pid  5967] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5967] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5967] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019bf1a990, parent_tid=0x7f019bf1a990, exit_signal=0, stack=0x7f019b71a000, stack_size=0x8002c0, tls=0x7f019bf1a6c0} <unfinished ...>
[pid  5967] <... openat resumed>)       = 3
/strace: Process 5968 attached
[pid  5967] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5968]}, 88) = 5968
[pid  5968] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5968] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5968] set_robust_list(0x7f019bf1a9a0, 24 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5968] <... set_robust_list resumed>) = 0
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5968] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019c71b990, parent_tid=0x7f019c71b990, exit_signal=0, stack=0x7f019bf1b000, stack_size=0x8002c0, tls=0x7f019c71b6c0} <unfinished ...>
[pid  5968] <... rt_sigprocmask resumed>, NULL, 8) = 0
/strace: Process 5969 attached
[pid  5968] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5969]}, 88) = 5969
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5969] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5968] <... openat resumed>)       = 4
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019cf1c990, parent_tid=0x7f019cf1c990, exit_signal=0, stack=0x7f019c71c000, stack_size=0x8002c0, tls=0x7f019cf1c6c0} <unfinished ...>
[pid  5969] <... rseq resumed>)         = 0
[pid  5968] write(4, "nqn=testnqn,transport=loop", 26/strace: Process 5971 attached
 <unfinished ...>
[pid  5969] set_robust_list(0x7f019c71b9a0, 24 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5971]}, 88) = 5971
[pid  5971] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5971] <... rseq resumed>)         = 0
[pid  5969] <... set_robust_list resumed>) = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5971] set_robust_list(0x7f019cf1c9a0, 24 <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5969] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019f722000
[pid  5971] <... set_robust_list resumed>) = 0
[pid  5969] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mprotect(0x7f019f723000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5971] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5969] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5971] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5971] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5971] <... openat resumed>)       = 6
[pid  5969] <... openat resumed>)       = 5
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ff22990, parent_tid=0x7f019ff22990, exit_signal=0, stack=0x7f019f722000, stack_size=0x8002c0, tls=0x7f019ff226c0}/strace: Process 5972 attached
 <unfinished ...>
[pid  5971] write(6, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5972]}, 88) = 5972
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019ef21000
[pid  5858] mprotect(0x7f019ef22000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5972] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5969] write(5, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5972] <... rseq resumed>)         = 0
[pid  5972] set_robust_list(0x7f019ff229a0, 24 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5972] <... set_robust_list resumed>) = 0
[pid  5972] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019f721990, parent_tid=0x7f019f721990, exit_signal=0, stack=0x7f019ef21000, stack_size=0x8002c0, tls=0x7f019f7216c0} <unfinished ...>
[pid  5972] <... rt_sigprocmask resumed>, NULL, 8) = 0
/strace: Process 5973 attached
[pid  5972] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5973]}, 88) = 5973
[pid  5973] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5972] <... openat resumed>)       = 7
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5973] <... rseq resumed>)         = 0
[pid  5972] write(7, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5973] set_robust_list(0x7f019f7219a0, 24 <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019e720000
[pid  5973] <... set_robust_list resumed>) = 0
[pid  5858] mprotect(0x7f019e721000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5973] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5973] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5973] <... openat resumed>)       = 8
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ef20990, parent_tid=0x7f019ef20990, exit_signal=0, stack=0x7f019e720000, stack_size=0x8002c0, tls=0x7f019ef206c0} <unfinished ...>
[pid  5973] write(8, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5974]}, 88) = 5974
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019df1f000
[pid  5858] mprotect(0x7f019df20000, 8388608, PROT_READ|PROT_WRITE/strace: Process 5974 attached
) = 0
[pid  5974] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5974] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5974] set_robust_list(0x7f019ef209a0, 24 <unfinished ...>
[pid  5967] <... write resumed>)        = 26
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019e71f990, parent_tid=0x7f019e71f990, exit_signal=0, stack=0x7f019df1f000, stack_size=0x8002c0, tls=0x7f019e71f6c0}/strace: Process 5976 attached
 <unfinished ...>
[pid  5976] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[   78.995733][ T1037] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   78.997717][ T5967] nvme nvme0: creating 2 I/O queues.
[   78.998814][ T5967] nvme nvme0: new ctrl: "testnqn"
[pid  5967] close(3 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5976]}, 88) = 5976
[pid  5976] <... rseq resumed>)         = 0
[pid  5974] <... set_robust_list resumed>) = 0
[pid  5967] <... close resumed>)        = 0
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5976] set_robust_list(0x7f019e71f9a0, 24 <unfinished ...>
[pid  5974] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5976] <... set_robust_list resumed>) = 0
[pid  5974] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5967] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  5974] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5967] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5976] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5974] <... openat resumed>)       = 3
[pid  5967] madvise(0x7f019af19000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  5974] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5967] <... madvise resumed>)      = 0
[pid  5858] <... mmap resumed>)         = 0x7f019d71e000
[pid  5976] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5967] exit(0 <unfinished ...>
[pid  5858] mprotect(0x7f019d71f000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5976] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5967] <... exit resumed>)         = ?
[pid  5858] <... mprotect resumed>)     = 0
[pid  5976] <... openat resumed>)       = 9
[pid  5967] +++ exited with 0 +++
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5976] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019df1e990, parent_tid=0x7f019df1e990, exit_signal=0, stack=0x7f019d71e000, stack_size=0x8002c0, tls=0x7f019df1e6c0} => {parent_tid=[5977]}, 88) = 5977
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019cf1d000
/strace: Process 5977 attached
[pid  5858] mprotect(0x7f019cf1e000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5977] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5977] <... rseq resumed>)         = 0
[pid  5977] set_robust_list(0x7f019df1e9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5977] <... set_robust_list resumed>) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019d71d990, parent_tid=0x7f019d71d990, exit_signal=0, stack=0x7f019cf1d000, stack_size=0x8002c0, tls=0x7f019d71d6c0} <unfinished ...>
[pid  5977] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
/strace: Process 5978 attached
[pid  5977] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5978]}, 88) = 5978
[pid  5978] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5977] <... openat resumed>)       = 10
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] futex(0x7f019bf1a990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5968, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5977] write(10, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5978] <... rseq resumed>)         = 0
[pid  5978] set_robust_list(0x7f019d71d9a0, 24) = 0
[pid  5978] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5978] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 11
[   79.038601][ T5893] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.041355][ T5968] nvme nvme1: creating 2 I/O queues.
[   79.047935][ T5968] nvme nvme1: new ctrl: "testnqn"
[pid  5978] write(11, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5968] <... write resumed>)        = 26
[pid  5968] close(4)                    = 0
[pid  5968] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5968] madvise(0x7f019b71a000, 8372224, MADV_DONTNEED) = 0
[pid  5968] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5968] +++ exited with 0 +++
[pid  5858] futex(0x7f019c71b990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5969, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5971] <... write resumed>)        = 26
[   79.077903][ T1037] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.078649][ T5971] nvme nvme2: creating 2 I/O queues.
[   79.080453][ T5971] nvme nvme2: new ctrl: "testnqn"
[pid  5971] close(6)                    = 0
[pid  5971] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5971] madvise(0x7f019c71c000, 8372224, MADV_DONTNEED) = 0
[pid  5971] exit(0)                     = ?
[pid  5971] +++ exited with 0 +++
[   79.119563][   T27] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.120374][ T5969] nvme nvme3: creating 2 I/O queues.
[   79.129066][ T5969] nvme nvme3: new ctrl: "testnqn"
[pid  5969] <... write resumed>)        = 26
[pid  5969] close(5)                    = 0
[pid  5969] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5969] madvise(0x7f019bf1b000, 8372224, MADV_DONTNEED) = 0
[pid  5969] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5969] +++ exited with 0 +++
[   79.171200][ T1037] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.176784][ T5972] nvme nvme4: creating 2 I/O queues.
[   79.178881][ T5972] nvme nvme4: new ctrl: "testnqn"
[pid  5858] futex(0x7f019ff22990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5972, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5972] <... write resumed>)        = 26
[pid  5972] close(7)                    = 0
[pid  5972] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5972] madvise(0x7f019f722000, 8372224, MADV_DONTNEED) = 0
[pid  5972] exit(0)                     = ?
[pid  5972] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019af19000, 8392704) = 0
[   79.229466][   T65] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.230520][ T5973] nvme nvme5: creating 2 I/O queues.
[   79.237277][ T5973] nvme nvme5: new ctrl: "testnqn"
[pid  5858] futex(0x7f019f721990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5973, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5973] <... write resumed>)        = 26
[pid  5973] close(8)                    = 0
[pid  5973] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5973] madvise(0x7f019ef21000, 8372224, MADV_DONTNEED) = 0
[pid  5973] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5973] +++ exited with 0 +++
[pid  5858] munmap(0x7f019b71a000, 8392704) = 0
[pid  5858] futex(0x7f019ef20990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5974, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5974] <... write resumed>)        = 26
[pid  5974] close(3)                    = 0
[   79.264391][ T5884] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.265244][ T5974] nvme nvme6: creating 2 I/O queues.
[   79.268087][ T5974] nvme nvme6: new ctrl: "testnqn"
[pid  5974] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5974] madvise(0x7f019e720000, 8372224, MADV_DONTNEED) = 0
[pid  5974] exit(0)                     = ?
[pid  5974] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019bf1b000, 8392704) = 0
[pid  5858] futex(0x7f019e71f990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5976, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5976] <... write resumed>)        = 26
[   79.314409][ T5893] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.315287][ T5976] nvme nvme7: creating 2 I/O queues.
[   79.318570][ T5976] nvme nvme7: new ctrl: "testnqn"
[pid  5976] close(9)                    = 0
[pid  5976] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5976] madvise(0x7f019df1f000, 8372224, MADV_DONTNEED) = 0
[pid  5976] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5976] +++ exited with 0 +++
[   79.349241][   T87] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.349978][ T5977] nvme nvme8: creating 2 I/O queues.
[pid  5858] munmap(0x7f019c71c000, 8392704) = 0
[pid  5858] futex(0x7f019df1e990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5977, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5977] <... write resumed>)        = 26
[   79.358739][ T5977] nvme nvme8: new ctrl: "testnqn"
[pid  5977] close(10)                   = 0
[pid  5977] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5977] madvise(0x7f019d71e000, 8372224, MADV_DONTNEED) = 0
[pid  5977] exit(0)                     = ?
[pid  5977] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019f722000, 8392704) = 0
[pid  5858] futex(0x7f019d71d990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5978, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5978] <... write resumed>)        = 26
[   79.388087][   T87] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   79.388800][ T5978] nvme nvme9: creating 2 I/O queues.
[   79.389890][ T5978] nvme nvme9: new ctrl: "testnqn"
[pid  5978] close(11)                   = 0
[pid  5978] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5978] madvise(0x7f019cf1d000, 8372224, MADV_DONTNEED) = 0
[pid  5978] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019ef21000, 8392704) = 0
[pid  5858] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  5978] +++ exited with 0 +++
<... openat resumed>)                   = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents64(3, 0x555593c2f2e0 /* 12 entries */, 32768) = 368
openat(AT_FDCWD, "/sys/class/nvme/nvme7/delete_controller", O_WRONLY) = 4
[   79.443852][ T5858] nvme nvme7: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY) = 4
[   79.734552][ T5858] nvme nvme5: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   80.037494][ T5858] nvme nvme3: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 4
[   80.295690][ T5858] nvme nvme1: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   80.566768][ T5858] nvme nvme8: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   80.836365][ T5858] nvme nvme6: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[   81.086326][ T5858] nvme nvme4: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   81.357207][ T5858] nvme nvme2: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme0/delete_controller", O_WRONLY) = 4
[   81.644208][ T5858] nvme nvme0: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 4
[   81.887010][ T5858] nvme nvme9: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
getdents64(3, 0x555593c2f2e0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019d71d990, parent_tid=0x7f019d71d990, exit_signal=0, stack=0x7f019cf1d000, stack_size=0x8002c0, tls=0x7f019d71d6c0}/strace: Process 5988 attached
 => {parent_tid=[5988]}, 88) = 5988
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5988] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5988] <... rseq resumed>)         = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5988] set_robust_list(0x7f019d71d9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5988] <... set_robust_list resumed>) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019df1e990, parent_tid=0x7f019df1e990, exit_signal=0, stack=0x7f019d71e000, stack_size=0x8002c0, tls=0x7f019df1e6c0} <unfinished ...>
[pid  5988] rt_sigprocmask(SIG_SETMASK, []/strace: Process 5989 attached
, NULL, 8) = 0
[pid  5858] <... clone3 resumed> => {parent_tid=[5989]}, 88) = 5989
[pid  5988] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5989] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5988] <... openat resumed>)       = 3
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5989] <... rseq resumed>)         = 0
[pid  5989] set_robust_list(0x7f019df1e9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5989] <... set_robust_list resumed>) = 0
[pid  5988] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5989] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019e71f990, parent_tid=0x7f019e71f990, exit_signal=0, stack=0x7f019df1f000, stack_size=0x8002c0, tls=0x7f019e71f6c0} <unfinished ...>
[pid  5989] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5989] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 4
[pid  5989] write(4, "nqn=testnqn,transport=loop", 26/strace: Process 5990 attached
 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5990]}, 88) = 5990
[pid  5990] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[   82.232530][   T65] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.233788][ T5988] nvme nvme0: creating 2 I/O queues.
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ef20990, parent_tid=0x7f019ef20990, exit_signal=0, stack=0x7f019e720000, stack_size=0x8002c0, tls=0x7f019ef206c0}/strace: Process 5992 attached
 <unfinished ...>
[pid  5990] <... rseq resumed>)         = 0
[pid  5988] <... write resumed>)        = 26
[pid  5990] set_robust_list(0x7f019e71f9a0, 24) = 0
[pid  5990] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5990] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5992]}, 88) = 5992
[pid  5990] <... openat resumed>)       = 5
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5992] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5990] write(5, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5992] <... rseq resumed>)         = 0
[pid  5858] <... mmap resumed>)         = 0x7f019f722000
[pid  5992] set_robust_list(0x7f019ef209a0, 24 <unfinished ...>
[pid  5858] mprotect(0x7f019f723000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5992] <... set_robust_list resumed>) = 0
[pid  5858] <... mprotect resumed>)     = 0
[pid  5992] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5992] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5992] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 6
[pid  5988] close(3 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019ff22990, parent_tid=0x7f019ff22990, exit_signal=0, stack=0x7f019f722000, stack_size=0x8002c0, tls=0x7f019ff226c0}/strace: Process 5994 attached
[   82.237440][ T5988] nvme nvme0: new ctrl: "testnqn"
 => {parent_tid=[5994]}, 88) = 5994
[pid  5992] write(6, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5988] <... close resumed>)        = 0
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f019ef21000
[pid  5994] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5988] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  5858] mprotect(0x7f019ef22000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5994] <... rseq resumed>)         = 0
[pid  5858] <... mprotect resumed>)     = 0
[pid  5994] set_robust_list(0x7f019ff229a0, 24) = 0
[pid  5994] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5994] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5994] <... openat resumed>)       = 3
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019f721990, parent_tid=0x7f019f721990, exit_signal=0, stack=0x7f019ef21000, stack_size=0x8002c0, tls=0x7f019f7216c0} <unfinished ...>
[pid  5994] write(3, "nqn=testnqn,transport=loop", 26/strace: Process 5995 attached
 <unfinished ...>
[pid  5988] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] <... clone3 resumed> => {parent_tid=[5995]}, 88) = 5995
[pid  5995] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5988] madvise(0x7f019cf1d000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5995] <... rseq resumed>)         = 0
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5995] set_robust_list(0x7f019f7219a0, 24 <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5995] <... set_robust_list resumed>) = 0
[pid  5858] <... mmap resumed>)         = 0x7f019c71c000
[pid  5995] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5988] <... madvise resumed>)      = 0
[pid  5858] mprotect(0x7f019c71d000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5995] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] <... mprotect resumed>)     = 0
[pid  5995] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5995] <... openat resumed>)       = 7
[pid  5988] exit(0 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5995] write(7, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019cf1c990, parent_tid=0x7f019cf1c990, exit_signal=0, stack=0x7f019c71c000, stack_size=0x8002c0, tls=0x7f019cf1c6c0} <unfinished ...>
[pid  5988] <... exit resumed>)         = ?
/strace: Process 5996 attached
[   82.273667][   T65] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.274694][ T5989] nvme nvme1: creating 2 I/O queues.
[pid  5858] <... clone3 resumed> => {parent_tid=[5996]}, 88) = 5996
[pid  5988] +++ exited with 0 +++
[pid  5996] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5996] <... rseq resumed>)         = 0
[pid  5996] set_robust_list(0x7f019cf1c9a0, 24) = 0
[pid  5996] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5996] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019bf1b000
[pid  5996] <... openat resumed>)       = 8
[pid  5858] mprotect(0x7f019bf1c000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5996] write(8, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019c71b990, parent_tid=0x7f019c71b990, exit_signal=0, stack=0x7f019bf1b000, stack_size=0x8002c0, tls=0x7f019c71b6c0}/strace: Process 5997 attached
 <unfinished ...>
[pid  5989] <... write resumed>)        = 26
[   82.285346][ T5989] nvme nvme1: new ctrl: "testnqn"
[pid  5989] close(4 <unfinished ...>
[pid  5858] <... clone3 resumed> => {parent_tid=[5997]}, 88) = 5997
[pid  5989] <... close resumed>)        = 0
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5997] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5997] <... rseq resumed>)         = 0
[pid  5989] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  5989] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5997] set_robust_list(0x7f019c71b9a0, 24 <unfinished ...>
[pid  5989] madvise(0x7f019d71e000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  5858] <... mmap resumed>)         = 0x7f019b71a000
[pid  5997] <... set_robust_list resumed>) = 0
[pid  5997] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5989] <... madvise resumed>)      = 0
[pid  5997] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  5989] exit(0 <unfinished ...>
[pid  5858] mprotect(0x7f019b71b000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5989] <... exit resumed>)         = ?
[pid  5997] <... openat resumed>)       = 4
[pid  5989] +++ exited with 0 +++
[pid  5858] <... mprotect resumed>)     = 0
[pid  5997] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019bf1a990, parent_tid=0x7f019bf1a990, exit_signal=0, stack=0x7f019b71a000, stack_size=0x8002c0, tls=0x7f019bf1a6c0} => {parent_tid=[5999]}, 88) = 5999
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0/strace: Process 5999 attached
) = 0x7f019af19000
[pid  5858] mprotect(0x7f019af1a000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5999] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5999] <... rseq resumed>)         = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5999] set_robust_list(0x7f019bf1a9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5999] <... set_robust_list resumed>) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019b719990, parent_tid=0x7f019b719990, exit_signal=0, stack=0x7f019af19000, stack_size=0x8002c0, tls=0x7f019b7196c0} <unfinished ...>
[pid  5999] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] <... clone3 resumed> => {parent_tid=[6000]}, 88) = 6000
/strace: Process 6000 attached
[pid  5999] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6000] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5999] <... openat resumed>)       = 9
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5999] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] futex(0x7f019e71f990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5990, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6000] <... rseq resumed>)         = 0
[pid  6000] set_robust_list(0x7f019b7199a0, 24) = 0
[pid  6000] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  6000] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 10
[   82.318649][ T5893] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.320865][ T5990] nvme nvme2: creating 2 I/O queues.
[   82.326994][ T5990] nvme nvme2: new ctrl: "testnqn"
[pid  6000] write(10, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5990] <... write resumed>)        = 26
[pid  5990] close(5)                    = 0
[pid  5990] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5990] madvise(0x7f019df1f000, 8372224, MADV_DONTNEED) = 0
[pid  5990] exit(0)                     = ?
[pid  5990] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[   82.361606][ T5893] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.364013][ T5992] nvme nvme3: creating 2 I/O queues.
[pid  5858] futex(0x7f019ef20990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5992, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5992] <... write resumed>)        = 26
[pid  5992] close(6)                    = 0
[pid  5992] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   82.368623][ T5992] nvme nvme3: new ctrl: "testnqn"
[pid  5992] madvise(0x7f019e720000, 8372224, MADV_DONTNEED) = 0
[pid  5992] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5992] +++ exited with 0 +++
[   82.400401][ T5893] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.404276][ T5994] nvme nvme4: creating 2 I/O queues.
[   82.408457][ T5994] nvme nvme4: new ctrl: "testnqn"
[pid  5858] futex(0x7f019ff22990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5994, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5994] <... write resumed>)        = 26
[pid  5994] close(3)                    = 0
[pid  5994] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5994] madvise(0x7f019f722000, 8372224, MADV_DONTNEED) = 0
[pid  5994] exit(0)                     = ?
[pid  5994] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019cf1d000, 8392704) = 0
[   82.441063][   T31] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.441797][ T5995] nvme nvme5: creating 2 I/O queues.
[   82.446763][ T5995] nvme nvme5: new ctrl: "testnqn"
[pid  5858] futex(0x7f019f721990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5995, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5995] <... write resumed>)        = 26
[pid  5995] close(7)                    = 0
[pid  5995] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5995] madvise(0x7f019ef21000, 8372224, MADV_DONTNEED) = 0
[pid  5995] exit(0)                     = ?
[pid  5995] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019d71e000, 8392704) = 0
[   82.480634][   T27] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.481370][ T5996] nvme nvme6: creating 2 I/O queues.
[   82.486581][ T5996] nvme nvme6: new ctrl: "testnqn"
[pid  5858] futex(0x7f019cf1c990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5996, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5996] <... write resumed>)        = 26
[pid  5996] close(8)                    = 0
[pid  5996] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5996] madvise(0x7f019c71c000, 8372224, MADV_DONTNEED) = 0
[pid  5996] exit(0)                     = ?
[pid  5996] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019df1f000, 8392704) = 0
[   82.515609][   T95] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] futex(0x7f019c71b990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5997, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5997] <... write resumed>)        = 26
[   82.516334][ T5997] nvme nvme7: creating 2 I/O queues.
[   82.518969][ T5997] nvme nvme7: new ctrl: "testnqn"
[pid  5997] close(4)                    = 0
[pid  5997] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5997] madvise(0x7f019bf1b000, 8372224, MADV_DONTNEED) = 0
[pid  5997] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5997] +++ exited with 0 +++
[pid  5858] munmap(0x7f019e720000, 8392704) = 0
[pid  5858] futex(0x7f019bf1a990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5999, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5999] <... write resumed>)        = 26
[pid  5999] close(9)                    = 0
[pid  5999] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   82.552974][   T63] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5999] madvise(0x7f019b71a000, 8372224, MADV_DONTNEED) = 0
[   82.553822][ T5999] nvme nvme8: creating 2 I/O queues.
[   82.556410][ T5999] nvme nvme8: new ctrl: "testnqn"
[pid  5999] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5999] +++ exited with 0 +++
[pid  5858] munmap(0x7f019f722000, 8392704) = 0
[   82.587580][   T65] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.589160][ T6000] nvme nvme9: creating 2 I/O queues.
[   82.591782][ T6000] nvme nvme9: new ctrl: "testnqn"
[pid  5858] futex(0x7f019b719990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6000, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6000] <... write resumed>)        = 26
[pid  6000] close(10)                   = 0
[pid  6000] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6000] madvise(0x7f019af19000, 8372224, MADV_DONTNEED) = 0
[pid  6000] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019ef21000, 8392704) = 0
[pid  5858] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid  5858] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  5858] getdents64(3 <unfinished ...>
[pid  6000] +++ exited with 0 +++
<... getdents64 resumed>, 0x555593c2f2e0 /* 12 entries */, 32768) = 368
openat(AT_FDCWD, "/sys/class/nvme/nvme7/delete_controller", O_WRONLY) = 4
[   82.636204][ T5858] nvme nvme7: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY) = 4
[   82.875910][ T5858] nvme nvme5: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   83.133849][ T5858] nvme nvme3: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 4
[   83.406560][ T5858] nvme nvme1: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   83.703883][ T5858] nvme nvme8: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   83.983546][ T5858] nvme nvme6: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[   84.246055][ T5858] nvme nvme4: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   84.524239][ T5858] nvme nvme2: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme0/delete_controller", O_WRONLY) = 4
[   84.823812][ T5858] nvme nvme0: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 4
[   85.105349][ T5858] nvme nvme9: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
getdents64(3, 0x555593c2f2e0 /* 0 entries */, 32768) = 0
close(3)                                = 0
[   85.457777][   T35] audit: type=1400 audit(1790187252.846:272): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="/" dev="configfs" ino=1108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.457804][   T35] audit: type=1400 audit(1790187252.846:273): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="nvmet" dev="configfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") = 0
[   85.457820][   T35] audit: type=1400 audit(1790187252.846:274): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="ports" dev="configfs" ino=1567 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.457836][   T35] audit: type=1400 audit(1790187252.846:275): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="1" dev="configfs" ino=8820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
rmdir("/sys/kernel/config/nvmet/ports/1") = 0
[   85.457851][   T35] audit: type=1400 audit(1790187252.846:276): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=8821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY) = 3
[   85.457867][   T35] audit: type=1400 audit(1790187252.846:277): avc:  denied  { write search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=8821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.458388][   T35] audit: type=1400 audit(1790187252.846:278): avc:  denied  { remove_name } for  pid=5858 comm="syz-executor409" name="testnqn" dev="configfs" ino=8826 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.458615][   T35] audit: type=1400 audit(1790187252.846:279): avc:  denied  { unlink } for  pid=5858 comm="syz-executor409" name="testnqn" dev="configfs" ino=8826 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   85.498319][   T35] audit: type=1400 audit(1790187252.886:280): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="/" dev="configfs" ino=1108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
write(3, "0", 1)                        = 1
[   85.498346][   T35] audit: type=1400 audit(1790187252.886:281): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="nvmet" dev="configfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
close(3)                                = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1") = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn") = 0
unlink("/tmp/nvme_backing")             = 0
write(1, "[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.\n[+] write to /sys/kernel/config/nv"..., 683) = 683
exit_group(0)                           = ?
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host successful.
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 successful.
[+] /tmp/nvme_backing created successfully.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable successful.
[+] mkdir /sys/kernel/config/nvmet/ports/1 successful.
[+] write to /sys/kernel/config/nvmet/ports/1/addr_trtype successful.
[+] symlink successful.
[*] Starting concurrent NVMe multipath connections...
[*] Cleaning up...
+++ exited with 0 +++
 TestError:]

map[TruncatedConsoleOutput:[   68.885199][   T34] audit: type=1400 audit(1790187136.096:265): avc:  denied  { write } for  pid=5894 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.063166][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   69.323757][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   69.574591][   T34] audit: type=1400 audit(1790187136.776:266): avc:  denied  { write } for  pid=5897 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.603028][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   69.626235][   T34] audit: type=1400 audit(1790187136.836:267): avc:  denied  { write } for  pid=5900 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.955861][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   70.234190][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   70.491886][   T34] audit: type=1400 audit(1790187137.696:268): avc:  denied  { write } for  pid=5903 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.523141][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   70.539632][   T34] audit: type=1400 audit(1790187137.746:269): avc:  denied  { write } for  pid=5906 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.756710][   T35] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.757819][ T5909] nvme nvme0: creating 2 I/O queues.
[   70.758926][ T5909] nvme nvme0: new ctrl: "testnqn"
[   70.809616][ T1243] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.811773][ T5910] nvme nvme1: creating 2 I/O queues.
[   70.828877][ T5910] nvme nvme1: new ctrl: "testnqn"
[   70.851270][   T34] audit: type=1400 audit(1790187138.056:270): avc:  denied  { write } for  pid=5921 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.867765][ T5878] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.868481][ T5911] nvme nvme2: creating 2 I/O queues.
[   70.871877][ T5911] nvme nvme2: new ctrl: "testnqn"
[   70.923323][   T29] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.924093][ T5913] nvme nvme3: creating 2 I/O queues.
[   70.926828][ T5913] nvme nvme3: new ctrl: "testnqn"
[   70.927190][   T34] audit: type=1400 audit(1790187138.136:271): avc:  denied  { write } for  pid=5926 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.981819][   T64] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.984145][ T5914] nvme nvme4: creating 2 I/O queues.
[   70.992012][ T5914] nvme nvme4: new ctrl: "testnqn"
[   71.031722][ T5876] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.033384][ T5915] nvme nvme5: creating 2 I/O queues.
[   71.047005][ T5915] nvme nvme5: new ctrl: "testnqn"
[   71.077511][ T1527] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.078288][ T5917] nvme nvme6: creating 2 I/O queues.
[   71.081131][ T5917] nvme nvme6: new ctrl: "testnqn"
[   71.121703][ T5878] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.124026][ T5916] nvme nvme7: creating 2 I/O queues.
[   71.130399][ T5916] nvme nvme7: new ctrl: "testnqn"
[   71.157327][   T94] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.158042][ T5919] nvme nvme8: creating 2 I/O queues.
[   71.161992][ T5919] nvme nvme8: new ctrl: "testnqn"
[   71.207927][   T27] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.209697][ T5918] nvme nvme9: creating 2 I/O queues.
[   71.218334][ T5918] nvme nvme9: new ctrl: "testnqn"
[   71.224785][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   71.493352][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   71.704792][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.704832][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   71.803535][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   72.093600][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   72.333098][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   72.613212][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   72.863049][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   73.133049][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   73.403388][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   73.663146][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   73.965693][   T94] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   73.967039][ T5936] nvme nvme0: creating 2 I/O queues.
[   73.968092][ T5936] nvme nvme0: new ctrl: "testnqn"
[   73.998981][   T28] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.001325][ T5937] nvme nvme1: creating 2 I/O queues.
[   74.012413][ T5937] nvme nvme1: new ctrl: "testnqn"
[   74.046647][   T64] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.047459][ T5938] nvme nvme2: creating 2 I/O queues.
[   74.048561][ T5938] nvme nvme2: new ctrl: "testnqn"
[   74.078181][ T5878] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.078967][ T5939] nvme nvme3: creating 2 I/O queues.
[   74.081636][ T5939] nvme nvme3: new ctrl: "testnqn"
[   74.114228][   T35] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.114890][ T5941] nvme nvme4: creating 2 I/O queues.
[   74.117575][ T5941] nvme nvme4: new ctrl: "testnqn"
[   74.154883][   T94] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.155672][ T5942] nvme nvme5: creating 2 I/O queues.
[   74.158332][ T5942] nvme nvme5: new ctrl: "testnqn"
[   74.188116][   T27] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.188817][ T5943] nvme nvme6: creating 2 I/O queues.
[   74.191792][ T5943] nvme nvme6: new ctrl: "testnqn"
[   74.222244][ T1108] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.223143][ T5944] nvme nvme7: creating 2 I/O queues.
[   74.225780][ T5944] nvme nvme7: new ctrl: "testnqn"
[   74.253028][   T64] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.254543][ T5945] nvme nvme8: creating 2 I/O queues.
[   74.256988][ T5945] nvme nvme8: new ctrl: "testnqn"
[   74.288601][   T27] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.289593][ T5946] nvme nvme9: creating 2 I/O queues.
[   74.292406][ T5946] nvme nvme9: new ctrl: "testnqn"
[   74.301427][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   74.573150][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   74.883545][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   75.153156][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   75.413275][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   75.663160][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   75.953110][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   76.213685][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   76.464220][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   76.713567][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   76.813263][   T33] cfg80211: failed to load regulatory.db
[   77.056009][   T64] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.057185][ T5956] nvme nvme0: creating 2 I/O queues.
[   77.059636][ T5956] nvme nvme0: new ctrl: "testnqn"
[   77.097038][   T94] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.098482][ T5957] nvme nvme1: creating 2 I/O queues.
[   77.099663][ T5957] nvme nvme1: new ctrl: "testnqn"
[   77.125894][   T27] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.128162][ T5958] nvme nvme2: creating 2 I/O queues.
[   77.131747][ T5958] nvme nvme2: new ctrl: "testnqn"
[   77.163029][ T5928] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.164317][ T5959] nvme nvme3: creating 2 I/O queues.
[   77.166498][ T5959] nvme nvme3: new ctrl: "testnqn"
[   77.192078][ T5928] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.199057][ T5961] nvme nvme4: creating 2 I/O queues.
[   77.201265][ T5961] nvme nvme4: new ctrl: "testnqn"
[   77.238409][ T5928] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.239613][ T5963] nvme nvme5: creating 2 I/O queues.
[   77.248882][ T5963] nvme nvme5: new ctrl: "testnqn"
[   77.278992][   T64] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.281054][ T5962] nvme nvme6: creating 2 I/O queues.
[   77.292068][ T5962] nvme nvme6: new ctrl: "testnqn"
[   77.323059][ T1527] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.323829][ T5964] nvme nvme7: creating 2 I/O queues.
[   77.326525][ T5964] nvme nvme7: new ctrl: "testnqn"
[   77.360258][ T2294] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.361133][ T5965] nvme nvme8: creating 2 I/O queues.
[   77.371128][ T5965] nvme nvme8: new ctrl: "testnqn"
[   77.393994][ T5970] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.394724][ T5966] nvme nvme9: creating 2 I/O queues.
[   77.397280][ T5966] nvme nvme9: new ctrl: "testnqn"
[   77.400090][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   77.663310][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   77.933439][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   78.213623][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   78.503903][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   78.763217][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   79.023138][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   79.283897][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   79.563126][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   79.844246][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   80.175163][   T84] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.176261][ T5977] nvme nvme0: creating 2 I/O queues.
[   80.178789][ T5977] nvme nvme0: new ctrl: "testnqn"
[   80.213918][ T5970] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.214599][ T5978] nvme nvme1: creating 2 I/O queues.
[   80.219619][ T5978] nvme nvme1: new ctrl: "testnqn"
[   80.253576][   T64] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.254329][ T5982] nvme nvme2: creating 2 I/O queues.
[   80.256136][ T5982] nvme nvme2: new ctrl: "testnqn"
[   80.304742][ T5928] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.305570][ T5979] nvme nvme3: creating 2 I/O queues.
[   80.308255][ T5979] nvme nvme3: new ctrl: "testnqn"
[   80.335121][ T5970] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.335873][ T5981] nvme nvme4: creating 2 I/O queues.
[   80.338438][ T5981] nvme nvme4: new ctrl: "testnqn"
[   80.374891][   T94] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.377074][ T5984] nvme nvme5: creating 2 I/O queues.
[   80.379788][ T5984] nvme nvme5: new ctrl: "testnqn"
[   80.413919][ T5928] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.414615][ T5983] nvme nvme6: creating 2 I/O queues.
[   80.420582][ T5983] nvme nvme6: new ctrl: "testnqn"
[   80.459803][   T27] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.461031][ T5985] nvme nvme7: creating 2 I/O queues.
[   80.473752][ T5985] nvme nvme7: new ctrl: "testnqn"
[   80.500453][   T94] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.502062][ T5986] nvme nvme8: creating 2 I/O queues.
[   80.506882][ T5986] nvme nvme8: new ctrl: "testnqn"
[   80.538817][ T5928] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.539805][ T5987] nvme nvme9: creating 2 I/O queues.
[   80.549393][ T5987] nvme nvme9: new ctrl: "testnqn"
[   80.551743][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   80.804846][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   81.054125][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   81.303601][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   81.563031][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   81.823824][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   82.063122][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   82.313129][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   82.543890][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   82.732381][   T94] nvme nvme0: long keepalive RTT (4294752936 ms)
[   82.732410][   T94] nvme nvme0: failed nvme_keep_alive_end_io error=4
[   82.823096][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   83.095273][   T34] audit: type=1400 audit(1790187150.306:272): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095379][   T34] audit: type=1400 audit(1790187150.306:273): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="nvmet" dev="configfs" ino=3602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095508][   T34] audit: type=1400 audit(1790187150.306:274): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="ports" dev="configfs" ino=3604 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095600][   T34] audit: type=1400 audit(1790187150.306:275): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="1" dev="configfs" ino=8313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095692][   T34] audit: type=1400 audit(1790187150.306:276): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="subsystems" dev="configfs" ino=8314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095931][   T34] audit: type=1400 audit(1790187150.306:277): avc:  denied  { write search } for  pid=5854 comm="syz-executor239" name="subsystems" dev="configfs" ino=8314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.096963][   T34] audit: type=1400 audit(1790187150.306:278): avc:  denied  { remove_name } for  pid=5854 comm="syz-executor239" name="testnqn" dev="configfs" ino=8319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.099255][   T34] audit: type=1400 audit(1790187150.306:279): avc:  denied  { unlink } for  pid=5854 comm="syz-executor239" name="testnqn" dev="configfs" ino=8319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   83.099277][   T34] audit: type=1400 audit(1790187150.306:280): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.099293][   T34] audit: type=1400 audit(1790187150.306:281): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="nvmet" dev="configfs" ino=3602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host successful.
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 successful.
[+] /tmp/nvme_backing created successfully.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable successful.
[+] mkdir /sys/kernel/config/nvmet/ports/1 successful.
[+] write to /sys/kernel/config/nvmet/ports/1/addr_trtype successful.
[+] symlink successful.
[*] Starting concurrent NVMe multipath connections...
[*] Cleaning up...
 TruncatedCrashReport: TruncatedStraceOutput:[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019bf1a990, parent_tid=0x7f019bf1a990, exit_signal=0, stack=0x7f019b71a000, stack_size=0x8002c0, tls=0x7f019bf1a6c0} => {parent_tid=[5999]}, 88) = 5999
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0/strace: Process 5999 attached
) = 0x7f019af19000
[pid  5858] mprotect(0x7f019af1a000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5999] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5999] <... rseq resumed>)         = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5999] set_robust_list(0x7f019bf1a9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5999] <... set_robust_list resumed>) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019b719990, parent_tid=0x7f019b719990, exit_signal=0, stack=0x7f019af19000, stack_size=0x8002c0, tls=0x7f019b7196c0} <unfinished ...>
[pid  5999] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] <... clone3 resumed> => {parent_tid=[6000]}, 88) = 6000
/strace: Process 6000 attached
[pid  5999] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6000] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5999] <... openat resumed>)       = 9
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5999] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] futex(0x7f019e71f990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5990, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6000] <... rseq resumed>)         = 0
[pid  6000] set_robust_list(0x7f019b7199a0, 24) = 0
[pid  6000] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  6000] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 10
[   82.318649][ T5893] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.320865][ T5990] nvme nvme2: creating 2 I/O queues.
[   82.326994][ T5990] nvme nvme2: new ctrl: "testnqn"
[pid  6000] write(10, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5990] <... write resumed>)        = 26
[pid  5990] close(5)                    = 0
[pid  5990] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5990] madvise(0x7f019df1f000, 8372224, MADV_DONTNEED) = 0
[pid  5990] exit(0)                     = ?
[pid  5990] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[   82.361606][ T5893] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.364013][ T5992] nvme nvme3: creating 2 I/O queues.
[pid  5858] futex(0x7f019ef20990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5992, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5992] <... write resumed>)        = 26
[pid  5992] close(6)                    = 0
[pid  5992] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   82.368623][ T5992] nvme nvme3: new ctrl: "testnqn"
[pid  5992] madvise(0x7f019e720000, 8372224, MADV_DONTNEED) = 0
[pid  5992] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5992] +++ exited with 0 +++
[   82.400401][ T5893] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.404276][ T5994] nvme nvme4: creating 2 I/O queues.
[   82.408457][ T5994] nvme nvme4: new ctrl: "testnqn"
[pid  5858] futex(0x7f019ff22990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5994, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5994] <... write resumed>)        = 26
[pid  5994] close(3)                    = 0
[pid  5994] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5994] madvise(0x7f019f722000, 8372224, MADV_DONTNEED) = 0
[pid  5994] exit(0)                     = ?
[pid  5994] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019cf1d000, 8392704) = 0
[   82.441063][   T31] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.441797][ T5995] nvme nvme5: creating 2 I/O queues.
[   82.446763][ T5995] nvme nvme5: new ctrl: "testnqn"
[pid  5858] futex(0x7f019f721990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5995, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5995] <... write resumed>)        = 26
[pid  5995] close(7)                    = 0
[pid  5995] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5995] madvise(0x7f019ef21000, 8372224, MADV_DONTNEED) = 0
[pid  5995] exit(0)                     = ?
[pid  5995] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019d71e000, 8392704) = 0
[   82.480634][   T27] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.481370][ T5996] nvme nvme6: creating 2 I/O queues.
[   82.486581][ T5996] nvme nvme6: new ctrl: "testnqn"
[pid  5858] futex(0x7f019cf1c990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5996, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5996] <... write resumed>)        = 26
[pid  5996] close(8)                    = 0
[pid  5996] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5996] madvise(0x7f019c71c000, 8372224, MADV_DONTNEED) = 0
[pid  5996] exit(0)                     = ?
[pid  5996] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019df1f000, 8392704) = 0
[   82.515609][   T95] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] futex(0x7f019c71b990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5997, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5997] <... write resumed>)        = 26
[   82.516334][ T5997] nvme nvme7: creating 2 I/O queues.
[   82.518969][ T5997] nvme nvme7: new ctrl: "testnqn"
[pid  5997] close(4)                    = 0
[pid  5997] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5997] madvise(0x7f019bf1b000, 8372224, MADV_DONTNEED) = 0
[pid  5997] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5997] +++ exited with 0 +++
[pid  5858] munmap(0x7f019e720000, 8392704) = 0
[pid  5858] futex(0x7f019bf1a990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5999, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5999] <... write resumed>)        = 26
[pid  5999] close(9)                    = 0
[pid  5999] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   82.552974][   T63] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5999] madvise(0x7f019b71a000, 8372224, MADV_DONTNEED) = 0
[   82.553822][ T5999] nvme nvme8: creating 2 I/O queues.
[   82.556410][ T5999] nvme nvme8: new ctrl: "testnqn"
[pid  5999] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5999] +++ exited with 0 +++
[pid  5858] munmap(0x7f019f722000, 8392704) = 0
[   82.587580][   T65] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.589160][ T6000] nvme nvme9: creating 2 I/O queues.
[   82.591782][ T6000] nvme nvme9: new ctrl: "testnqn"
[pid  5858] futex(0x7f019b719990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6000, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6000] <... write resumed>)        = 26
[pid  6000] close(10)                   = 0
[pid  6000] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6000] madvise(0x7f019af19000, 8372224, MADV_DONTNEED) = 0
[pid  6000] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019ef21000, 8392704) = 0
[pid  5858] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid  5858] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  5858] getdents64(3 <unfinished ...>
[pid  6000] +++ exited with 0 +++
<... getdents64 resumed>, 0x555593c2f2e0 /* 12 entries */, 32768) = 368
openat(AT_FDCWD, "/sys/class/nvme/nvme7/delete_controller", O_WRONLY) = 4
[   82.636204][ T5858] nvme nvme7: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY) = 4
[   82.875910][ T5858] nvme nvme5: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   83.133849][ T5858] nvme nvme3: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 4
[   83.406560][ T5858] nvme nvme1: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   83.703883][ T5858] nvme nvme8: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   83.983546][ T5858] nvme nvme6: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[   84.246055][ T5858] nvme nvme4: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   84.524239][ T5858] nvme nvme2: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme0/delete_controller", O_WRONLY) = 4
[   84.823812][ T5858] nvme nvme0: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 4
[   85.105349][ T5858] nvme nvme9: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
getdents64(3, 0x555593c2f2e0 /* 0 entries */, 32768) = 0
close(3)                                = 0
[   85.457777][   T35] audit: type=1400 audit(1790187252.846:272): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="/" dev="configfs" ino=1108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.457804][   T35] audit: type=1400 audit(1790187252.846:273): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="nvmet" dev="configfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") = 0
[   85.457820][   T35] audit: type=1400 audit(1790187252.846:274): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="ports" dev="configfs" ino=1567 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.457836][   T35] audit: type=1400 audit(1790187252.846:275): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="1" dev="configfs" ino=8820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
rmdir("/sys/kernel/config/nvmet/ports/1") = 0
[   85.457851][   T35] audit: type=1400 audit(1790187252.846:276): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=8821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY) = 3
[   85.457867][   T35] audit: type=1400 audit(1790187252.846:277): avc:  denied  { write search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=8821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.458388][   T35] audit: type=1400 audit(1790187252.846:278): avc:  denied  { remove_name } for  pid=5858 comm="syz-executor409" name="testnqn" dev="configfs" ino=8826 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.458615][   T35] audit: type=1400 audit(1790187252.846:279): avc:  denied  { unlink } for  pid=5858 comm="syz-executor409" name="testnqn" dev="configfs" ino=8826 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   85.498319][   T35] audit: type=1400 audit(1790187252.886:280): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="/" dev="configfs" ino=1108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
write(3, "0", 1)                        = 1
[   85.498346][   T35] audit: type=1400 audit(1790187252.886:281): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="nvmet" dev="configfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
close(3)                                = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1") = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn") = 0
unlink("/tmp/nvme_backing")             = 0
write(1, "[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.\n[+] write to /sys/kernel/config/nv"..., 683) = 683
exit_group(0)                           = ?
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host successful.
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 successful.
[+] /tmp/nvme_backing created successfully.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable successful.
[+] mkdir /sys/kernel/config/nvmet/ports/1 successful.
[+] write to /sys/kernel/config/nvmet/ports/1/addr_trtype successful.
[+] symlink successful.
[*] Starting concurrent NVMe multipath connections...
[*] Cleaning up...
+++ exited with 0 +++
]

deep-reasoning

map[Feedback:The execution was successful, but it failed to trigger the `WARNING: bad unlock balance in nvme_update_ns_info` bug.

The reproducer successfully sets up an NVMe loopback target and establishes concurrent connections, which triggers namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`). However, the normal connection process does not hit the buggy code path.

The unlock imbalance in `nvme_update_ns_info` (specifically on `q->q_usage_counter(io)`) is likely caused by an error path or a race condition where `blk_mq_unfreeze_queue()` is called without a corresponding `blk_mq_freeze_queue()`, or called twice.

To trigger this, you should try to force `nvme_update_ns_info` into an error path or race condition. Strategies to consider:
1. **Concurrent Rescans:** Trigger explicit controller rescans (e.g., `echo 1 > /sys/class/nvme/nvmeX/rescan_controller`) concurrently with controller connections and disconnections.
2. **Dynamic Target Reconfiguration:** While the host is connecting or scanning, dynamically alter the NVMe target namespace (e.g., disable and re-enable the namespace in configfs, or change the size of the backing file). This can force `nvme_update_ns_info` to handle unexpected changes in namespace attributes (like capacity or LBA format changes) during the scan, which often have complex error handling and queue freezing logic.
3. **Multipath Races:** Ensure multipath is fully active and try to race the creation of the multipath head (`ns->head`) with namespace updates. You might need to connect multiple controllers to the same subsystem and rescan them simultaneously.
4. **Fault Injection:** Simulate I/O errors during the identify namespace command by truncating the backing file or using a faulty loop device to force `nvme_update_ns_info` into its error handling paths. ProbePassed:false TerminalError: TitleMatches:false]

You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.

=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
   that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
   meaning the codebase version is mismatched and the target code is absent.

=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
  or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.


=== PHASE 2: BUG REPRODUCTION (EVALUATION) ===
The executed program was a full reproducer candidate attempting to trigger the target bug/crash.
Use this to guide your classification and feedback:
1. If a crash was triggered (Reproduced is true):
   - Determine if the triggered crash matches the expected bug.
   - If you conclude they represent the same underlying bug (the same root cause)
     despite different titles, crash signatures, or call traces, set TitleMatches
     to true and provide a detailed, technical, and verbose explanation of the
     equivalence in the 'Feedback' field.
   - If they do not represent the same bug (a completely unrelated crash/collision),
     set TitleMatches to false and explain the collision in 'Feedback'.
   - If they match exactly, set TitleMatches to true and provide a brief confirmation in 'Feedback'.
2. If the execution was successful (exit 0) WITHOUT a crash (Reproduced is false):
   - The reproduction attempt failed to trigger the bug. Analyze the console/strace output
     to understand why the bug did not trigger (e.g., timing, input arguments, environment setup)
     and provide feedback on how to improve the reproducer logic to trigger the crash.

Critical Diagnostic Rule for Reproduction Failures:
If the reproduction attempt fails (e.g., a system call returns an error, or a
warning/error message appears in the console log), you MUST:
1. Identify the failing system call from the execution trace or strace output.
2. Identify any corresponding warning or error messages in the console log.
3. Provide a clear technical diagnosis in the feedback identifying the failing call,
   return code (errno), and error messages so the strategy-refiner can analyze the root cause.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

IsProbe: false
Reproduced: false
Console Output: [   68.885199][   T34] audit: type=1400 audit(1790187136.096:265): avc:  denied  { write } for  pid=5894 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.063166][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   69.323757][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   69.574591][   T34] audit: type=1400 audit(1790187136.776:266): avc:  denied  { write } for  pid=5897 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.603028][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   69.626235][   T34] audit: type=1400 audit(1790187136.836:267): avc:  denied  { write } for  pid=5900 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.955861][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   70.234190][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   70.491886][   T34] audit: type=1400 audit(1790187137.696:268): avc:  denied  { write } for  pid=5903 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.523141][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   70.539632][   T34] audit: type=1400 audit(1790187137.746:269): avc:  denied  { write } for  pid=5906 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.756710][   T35] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.757819][ T5909] nvme nvme0: creating 2 I/O queues.
[   70.758926][ T5909] nvme nvme0: new ctrl: "testnqn"
[   70.809616][ T1243] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.811773][ T5910] nvme nvme1: creating 2 I/O queues.
[   70.828877][ T5910] nvme nvme1: new ctrl: "testnqn"
[   70.851270][   T34] audit: type=1400 audit(1790187138.056:270): avc:  denied  { write } for  pid=5921 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.867765][ T5878] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.868481][ T5911] nvme nvme2: creating 2 I/O queues.
[   70.871877][ T5911] nvme nvme2: new ctrl: "testnqn"
[   70.923323][   T29] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.924093][ T5913] nvme nvme3: creating 2 I/O queues.
[   70.926828][ T5913] nvme nvme3: new ctrl: "testnqn"
[   70.927190][   T34] audit: type=1400 audit(1790187138.136:271): avc:  denied  { write } for  pid=5926 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.981819][   T64] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   70.984145][ T5914] nvme nvme4: creating 2 I/O queues.
[   70.992012][ T5914] nvme nvme4: new ctrl: "testnqn"
[   71.031722][ T5876] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.033384][ T5915] nvme nvme5: creating 2 I/O queues.
[   71.047005][ T5915] nvme nvme5: new ctrl: "testnqn"
[   71.077511][ T1527] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.078288][ T5917] nvme nvme6: creating 2 I/O queues.
[   71.081131][ T5917] nvme nvme6: new ctrl: "testnqn"
[   71.121703][ T5878] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.124026][ T5916] nvme nvme7: creating 2 I/O queues.
[   71.130399][ T5916] nvme nvme7: new ctrl: "testnqn"
[   71.157327][   T94] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.158042][ T5919] nvme nvme8: creating 2 I/O queues.
[   71.161992][ T5919] nvme nvme8: new ctrl: "testnqn"
[   71.207927][   T27] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   71.209697][ T5918] nvme nvme9: creating 2 I/O queues.
[   71.218334][ T5918] nvme nvme9: new ctrl: "testnqn"
[   71.224785][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   71.493352][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   71.704792][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.704832][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   71.803535][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   72.093600][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   72.333098][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   72.613212][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   72.863049][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   73.133049][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   73.403388][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   73.663146][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   73.965693][   T94] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   73.967039][ T5936] nvme nvme0: creating 2 I/O queues.
[   73.968092][ T5936] nvme nvme0: new ctrl: "testnqn"
[   73.998981][   T28] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.001325][ T5937] nvme nvme1: creating 2 I/O queues.
[   74.012413][ T5937] nvme nvme1: new ctrl: "testnqn"
[   74.046647][   T64] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.047459][ T5938] nvme nvme2: creating 2 I/O queues.
[   74.048561][ T5938] nvme nvme2: new ctrl: "testnqn"
[   74.078181][ T5878] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.078967][ T5939] nvme nvme3: creating 2 I/O queues.
[   74.081636][ T5939] nvme nvme3: new ctrl: "testnqn"
[   74.114228][   T35] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.114890][ T5941] nvme nvme4: creating 2 I/O queues.
[   74.117575][ T5941] nvme nvme4: new ctrl: "testnqn"
[   74.154883][   T94] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.155672][ T5942] nvme nvme5: creating 2 I/O queues.
[   74.158332][ T5942] nvme nvme5: new ctrl: "testnqn"
[   74.188116][   T27] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.188817][ T5943] nvme nvme6: creating 2 I/O queues.
[   74.191792][ T5943] nvme nvme6: new ctrl: "testnqn"
[   74.222244][ T1108] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.223143][ T5944] nvme nvme7: creating 2 I/O queues.
[   74.225780][ T5944] nvme nvme7: new ctrl: "testnqn"
[   74.253028][   T64] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.254543][ T5945] nvme nvme8: creating 2 I/O queues.
[   74.256988][ T5945] nvme nvme8: new ctrl: "testnqn"
[   74.288601][   T27] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   74.289593][ T5946] nvme nvme9: creating 2 I/O queues.
[   74.292406][ T5946] nvme nvme9: new ctrl: "testnqn"
[   74.301427][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   74.573150][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   74.883545][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   75.153156][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   75.413275][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   75.663160][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   75.953110][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   76.213685][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   76.464220][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   76.713567][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   76.813263][   T33] cfg80211: failed to load regulatory.db
[   77.056009][   T64] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.057185][ T5956] nvme nvme0: creating 2 I/O queues.
[   77.059636][ T5956] nvme nvme0: new ctrl: "testnqn"
[   77.097038][   T94] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.098482][ T5957] nvme nvme1: creating 2 I/O queues.
[   77.099663][ T5957] nvme nvme1: new ctrl: "testnqn"
[   77.125894][   T27] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.128162][ T5958] nvme nvme2: creating 2 I/O queues.
[   77.131747][ T5958] nvme nvme2: new ctrl: "testnqn"
[   77.163029][ T5928] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.164317][ T5959] nvme nvme3: creating 2 I/O queues.
[   77.166498][ T5959] nvme nvme3: new ctrl: "testnqn"
[   77.192078][ T5928] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.199057][ T5961] nvme nvme4: creating 2 I/O queues.
[   77.201265][ T5961] nvme nvme4: new ctrl: "testnqn"
[   77.238409][ T5928] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.239613][ T5963] nvme nvme5: creating 2 I/O queues.
[   77.248882][ T5963] nvme nvme5: new ctrl: "testnqn"
[   77.278992][   T64] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.281054][ T5962] nvme nvme6: creating 2 I/O queues.
[   77.292068][ T5962] nvme nvme6: new ctrl: "testnqn"
[   77.323059][ T1527] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.323829][ T5964] nvme nvme7: creating 2 I/O queues.
[   77.326525][ T5964] nvme nvme7: new ctrl: "testnqn"
[   77.360258][ T2294] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.361133][ T5965] nvme nvme8: creating 2 I/O queues.
[   77.371128][ T5965] nvme nvme8: new ctrl: "testnqn"
[   77.393994][ T5970] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   77.394724][ T5966] nvme nvme9: creating 2 I/O queues.
[   77.397280][ T5966] nvme nvme9: new ctrl: "testnqn"
[   77.400090][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   77.663310][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   77.933439][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   78.213623][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   78.503903][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   78.763217][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   79.023138][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   79.283897][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   79.563126][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   79.844246][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   80.175163][   T84] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.176261][ T5977] nvme nvme0: creating 2 I/O queues.
[   80.178789][ T5977] nvme nvme0: new ctrl: "testnqn"
[   80.213918][ T5970] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.214599][ T5978] nvme nvme1: creating 2 I/O queues.
[   80.219619][ T5978] nvme nvme1: new ctrl: "testnqn"
[   80.253576][   T64] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.254329][ T5982] nvme nvme2: creating 2 I/O queues.
[   80.256136][ T5982] nvme nvme2: new ctrl: "testnqn"
[   80.304742][ T5928] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.305570][ T5979] nvme nvme3: creating 2 I/O queues.
[   80.308255][ T5979] nvme nvme3: new ctrl: "testnqn"
[   80.335121][ T5970] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.335873][ T5981] nvme nvme4: creating 2 I/O queues.
[   80.338438][ T5981] nvme nvme4: new ctrl: "testnqn"
[   80.374891][   T94] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.377074][ T5984] nvme nvme5: creating 2 I/O queues.
[   80.379788][ T5984] nvme nvme5: new ctrl: "testnqn"
[   80.413919][ T5928] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.414615][ T5983] nvme nvme6: creating 2 I/O queues.
[   80.420582][ T5983] nvme nvme6: new ctrl: "testnqn"
[   80.459803][   T27] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.461031][ T5985] nvme nvme7: creating 2 I/O queues.
[   80.473752][ T5985] nvme nvme7: new ctrl: "testnqn"
[   80.500453][   T94] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.502062][ T5986] nvme nvme8: creating 2 I/O queues.
[   80.506882][ T5986] nvme nvme8: new ctrl: "testnqn"
[   80.538817][ T5928] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:1e599145-e359-4ba2-b667-52199c65c380.
[   80.539805][ T5987] nvme nvme9: creating 2 I/O queues.
[   80.549393][ T5987] nvme nvme9: new ctrl: "testnqn"
[   80.551743][ T5854] nvme nvme7: Removing ctrl: NQN "testnqn"
[   80.804846][ T5854] nvme nvme5: Removing ctrl: NQN "testnqn"
[   81.054125][ T5854] nvme nvme3: Removing ctrl: NQN "testnqn"
[   81.303601][ T5854] nvme nvme1: Removing ctrl: NQN "testnqn"
[   81.563031][ T5854] nvme nvme8: Removing ctrl: NQN "testnqn"
[   81.823824][ T5854] nvme nvme6: Removing ctrl: NQN "testnqn"
[   82.063122][ T5854] nvme nvme4: Removing ctrl: NQN "testnqn"
[   82.313129][ T5854] nvme nvme2: Removing ctrl: NQN "testnqn"
[   82.543890][ T5854] nvme nvme0: Removing ctrl: NQN "testnqn"
[   82.732381][   T94] nvme nvme0: long keepalive RTT (4294752936 ms)
[   82.732410][   T94] nvme nvme0: failed nvme_keep_alive_end_io error=4
[   82.823096][ T5854] nvme nvme9: Removing ctrl: NQN "testnqn"
[   83.095273][   T34] audit: type=1400 audit(1790187150.306:272): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095379][   T34] audit: type=1400 audit(1790187150.306:273): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="nvmet" dev="configfs" ino=3602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095508][   T34] audit: type=1400 audit(1790187150.306:274): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="ports" dev="configfs" ino=3604 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095600][   T34] audit: type=1400 audit(1790187150.306:275): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="1" dev="configfs" ino=8313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095692][   T34] audit: type=1400 audit(1790187150.306:276): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="subsystems" dev="configfs" ino=8314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.095931][   T34] audit: type=1400 audit(1790187150.306:277): avc:  denied  { write search } for  pid=5854 comm="syz-executor239" name="subsystems" dev="configfs" ino=8314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.096963][   T34] audit: type=1400 audit(1790187150.306:278): avc:  denied  { remove_name } for  pid=5854 comm="syz-executor239" name="testnqn" dev="configfs" ino=8319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.099255][   T34] audit: type=1400 audit(1790187150.306:279): avc:  denied  { unlink } for  pid=5854 comm="syz-executor239" name="testnqn" dev="configfs" ino=8319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   83.099277][   T34] audit: type=1400 audit(1790187150.306:280): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   83.099293][   T34] audit: type=1400 audit(1790187150.306:281): avc:  denied  { search } for  pid=5854 comm="syz-executor239" name="nvmet" dev="configfs" ino=3602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host successful.
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 successful.
[+] /tmp/nvme_backing created successfully.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable successful.
[+] mkdir /sys/kernel/config/nvmet/ports/1 successful.
[+] write to /sys/kernel/config/nvmet/ports/1/addr_trtype successful.
[+] symlink successful.
[*] Starting concurrent NVMe multipath connections...
[*] Cleaning up...

Strace Output: [pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019bf1a990, parent_tid=0x7f019bf1a990, exit_signal=0, stack=0x7f019b71a000, stack_size=0x8002c0, tls=0x7f019bf1a6c0} => {parent_tid=[5999]}, 88) = 5999
[pid  5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0/strace: Process 5999 attached
) = 0x7f019af19000
[pid  5858] mprotect(0x7f019af1a000, 8388608, PROT_READ|PROT_WRITE <unfinished ...>
[pid  5999] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5858] <... mprotect resumed>)     = 0
[pid  5999] <... rseq resumed>)         = 0
[pid  5858] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5999] set_robust_list(0x7f019bf1a9a0, 24 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5999] <... set_robust_list resumed>) = 0
[pid  5858] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f019b719990, parent_tid=0x7f019b719990, exit_signal=0, stack=0x7f019af19000, stack_size=0x8002c0, tls=0x7f019b7196c0} <unfinished ...>
[pid  5999] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5858] <... clone3 resumed> => {parent_tid=[6000]}, 88) = 6000
/strace: Process 6000 attached
[pid  5999] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6000] rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053 <unfinished ...>
[pid  5999] <... openat resumed>)       = 9
[pid  5858] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5999] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5858] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5858] futex(0x7f019e71f990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5990, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6000] <... rseq resumed>)         = 0
[pid  6000] set_robust_list(0x7f019b7199a0, 24) = 0
[pid  6000] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  6000] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR) = 10
[   82.318649][ T5893] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.320865][ T5990] nvme nvme2: creating 2 I/O queues.
[   82.326994][ T5990] nvme nvme2: new ctrl: "testnqn"
[pid  6000] write(10, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  5990] <... write resumed>)        = 26
[pid  5990] close(5)                    = 0
[pid  5990] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5990] madvise(0x7f019df1f000, 8372224, MADV_DONTNEED) = 0
[pid  5990] exit(0)                     = ?
[pid  5990] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[   82.361606][ T5893] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.364013][ T5992] nvme nvme3: creating 2 I/O queues.
[pid  5858] futex(0x7f019ef20990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5992, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5992] <... write resumed>)        = 26
[pid  5992] close(6)                    = 0
[pid  5992] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   82.368623][ T5992] nvme nvme3: new ctrl: "testnqn"
[pid  5992] madvise(0x7f019e720000, 8372224, MADV_DONTNEED) = 0
[pid  5992] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5992] +++ exited with 0 +++
[   82.400401][ T5893] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.404276][ T5994] nvme nvme4: creating 2 I/O queues.
[   82.408457][ T5994] nvme nvme4: new ctrl: "testnqn"
[pid  5858] futex(0x7f019ff22990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5994, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5994] <... write resumed>)        = 26
[pid  5994] close(3)                    = 0
[pid  5994] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5994] madvise(0x7f019f722000, 8372224, MADV_DONTNEED) = 0
[pid  5994] exit(0)                     = ?
[pid  5994] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019cf1d000, 8392704) = 0
[   82.441063][   T31] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.441797][ T5995] nvme nvme5: creating 2 I/O queues.
[   82.446763][ T5995] nvme nvme5: new ctrl: "testnqn"
[pid  5858] futex(0x7f019f721990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5995, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5995] <... write resumed>)        = 26
[pid  5995] close(7)                    = 0
[pid  5995] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5995] madvise(0x7f019ef21000, 8372224, MADV_DONTNEED) = 0
[pid  5995] exit(0)                     = ?
[pid  5995] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019d71e000, 8392704) = 0
[   82.480634][   T27] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.481370][ T5996] nvme nvme6: creating 2 I/O queues.
[   82.486581][ T5996] nvme nvme6: new ctrl: "testnqn"
[pid  5858] futex(0x7f019cf1c990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5996, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5996] <... write resumed>)        = 26
[pid  5996] close(8)                    = 0
[pid  5996] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5996] madvise(0x7f019c71c000, 8372224, MADV_DONTNEED) = 0
[pid  5996] exit(0)                     = ?
[pid  5996] +++ exited with 0 +++
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019df1f000, 8392704) = 0
[   82.515609][   T95] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5858] futex(0x7f019c71b990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5997, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5997] <... write resumed>)        = 26
[   82.516334][ T5997] nvme nvme7: creating 2 I/O queues.
[   82.518969][ T5997] nvme nvme7: new ctrl: "testnqn"
[pid  5997] close(4)                    = 0
[pid  5997] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  5997] madvise(0x7f019bf1b000, 8372224, MADV_DONTNEED) = 0
[pid  5997] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5997] +++ exited with 0 +++
[pid  5858] munmap(0x7f019e720000, 8392704) = 0
[pid  5858] futex(0x7f019bf1a990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 5999, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  5999] <... write resumed>)        = 26
[pid  5999] close(9)                    = 0
[pid  5999] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[   82.552974][   T63] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[pid  5999] madvise(0x7f019b71a000, 8372224, MADV_DONTNEED) = 0
[   82.553822][ T5999] nvme nvme8: creating 2 I/O queues.
[   82.556410][ T5999] nvme nvme8: new ctrl: "testnqn"
[pid  5999] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5999] +++ exited with 0 +++
[pid  5858] munmap(0x7f019f722000, 8392704) = 0
[   82.587580][   T65] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0035a3a6-272a-4c93-abb4-df234ffc3b9b.
[   82.589160][ T6000] nvme nvme9: creating 2 I/O queues.
[   82.591782][ T6000] nvme nvme9: new ctrl: "testnqn"
[pid  5858] futex(0x7f019b719990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6000, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6000] <... write resumed>)        = 26
[pid  6000] close(10)                   = 0
[pid  6000] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6000] madvise(0x7f019af19000, 8372224, MADV_DONTNEED) = 0
[pid  6000] exit(0)                     = ?
[pid  5858] <... futex resumed>)        = 0
[pid  5858] munmap(0x7f019ef21000, 8392704) = 0
[pid  5858] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid  5858] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  5858] getdents64(3 <unfinished ...>
[pid  6000] +++ exited with 0 +++
<... getdents64 resumed>, 0x555593c2f2e0 /* 12 entries */, 32768) = 368
openat(AT_FDCWD, "/sys/class/nvme/nvme7/delete_controller", O_WRONLY) = 4
[   82.636204][ T5858] nvme nvme7: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY) = 4
[   82.875910][ T5858] nvme nvme5: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   83.133849][ T5858] nvme nvme3: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 4
[   83.406560][ T5858] nvme nvme1: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   83.703883][ T5858] nvme nvme8: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   83.983546][ T5858] nvme nvme6: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[   84.246055][ T5858] nvme nvme4: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   84.524239][ T5858] nvme nvme2: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme0/delete_controller", O_WRONLY) = 4
[   84.823812][ T5858] nvme nvme0: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 4
[   85.105349][ T5858] nvme nvme9: Removing ctrl: NQN "testnqn"
write(4, "1", 1)                        = 1
close(4)                                = 0
getdents64(3, 0x555593c2f2e0 /* 0 entries */, 32768) = 0
close(3)                                = 0
[   85.457777][   T35] audit: type=1400 audit(1790187252.846:272): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="/" dev="configfs" ino=1108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.457804][   T35] audit: type=1400 audit(1790187252.846:273): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="nvmet" dev="configfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") = 0
[   85.457820][   T35] audit: type=1400 audit(1790187252.846:274): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="ports" dev="configfs" ino=1567 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.457836][   T35] audit: type=1400 audit(1790187252.846:275): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="1" dev="configfs" ino=8820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
rmdir("/sys/kernel/config/nvmet/ports/1") = 0
[   85.457851][   T35] audit: type=1400 audit(1790187252.846:276): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=8821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY) = 3
[   85.457867][   T35] audit: type=1400 audit(1790187252.846:277): avc:  denied  { write search } for  pid=5858 comm="syz-executor409" name="subsystems" dev="configfs" ino=8821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.458388][   T35] audit: type=1400 audit(1790187252.846:278): avc:  denied  { remove_name } for  pid=5858 comm="syz-executor409" name="testnqn" dev="configfs" ino=8826 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.458615][   T35] audit: type=1400 audit(1790187252.846:279): avc:  denied  { unlink } for  pid=5858 comm="syz-executor409" name="testnqn" dev="configfs" ino=8826 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   85.498319][   T35] audit: type=1400 audit(1790187252.886:280): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="/" dev="configfs" ino=1108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
write(3, "0", 1)                        = 1
[   85.498346][   T35] audit: type=1400 audit(1790187252.886:281): avc:  denied  { search } for  pid=5858 comm="syz-executor409" name="nvmet" dev="configfs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
close(3)                                = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1") = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn") = 0
unlink("/tmp/nvme_backing")             = 0
write(1, "[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.\n[+] write to /sys/kernel/config/nv"..., 683) = 683
exit_group(0)                           = ?
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host successful.
[+] mkdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 successful.
[+] /tmp/nvme_backing created successfully.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path successful.
[+] write to /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable successful.
[+] mkdir /sys/kernel/config/nvmet/ports/1 successful.
[+] write to /sys/kernel/config/nvmet/ports/1/addr_trtype successful.
[+] symlink successful.
[*] Starting concurrent NVMe multipath connections...
[*] Cleaning up...
+++ exited with 0 +++

Crash Report: 

gemini-3.1-pro-preview

							input: 19956
							output: 466
							thoughts: 2177
						

**My Thought Process on the NVMe Unlock Balance Bug**

Alright, so the core task here is to analyze the results of a reproducer program designed to trigger a specific Linux kernel bug: `WARNING: bad unlock balance in nvme_update_ns_info`. I need to do this as if I'm thinking it through myself, providing a detailed summary for someone who's an expert in this domain.

First off, the reproducer was run, and the key outcomes were: `IsProbe: false` and, critically, `Reproduced: false`. This tells me straight away that the specific bug I'm looking for didn't manifest. Looking at the console output, I see a flurry of NVMe controller creations and removals. That's expected behavior when setting up and tearing down NVMe devices, especially in a test environment. However, there's no crash or any warning that directly matches the bug description.

Next, I'll examine the `strace` output. This is where the reproducer's actions become clearer. It's busy setting up an NVMe target – essentially a virtual NVMe device. It's creating a loopback transport, which is a common way to test NVMe functionality without physical hardware. Then, it spawns multiple threads to connect to this target concurrently. This concurrent connection is likely intended to induce a race condition. After the connections are made, the reproducer cleans up by deleting the controllers and removing the configuration entries from `configfs`.

Now, let's dive into the bug itself: `bad unlock balance detected!` in `nvme_update_ns_info`. The stack trace provided with the bug description is crucial here. I see:
```
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
```
The core of the problem is highlighted: the bug is about `blk_mq_unfreeze_queue` being called without a corresponding `blk_mq_freeze_queue` or a similar preceding operation. This imbalance on `q->q_usage_counter(io)` is what `lockdep` is flagging.

So, the reproducer *did* set up the NVMe target and connect to it, which implies that it *should* have gone through the code paths involved in scanning namespaces and updating their information. However, it failed to trigger the bug. This leads me to ponder: why?

My hypothesis is that the bug might only manifest under very specific conditions.
1.  **Error Paths:** Perhaps the bug is triggered only when an error occurs during the `nvme_update_ns_info` or `nvme_alloc_ns` functions. The reproducer's current execution path seems to be the "happy path" where everything succeeds.
2.  **Specific Race Conditions:** The concurrent connection attempt is meant to induce a race, but maybe it's not the *right kind* of race. It's possible the bug requires a more nuanced race during the actual namespace scanning phase, not just during the initial connection setup and teardown.
3.  **Context of `nvme_update_ns_info`:** I recall that `nvme_update_ns_info` is indeed called during `nvme_scan_ns`, specifically within `nvme_alloc_ns`. If `nvme_update_ns_info` itself has a logic flaw where it calls `blk_mq_unfreeze_queue` inappropriately, that could explain it.

Let's look closer at `nvme_update_ns_info` in `drivers/nvme/host/core.c`. I can see a snippet that's relevant:
```c
static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
{
    // ...
    if (ns->disk && nvme_ns_head_multipath(ns->head)) {
        blk_mq_freeze_queue(ns->disk->queue);
        // ... other operations ...
        blk_mq_unfreeze_queue(ns->disk->queue);
    }
    // ...
}
```
The imbalance occurs on `q->q_usage_counter(io)`. If `blk_mq_unfreeze_queue` is called without a preceding `blk_mq_freeze_queue`, or if it's called on the wrong queue, or if there's an error path that skips the freeze but still attempts an unfreeze, this warning would pop up.

Now, considering the reproducer's execution: it initiated 10 concurrent connections. It appears these connections were established successfully, and then the cleanup followed. If the bug is related to an error path or a specific race condition within `nvme_update_ns_info`, the current reproducer might not be putting the code into that state.

What could be missing?
*   **Error Injection:** The bug might be in an error handling path. My reproducer isn't forcing any errors.
*   **Namespace Scan Nuances:** The reproducer simply connects and disconnects. It doesn't explicitly trigger a *rescan* while the system is active or change namespace configurations on the fly.
*   **Race Window:** The race condition might need to occur during a very specific moment of namespace attribute updates, perhaps when the multipath status changes, or when LBA format or capacity is modified mid-scan. The reproducer's `nqn=testnqn` suggests it's connecting to the same subsystem, and the output mentions "Starting concurrent NVMe multipath connections...", so multipath *is* likely involved.

I'm also reminded that bugs like this are often found by fuzzers like `syzkaller`. This makes me wonder if there's a known fix or a specific commit that addresses this particular `nvme_update_ns_info` unlock balance. If I could search my knowledge base for "bad unlock balance in nvme_update_ns_info", I might find a clue.

Let's hypothesize on how the bug might actually be triggered based on the code structure. The `nvme_update_ns_info` function freezes the queue *only if* `!ns->head->disk`. This implies a condition where the queue might *not* be frozen, and then `blk_mq_unfreeze_queue` is called. Or, more likely, `blk_mq_freeze_queue` *is* called, but an error path bypasses the corresponding `blk_mq_unfreeze_queue` and then later calls it again, or calls `blk_mq_unfreeze_queue` without a matching `freeze`.

To refine the reproducer strategy, I need to provide actionable feedback. The current execution successfully set up and tore down the loopback NVMe target and established concurrent connections, but it *failed* to trigger the `WARNING: bad unlock balance in nvme_update_ns_info`. The bug likely lies in an error path or a race condition during the namespace scanning and updating process.

To improve the reproducer, I should suggest:
1.  **Triggering Rescans:** Instead of just connecting and disconnecting, actively trigger explicit controller rescans (`echo 1 > /sys/class/nvme/nvmeX/rescan_controller`). This should be done concurrently with the connection/disconnection attempts to create more race opportunities.
2.  **Dynamic Target Manipulation:** While the host is actively scanning or connecting, I should try to dynamically change the NVMe target's namespace configuration. This could involve disabling/re-enabling namespaces in `configfs`, or changing the size of the backing file. This forces `nvme_update_ns_info` to handle unexpected attribute changes, potentially leading it down an error path.
3.  **Multipath Specific Races:** Since multipath is mentioned, I should focus on racing namespace updates with the creation or management of the multipath head (`ns->head`). This might involve multiple controllers pointing to the same subsystem and then triggering rescans simultaneously.
4.  **Simulating I/O Errors:** If possible, I should try to simulate I/O errors during the identify namespace command. This could be done by, for example, truncating the backing file of a loop device or using a faulty loop device. This would force the code down error handling paths.

Essentially, the goal is to nudge the `nvme_update_ns_info` function into a state where the `blk_mq_freeze_queue`/`blk_mq_unfreeze_queue` pairing becomes unbalanced. The current reproducer seems too clean.

map[Feedback:The execution was successful, but it failed to trigger the `WARNING: bad unlock balance in nvme_update_ns_info` bug.

The reproducer successfully sets up an NVMe loopback target and establishes concurrent connections, which triggers namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`). However, the normal connection process does not hit the buggy code path.

The unlock imbalance in `nvme_update_ns_info` (specifically on `q->q_usage_counter(io)`) is likely caused by an error path or a race condition where `blk_mq_unfreeze_queue()` is called without a corresponding `blk_mq_freeze_queue()`, or called twice.

To trigger this, you should try to force `nvme_update_ns_info` into an error path or race condition. Strategies to consider:
1. **Concurrent Rescans:** Trigger explicit controller rescans (e.g., `echo 1 > /sys/class/nvme/nvmeX/rescan_controller`) concurrently with controller connections and disconnections.
2. **Dynamic Target Reconfiguration:** While the host is connecting or scanning, dynamically alter the NVMe target namespace (e.g., disable and re-enable the namespace in configfs, or change the size of the backing file). This can force `nvme_update_ns_info` to handle unexpected changes in namespace attributes (like capacity or LBA format changes) during the scan, which often have complex error handling and queue freezing logic.
3. **Multipath Races:** Ensure multipath is fully active and try to race the creation of the multipath head (`ns->head`) with namespace updates. You might need to connect multiple controllers to the same subsystem and rescan them simultaneously.
4. **Fault Injection:** Simulate I/O errors during the identify namespace command by truncating the backing file or using a faulty loop device to force `nvme_update_ns_info` into its error handling paths. ProbePassed:false TerminalError: TitleMatches:false]

map[Feedback:The execution was successful, but it failed to trigger the `WARNING: bad unlock balance in nvme_update_ns_info` bug.

The reproducer successfully sets up an NVMe loopback target and establishes concurrent connections, which triggers namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`). However, the normal connection process does not hit the buggy code path.

The unlock imbalance in `nvme_update_ns_info` (specifically on `q->q_usage_counter(io)`) is likely caused by an error path or a race condition where `blk_mq_unfreeze_queue()` is called without a corresponding `blk_mq_freeze_queue()`, or called twice.

To trigger this, you should try to force `nvme_update_ns_info` into an error path or race condition. Strategies to consider:
1. **Concurrent Rescans:** Trigger explicit controller rescans (e.g., `echo 1 > /sys/class/nvme/nvmeX/rescan_controller`) concurrently with controller connections and disconnections.
2. **Dynamic Target Reconfiguration:** While the host is connecting or scanning, dynamically alter the NVMe target namespace (e.g., disable and re-enable the namespace in configfs, or change the size of the backing file). This can force `nvme_update_ns_info` to handle unexpected changes in namespace attributes (like capacity or LBA format changes) during the scan, which often have complex error handling and queue freezing logic.
3. **Multipath Races:** Ensure multipath is fully active and try to race the creation of the multipath head (`ns->head`) with namespace updates. You might need to connect multiple controllers to the same subsystem and rescan them simultaneously.
4. **Fault Injection:** Simulate I/O errors during the identify namespace command by truncating the backing file or using a faulty loop device to force `nvme_update_ns_info` into its error handling paths. ProbePassed:false TerminalError: TitleMatches:false]

map[CapabilitiesVerified:true ContinueSignal:continue EquivalenceAnalysis: OracleFeedback:The execution was successful, but it failed to trigger the `WARNING: bad unlock balance in nvme_update_ns_info` bug.

The reproducer successfully sets up an NVMe loopback target and establishes concurrent connections, which triggers namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`). However, the normal connection process does not hit the buggy code path.

The unlock imbalance in `nvme_update_ns_info` (specifically on `q->q_usage_counter(io)`) is likely caused by an error path or a race condition where `blk_mq_unfreeze_queue()` is called without a corresponding `blk_mq_freeze_queue()`, or called twice.

To trigger this, you should try to force `nvme_update_ns_info` into an error path or race condition. Strategies to consider:
1. **Concurrent Rescans:** Trigger explicit controller rescans (e.g., `echo 1 > /sys/class/nvme/nvmeX/rescan_controller`) concurrently with controller connections and disconnections.
2. **Dynamic Target Reconfiguration:** While the host is connecting or scanning, dynamically alter the NVMe target namespace (e.g., disable and re-enable the namespace in configfs, or change the size of the backing file). This can force `nvme_update_ns_info` to handle unexpected changes in namespace attributes (like capacity or LBA format changes) during the scan, which often have complex error handling and queue freezing logic.
3. **Multipath Races:** Ensure multipath is fully active and try to race the creation of the multipath head (`ns->head`) with namespace updates. You might need to connect multiple controllers to the same subsystem and rescan them simultaneously.
4. **Fault Injection:** Simulate I/O errors during the identify namespace command by truncating the backing file or using a faulty loop device to force `nvme_update_ns_info` into its error handling paths. ReproC: Reproduced:false ReproducedBugTitle: ReproducedCrashReport:]

map[OracleFeedback:The execution was successful, but it failed to trigger the `WARNING: bad unlock balance in nvme_update_ns_info` bug.

The reproducer successfully sets up an NVMe loopback target and establishes concurrent connections, which triggers namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`). However, the normal connection process does not hit the buggy code path.

The unlock imbalance in `nvme_update_ns_info` (specifically on `q->q_usage_counter(io)`) is likely caused by an error path or a race condition where `blk_mq_unfreeze_queue()` is called without a corresponding `blk_mq_freeze_queue()`, or called twice.

To trigger this, you should try to force `nvme_update_ns_info` into an error path or race condition. Strategies to consider:
1. **Concurrent Rescans:** Trigger explicit controller rescans (e.g., `echo 1 > /sys/class/nvme/nvmeX/rescan_controller`) concurrently with controller connections and disconnections.
2. **Dynamic Target Reconfiguration:** While the host is connecting or scanning, dynamically alter the NVMe target namespace (e.g., disable and re-enable the namespace in configfs, or change the size of the backing file). This can force `nvme_update_ns_info` to handle unexpected changes in namespace attributes (like capacity or LBA format changes) during the scan, which often have complex error handling and queue freezing logic.
3. **Multipath Races:** Ensure multipath is fully active and try to race the creation of the multipath head (`ns->head`) with namespace updates. You might need to connect multiple controllers to the same subsystem and rescan them simultaneously.
4. **Fault Injection:** Simulate I/O errors during the identify namespace command by truncating the backing file or using a faulty loop device to force `nvme_update_ns_info` into its error handling paths.]

deep-reasoning

You are an expert in Linux kernel debugging.
Refine the reproduction strategy based on feedback from previous attempts.
Analyze the technical diagnosis provided in the oracle feedback and translate it into concrete,
step-by-step instructions for the repro-generator on how to modify the code structure, alignments,
offsets, or parameters of the candidate program.

=== TOOL SELECTION GUIDELINES ===
- Prefer codesearch-definition-source and codesearch-struct-layout first for symbol lookups.
- Fall back to read-file or grepper for macros, headers, or if symbol lookup fails.

=== CRITICAL PROHIBITIONS ===
- Do NOT repeat searches for the same symbols or files. Use information you have already gathered.
- Do NOT write long explanations. Keep your reasoning short and focused on actionable changes.
- Do NOT assume a bug is fixed based on git commit history.
- If you are stuck, try a different approach or proceed to generate a candidate reproducer.
Prefer calling several tools at the same time to save round-trips.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Current Strategy: ```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_THREADS 10

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

void* connect_thread(void* arg)
{
	int fd = open("/dev/nvme-fabrics", O_RDWR);
	if (fd >= 0) {
		// Connect to the loopback target, creating a new path to the namespace.
		if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
			// Ignore errors, as concurrent connections might occasionally fail.
		}
		close(fd);
	}
	return NULL;
}

void disconnect_all()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t t[NUM_THREADS];

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_create(&t[j], NULL, connect_thread, NULL);
		}

		for (int j = 0; j < NUM_THREADS; j++) {
			pthread_join(t[j], NULL);
		}

		disconnect_all();
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```
Feedback: The execution was successful, but it failed to trigger the `WARNING: bad unlock balance in nvme_update_ns_info` bug.

The reproducer successfully sets up an NVMe loopback target and establishes concurrent connections, which triggers namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`). However, the normal connection process does not hit the buggy code path.

The unlock imbalance in `nvme_update_ns_info` (specifically on `q->q_usage_counter(io)`) is likely caused by an error path or a race condition where `blk_mq_unfreeze_queue()` is called without a corresponding `blk_mq_freeze_queue()`, or called twice.

To trigger this, you should try to force `nvme_update_ns_info` into an error path or race condition. Strategies to consider:
1. **Concurrent Rescans:** Trigger explicit controller rescans (e.g., `echo 1 > /sys/class/nvme/nvmeX/rescan_controller`) concurrently with controller connections and disconnections.
2. **Dynamic Target Reconfiguration:** While the host is connecting or scanning, dynamically alter the NVMe target namespace (e.g., disable and re-enable the namespace in configfs, or change the size of the backing file). This can force `nvme_update_ns_info` to handle unexpected changes in namespace attributes (like capacity or LBA format changes) during the scan, which often have complex error handling and queue freezing logic.
3. **Multipath Races:** Ensure multipath is fully active and try to race the creation of the multipath head (`ns->head`) with namespace updates. You might need to connect multiple controllers to the same subsystem and rescan them simultaneously.
4. **Fault Injection:** Simulate I/O errors during the identify namespace command by truncating the backing file or using a faulty loop device to force `nvme_update_ns_info` into its error handling paths.

An analysis of the lockdep warning and the block layer's queue freezing mechanism reveals a subtle race condition involving the `q->mq_freeze_disk_dead` flag.

### Root Cause Analysis
1. When `nvme_alloc_ns` is called for a new namespace, it allocates the multipath disk (`ns->head->disk`) but does **not** register it immediately.
2. It then calls `nvme_update_ns_info`, which freezes the queue (`blk_mq_freeze_queue`). Because the disk is not registered, `blk_freeze_set_owner` sets `q->mq_freeze_disk_dead = TRUE`.
3. Consequently, `blk_freeze_acquire_lock` does **not** acquire the `io_lockdep_map` lock.
4. `nvme_update_ns_info` then unfreezes the queue. `__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` to 0 and returns `TRUE`.
5. **The Race Window:** If the thread is preempted right here (before calling `blk_unfreeze_release_lock`), another thread can register the disk (e.g., via `nvme_mpath_add_disk`).
6. If a third thread (or a rescan) now calls `nvme_update_ns_info` on the same namespace, it freezes the queue again. Since the disk is now registered, `blk_freeze_set_owner` overwrites `q->mq_freeze_disk_dead` to `FALSE`.
7. When the original thread resumes, it calls `blk_unfreeze_release_lock`. It reads the new value of `q->mq_freeze_disk_dead` (`FALSE`) and attempts to release the `io_lockdep_map` lock, which it never acquired. This triggers the `bad unlock balance` warning.

### Reproduction Strategy
To trigger this race condition, we need to maximize the chances of a thread being preempted in the tiny window between `__blk_mq_unfreeze_queue` and `blk_unfreeze_release_lock`, while another thread registers the disk and a third thread freezes it again.

We can achieve this by running three concurrent workloads:
1. **Connect Threads:** Continuously connect NVMe loopback controllers. This triggers `nvme_alloc_ns` (which freezes the queue while the disk is unregistered) and eventually registers the disk.
2. **Rescan Threads:** Continuously trigger controller rescans (`echo 1 > /sys/class/nvme/nvmeX/rescan_controller`). This calls `nvme_update_ns_info` on already registered disks, overwriting `q->mq_freeze_disk_dead` to `FALSE`.
3. **Disconnect Threads:** Periodically delete controllers to keep the system churning and allow new connections to be established.

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 1

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		int fd = open("/dev/nvme-fabrics", O_RDWR);
		if (fd >= 0) {
			write(fd, "nqn=testnqn,transport=loop", 26);
			close(fd);
		}
	}
	return NULL;
}

void* rescan_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/rescan_controller; do echo 1 > $f 2>/dev/null; done");
	}
	return NULL;
}

void* disconnect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
		usleep(100000); // Disconnect less frequently to allow rescans to hit registered disks
	}
	return NULL;
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t ct[NUM_CONNECT_THREADS];
		pthread_t rt[NUM_RESCAN_THREADS];
		pthread_t dt[NUM_DISCONNECT_THREADS];

		__atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_create(&ct[i], NULL, connect_thread, NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_create(&rt[i], NULL, rescan_thread, NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_create(&dt[i], NULL, disconnect_thread, NULL);

		sleep(5);
		__atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_join(ct[i], NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_join(rt[i], NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_join(dt[i], NULL);
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```

gemini-3.1-pro-preview

							input: 5182
							output: 32
							thoughts: 116
						

**My Thought Process Regarding the `nvme_update_ns_info` Unlock Balance Warning**

Right, so I'm looking at this bug report, and the core of the issue seems to be a `WARNING: bad unlock balance in nvme_update_ns_info`. That immediately tells me there's a mismatch in how locks are being acquired and released within this specific function. My brain immediately jumps to the kernel's lockdep mechanism, which is what's flagging this imbalance.

The warning points directly to the line `q->q_usage_counter(io)` within the `blk_mq_unfreeze_queue` function. This is a critical piece of information. It's not just a random function call; it's happening during queue unfreezing, which is a sensitive operation. The fact that `q->q_usage_counter(io)` is involved suggests that the usage counter for the queue is being manipulated, and this manipulation is somehow leading to the unlock imbalance.

The traceback further hones in on the exact location: `nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623`. This confirms that the problematic code path originates from `nvme_update_ns_info`. My next logical step, then, is to dive into the `nvme_update_ns_info` function itself, specifically around line 2623 in `drivers/nvme/host/core.c`. I need to meticulously examine the locking and unlocking primitives used within this function, paying close attention to how the queue usage counter is managed and how that interacts with the broader block layer's locking mechanisms, particularly in the context of unfreezing. The goal is to pinpoint the exact sequence of operations that leads to lockdep detecting an unlock without a corresponding lock, or an unlock on a lock that isn't held by the current context.

map[ContextFile: Name:nvme_update_ns_info]

map[SourceCode:2539:	static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
2540:	{
2541:		bool unsupported = false;
2542:		int ret;
2543:	
2544:		switch (info->ids.csi) {
2545:		case NVME_CSI_ZNS:
2546:			if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
2547:				dev_info(ns->ctrl->device,
2548:		"block device for nsid %u not supported without CONFIG_BLK_DEV_ZONED\n",
2549:					info->nsid);
2550:				ret = nvme_update_ns_info_generic(ns, info);
2551:				break;
2552:			}
2553:			ret = nvme_update_ns_info_block(ns, info);
2554:			break;
2555:		case NVME_CSI_NVM:
2556:			ret = nvme_update_ns_info_block(ns, info);
2557:			break;
2558:		default:
2559:			dev_info(ns->ctrl->device,
2560:				"block device for nsid %u not supported (csi %u)\n",
2561:				info->nsid, info->ids.csi);
2562:			ret = nvme_update_ns_info_generic(ns, info);
2563:			break;
2564:		}
2565:	
2566:		/*
2567:		 * If probing fails due an unsupported feature, hide the block device,
2568:		 * but still allow other access.
2569:		 */
2570:		if (ret == -ENODEV) {
2571:			ns->disk->flags |= GENHD_FL_HIDDEN;
2572:			set_bit(NVME_NS_READY, &ns->flags);
2573:			unsupported = true;
2574:			ret = 0;
2575:		}
2576:	
2577:		if (!ret && nvme_ns_head_multipath(ns->head)) {
2578:			struct queue_limits *ns_lim = &ns->disk->queue->limits;
2579:			struct queue_limits lim;
2580:			unsigned int memflags;
2581:	
2582:			lim = queue_limits_start_update(ns->head->disk->queue);
2583:			memflags = blk_mq_freeze_queue(ns->head->disk->queue);
2584:			/*
2585:			 * queue_limits mixes values that are the hardware limitations
2586:			 * for bio splitting with what is the device configuration.
2587:			 *
2588:			 * For NVMe the device configuration can change after e.g. a
2589:			 * Format command, and we really want to pick up the new format
2590:			 * value here.  But we must still stack the queue limits to the
2591:			 * least common denominator for multipathing to split the bios
2592:			 * properly.
2593:			 *
2594:			 * To work around this, we explicitly set the device
2595:			 * configuration to those that we just queried, but only stack
2596:			 * the splitting limits in to make sure we still obey possibly
2597:			 * lower limitations of other controllers.
2598:			 */
2599:			lim.logical_block_size = ns_lim->logical_block_size;
2600:			lim.physical_block_size = ns_lim->physical_block_size;
2601:			lim.io_min = ns_lim->io_min;
2602:			lim.io_opt = ns_lim->io_opt;
2603:			queue_limits_stack_bdev(&lim, ns->disk->part0, 0,
2604:						ns->head->disk->disk_name);
2605:			if (lim.features & BLK_FEAT_ZONED)
2606:				nvme_stack_zone_resources(&lim, ns_lim);
2607:			if (unsupported)
2608:				ns->head->disk->flags |= GENHD_FL_HIDDEN;
2609:			else
2610:				nvme_init_integrity(ns->head, &lim, info);
2611:			lim.max_write_streams = ns_lim->max_write_streams;
2612:			lim.write_stream_granularity = ns_lim->write_stream_granularity;
2613:			ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
2614:			if (ret)
2615:				goto unfreeze_head_queue;
2616:	
2617:			set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
2618:			set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
2619:			nvme_mpath_revalidate_paths(ns->head);
2620:			ret = nvme_mpath_revalidate_zones(ns->head);
2621:	
2622:	unfreeze_head_queue:
2623:			blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
2624:		}
2625:	
2626:		return ret;
2627:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 6841
							output: 31
							thoughts: 458
						

**My Thought Process Regarding Multipath Namespace Updates in NVMe**

I'm analyzing this C code snippet dealing with NVMe multipath namespaces. My primary focus here is on the handling of the block queue's state, specifically around freezing and unfreezing it during namespace information updates.

I've just processed a block of code that appears to be within an `if` condition. The condition itself, `!ret && nvme_ns_head_multipath(ns->head)`, suggests that this block of code is executed only when there isn't an existing error (`!ret`) and the namespace (`ns`) in question is part of a multipath configuration (`nvme_ns_head_multipath(ns->head)`). This makes sense – multipath configurations often require more careful state management.

Inside this block, I see the creation of `struct queue_limits` variables, both local and derived from the namespace's head disk. There's a call to `queue_limits_start_update`. This implies a process of updating the queue limits, which is a critical operation as it directly affects how I/O is handled.

Then, I encounter `blk_mq_freeze_queue(ns->head->disk->queue)`. This is a significant step. Freezing the queue is a standard mechanism to temporarily halt all I/O operations to the device. This is crucial before making changes that could impact the device's state or its accessibility, such as updating capacity or read-only status.

My immediate thought after seeing `blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);` is to question its signature and the `memflags` argument. The `blk_mq_unfreeze_queue` function, in my experience with older kernel versions, typically only accepts the queue itself as an argument. The fact that it's being called with a second argument, `memflags`, immediately raises a red flag.

The compiler warning I'm seeing, `blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623`, confirms my suspicion. It explicitly points to the `blk_mq_unfreeze_queue` function in `blk-mq.h` and the call site within `nvme_update_ns_info`. This warning is likely indicating an API mismatch, a potential change in the function signature between kernel versions.

This leads me to re-examine the `blk_mq_freeze_queue` call. I'm wondering about its return value. Does it *always* return `memflags` in recent kernels? Or is it possible that in some recent kernel versions, it *doesn't* return anything, or its return value has changed its meaning entirely? The ambiguity here is concerning. If `blk_mq_freeze_queue` *is* meant to return a value like `memflags` in newer kernels, and `blk_mq_unfreeze_queue` *now* expects it, then the code is likely correct for those newer kernels. However, if the kernel version being targeted is older, or if `blk_mq_freeze_queue`'s behavior has been more subtle in its changes, this could be a bug.

The subsequent lines – updating capacity, setting read-only status, and revalidating paths and zones – all reinforce the idea that fundamental changes are being made to the namespace's representation and behavior. These operations *absolutely* require a stable, quiescent queue, hence the freeze/unfreeze mechanism.

The crucial point of my current thought process is the mismatch I perceive between my understanding of older kernel APIs and the code I'm observing, specifically the two-argument call to `blk_mq_unfreeze_queue` and the potential use of a return value from `blk_mq_freeze_queue`. I need to reconcile this with the possibility that the kernel API for block multi-queue handling has evolved, and this code is written to accommodate a newer interface. The warning is my primary guide, suggesting that the `blk_mq_unfreeze_queue` function signature has indeed changed.

map[ContextFile: Name:blk_mq_freeze_queue]

map[SourceCode: 951:	static inline unsigned int __must_check
 952:	blk_mq_freeze_queue(struct request_queue *q)
 953:	{
 954:		unsigned int memflags = memalloc_noio_save();
 955:	
 956:		blk_mq_freeze_queue_nomemsave(q);
 957:		return memflags;
 958:	}
 SourceFile:include/linux/blk-mq.h]

gemini-3.1-pro-preview

							input: 7454
							output: 32
							thoughts: 37
						

**My Thought Process Regarding `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` Flags**

Right, I need to get a firm grasp on how the memory flags are handled across these two functions in the blk-mq subsystem. My initial thought was that `blk_mq_freeze_queue` *returns* `memflags`, and then `blk_mq_unfreeze_queue` *takes* them. But I've just had a moment of clarity – that's not quite right.

Let me retrace: The `blk_mq_freeze_queue` function is the one that initiates the freezing process. When it's called, it needs to communicate certain memory-related constraints or capabilities to the underlying block layer or the hardware itself, ensuring that operations are suspended in a memory-aware manner. So, yes, it *communicates* `memflags`, but not by returning them in the sense of a direct output value that's then passed along verbatim. Instead, it's more about *setting* or *propagating* these flags as part of the freeze operation's context. Think of it as the freeze operation *itself* needing to know these flags to execute correctly.

Then, `blk_mq_unfreeze_queue` comes into play when we're resuming operations. This function needs to know how to *undo* the freeze, and crucially, how to re-establish normal operation considering any memory implications that were in effect during the freeze. So, it's not that it *receives* the flags that were *returned* by `freeze`. Instead, the `unfreeze` operation needs to be aware of the same *set* of memory flags that governed the freeze. It's about a shared context or understanding of the memory state, rather than a direct handover of a return value. The flags are likely passed down or managed within the blk-mq context that both functions operate within, ensuring consistency. My initial assumption of a simple "return/take" pattern was too literal and missed the underlying context-driven nature of how these flags are applied.

map[ContextFile: Name:blk_mq_unfreeze_queue]

map[SourceCode: 959:	static inline void
 960:	blk_mq_unfreeze_queue(struct request_queue *q, unsigned int memflags)
 961:	{
 962:		blk_mq_unfreeze_queue_nomemrestore(q);
 963:		memalloc_noio_restore(memflags);
 964:	}
 SourceFile:include/linux/blk-mq.h]

gemini-3.1-pro-preview

							input: 7629
							output: 36
							thoughts: 42
						

**My Thought Process**

Okay, so I'm delving into the intricacies of block layer queue management, specifically focusing on how a queue gets unfrozen after encountering memory pressure. My initial assumption might have been that a generic `unfreeze` function handles this. However, upon closer inspection of the code, I've realized that the critical function for this particular scenario, where we're explicitly *not* restoring memory, is `blk_mq_unfreeze_queue_nomemrestore`. This is a subtle but important distinction. It tells me that the system is designed to handle different unfreezing contexts, and this specific function is tailored for situations where the memory reclamation that might have led to the freeze is not being reversed or recovered. Therefore, my next step is to thoroughly examine `blk_mq_unfreeze_queue_nomemrestore` to understand its precise mechanisms and implications.

map[ContextFile: Name:blk_mq_unfreeze_queue_nomemrestore]

map[SourceCode: 230:	void blk_mq_unfreeze_queue_nomemrestore(struct request_queue *q)
 231:	{
 232:		if (__blk_mq_unfreeze_queue(q, false))
 233:			blk_unfreeze_release_lock(q);
 234:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 7802
							output: 33
							thoughts: 14
						

**My Internal Monologue - Deconstructing a Queue Unfreeze Operation**

Hmm, the specific function `__blk_mq_unfreeze_queue` just popped into my awareness. This immediately triggers a cascade of thoughts related to block layer queue management, particularly in the context of Multi-Queue (MQ) block layer.

My initial reaction is one of focused attention. The double underscore prefix (`__`) strongly suggests a private, internal function. This means it's not intended for direct use by external modules or drivers. Instead, it's likely a crucial component of the block layer's internal machinery, designed to be called by other internal block layer functions. This hints at a delicate, core operation that the block layer itself needs to orchestrate carefully.

The name itself, `unfreeze_queue`, is highly descriptive. I immediately associate "unfreeze" with the inverse operation of "freeze." So, my internal model of the block layer's state machine for a given request queue immediately brings to mind scenarios where a queue might be frozen. Why would a queue be frozen in the first place? My mind races through the possibilities:

*   **Error Handling/Recovery:** Perhaps a device has encountered a persistent error, and the block layer freezes the queue to prevent further I/O from being submitted and potentially exacerbating the problem. Unfreezing would then be part of the recovery process once the issue is resolved or mitigated.
*   **Resource Management:** In certain high-load or specific operational modes, the block layer might temporarily freeze a queue to manage system resources more effectively. This could be to allow other critical operations to complete or to prevent resource starvation.
*   **Device Hotplug/Removal:** While less common for "freezing," the concept of quiescing I/O is relevant here. Unfreezing would then signify that the queue is ready for I/O again after a device state change.
*   **System Suspend/Resume:** During system sleep states, I/O would certainly be suspended. `__blk_mq_unfreeze_queue` could be the mechanism that re-enables I/O once the system resumes.

Given the context of MQ, I know that this function is operating within a more sophisticated framework than the older, single-queue block layer. The MQ layer inherently supports multiple hardware queues, and the "queue" referred to here could be a logical queue within the block layer that maps to one or more underlying hardware queues. The unfreezing operation therefore needs to be mindful of the multi-queue nature and ensure that all relevant underlying queues are properly unfrozen and made available for I/O submission.

My next thought is about the implications of calling `__blk_mq_unfreeze_queue`. What does unfreezing entail? It's not just about flipping a flag. It likely involves:

*   **Re-enabling I/O Submission:** The primary effect is that new I/O requests can now be submitted to this queue.
*   **Rescheduling Pending I/O:** Any I/O requests that were waiting due to the frozen state might now be eligible to be processed or rescheduled. This could involve requeueing them back into the scheduler's consideration.
*   **State Management:** The internal state of the queue must be updated to reflect its active, un-frozen status. This might involve updating counters, flags, or pointers.
*   **Potential Interactions with Schedulers:** The I/O scheduler plays a crucial role. Unfreezing might require signaling the scheduler that the queue is ready again, allowing it to resume its scheduling decisions for that queue.
*   **Concurrency and Locking:** Since this is an internal block layer function, I'm certain that proper locking mechanisms are involved. Unfreezing a queue is a critical operation, and it must be done in a way that prevents race conditions with other parts of the block layer that might be trying to access or modify the same queue simultaneously. The function likely acquires necessary locks before proceeding and releases them afterwards.

I'm also considering the parameters this function might take. It would almost certainly need a reference to the `request_queue` structure itself. Perhaps it takes flags to indicate *how* to unfreeze, or if there are specific conditions to check. However, given the `__` prefix, it's probable that the calling function has already done the necessary validation and setup.

Ultimately, `__blk_mq_unfreeze_queue` represents a critical transition point in the lifecycle of a block layer request queue. It's a function that signals a return to operational readiness, a restoration of the flow of data to and from storage devices. Its implementation would be a testament to the robustness and careful design of the Linux block layer, especially in its modern MQ incarnation. I'm picturing the intricate dance of state transitions and synchronization primitives that must be in play to ensure this operation completes reliably and efficiently.

map[ContextFile: Name:__blk_mq_unfreeze_queue]

map[SourceCode: 211:	bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
 212:	{
 213:		bool unfreeze;
 214:	
 215:		mutex_lock(&q->mq_freeze_lock);
 216:		if (force_atomic)
 217:			q->q_usage_counter.data->force_atomic = true;
 218:		q->mq_freeze_depth--;
 219:		WARN_ON_ONCE(q->mq_freeze_depth < 0);
 220:		if (!q->mq_freeze_depth) {
 221:			percpu_ref_resurrect(&q->q_usage_counter);
 222:			wake_up_all(&q->mq_freeze_wq);
 223:		}
 224:		unfreeze = blk_unfreeze_check_owner(q);
 225:		mutex_unlock(&q->mq_freeze_lock);
 226:	
 227:		return unfreeze;
 228:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 8148
							output: 32
							thoughts: 79
						

**My Thought Process Regarding the `bad unlock balance detected!` Warning**

Ah, I've encountered an interesting situation here with this `bad unlock balance detected!` warning, specifically within the `blk_mq_unfreeze_queue` function. My initial thought process upon seeing this is to dissect what it implies. The warning itself screams "improper lock handling." It's indicating that at the point where `blk_mq_unfreeze_queue` is executing, it's attempting to release a lock that, according to the system's tracking, was never actually acquired or held.

My immediate next step, then, is to trace back the execution flow to understand how we arrived at this state. The warning points to `blk_unfreeze_release_lock(q)` as the specific operation that's failing. This function's name is quite explicit: its purpose is to *release* a lock. Therefore, the core of the problem is that this `blk_unfreeze_release_lock(q)` call is being made when the lock associated with queue `q` is *not* currently held by the thread of execution.

To fully grasp this, I need to delve into the implementation of `blk_unfreeze_release_lock` itself. I'll be examining its internal logic to see how it checks for the lock's status and what conditions would lead it to believe the lock is absent, thereby triggering this specific warning. This will likely involve looking at the underlying locking primitives and how they are managed throughout the block layer's queue freezing and unfreezing operations. I'm keen to understand the specific path that leads to `blk_unfreeze_release_lock` being invoked without a preceding `lock` operation.

map[ContextFile: Name:blk_unfreeze_release_lock]

map[SourceCode: 769:	static inline void blk_unfreeze_release_lock(struct request_queue *q)
 770:	{
 771:		if (!q->mq_freeze_queue_dying)
 772:			rwsem_release(&q->q_lockdep_map, _RET_IP_);
 773:		if (!q->mq_freeze_disk_dead)
 774:			rwsem_release(&q->io_lockdep_map, _RET_IP_);
 775:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 8401
							output: 32
							thoughts: 196
						

**My Thought Process Regarding the kworker Lock Warning**

Okay, so I'm looking at this warning: `kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at: ... blk_mq_unfreeze_queue`. My immediate thought is to trace this down. I see that `blk_mq_unfreeze_queue` is where the problematic release is happening, and it's associated with `&q->io_lockdep_map`, which is being referred to as `&q->q_usage_counter(io)` in this context.

Now, the core question is: why is this lock release unbalanced? The typical flow suggests that `blk_mq_freeze_queue` acquires this lock, and consequently, `blk_mq_unfreeze_queue` should release it. This is the standard acquire/release pattern I'd expect.

However, I'm noticing a conditional path here. The actual release mechanism, `rwsem_release(&q->io_lockdep_map, _RET_IP_)`, isn't directly called by `blk_mq_unfreeze_queue` itself. Instead, I see that `blk_unfreeze_release_lock` is called *if* `__blk_mq_unfreeze_queue` returns `true`. And what determines if `__blk_mq_unfreeze_queue` returns true? It's the result of `blk_unfreeze_check_owner(q)`.

This is the crucial piece. The lock release is conditional. The `kworker` is attempting to release a lock that might not have been properly acquired in this specific execution path, or perhaps it's being released when it shouldn't be. The fact that it's being called from `blk_mq_unfreeze_queue` and involves a check for ownership (`blk_unfreeze_check_owner`) suggests that there's a scenario where the expected ownership or acquisition of this `q_usage_counter(io)` lock is not met, leading to the lockdep warning about an unbalanced operation. I need to investigate the conditions under which `blk_unfreeze_check_owner(q)` could return true, leading to this seemingly premature or unwarranted release.

map[ContextFile: Name:blk_unfreeze_check_owner]

map[SourceCode: 137:	/* verify the last unfreeze in owner context */
 138:	static bool blk_unfreeze_check_owner(struct request_queue *q)
 139:	{
 140:		if (q->mq_freeze_owner != current)
 141:			return false;
 142:		if (--q->mq_freeze_owner_depth == 0) {
 143:			q->mq_freeze_owner = NULL;
 144:			return true;
 145:		}
 146:		return false;
 147:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 8795
							output: 35
							thoughts: 56
						

**My Thought Process Unfolding: Delving into `blk_mq_freeze_queue`**

Alright, so the immediate thought that surfaces as I examine `blk_mq_freeze_queue` is the explicit mechanism for ownership and depth tracking. The function, without question, establishes `q->mq_freeze_owner` as `current`. This is a critical piece of information, signaling that the current process is taking exclusive control or responsibility for the freeze operation on this particular queue. Simultaneously, the increment of `q->mq_freeze_owner_depth` indicates a hierarchical or layered approach to freezing. This isn't just a simple on/off switch; there's a counter at play, suggesting that multiple entities or nested operations might be involved in the freezing process, each contributing to the overall depth.

However, my mind immediately pivots. The presence of `blk_mq_freeze_queue` implies there's likely a counterpart, a variation that handles the same core functionality but perhaps with a different set of constraints or optimizations. This is where `blk_mq_freeze_queue_nomemsave` comes into play. The name itself is a significant clue. The "nomemsave" suffix strongly suggests that this alternative function forgoes any memory-saving operations that might be inherent in the primary `blk_mq_freeze_queue`. This could imply a performance trade-off: perhaps `blk_mq_freeze_queue_nomemsave` is faster because it avoids certain overheads associated with memory management during the freeze, or it might be intended for scenarios where memory isn't a primary concern, and speed is paramount. I'm now keenly interested in understanding the precise implications of this "nomemsave" distinction. Does it affect the state of the queue, the behavior of subsequent operations, or simply the execution path within the freeze logic? The next step is to trace the execution within `blk_mq_freeze_queue_nomemsave` and compare its behavior and internal state changes to that of its parent function, paying close attention to any divergences that arise specifically due to the absence of memory saving.

map[ContextFile: Name:blk_mq_freeze_queue_nomemsave]

map[SourceCode: 204:	void blk_mq_freeze_queue_nomemsave(struct request_queue *q)
 205:	{
 206:		blk_freeze_queue_start(q);
 207:		blk_mq_freeze_queue_wait(q);
 208:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 8976
							output: 31
							thoughts: 10
						

**My Thought Process on `blk_freeze_queue_start`**

Ah, `blk_freeze_queue_start`. I'm seeing this function signature and immediately my mind goes to a few key areas. My initial thought is, "Okay, this is clearly part of the block layer's freezing mechanism." The name itself, `blk_freeze_queue_start`, is quite descriptive.

So, I'm mentally picturing the context: we're in the midst of a system-wide freeze operation. This function is likely being invoked to signal the *beginning* of this freezing process for a specific block queue. It's not the whole freeze; it's the initiation point for a particular queue. This implies that there will be subsequent steps, likely involving other queues or the overall system state.

My expertise tells me that block layer freezing is a critical operation for quiescing I/O operations. This is essential for things like snapshots, suspend-to-disk (hibernate), or even certain types of debugging or migration scenarios. The goal is to ensure that no new I/O requests are initiated or processed by the block device represented by this queue, or at least, to bring it to a controlled, stoppable state.

Therefore, when I encounter `blk_freeze_queue_start`, I'm expecting to see logic that:

1.  **Marks the queue as being in a frozen state:** There must be some internal state flag or counter within the block queue structure itself that gets updated to indicate it's entering the freeze phase. This is crucial for other parts of the block layer and potentially the I/O scheduler to understand the current operational mode.
2.  **Potentially acquires necessary locks:** Freezing a queue often involves synchronizing access to its internal data structures. I'd be looking for lock acquisitions (e.g., spinlocks, mutexes) to ensure atomicity and prevent race conditions during this transition.
3.  **Initiates the stopping of outstanding I/O:** While `blk_freeze_queue_start` might be the *start*, it's likely that the actual stopping of active I/O requests happens here or is signaled to begin. This could involve flushing pending requests, preventing new ones from being issued, or waiting for existing ones to complete gracefully.
4.  **May involve signaling other components:** The block layer is part of a larger ecosystem. This function might need to signal to the I/O scheduler, or even higher layers like filesystem drivers, that the queue is about to become inactive. This is important for coordinated shutdown.
5.  **Is likely called with appropriate context:** The caller of this function is probably a higher-level freezing mechanism. The context in which `blk_freeze_queue_start` is called is important – is it an interrupt context, a process context, or something else? This will influence the type of operations that can be safely performed within the function.

In essence, `blk_freeze_queue_start` is the entry point to my mental model of bringing a specific block device's I/O operations to a halt in a controlled manner, preparing it for a quiescent state. It's a signal that the "pause" button is being pressed for this particular piece of hardware, and the subsequent actions will ensure that the system can safely proceed with whatever operation requires this quiescence.

map[ContextFile: Name:blk_freeze_queue_start]

map[SourceCode: 182:	void blk_freeze_queue_start(struct request_queue *q)
 183:	{
 184:		if (__blk_freeze_queue_start(q, current))
 185:			blk_freeze_acquire_lock(q);
 186:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 9105
							output: 32
							thoughts: 11
						

**My Thought Process on `__blk_freeze_queue_start`**

Right, so I'm looking at this `__blk_freeze_queue_start` function. My initial reaction is to understand its fundamental purpose. It's clearly part of the block layer's freeze/unfreeze mechanism, which is essential for tasks like suspend-to-disk or snapshots where we need to halt I/O operations gracefully.

My immediate thought is, "What exactly does this function *do* to achieve that freeze?" I'm expecting it to be the point where the decision is made to *begin* the freezing process for a specific block device queue. It's not likely to be the *entire* freeze logic, but rather the trigger or the initial state change.

I'm thinking about the implications of calling this. If I'm in a situation where I need to freeze a queue, this is likely the entry point I'd be interacting with, or at least the internal function that gets called by a higher-level freeze request. It suggests a state transition is imminent.

My internal monologue then turns to the parameters it might take. It's going to need to know *which* queue to freeze. So, a pointer to the `struct request_queue` is almost a certainty. What else? Perhaps some flags to indicate the *type* of freeze, or specific conditions that need to be met before proceeding. For example, are we dealing with a graceful freeze that allows existing requests to complete, or a more immediate, potentially data-lossy freeze?

I'm also contemplating the return value. What would be a meaningful success or failure indicator here? A zero return usually signifies success, but what would constitute failure? Perhaps the queue is already frozen, or there's some unrecoverable error in the device or queue state that prevents freezing.

The name itself, `__blk_freeze_queue_start`, is quite informative. The `__` prefix strongly suggests this is an internal, low-level helper function, not intended for direct external use by application-level code. It's likely called by other, more public freeze functions within the block layer. The "start" part reinforces my belief that this is the initiation point, the signal that the freezing process is officially underway for this particular queue.

So, to summarize my immediate thoughts: this function is the internal gateway to initiating the freezing of a block device queue. It's likely to accept the target queue and potentially some control flags, and it will signal whether the freezing process has begun successfully, implying a subsequent series of actions will occur to actually stop the I/O. It's a crucial piece of the block layer's state management for I/O suspension.

map[ContextFile: Name:__blk_freeze_queue_start]

map[SourceCode: 163:	bool __blk_freeze_queue_start(struct request_queue *q,
 164:				      struct task_struct *owner)
 165:	{
 166:		bool freeze;
 167:	
 168:		mutex_lock(&q->mq_freeze_lock);
 169:		freeze = blk_freeze_set_owner(q, owner);
 170:		if (++q->mq_freeze_depth == 1) {
 171:			percpu_ref_kill(&q->q_usage_counter);
 172:			mutex_unlock(&q->mq_freeze_lock);
 173:			if (queue_is_mq(q))
 174:				blk_mq_run_hw_queues(q, false);
 175:		} else {
 176:			mutex_unlock(&q->mq_freeze_lock);
 177:		}
 178:	
 179:		return freeze;
 180:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 9426
							output: 31
							thoughts: 10
						

**My Thought Process on `blk_freeze_set_owner`**

Alright, let's dive into this `blk_freeze_set_owner` function. My initial reaction is to understand its purpose within the block layer's freeze/unfreeze mechanism. Given the name, I'm immediately thinking about how it's intended to manage ownership during these freeze operations, likely to ensure that only the designated owner can interact with a block device in a specific state.

My first question would be: what exactly constitutes "ownership" in this context? Is it about which process or subsystem initiated the freeze? Is it tied to specific I/O operations or configurations? I'd be looking for the logic that establishes and verifies this ownership.

I'd also consider the implications of this ownership. Why is it necessary? Is it to prevent race conditions where multiple entities might try to manipulate the frozen device? Is it for security, to limit access? Or perhaps it's a way to serialize operations when the device is in a sensitive state.

When I examine the implementation, I'll be scrutinizing how the `owner` itself is represented and passed. Is it a simple identifier, a pointer, or something more complex? I'd also pay close attention to the error handling. What happens if the wrong entity tries to set or interact with the owner of a frozen device? Are there specific return codes or error paths I should be aware of?

Furthermore, I'd be curious about the lifecycle of this ownership. When is it set? When is it cleared? Does it persist across multiple freeze/unfreeze cycles, or is it tied to a single operation? I'd be looking for the counterpart function, presumably `blk_freeze_clear_owner` or something similar, to understand the full scope.

Ultimately, my goal with `blk_freeze_set_owner` is to understand its role as a gatekeeper, ensuring the integrity and predictable behavior of block devices during freeze operations by enforcing a strict ownership model. I'd be evaluating its design for robustness, clarity, and its contribution to the overall stability of the block layer.

map[ContextFile: Name:blk_freeze_set_owner]

map[SourceCode: 116:	static bool blk_freeze_set_owner(struct request_queue *q,
 117:					 struct task_struct *owner)
 118:	{
 119:		if (!owner)
 120:			return false;
 121:	
 122:		if (!q->mq_freeze_depth) {
 123:			q->mq_freeze_owner = owner;
 124:			q->mq_freeze_owner_depth = 1;
 125:			q->mq_freeze_disk_dead = !q->disk ||
 126:				test_bit(GD_DEAD, &q->disk->state) ||
 127:				!blk_queue_registered(q);
 128:			q->mq_freeze_queue_dying = blk_queue_dying(q);
 129:			return true;
 130:		}
 131:	
 132:		if (owner == q->mq_freeze_owner)
 133:			q->mq_freeze_owner_depth += 1;
 134:		return false;
 135:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 9778
							output: 31
							thoughts: 833
						

**My Thoughts on Block Freeze Lock Balancing**

Okay, so I've been digging into this block freeze mechanism, and specifically the lock balancing. It's been a bit of a winding road to get here, but I think I'm starting to piece together the logic, and more importantly, the potential pitfalls.

My initial thought process was to understand what makes `blk_freeze_set_owner` return `true`. I first assumed it was solely based on the `mq_freeze_depth` being zero, meaning it's the very first freeze. But then I realized it's a bit more nuanced: it returns `true` if it's the *first* freeze (`!q->mq_freeze_depth`) *or* if the current `owner` is the *same* as the existing `q->mq_freeze_owner`.

Then, I looked at the behavior when `q->mq_freeze_depth > 0`. In this scenario, if the `owner` *matches* `q->mq_freeze_owner`, the function increments `owner_depth` but returns `false`. This `false` return value is crucial, as it propagates up to `blk_freeze_queue_start`, which then *doesn't* call `blk_freeze_acquire_lock`. This is where my confusion started – it seems like for nested freezes by the same owner, the lock isn't acquired. This initially felt wrong, but then I started thinking about the unfreeze path.

Looking at `blk_unfreeze_check_owner`, I saw that it decrements `q->mq_freeze_owner_depth`. If this depth reaches zero, it resets `q->mq_freeze_owner` to `NULL` and returns `true`. This `true` return then triggers `blk_unfreeze_release_lock`. This is where the balance becomes apparent: if the `owner_depth` was initially 2, the first unfreeze brings it to 1 and returns `false`, no lock release. The *second* unfreeze brings it to 0, returns `true`, and *then* `blk_unfreeze_release_lock` is called. This means `blk_freeze_acquire_lock` is called exactly once (during the initial freeze when `!q->mq_freeze_depth`), and `blk_unfreeze_release_lock` is also called exactly once (when `owner_depth` finally hits zero). This feels perfectly balanced for the same owner.

Then I considered the case where `blk_freeze_set_owner` is called with a `depth > 0` but a *different* `owner`. In this situation, `blk_freeze_set_owner` returns `false`, and `blk_freeze_acquire_lock` is skipped. When this *other* owner later tries to unfreeze, `blk_unfreeze_check_owner` will see that `q->mq_freeze_owner != current`, returning `false`. Consequently, `blk_unfreeze_release_lock` isn't called. Again, this seems balanced – the lock wasn't acquired by this different owner, so it's not released.

I also explored the edge case where `q->mq_freeze_depth` is 0, but `blk_freeze_set_owner` is called with `owner = NULL`. It returns `false`, `blk_freeze_acquire_lock` isn't called, and similarly, `blk_unfreeze_check_owner` returns `false`, preventing `blk_unfreeze_release_lock`. So, even in this scenario, the lock paths seem to be handled correctly.

This leads me to the core of the problem: the "bad unlock balance detected!" warning. This implies that `blk_unfreeze_release_lock` is being called, but the lock was *not* held by the current task. `blk_unfreeze_release_lock` ultimately calls `rwsem_release`. If `q->mq_freeze_owner == current`, it implies that `current` was indeed the one who set the owner. And if `owner_depth` reached 0, it means `current` was the *original* freezer. Logically, if `current` was the original freezer, they *must* have acquired the lock. So, why wouldn't they still hold it when `blk_unfreeze_release_lock` is called? This is where I need to focus my attention next: a deep dive into `blk_freeze_acquire_lock` to understand precisely how and when it takes ownership of the lock.

map[ContextFile: Name:blk_freeze_acquire_lock]

map[SourceCode: 761:	static inline void blk_freeze_acquire_lock(struct request_queue *q)
 762:	{
 763:		if (!q->mq_freeze_disk_dead)
 764:			rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
 765:		if (!q->mq_freeze_queue_dying)
 766:			rwsem_acquire(&q->q_lockdep_map, 0, 1, _RET_IP_);
 767:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 10795
							output: 32
							thoughts: 1068
						

**My Thoughts on Lock Management in `blk_mq` Freezing**

Okay, I've been digging into how the `blk_mq` freezing mechanism handles its locks, and I'm piecing together the logic. Initially, I observed that `blk_freeze_acquire_lock` and `blk_unfreeze_release_lock` both seem to be checking the same critical flags: `!q->mq_freeze_disk_dead` and `!q->mq_freeze_queue_dying`. This immediately made me wonder about potential race conditions. What if one of these flags changed between the moment I acquire the lock and the moment I'm supposed to release it?

My first thought was that this could lead to an incorrect lock release, or worse, a failure to release the lock when it should be. However, I then looked at where these flags are actually set: in `blk_freeze_set_owner`. The code there clearly shows that `q->mq_freeze_disk_dead` and `q->mq_freeze_queue_dying` are populated based on the queue's state *at the time of freezing*. Since both the acquire and release operations read these flags directly from the `request_queue` structure (`q`), they are effectively reading the *same snapshot* of these flags as they were when the freeze was initiated. This provides a strong guarantee that these specific flags won't change in a problematic way between acquiring and releasing the lock within a single freeze/unfreeze cycle initiated by the same task.

Then I started considering external influences. What if another task tries to call `blk_freeze_set_owner` concurrently? My analysis suggests this is prevented. If `!q->mq_freeze_depth` is false (meaning there's already an active freeze), the `blk_freeze_set_owner` function simply won't update the flags or set a new owner. So, the flags remain consistent for the existing freeze.

My next question was about the depth management. What happens if `q->mq_freeze_depth` drops to zero, and then *another* task initiates a freeze? My understanding is that this simply starts a new, independent freeze cycle. The flags would be re-evaluated and updated accordingly for that new cycle.

This led me to a different concern: could `blk_mq_unfreeze_queue` be called more times than `blk_mq_freeze_queue` *by the same task*? I've examined the `blk_unfreeze_check_owner` logic for this scenario. If `blk_mq_unfreeze_queue` is called without a corresponding freeze by the same task, `blk_unfreeze_check_owner` checks if `q->mq_freeze_owner != current`. If no one owns the freeze (`q->mq_freeze_owner` is NULL), or if a different task owns it, this check correctly returns `false`, preventing an unlock.

I then dug deeper into the case where `q->mq_freeze_owner == current`, but the `owner_depth` is already zero. My deduction here is that if `owner_depth` is zero, `q->mq_freeze_owner` *must* also be NULL. Therefore, the check `q->mq_freeze_owner != current` would be `true` (since `current` is a valid task pointer and not NULL), and `blk_unfreeze_check_owner` would correctly return `false`, preventing an erroneous release.

So, how could `q->mq_freeze_owner == current` possibly be true if `current` didn't actually acquire the lock? The only way for `q->mq_freeze_owner` to be set to `current` is if `current` initiated a freeze using `blk_mq_freeze_queue` when `!q->mq_freeze_depth` was true, which *explicitly means the lock was acquired*.

Let's trace a sequence of events:
1.  `current` calls `blk_mq_freeze_queue`. `!q->mq_freeze_depth` is true. Owner is set, depth becomes 1, and the lock is acquired.
2.  `current` calls `blk_mq_unfreeze_queue`. Depth is decremented to 0. The check passes, and the lock is released.
3.  `current` calls `blk_mq_unfreeze_queue` *again*. Now, `q->mq_freeze_owner` is NULL (because depth is 0). The `q->mq_freeze_owner != current` check will be `true`, and the function will correctly return `false`, preventing a double unlock.

Finally, I considered the scenario where `current` calls `blk_mq_freeze_queue` twice *without* an intervening unfreeze.
1.  First call: `!q->mq_freeze_depth` is true. Owner is set, depth becomes 1, lock is acquired.
2.  Second call: `owner == current` is true. Depth is incremented to 2. The lock is *not* re-acquired.
Now, if `current` calls `blk_mq_unfreeze_queue` three times:
1.  First call: Depth decremented to 1. The check returns `false`. Lock is not released.
2.  Second call: Depth decremented to 0. The check returns `true`. The lock is released.
3.  Third call: `q->mq_freeze_owner` is now NULL. The check returns `false`. Lock is not released again.

It seems that with the current logic, an unbalanced unlock (calling `unfreeze` more times than `freeze` for the *same* owner) shouldn't occur. My next step is to investigate specific call paths, like within `nvme_update_ns_info`, to see if there are any subtle interactions that might lead to an unexpected state or an unbalanced lock.

map[ContextFile: Name:nvme_update_ns_info]

map[SourceCode:2539:	static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
2540:	{
2541:		bool unsupported = false;
2542:		int ret;
2543:	
2544:		switch (info->ids.csi) {
2545:		case NVME_CSI_ZNS:
2546:			if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
2547:				dev_info(ns->ctrl->device,
2548:		"block device for nsid %u not supported without CONFIG_BLK_DEV_ZONED\n",
2549:					info->nsid);
2550:				ret = nvme_update_ns_info_generic(ns, info);
2551:				break;
2552:			}
2553:			ret = nvme_update_ns_info_block(ns, info);
2554:			break;
2555:		case NVME_CSI_NVM:
2556:			ret = nvme_update_ns_info_block(ns, info);
2557:			break;
2558:		default:
2559:			dev_info(ns->ctrl->device,
2560:				"block device for nsid %u not supported (csi %u)\n",
2561:				info->nsid, info->ids.csi);
2562:			ret = nvme_update_ns_info_generic(ns, info);
2563:			break;
2564:		}
2565:	
2566:		/*
2567:		 * If probing fails due an unsupported feature, hide the block device,
2568:		 * but still allow other access.
2569:		 */
2570:		if (ret == -ENODEV) {
2571:			ns->disk->flags |= GENHD_FL_HIDDEN;
2572:			set_bit(NVME_NS_READY, &ns->flags);
2573:			unsupported = true;
2574:			ret = 0;
2575:		}
2576:	
2577:		if (!ret && nvme_ns_head_multipath(ns->head)) {
2578:			struct queue_limits *ns_lim = &ns->disk->queue->limits;
2579:			struct queue_limits lim;
2580:			unsigned int memflags;
2581:	
2582:			lim = queue_limits_start_update(ns->head->disk->queue);
2583:			memflags = blk_mq_freeze_queue(ns->head->disk->queue);
2584:			/*
2585:			 * queue_limits mixes values that are the hardware limitations
2586:			 * for bio splitting with what is the device configuration.
2587:			 *
2588:			 * For NVMe the device configuration can change after e.g. a
2589:			 * Format command, and we really want to pick up the new format
2590:			 * value here.  But we must still stack the queue limits to the
2591:			 * least common denominator for multipathing to split the bios
2592:			 * properly.
2593:			 *
2594:			 * To work around this, we explicitly set the device
2595:			 * configuration to those that we just queried, but only stack
2596:			 * the splitting limits in to make sure we still obey possibly
2597:			 * lower limitations of other controllers.
2598:			 */
2599:			lim.logical_block_size = ns_lim->logical_block_size;
2600:			lim.physical_block_size = ns_lim->physical_block_size;
2601:			lim.io_min = ns_lim->io_min;
2602:			lim.io_opt = ns_lim->io_opt;
2603:			queue_limits_stack_bdev(&lim, ns->disk->part0, 0,
2604:						ns->head->disk->disk_name);
2605:			if (lim.features & BLK_FEAT_ZONED)
2606:				nvme_stack_zone_resources(&lim, ns_lim);
2607:			if (unsupported)
2608:				ns->head->disk->flags |= GENHD_FL_HIDDEN;
2609:			else
2610:				nvme_init_integrity(ns->head, &lim, info);
2611:			lim.max_write_streams = ns_lim->max_write_streams;
2612:			lim.write_stream_granularity = ns_lim->write_stream_granularity;
2613:			ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
2614:			if (ret)
2615:				goto unfreeze_head_queue;
2616:	
2617:			set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
2618:			set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
2619:			nvme_mpath_revalidate_paths(ns->head);
2620:			ret = nvme_mpath_revalidate_zones(ns->head);
2621:	
2622:	unfreeze_head_queue:
2623:			blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
2624:		}
2625:	
2626:		return ret;
2627:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 13406
							output: 32
							thoughts: 139
						

**My Thought Process Unraveling `blk_mq_freeze_queue` and Multipath Queues**

Okay, so I'm looking at this code flow, and I see `blk_mq_freeze_queue` being called, and it's being called on `ns->head->disk->queue`. That's interesting. Then, immediately after, `blk_mq_unfreeze_queue` is also called on the exact same `ns->head->disk->queue`.

My first reaction is a flicker of doubt: could it be that `ns->head->disk->queue` *isn't* actually a blk-mq queue? Because if it's not a blk-mq queue, then calling these blk-mq specific functions on it would be… problematic, to say the least. It doesn't feel right.

But then I remind myself of the current state of things. Multipath queues – aren't they blk-mq queues now? I pause for a second, questioning that assumption. Wait, no, hold on a minute. My understanding is that multipath queues themselves are traditionally bio-based, not necessarily blk-mq from the ground up. This is where the confusion starts to bubble up.

So, if multipath queues are bio-based, but `blk_mq_freeze_queue` is being called on `ns->head->disk->queue`, which *is* the multipath queue… then how does that work? Is there an abstraction layer I'm missing?

This leads me to a crucial point of clarification: *is* `ns->head->disk->queue` truly the multipath queue, or is it something else that the multipath layer is exposing and that *happens* to be a blk-mq queue?

My immediate next step, to resolve this fundamental uncertainty, is to dive into the implementation. I need to find the definition and allocation of `ns->head->disk->queue`. The most logical place to start looking for how this queue is set up, especially in the context of NVMe namespaces, is within the `nvme_alloc_ns_head` function. That's where I'll find the definitive answer about what kind of queue `ns->head->disk->queue` actually is.

map[ContextFile: Name:nvme_alloc_ns_head]

map[SourceCode:4002:	static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ns *ns,
4003:			struct nvme_ns_info *info)
4004:		__must_hold(&ns->ctrl->subsys->lock)
4005:	{
4006:		struct nvme_ctrl *ctrl = ns->ctrl;
4007:		struct nvme_ns_head *head;
4008:		size_t size = sizeof(*head);
4009:		int ret = -ENOMEM;
4010:	
4011:	#ifdef CONFIG_NVME_MULTIPATH
4012:		size += nr_node_ids * sizeof(struct nvme_ns *);
4013:	#endif
4014:	
4015:		head = kzalloc(size, GFP_KERNEL);
4016:		if (!head)
4017:			goto out;
4018:		ret = ida_alloc_min(&ctrl->subsys->ns_ida, 1, GFP_KERNEL);
4019:		if (ret < 0)
4020:			goto out_free_head;
4021:		head->instance = ret;
4022:		INIT_LIST_HEAD(&head->list);
4023:		ret = init_srcu_struct(&head->srcu);
4024:		if (ret)
4025:			goto out_ida_remove;
4026:		head->subsys = ctrl->subsys;
4027:		head->ns_id = info->nsid;
4028:		head->ids = info->ids;
4029:		head->shared = info->is_shared;
4030:		head->rotational = info->is_rotational;
4031:		ratelimit_state_init(&head->rs_nuse, 5 * HZ, 1);
4032:		ratelimit_set_flags(&head->rs_nuse, RATELIMIT_MSG_ON_RELEASE);
4033:		kref_init(&head->ref);
4034:		ns->head = head;
4035:	
4036:		if (head->ids.csi) {
4037:			ret = nvme_get_effects_log(ctrl, head->ids.csi, &head->effects);
4038:			if (ret)
4039:				goto out_cleanup_srcu;
4040:		} else
4041:			head->effects = ctrl->effects;
4042:	
4043:		if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
4044:			ret = nvme_query_fdp_info(ns, info);
4045:			if (ret < 0)
4046:				goto out_cleanup_srcu;
4047:		}
4048:	
4049:		ret = nvme_mpath_alloc_disk(ctrl, head);
4050:		if (ret)
4051:			goto out_cleanup_fdp;
4052:	
4053:		list_add_tail(&head->entry, &ctrl->subsys->nsheads);
4054:	
4055:		kref_get(&ctrl->subsys->ref);
4056:	
4057:		return head;
4058:	out_cleanup_fdp:
4059:		kfree(head->plids);
4060:	out_cleanup_srcu:
4061:		cleanup_srcu_struct(&head->srcu);
4062:	out_ida_remove:
4063:		ida_free(&ctrl->subsys->ns_ida, head->instance);
4064:	out_free_head:
4065:		kfree(head);
4066:		ns->head = NULL;
4067:	out:
4068:		if (ret > 0)
4069:			ret = blk_status_to_errno(nvme_error_status(ret));
4070:		return ERR_PTR(ret);
4071:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 14689
							output: 33
							thoughts: 15
						

**My Thought Process on `nvme_mpath_alloc_disk`**

Alright, my first inclination here is to dive straight into the `nvme_mpath_alloc_disk` function. I need to understand how this particular component handles the allocation of disks within an NVMe multipath configuration. My expertise in this area tells me that the intricacies of device mapping and resource management are crucial, so I'll be looking for specific details on how it identifies, registers, and potentially manages multiple paths to the same underlying NVMe storage. I'm anticipating examining its role in presenting a unified block device to the system, abstracting away the underlying multipathing complexity. I'll be paying close attention to any data structures it employs, how it interacts with other kernel subsystems like the NVMe driver itself and the block layer, and its error handling mechanisms. The goal is to get a clear, detailed picture of its internal workings and its contribution to the overall NVMe multipathing solution.

map[ContextFile: Name:nvme_mpath_alloc_disk]

map[SourceCode: 734:	int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
 735:	{
 736:		struct queue_limits lim;
 737:	
 738:		mutex_init(&head->lock);
 739:		spin_lock_init(&head->requeue_lock);
 740:		INIT_WORK(&head->requeue_work, nvme_requeue_work);
 741:		INIT_WORK(&head->partition_scan_work, nvme_partition_scan_work);
 742:		INIT_DELAYED_WORK(&head->remove_work, nvme_remove_head_work);
 743:	
 744:		/*
 745:		 * If "multipath_always_on" is enabled, a multipath node is added
 746:		 * regardless of whether the disk is single/multi ported, and whether
 747:		 * the namespace is shared or private. If "multipath_always_on" is not
 748:		 * enabled, a multipath node is added only if the subsystem supports
 749:		 * multiple controllers and the "multipath" option is configured. In
 750:		 * either case, for private namespaces, we ensure that the NSID is
 751:		 * unique.
 752:		 */
 753:		if (!multipath_always_on) {
 754:			if (!(ctrl->subsys->cmic & NVME_CTRL_CMIC_MULTI_CTRL) ||
 755:					!multipath)
 756:				return 0;
 757:		}
 758:	
 759:		if (!nvme_is_unique_nsid(ctrl, head))
 760:			return 0;
 761:	
 762:		blk_set_stacking_limits(&lim);
 763:		lim.dma_alignment = 3;
 764:		lim.features |= BLK_FEAT_IO_STAT | BLK_FEAT_NOWAIT |
 765:			BLK_FEAT_POLL | BLK_FEAT_ATOMIC_WRITES | BLK_FEAT_PCI_P2PDMA;
 766:		if (head->ids.csi == NVME_CSI_ZNS)
 767:			lim.features |= BLK_FEAT_ZONED;
 768:	
 769:		head->disk = blk_alloc_disk(&lim, ctrl->numa_node);
 770:		if (IS_ERR(head->disk))
 771:			return PTR_ERR(head->disk);
 772:		head->disk->fops = &nvme_ns_head_ops;
 773:		head->disk->private_data = head;
 774:	
 775:		/*
 776:		 * We need to suppress the partition scan from occuring within the
 777:		 * controller's scan_work context. If a path error occurs here, the IO
 778:		 * will wait until a path becomes available or all paths are torn down,
 779:		 * but that action also occurs within scan_work, so it would deadlock.
 780:		 * Defer the partition scan to a different context that does not block
 781:		 * scan_work.
 782:		 */
 783:		set_bit(GD_SUPPRESS_PART_SCAN, &head->disk->state);
 784:		sprintf(head->disk->disk_name, "nvme%dn%d",
 785:				ctrl->subsys->instance, head->instance);
 786:		nvme_get_ns_head(head);
 787:		return 0;
 788:	}
 SourceFile:drivers/nvme/host/multipath.c]

gemini-3.1-pro-preview

							input: 15740
							output: 29
							thoughts: 53
						

**My Thought Process Regarding `blk_alloc_disk`**

My immediate reaction upon seeing `head->disk = blk_alloc_disk(&lim, ctrl->numa_node);` is one of intense curiosity. I'm trying to pinpoint the fundamental nature of what `blk_alloc_disk` is doing. Specifically, I'm wondering if this allocation is the very genesis of a blk-mq queue. To satisfy this, my next logical step, my immediate internal directive, is to dive into the implementation of `blk_alloc_disk` itself and scrutinize its workings.

log-in to see details

map[ContextFile: Name:blk_alloc_disk]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 15827
							output: 22
							thoughts: 16
						

**My Thought Process Regarding `blk_alloc_disk`**

My initial reaction upon encountering `blk_alloc_disk` was a momentary pause. I recognized it wasn't a standard, standalone function in the way many other kernel interfaces are. My immediate thought was, "Hold on, is this a true function call, or is it more of a shorthand?" I then clarified in my mind that `blk_alloc_disk` is, in fact, a macro or an inline function. This distinction is important because it affects how the code is processed and potentially optimized by the compiler. Knowing it's a macro or inline means the code it represents will likely be expanded directly at the call site, rather than incurring the overhead of a traditional function call. This is a subtle but critical detail for understanding the low-level mechanics and performance characteristics of the block layer.

map[Expression:#define blk_alloc_disk]

map[Output:include/linux/blkdev.h=980=struct gendisk *__blk_alloc_disk(struct queue_limits *lim, int node,
--
include/linux/blkdev.h-994- */
include/linux/blkdev.h:995:#define blk_alloc_disk(lim, node_id)					\
include/linux/blkdev.h-996-({									\
]

gemini-3.1-pro-preview

							input: 15964
							output: 30
							thoughts: 12
						

**My Thought Process on `__blk_alloc_disk`**

Right, so I'm trying to get a handle on how this block device allocation is happening, and my focus has naturally landed on the `__blk_alloc_disk` function. I need to understand the mechanics behind it, the decisions it makes, and the resources it manages.

My initial thought is to scrutinize its purpose: what exactly is it *doing*? It's clearly involved in the allocation of disk-related structures. I'm assuming it's responsible for setting up the essential data structures that represent a block device within the kernel, getting them ready for use. This likely involves memory allocation, initializing fields, and possibly linking it into some internal kernel lists or structures.

I'll be looking for the parameters it takes. What information does it need to perform this allocation? It's probably going to involve things like the size of the device, perhaps some unique identifiers, and any specific flags or configuration options that dictate how this particular block device should behave.

Then, I'll dive into the core of its operation. What are the specific steps it executes? This is where the real meat of the process lies. I expect to see calls to memory allocation functions, like `kmalloc` or similar, to secure the necessary memory for the disk structure itself and any associated data. I'll also be keen to see how it initializes the various members of this structure. This could involve setting default values, populating fields with information passed in as arguments, and perhaps even performing some basic validation.

Furthermore, I'll be examining how it handles errors. What happens if memory allocation fails? Or if the provided parameters are invalid? A robust allocation function needs to gracefully handle these scenarios, returning appropriate error codes and ensuring the system remains in a consistent state. I’m looking for clear error handling paths and how they are managed.

I also suspect there's a relationship with other parts of the block layer. `__blk_alloc_disk` isn't likely an isolated function. It probably interacts with other core kernel subsystems, perhaps related to device registration, driver binding, or even power management. I'll be keeping an eye out for these interdependencies. How does it integrate into the broader block device management framework?

Finally, I'll be considering the lifecycle. While `__blk_alloc_disk` is about *allocation*, it's crucial to also understand how the allocated resources are later *freed*. This might not be directly within this function, but understanding its output and the structures it creates will inform my understanding of the corresponding deallocation process.

In essence, my thought process is to dissect `__blk_alloc_disk` systematically: understand its role, inputs, internal workings, error handling, and its place within the larger kernel architecture, all with the goal of fully grasping the block device allocation mechanism.

map[ContextFile: Name:__blk_alloc_disk]

map[SourceCode:1520:	struct gendisk *__blk_alloc_disk(struct queue_limits *lim, int node,
1521:			struct lock_class_key *lkclass)
1522:	{
1523:		struct queue_limits default_lim = { };
1524:		struct request_queue *q;
1525:		struct gendisk *disk;
1526:	
1527:		q = blk_alloc_queue(lim ? lim : &default_lim, node);
1528:		if (IS_ERR(q))
1529:			return ERR_CAST(q);
1530:	
1531:		disk = __alloc_disk_node(q, node, lkclass);
1532:		if (!disk) {
1533:			blk_put_queue(q);
1534:			return ERR_PTR(-ENOMEM);
1535:		}
1536:		set_bit(GD_OWNS_QUEUE, &disk->state);
1537:		return disk;
1538:	}
 SourceFile:block/genhd.c]

gemini-3.1-pro-preview

							input: 16298
							output: 29
							thoughts: 8
						

**My Thought Process Regarding `blk_alloc_queue`**

When I encounter `blk_alloc_queue`, my immediate thought is about its purpose: I understand this function is responsible for the **allocation of a block layer request queue**. This is a critical data structure in the Linux kernel's block subsystem, acting as the central hub for managing I/O requests directed at block devices.

My mind immediately jumps to the implications of this allocation. It signifies the creation of a new queue, which implies that a device (or a virtual representation of one) is being initialized or brought online, and it requires a mechanism to serialize and process its incoming I/O. This isn't just a simple memory allocation; it's a foundational step in enabling I/O for a storage component.

I consider the context in which `blk_alloc_queue` would be called. It's likely to be during device driver initialization, perhaps when a new disk is detected, a RAID array is assembled, or a virtual disk is provisioned. The successful execution of this function is a prerequisite for any further I/O operations to that specific device.

My internal monologue also touches upon the properties and configuration associated with this allocated queue. I know that once allocated, this queue will need to be populated with various parameters and linked to the underlying hardware or virtual device. This might involve setting up queue depth limits, dispatching functions, and other policy-related configurations that influence how I/O requests are handled.

Furthermore, I think about the lifecycle of such a queue. While `blk_alloc_queue` *allocates* it, there must be a corresponding function for *deallocation* – likely `blk_free_queue` – which would be called when the device is being taken offline or is no longer in use. This highlights the importance of proper resource management within the kernel.

Finally, my expertise leads me to anticipate potential failure points. What happens if memory allocation fails? `blk_alloc_queue` would likely return an error, and the system would need to handle this gracefully, preventing the device from becoming usable. This is a common concern when dealing with kernel-level resource allocation.

map[ContextFile: Name:blk_alloc_queue]

map[SourceCode: 436:	struct request_queue *blk_alloc_queue(struct queue_limits *lim, int node_id)
 437:	{
 438:		struct request_queue *q;
 439:		int error;
 440:	
 441:		q = kmem_cache_alloc_node(blk_requestq_cachep, GFP_KERNEL | __GFP_ZERO,
 442:					  node_id);
 443:		if (!q)
 444:			return ERR_PTR(-ENOMEM);
 445:	
 446:		q->last_merge = NULL;
 447:	
 448:		q->id = ida_alloc(&blk_queue_ida, GFP_KERNEL);
 449:		if (q->id < 0) {
 450:			error = q->id;
 451:			goto fail_q;
 452:		}
 453:	
 454:		q->stats = blk_alloc_queue_stats();
 455:		if (!q->stats) {
 456:			error = -ENOMEM;
 457:			goto fail_id;
 458:		}
 459:	
 460:		error = blk_set_default_limits(lim);
 461:		if (error)
 462:			goto fail_stats;
 463:		q->limits = *lim;
 464:	
 465:		q->node = node_id;
 466:	
 467:		atomic_set(&q->nr_active_requests_shared_tags, 0);
 468:	
 469:		timer_setup(&q->timeout, blk_rq_timed_out_timer, 0);
 470:		INIT_WORK(&q->timeout_work, blk_timeout_work);
 471:		INIT_LIST_HEAD(&q->icq_list);
 472:	
 473:		refcount_set(&q->refs, 1);
 474:		mutex_init(&q->debugfs_mutex);
 475:		mutex_init(&q->elevator_lock);
 476:		mutex_init(&q->sysfs_lock);
 477:		mutex_init(&q->limits_lock);
 478:		mutex_init(&q->rq_qos_mutex);
 479:		spin_lock_init(&q->queue_lock);
 480:	
 481:		init_waitqueue_head(&q->mq_freeze_wq);
 482:		mutex_init(&q->mq_freeze_lock);
 483:	
 484:		blkg_init_queue(q);
 485:	
 486:		/*
 487:		 * Init percpu_ref in atomic mode so that it's faster to shutdown.
 488:		 * See blk_register_queue() for details.
 489:		 */
 490:		error = percpu_ref_init(&q->q_usage_counter,
 491:					blk_queue_usage_counter_release,
 492:					PERCPU_REF_INIT_ATOMIC, GFP_KERNEL);
 493:		if (error)
 494:			goto fail_stats;
 495:		lockdep_register_key(&q->io_lock_cls_key);
 496:		lockdep_register_key(&q->q_lock_cls_key);
 497:		lockdep_init_map(&q->io_lockdep_map, "&q->q_usage_counter(io)",
 498:				 &q->io_lock_cls_key, 0);
 499:		lockdep_init_map(&q->q_lockdep_map, "&q->q_usage_counter(queue)",
 500:				 &q->q_lock_cls_key, 0);
 501:	
 502:		/* Teach lockdep about lock ordering (reclaim WRT queue freeze lock). */
 503:		fs_reclaim_acquire(GFP_KERNEL);
 504:		rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
 505:		rwsem_release(&q->io_lockdep_map, _RET_IP_);
 506:		fs_reclaim_release(GFP_KERNEL);
 507:	
 508:		q->nr_requests = BLKDEV_DEFAULT_RQ;
 509:		q->async_depth = BLKDEV_DEFAULT_RQ;
 510:	
 511:		return q;
 512:	
 513:	fail_stats:
 514:		blk_free_queue_stats(q->stats);
 515:	fail_id:
 516:		ida_free(&blk_queue_ida, q->id);
 517:	fail_q:
 518:		kmem_cache_free(blk_requestq_cachep, q);
 519:		return ERR_PTR(error);
 520:	}
 SourceFile:block/blk-core.c]

gemini-3.1-pro-preview

							input: 17700
							output: 38
							thoughts: 1767
						

**My Thought Process Unraveling a Potential Concurrency Issue with Block Queue Freezing**

Okay, let's trace this. I'm looking at `blk_alloc_queue` and I see it sets up various fields, including `q->mq_freeze_lock` and `q->q_usage_counter`. My immediate thought is, "Is this the newer blk-mq queueing mechanism?" And yes, it seems all block queues are now effectively blk-mq queues, or at least they're using this shared freezing infrastructure.

Then I jump to `blk_mq_freeze_queue` and see it calls `blk_freeze_queue_start` and `blk_mq_freeze_queue_wait`. The `_wait` part is key – it's waiting for `q->q_usage_counter` to hit zero. This makes sense for a freeze operation. But then I notice `blk_mq_freeze_queue` *returns* `memflags`. That's interesting; it implies some state is being captured to be used later.

Now, I'm examining the `nvme_update_ns_info` function. I see a block where, if a multipath situation is detected (`nvme_ns_head_multipath`), it proceeds to update queue limits. Crucially, it calls `queue_limits_start_update`, then `memflags = blk_mq_freeze_queue(ns->head->disk->queue)`, then `queue_limits_commit_update`, and finally, `blk_mq_unfreeze_queue(ns->head->disk->queue, memflags)`.

My brain immediately flags a potential problem: what if `nvme_update_ns_info` is called *concurrently* for the *same* `ns->head`?

Let's imagine two threads, Thread A and Thread B, both entering `nvme_update_ns_info` for the same `ns->head`.

*   **Both** threads will call `blk_mq_freeze_queue` on the same queue.
*   `blk_mq_freeze_queue` internally uses `blk_freeze_set_owner`.
*   **Thread A** enters `blk_mq_freeze_queue` first. The condition `!q->mq_freeze_depth` is true. It sets `q->mq_freeze_owner` to itself (Thread A), `owner_depth` to 1, and acquires `q->mq_freeze_lock`.
*   **Thread B** then enters `blk_mq_freeze_queue`. Now, `!q->mq_freeze_depth` is false (it was incremented by Thread A). It checks `owner == q->mq_freeze_owner`. Since Thread B is not Thread A, this is false.
*   Therefore, `blk_freeze_set_owner` returns `FALSE` for Thread B, meaning Thread B *does not* acquire the `q->mq_freeze_lock`.
*   Thread B then proceeds to `blk_mq_freeze_queue_wait`. This function waits for `percpu_ref_is_zero(&q->q_usage_counter)`. Since Thread A already decremented the usage counter during its `freeze` operation, Thread B will eventually see it reach zero and return from `blk_mq_freeze_queue`.
*   Thread B then performs its work (the `queue_limits_commit_update`).
*   Upon completion, Thread B calls `blk_mq_unfreeze_queue`. This eventually calls `__blk_mq_unfreeze_queue`.
*   Inside `__blk_mq_unfreeze_queue`, `q->mq_freeze_depth` is decremented. Let's assume it was 2 (one for A, one for B's intent). So it becomes 1.
*   Then, `blk_unfreeze_check_owner(q)` is called. Here's the critical part: `if (q->mq_freeze_owner != current)`. Thread A is the owner, and `current` is Thread B. So, this condition is TRUE. `blk_unfreeze_check_owner` returns `FALSE`.
*   This means Thread B *does not release the lock*.
*   Now, **Thread A** proceeds to call `blk_mq_unfreeze_queue`.
*   Again, `__blk_mq_unfreeze_queue` is called. `q->mq_freeze_depth` is decremented to 0.
*   `percpu_ref_resurrect` is called, and the wait queue is woken.
*   Then, `blk_unfreeze_check_owner(q)` is called again. Now, `q->mq_freeze_owner` is still Thread A, and `current` is also Thread A.
*   The `owner_depth` (which was presumably 1, as Thread A initiated the freeze and Thread B never got the lock) is decremented to 0.
*   `q->mq_freeze_owner` is set to `NULL`.
*   `blk_unfreeze_check_owner` returns `TRUE`.
*   This means Thread A *does release the lock*.

My initial reaction here is that it *seems* balanced. Thread A acquired the lock, and Thread A released it. Thread B never acquired it, and therefore didn't release it. So, no obvious lock imbalance.

But then I reconsider: what if Thread A calls `blk_mq_freeze_queue`, gets the lock, and then *immediately* calls `blk_mq_unfreeze_queue` (perhaps due to an error path *before* Thread B even gets involved)?

*   **Thread A** calls `blk_mq_freeze_queue`. Acquires lock. `mq_freeze_depth` becomes 1.
*   **Thread A** calls `blk_mq_unfreeze_queue`. `mq_freeze_depth` decrements to 0. `blk_unfreeze_check_owner` sees Thread A as owner and current, decrements `owner_depth` to 0, sets `mq_freeze_owner` to NULL, and returns TRUE. The lock is released.
*   Now, if Thread A (or another thread acting as Thread B in my previous scenario) calls `blk_mq_unfreeze_queue` *again* on the same queue, where `mq_freeze_depth` is already 0.
*   `__blk_mq_unfreeze_queue` is called. `mq_freeze_depth` is decremented. If it was 0, it would become -1. The `WARN_ON_ONCE(q->mq_freeze_depth < 0)` would trigger. This is a strong indicator of a problem.
*   More critically, `blk_unfreeze_check_owner` would be called. `q->mq_freeze_owner` is NULL. `current` would be Thread A (or Thread B). The check `q->mq_freeze_owner != current` would be TRUE (NULL != Thread X). It would return `FALSE`, meaning the lock is *not* released. This would be a clear lock leak if the operation proceeds.

So, the scenario that concerns me is not necessarily the direct concurrent freezing and then unfreezing by different threads, but the possibility of `blk_mq_unfreeze_queue` being called more times than `blk_mq_freeze_queue` within a certain scope, or even being called without a preceding freeze. My initial thought was the concurrent path, but now I'm leaning towards a potential for `blk_mq_unfreeze_queue` to be invoked in situations where `mq_freeze_depth` is not correctly managed, or when the `mq_freeze_owner` check fails unexpectedly. I need to scrutinize the call sites of `blk_mq_unfreeze_queue` within `drivers/nvme/host/core.c` to see if there's any path that could lead to this unbalanced state.

map[Expression:blk_mq_unfreeze_queue PathPrefix:drivers/nvme/host/core.c]

map[Output:drivers/nvme/host/core.c=2236=static int nvme_update_ns_info_generic(struct nvme_ns *ns,
--
drivers/nvme/host/core.c-2248-	set_disk_ro(ns->disk, nvme_ns_is_readonly(ns, info));
drivers/nvme/host/core.c:2249:	blk_mq_unfreeze_queue(ns->disk->queue, memflags);
drivers/nvme/host/core.c-2250-
--
drivers/nvme/host/core.c=2398=static int nvme_update_ns_info_block(struct nvme_ns *ns,
--
drivers/nvme/host/core.c-2508-	if (ret) {
drivers/nvme/host/core.c:2509:		blk_mq_unfreeze_queue(ns->disk->queue, memflags);
drivers/nvme/host/core.c-2510-		goto out;
--
drivers/nvme/host/core.c-2515-	set_bit(NVME_NS_READY, &ns->flags);
drivers/nvme/host/core.c:2516:	blk_mq_unfreeze_queue(ns->disk->queue, memflags);
drivers/nvme/host/core.c-2517-
--
drivers/nvme/host/core.c=2539=static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
--
drivers/nvme/host/core.c-2622-unfreeze_head_queue:
drivers/nvme/host/core.c:2623:		blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
drivers/nvme/host/core.c-2624-	}
--
drivers/nvme/host/core.c=5339=void nvme_unfreeze(struct nvme_ctrl *ctrl)
--
drivers/nvme/host/core.c-5346-				 srcu_read_lock_held(&ctrl->srcu))
drivers/nvme/host/core.c:5347:		blk_mq_unfreeze_queue_non_owner(ns->queue);
drivers/nvme/host/core.c-5348-	srcu_read_unlock(&ctrl->srcu, srcu_idx);
]

gemini-3.1-pro-preview

							input: 20115
							output: 34
							thoughts: 136
						

**My Thought Process Unraveling NVMe Namespace Updates**

Okay, so I'm digging into how NVMe namespace information is updated, and I've just had a bit of a revelation. I noticed that both `nvme_update_ns_info_generic` and `nvme_update_ns_info_block` are calling `blk_mq_unfreeze_queue`. That's interesting, but what's more significant is *where* they're calling it. They're both operating on `ns->disk->queue`.

Now, I remember that the higher-level function, `nvme_update_ns_info`, also makes a call to `blk_mq_unfreeze_queue`, but it's targeting `ns->head->disk->queue`. This subtle difference in the queue being referenced caught my attention.

It's crucial to remember the structure here: `nvme_update_ns_info` is the orchestrator; it ultimately delegates the actual update logic to either `nvme_update_ns_info_block` or `nvme_update_ns_info_generic`, depending on the specific conditions.

Given this, my immediate next step is to dive deeper into `nvme_update_ns_info_block`. I need to understand precisely *why* it's unfreezing its own associated queue, and how that relates to the broader context of `nvme_update_ns_info` unfreezing a potentially different queue (`ns->head->disk->queue`). This is where the finer details of the data path and queue management likely lie.

map[ContextFile: Name:nvme_update_ns_info_block]

map[SourceCode:2398:	static int nvme_update_ns_info_block(struct nvme_ns *ns,
2399:			struct nvme_ns_info *info)
2400:	{
2401:		struct queue_limits lim;
2402:		struct nvme_id_ns_nvm *nvm = NULL;
2403:		struct nvme_zone_info zi = {};
2404:		struct nvme_id_ns *id;
2405:		unsigned int memflags;
2406:		sector_t capacity;
2407:		unsigned lbaf;
2408:		int ret;
2409:	
2410:		ret = nvme_identify_ns(ns->ctrl, info->nsid, &id);
2411:		if (ret)
2412:			return ret;
2413:	
2414:		if (id->ncap == 0) {
2415:			/* namespace not allocated or attached */
2416:			info->is_removed = true;
2417:			ret = -ENXIO;
2418:			goto out;
2419:		}
2420:		lbaf = nvme_lbaf_index(id->flbas);
2421:	
2422:		if (nvme_id_cns_ok(ns->ctrl, NVME_ID_CNS_CS_NS)) {
2423:			ret = nvme_identify_ns_nvm(ns->ctrl, info->nsid, &nvm);
2424:			if (ret < 0)
2425:				goto out;
2426:		}
2427:	
2428:		if (IS_ENABLED(CONFIG_BLK_DEV_ZONED) &&
2429:		    ns->head->ids.csi == NVME_CSI_ZNS) {
2430:			ret = nvme_query_zone_info(ns, lbaf, &zi);
2431:			if (ret < 0)
2432:				goto out;
2433:		}
2434:	
2435:		if (nvme_invalid_lba_sz(le64_to_cpu(id->nsze),
2436:				id->lbaf[lbaf].ds - SECTOR_SHIFT, &capacity)) {
2437:			dev_warn_once(ns->ctrl->device,
2438:				"invalid LBA data size %u, skipping namespace\n",
2439:				id->lbaf[lbaf].ds);
2440:			ret = -ENODEV;
2441:			goto out;
2442:		}
2443:	
2444:		lim = queue_limits_start_update(ns->disk->queue);
2445:	
2446:		memflags = blk_mq_freeze_queue(ns->disk->queue);
2447:		ns->head->lba_shift = id->lbaf[lbaf].ds;
2448:		ns->head->nuse = le64_to_cpu(id->nuse);
2449:		nvme_set_ctrl_limits(ns->ctrl, &lim, false);
2450:		nvme_configure_metadata(ns->ctrl, ns->head, id, nvm, info);
2451:		nvme_set_chunk_sectors(ns, id, &lim);
2452:		if (!nvme_update_disk_info(ns, id, nvm, &lim))
2453:			capacity = 0;
2454:	
2455:		/*
2456:		 * A failed zone info query leaves zi zero-initialized, so skip the
2457:		 * zoned limits update instead of configuring the queue from it.
2458:		 * During a revalidation that keeps the zone geometry the queue was
2459:		 * last validated with; on a first scan the namespace is registered
2460:		 * without zoned limits, so that it is still available as a handle
2461:		 * for admin commands.
2462:		 */
2463:		if (IS_ENABLED(CONFIG_BLK_DEV_ZONED) &&
2464:		    ns->head->ids.csi == NVME_CSI_ZNS) {
2465:			if (zi.zone_size)
2466:				nvme_update_zone_info(ns, &lim, &zi);
2467:			else
2468:				dev_warn(ns->ctrl->device,
2469:					 "zone info query failed for nsid %u, %s\n",
2470:					 ns->head->ns_id,
2471:					 blk_queue_is_zoned(ns->disk->queue) ?
2472:					 "keeping the previous zone limits" :
2473:					 "not enabling zoned mode");
2474:		}
2475:	
2476:		if ((ns->ctrl->vwc & NVME_CTRL_VWC_PRESENT) && !info->no_vwc)
2477:			lim.features |= BLK_FEAT_WRITE_CACHE | BLK_FEAT_FUA;
2478:		else
2479:			lim.features &= ~(BLK_FEAT_WRITE_CACHE | BLK_FEAT_FUA);
2480:	
2481:		if (info->is_rotational)
2482:			lim.features |= BLK_FEAT_ROTATIONAL;
2483:	
2484:		/*
2485:		 * Register a metadata profile for PI, or the plain non-integrity NVMe
2486:		 * metadata masquerading as Type 0 if supported, otherwise reject block
2487:		 * I/O to namespaces with metadata except when the namespace supports
2488:		 * PI, as it can strip/insert in that case.
2489:		 */
2490:		if (!nvme_init_integrity(ns->head, &lim, info))
2491:			capacity = 0;
2492:	
2493:		lim.max_write_streams = ns->head->nr_plids;
2494:		lim.write_stream_granularity = ns->head->write_stream_granularity;
2495:	
2496:		/*
2497:		 * Only set the DEAC bit if the device guarantees that reads from
2498:		 * deallocated data return zeroes.  While the DEAC bit does not
2499:		 * require that, it must be a no-op if reads from deallocated data
2500:		 * do not return zeroes.
2501:		 */
2502:		if ((id->dlfeat & 0x7) == 0x1 && (id->dlfeat & (1 << 3))) {
2503:			ns->head->features |= NVME_NS_DEAC;
2504:			lim.max_hw_wzeroes_unmap_sectors = lim.max_write_zeroes_sectors;
2505:		}
2506:	
2507:		ret = queue_limits_commit_update(ns->disk->queue, &lim);
2508:		if (ret) {
2509:			blk_mq_unfreeze_queue(ns->disk->queue, memflags);
2510:			goto out;
2511:		}
2512:	
2513:		set_capacity_and_notify(ns->disk, capacity);
2514:		set_disk_ro(ns->disk, nvme_ns_is_readonly(ns, info));
2515:		set_bit(NVME_NS_READY, &ns->flags);
2516:		blk_mq_unfreeze_queue(ns->disk->queue, memflags);
2517:	
2518:		if (blk_queue_is_zoned(ns->queue)) {
2519:			ret = blk_revalidate_disk_zones(ns->disk);
2520:			if (ret && !nvme_first_scan(ns->disk))
2521:				goto out;
2522:		}
2523:	
2524:		ret = 0;
2525:	out:
2526:		kfree(nvm);
2527:		kfree(id);
2528:		return ret;
2529:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 22504
							output: 34
							thoughts: 1351
						

**My Debugging Journey with the `nvme_update_ns_info` Queue Lock Imbalance**

Initially, I noticed that `nvme_update_ns_info_block` and `nvme_update_ns_info` both call `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` on `ns->disk->queue` or `ns->head->disk->queue`. The warning message, specifically pointing to `kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at: blk_mq_unfreeze_queue ... nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623`, clearly indicated that the issue was an unbalanced `blk_mq_unfreeze_queue` call on `ns->head->disk->queue` within `nvme_update_ns_info` at line 2623.

My first thought was to examine the structure of the code block in `nvme_update_ns_info` where the freeze/unfreeze calls occurred. I saw that `blk_mq_unfreeze_queue` was indeed called within a `goto` target (`unfreeze_head_queue`), but this label was only reachable after the preceding `blk_mq_freeze_queue` call. This led me to question if there was any scenario where `blk_mq_unfreeze_queue` might be called without a corresponding `blk_mq_freeze_queue`.

Then, I considered the possibility that `ns->head->disk->queue` might not be a `blk-mq` queue at all. I traced its origin back to `nvme_mpath_alloc_disk`, which uses `blk_alloc_disk`. `blk_alloc_disk`, in turn, calls `blk_alloc_queue`. My understanding is that `blk_alloc_queue` creates a BIO-based queue, not necessarily a `blk-mq` queue, and that `blk_mq_init_queue` or `blk_mq_alloc_disk` are the mechanisms for initializing `blk-mq` queues.

However, upon deeper inspection of the `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` implementations, I found that they *do* handle BIO-based queues. The `__blk_freeze_queue_start` function, called by `blk_mq_freeze_queue`, explicitly checks `if (queue_is_mq(q))`, indicating that it gracefully handles non-`blk-mq` queues. So, the queue type itself didn't seem to be the root cause of the imbalance.

Returning to the `nvme_update_ns_info` function, I reread the code block around the `unfreeze_head_queue` label. The crucial part was realizing that the `goto unfreeze_head_queue;` instruction was executed if `ret = queue_limits_commit_update(...)` failed. This means `blk_mq_unfreeze_queue` *would* be called in that error path. But this still seemed to be within the scope of the preceding `blk_mq_freeze_queue`.

Then, the crucial insight hit me: what if something *else* within the `if (!ret && nvme_ns_head_multipath(ns->head))` block, specifically after the `queue_limits_commit_update` call and before the `unfreeze_head_queue` label, could *also* call `blk_mq_freeze_queue` or `blk_mq_unfreeze_queue`? I specifically focused on the calls to `set_capacity_and_notify`, `set_disk_ro`, `nvme_mpath_revalidate_paths`, and `nvme_mpath_revalidate_zones`. My suspicion immediately fell on `nvme_mpath_revalidate_zones(ns->head)`, as it's the most likely candidate to interact with queue freezing/unfreezing logic, especially in a multipath context. This is where I'm now directing my investigation.

map[ContextFile: Name:nvme_mpath_revalidate_zones]

map[SourceCode: 292:	int nvme_mpath_revalidate_zones(struct nvme_ns_head *head)
 293:	{
 294:		struct gendisk *disk = head->disk;
 295:		int ret;
 296:	
 297:		if (!disk || !blk_queue_is_zoned(disk->queue) ||
 298:		    !test_bit(NVME_NSHEAD_DISK_LIVE, &head->flags))
 299:			return 0;
 300:	
 301:		ret = blk_revalidate_disk_zones(disk);
 302:		if (ret)
 303:			dev_warn_ratelimited(disk_to_dev(disk),
 304:					     "failed to revalidate zoned namespace head: %d\n",
 305:					     ret);
 306:		return ret;
 307:	}
 SourceFile:drivers/nvme/host/multipath.c]

gemini-3.1-pro-preview

							input: 24150
							output: 32
							thoughts: 19
						

**My Thought Process on `blk_revalidate_disk_zones` and Queue Behavior**

My mind immediately goes to the `blk_revalidate_disk_zones` function. My primary concern is its impact on the block layer's queueing mechanism. Specifically, I'm asking myself: does this operation cause the queue to freeze or become unresponsive? This is critical for understanding potential performance bottlenecks and the overall stability of block device I/O. I need to ascertain whether `blk_revalidate_disk_zones` is a blocking operation that halts the flow of requests, or if it can be performed in a non-disruptive manner. This distinction is paramount in my analysis of the block I/O subsystem's behavior under various conditions.

map[ContextFile: Name:blk_revalidate_disk_zones]

map[SourceCode:2301:	/**
2302:	 * blk_revalidate_disk_zones - (re)allocate and initialize zone write plugs
2303:	 * @disk:	Target disk
2304:	 *
2305:	 * Helper function for low-level device drivers to check, (re) allocate and
2306:	 * initialize resources used for managing zoned disks. This function should
2307:	 * normally be called by blk-mq based drivers when a zoned gendisk is probed
2308:	 * and when the zone configuration of the gendisk changes (e.g. after a format).
2309:	 * Before calling this function, the device driver must already have set the
2310:	 * device zone size (chunk_sector limit) and the max zone append limit.
2311:	 * BIO based drivers can also use this function as long as the device queue
2312:	 * can be safely frozen.
2313:	 */
2314:	int blk_revalidate_disk_zones(struct gendisk *disk)
2315:	{
2316:		struct request_queue *q = disk->queue;
2317:		sector_t zone_sectors = q->limits.chunk_sectors;
2318:		sector_t capacity = get_capacity(disk);
2319:		struct blk_revalidate_zone_args args = { };
2320:		unsigned int memflags, noio_flag;
2321:		struct blk_report_zones_args rep_args = {
2322:			.cb = blk_revalidate_zone_cb,
2323:			.data = &args,
2324:		};
2325:		int ret = -ENOMEM;
2326:	
2327:		if (WARN_ON_ONCE(!blk_queue_is_zoned(q)))
2328:			return -EIO;
2329:	
2330:		if (!capacity)
2331:			return -ENODEV;
2332:	
2333:		/*
2334:		 * Checks that the device driver indicated a valid zone size and that
2335:		 * the max zone append limit is set.
2336:		 */
2337:		if (!zone_sectors || !is_power_of_2(zone_sectors)) {
2338:			pr_warn("%s: Invalid non power of two zone size (%llu)\n",
2339:				disk->disk_name, zone_sectors);
2340:			return -ENODEV;
2341:		}
2342:	
2343:		/*
2344:		 * Ensure that all memory allocations in this context are done as if
2345:		 * GFP_NOIO was specified.
2346:		 */
2347:		noio_flag = memalloc_noio_save();
2348:		ret = disk_revalidate_zone_resources(disk, &args);
2349:		if (ret) {
2350:			memalloc_noio_restore(noio_flag);
2351:			return ret;
2352:		}
2353:	
2354:		ret = disk->fops->report_zones(disk, 0, UINT_MAX, &rep_args);
2355:		if (!ret) {
2356:			pr_warn("%s: No zones reported\n", disk->disk_name);
2357:			ret = -ENODEV;
2358:		}
2359:		memalloc_noio_restore(noio_flag);
2360:	
2361:		if (ret <= 0)
2362:			goto free_resources;
2363:	
2364:		/*
2365:		 * If zones where reported, make sure that the entire disk capacity
2366:		 * has been checked.
2367:		 */
2368:		if (args.sector != capacity) {
2369:			pr_warn("%s: Missing zones from sector %llu\n",
2370:				disk->disk_name, args.sector);
2371:			ret = -ENODEV;
2372:			goto free_resources;
2373:		}
2374:	
2375:		ret = disk_update_zone_resources(disk, &args);
2376:		if (ret)
2377:			goto free_resources;
2378:	
2379:		return 0;
2380:	
2381:	free_resources:
2382:		pr_warn("%s: failed to revalidate zones\n", disk->disk_name);
2383:	
2384:		kfree(args.zones_cond);
2385:		memflags = blk_mq_freeze_queue(q);
2386:		disk_free_zone_resources(disk);
2387:		blk_mq_unfreeze_queue(q, memflags);
2388:	
2389:		return ret;
2390:	}
 SourceFile:block/blk-zoned.c]

gemini-3.1-pro-preview

							input: 25551
							output: 36
							thoughts: 4978
						

**My Thoughts on the NVMe `blk_mq_freeze_queue`/`unfreeze_queue` Lock Balance Issue**

This is a fascinating puzzle, and I've been digging through the code to understand where this "bad unlock balance" warning might be coming from. My initial analysis, tracing the direct calls within `nvme_update_ns_info` and its related functions like `blk_revalidate_disk_zones` and `nvme_mpath_revalidate_zones`, suggested everything was perfectly balanced. Each freeze seemed to have a corresponding unfreeze, and the ownership tracking appeared correct.

However, the core of the problem, as indicated by the `syzkaller` report, isn't about the *number* of freezes and unfrezees being mismatched globally, but rather about a specific task *attempting to release a lock it believes it holds, when in reality, it doesn't hold it anymore, or perhaps never acquired it properly in the first place*.

My first line of inquiry was to meticulously follow the `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` calls. I traced how `nvme_update_ns_info` freezes the queue, then calls into `nvme_mpath_revalidate_zones` which, in turn, calls `blk_revalidate_disk_zones`. Even if `blk_revalidate_disk_zones` hits its error path and calls `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` again on an already frozen queue, my understanding was that the `mq_freeze_depth` and `mq_freeze_owner_depth` counters would correctly handle this nested freezing, ultimately resulting in a balanced state when the initial freeze was undone. I did the same for `nvme_update_ns_info_block`, confirming that the freeze/unfreeze pairs were also correctly balanced.

The real confusion arose when I considered scenarios where the queue might *already be frozen by another task*. My initial thought was that `blk_mq_freeze_queue` would block. However, I then realized that `blk_mq_freeze_queue_wait` primarily waits on `q->q_usage_counter` to reach zero, not `mq_freeze_depth`. This led me to a scenario where one task (Thread A) freezes the queue, and a second task (Thread B) attempts to freeze it. If Thread A has already killed the `q->q_usage_counter` reference, Thread B's `blk_mq_freeze_queue_wait` would return immediately. This is where it gets tricky.

My subsequent tracing focused on the unfreeze logic when multiple threads are involved. I walked through the potential interplay of `blk_mq_unfreeze_queue` calls. Even if Thread B called `blk_mq_unfreeze_queue` before Thread A, or vice versa, the logic seemed to hold up; the lock would eventually be released by the original owner. The crucial part is that `blk_unfreeze_check_owner` ensures that only the designated owner can truly release the lock when its `owner_depth` drops to zero.

However, the "bad unlock balance" warning specifically mentions that the *current task* is trying to release a lock. This implies that `blk_unfreeze_check_owner` *returned TRUE* for the current task. For `blk_unfreeze_check_owner` to return TRUE, two conditions must be met: `q->mq_freeze_owner` must be `current`, and `q->mq_freeze_owner_depth` must become zero after decrementing. This strongly suggests that the *current task* is indeed the designated owner.

This leads me to the hypothesis that the problem lies in the interplay between acquiring and releasing the underlying `rwsem` locks (`io_lockdep_map` and `q_lockdep_map`) which are guarded by the `mq_freeze_disk_dead` and `mq_freeze_queue_dying` flags. The warning is specifically about the `io_lockdep_map`. My thought process is now focusing on a situation where:

1.  The current task initiates a freeze (`blk_mq_freeze_queue`).
2.  It correctly sets itself as the `mq_freeze_owner` and increments `mq_freeze_owner_depth`.
3.  Crucially, during the freeze initiation, `q->mq_freeze_disk_dead` is set to `false` (meaning the disk is considered "live" for the purpose of locking). This allows `blk_freeze_acquire_lock` to attempt acquiring `&q->io_lockdep_map`.
4.  Now, *before* the current task can release this lock, something happens that modifies the state. Perhaps a concurrent operation causes `q->mq_freeze_disk_dead` to become `true`.
5.  Later, when the current task calls `blk_mq_unfreeze_queue`, `blk_unfreeze_check_owner` returns TRUE (because it's still the owner and its depth is going to zero).
6.  However, `blk_unfreeze_release_lock` checks `!q->mq_freeze_disk_dead`. If `q->mq_freeze_disk_dead` is now `true` (due to some other concurrent event), it *skips* releasing `&q->io_lockdep_map`.
7.  This results in the current task successfully completing the `blk_mq_unfreeze_queue` logic (returning true from `blk_unfreeze_check_owner`), but the underlying `rwsem` (`io_lockdep_map`) is *not* released because the `q->mq_freeze_disk_dead` flag had changed. Lockdep then complains about a bad unlock balance because the `rwsem` was acquired but not released by this task.

This scenario, where a flag controlling the lock release path changes between acquisition and the intended release, is my current leading theory for how a seemingly balanced freeze/unfreeze count could still lead to a lockdep warning. The key is that the lockdep warning isn't about the `mq_freeze_depth` count, but about the actual `rwsem` acquisition/release state.

map[ContextFile: Name:blk_mq_unfreeze_queue_non_owner]

map[SourceCode: 250:	/* non_owner variant of blk_mq_unfreeze_queue */
 251:	void blk_mq_unfreeze_queue_non_owner(struct request_queue *q)
 252:	{
 253:		__blk_mq_unfreeze_queue(q, false);
 254:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 30664
							output: 27
							thoughts: 2058
						

**My Thought Process Regarding the `blk_mq_unfreeze_queue_non_owner` and Lockdep Warning**

I've been deeply analyzing a specific scenario within the block layer's multiqueue (blk-mq) freezing mechanism, and I'm trying to unravel how a particular lockdep warning, "bad unlock balance detected! ... but there are no more locks to release!", could be triggered.

Initially, my thought was that `blk_mq_unfreeze_queue_non_owner` itself couldn't be the culprit, as it's designed not to call `blk_unfreeze_release_lock`, which would inherently avoid the warning. However, this was too simplistic and led me down several recursive paths of inquiry.

My next line of reasoning focused on the conditions under which `blk_freeze_queue_start` might be called, but `blk_freeze_acquire_lock` is *not*. This hinges on `__blk_freeze_queue_start` returning `false`. I traced this back to `blk_freeze_set_owner` returning `false`.

Let's examine `blk_freeze_set_owner`:
```c
	if (!owner)
		return false;

	if (!q->mq_freeze_depth) {
		// ... initialization ...
		return true;
	}

	if (owner == q->mq_freeze_owner)
		q->mq_freeze_owner_depth += 1;
	return false;
```
Here's where it gets interesting. If `owner == q->mq_freeze_owner`, the function increments `owner_depth` but crucially returns `false`. This means `__blk_freeze_queue_start` would return `false`, and `blk_freeze_acquire_lock` would *not* be called.

My initial reaction was: "Hold on! If `owner == q->mq_freeze_owner`, it implies the `current` task *already* called `blk_freeze_queue_start` when `!q->mq_freeze_depth` was true. This means `current` *already* acquired the lock!" And since `owner_depth` is incremented, the lock will need to be released twice (via `blk_mq_unfreeze_queue`) to balance out. The first `blk_mq_unfreeze_queue` call (when `owner_depth` hits zero) would release the lock. This seemed perfectly balanced and couldn't lead to the warning.

I then considered the case where `owner != q->mq_freeze_owner`. In this scenario, `blk_freeze_set_owner` returns `false`, `__blk_freeze_queue_start` returns `false`, and `blk_freeze_acquire_lock` is skipped. When this task later calls `blk_mq_unfreeze_queue`, `blk_unfreeze_check_owner` would see that `q->mq_freeze_owner != current`, returning `false`, and thus `blk_unfreeze_release_lock` wouldn't be called. Again, this seemed balanced.

The plot thickened when I thought about a worker thread context. What if `current` (let's say a main thread) calls `blk_mq_freeze_queue`, `!q->mq_freeze_depth` is true, making `current` the owner and acquiring the lock. Then, `current` spawns a worker thread, and this *worker thread* calls `blk_mq_unfreeze_queue`.

Now, within the worker thread, `current` is *different* from `q->mq_freeze_owner` (which was the main thread). So, `blk_unfreeze_check_owner` would return `false`, and the lock would *never* be released by this worker. This seemed to point towards the warning.

But the warning is specifically "bad unlock balance detected! ... *but there are no more locks to release*!". This implies the worker thread *did* call `blk_unfreeze_release_lock`. For that to happen, `blk_unfreeze_check_owner` *must have returned true*. How could it return true? Only if `q->mq_freeze_owner == current`. This means the worker thread *itself* must be the owner! If the worker thread is the owner, it must have called `blk_mq_freeze_queue` itself, acquiring the lock. So why would lockdep say it doesn't hold the lock? This was a major point of confusion.

I had to re-read the lockdep warning itself very carefully:
```
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!
```
This confirmed my suspicion: the worker thread (`kworker/u8:28/9220`) *is* calling `blk_mq_unfreeze_queue`, it *is* attempting to call `blk_unfreeze_release_lock`, but lockdep insists it doesn't hold the lock.

So, the question became: how can `blk_freeze_acquire_lock` *not* have been called by this worker thread, yet `blk_unfreeze_release_lock` *is* called? This points to a scenario where `__blk_freeze_queue_start` returned `false`, but `blk_unfreeze_check_owner` returned `true`.

Let's revisit `blk_freeze_set_owner` again:
```c
	if (!owner)
		return false;

	if (!q->mq_freeze_depth) {
		q->mq_freeze_owner = owner;
		q->mq_freeze_owner_depth = 1;
		q->mq_freeze_disk_dead = !q->disk ||
			test_bit(GD_DEAD, &q->disk->state) ||
			!blk_queue_registered(q);
		q->mq_freeze_queue_dying = blk_queue_dying(q);
		return true;
	}

	if (owner == q->mq_freeze_owner)
		q->mq_freeze_owner_depth += 1;
	return false;
```
If `!q->mq_freeze_depth` is true, it returns `true`.
If `owner == q->mq_freeze_owner`, it returns `false`.

What if `q->mq_freeze_depth` is *not* zero, but `q->mq_freeze_owner` is `NULL`? If `q->mq_freeze_depth > 0` and `q->mq_freeze_owner == NULL`, then `owner == q->mq_freeze_owner` evaluates to `false` (since `owner` would likely be the `current` task pointer, which is non-NULL). In this case, `blk_freeze_set_owner` returns `false`.
Then, in `blk_unfreeze_check_owner`:
```c
	if (q->mq_freeze_owner != current)
		return false;
```
This would also return `false` because `q->mq_freeze_owner` is `NULL` and `current` is not. So, this path doesn't explain the scenario.

My next thought was: what if `blk_freeze_set_owner` *does* return `true`, so `blk_freeze_acquire_lock` *is* called, but it *doesn't actually acquire the lock*?
```c
static inline void blk_freeze_acquire_lock(struct request_queue *q)
{
	if (!q->mq_freeze_disk_dead)
		rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
	if (!q->mq_freeze_queue_dying)
		rwsem_acquire(&q->q_lockdep_map, 0, 1, _RET_IP_);
}
```
If `q->mq_freeze_disk_dead` is `true`, the `io_lockdep_map` is *not* acquired.
Conversely, `blk_unfreeze_release_lock`:
```c
static inline void blk_unfreeze_release_lock(struct request_queue *q)
{
	if (!q->mq_freeze_queue_dying)
		rwsem_release(&q->q_lockdep_map, _RET_IP_);
	if (!q->mq_freeze_disk_dead)
		rwsem_release(&q->io_lockdep_map, _RET_IP_);
}
```
If `q->mq_freeze_disk_dead` is `true`, the `io_lockdep_map` is *not* released.
This seems balanced *if* `q->mq_freeze_disk_dead` remains constant.

Can `q->mq_freeze_disk_dead` change? It's set within `blk_freeze_set_owner`:
```c
			q->mq_freeze_disk_dead = !q->disk ||
				test_bit(GD_DEAD, &q->disk->state) ||
				!blk_queue_registered(q);
```
This initialization only happens when `!q->mq_freeze_depth`. And `q->mq_freeze_depth` is only decremented in `blk_mq_unfreeze_queue`. It seems unlikely that `q->mq_freeze_disk_dead` would change between the acquire and release calls in a way that breaks this balance.

This leads me to the unsettling possibility: could there be a race condition or memory corruption that causes `q->mq_freeze_disk_dead` to be overwritten in an unexpected way? Or, perhaps the interpretation of the lockdep warning needs to be more nuanced. I'm currently digging into the definition of `struct request_queue` to see if `mq_freeze_disk_dead` is part of a bitfield that might be subject to unexpected modifications or if there are other fields that could influence this behavior. This is where I'm at – scrutinizing the exact memory layout and potential side effects of other operations on these flags.

map[ContextFile: Name:request_queue]

map[SourceCode: 488:	struct request_queue {
 489:		/*
 490:		 * The queue owner gets to use this for whatever they like.
 491:		 * ll_rw_blk doesn't touch it.
 492:		 */
 493:		void			*queuedata;
 494:	
 495:		struct elevator_queue	*elevator;
 496:	
 497:		const struct blk_mq_ops	*mq_ops;
 498:	
 499:		/* sw queues */
 500:		struct blk_mq_ctx __percpu	*queue_ctx;
 501:	
 502:		/*
 503:		 * various queue flags, see QUEUE_* below
 504:		 */
 505:		unsigned long		queue_flags;
 506:	
 507:		unsigned int __data_racy rq_timeout;
 508:	
 509:		unsigned int		queue_depth;
 510:	
 511:		refcount_t		refs;
 512:	
 513:		/* hw dispatch queues */
 514:		unsigned int		nr_hw_queues;
 515:		struct blk_mq_hw_ctx * __rcu *queue_hw_ctx __counted_by_ptr(nr_hw_queues);
 516:	
 517:		struct percpu_ref	q_usage_counter;
 518:		struct lock_class_key	io_lock_cls_key;
 519:		struct lockdep_map	io_lockdep_map;
 520:	
 521:		struct lock_class_key	q_lock_cls_key;
 522:		struct lockdep_map	q_lockdep_map;
 523:	
 524:		struct request		*last_merge;
 525:	
 526:		spinlock_t		queue_lock;
 527:	
 528:		int			quiesce_depth;
 529:	
 530:		struct gendisk		*disk;
 531:	
 532:		/*
 533:		 * mq queue kobject
 534:		 */
 535:		struct kobject *mq_kobj;
 536:	
 537:		struct queue_limits	limits;
 538:	
 539:	#ifdef CONFIG_PM
 540:		struct device		*dev;
 541:		enum rpm_status		rpm_status;
 542:	#endif
 543:	
 544:		/*
 545:		 * Number of contexts that have called blk_set_pm_only(). If this
 546:		 * counter is above zero then only RQF_PM requests are processed.
 547:		 */
 548:		atomic_t		pm_only;
 549:	
 550:		struct blk_queue_stats	*stats;
 551:		struct rq_qos		*rq_qos;
 552:		struct mutex		rq_qos_mutex;
 553:	
 554:		/*
 555:		 * ida allocated id for this queue.  Used to index queues from
 556:		 * ioctx.
 557:		 */
 558:		int			id;
 559:	
 560:		/*
 561:		 * queue settings
 562:		 */
 563:		unsigned int		nr_requests;	/* Max # of requests */
 564:		unsigned int		async_depth;	/* Max # of async requests */
 565:	
 566:	#ifdef CONFIG_BLK_INLINE_ENCRYPTION
 567:		struct blk_crypto_profile *crypto_profile;
 568:		struct kobject *crypto_kobject;
 569:	#endif
 570:	
 571:		struct timer_list	timeout;
 572:		struct work_struct	timeout_work;
 573:	
 574:		atomic_t		nr_active_requests_shared_tags;
 575:	
 576:		struct blk_mq_tags	*sched_shared_tags;
 577:	
 578:		struct list_head	icq_list;
 579:	#ifdef CONFIG_BLK_CGROUP
 580:		DECLARE_BITMAP		(blkcg_pols, BLKCG_MAX_POLS);
 581:		struct blkcg_gq		*root_blkg;
 582:		struct list_head	blkg_list;
 583:		struct mutex		blkcg_mutex;
 584:	#endif
 585:	
 586:		int			node;
 587:	
 588:		spinlock_t		requeue_lock;
 589:		struct list_head	requeue_list;
 590:		struct delayed_work	requeue_work;
 591:	
 592:	#ifdef CONFIG_BLK_DEV_IO_TRACE
 593:		struct blk_trace __rcu	*blk_trace;
 594:	#endif
 595:		/*
 596:		 * for flush operations
 597:		 */
 598:		struct blk_flush_queue	*fq;
 599:		struct list_head	flush_list;
 600:	
 601:		/*
 602:		 * Protects against I/O scheduler switching, particularly when updating
 603:		 * q->elevator. Since the elevator update code path may also modify q->
 604:		 * nr_requests and wbt latency, this lock also protects the sysfs attrs
 605:		 * nr_requests and wbt_lat_usec. Additionally the nr_hw_queues update
 606:		 * may modify hctx tags, reserved-tags and cpumask, so this lock also
 607:		 * helps protect the hctx sysfs/debugfs attrs. To ensure proper locking
 608:		 * order during an elevator or nr_hw_queue update, first freeze the
 609:		 * queue, then acquire ->elevator_lock.
 610:		 */
 611:		struct mutex		elevator_lock;
 612:	
 613:		struct mutex		sysfs_lock;
 614:		/*
 615:		 * Protects queue limits and also sysfs attribute read_ahead_kb.
 616:		 */
 617:		struct mutex		limits_lock;
 618:	
 619:		/*
 620:		 * for reusing dead hctx instance in case of updating
 621:		 * nr_hw_queues
 622:		 */
 623:		struct list_head	unused_hctx_list;
 624:		spinlock_t		unused_hctx_lock;
 625:	
 626:		int			mq_freeze_depth;
 627:	
 628:	#ifdef CONFIG_BLK_DEV_THROTTLING
 629:		/* Throttle data */
 630:		struct throtl_data *td;
 631:	#endif
 632:		struct rcu_head		rcu_head;
 633:	#ifdef CONFIG_LOCKDEP
 634:		struct task_struct	*mq_freeze_owner;
 635:		int			mq_freeze_owner_depth;
 636:		/*
 637:		 * Records disk & queue state in current context, used in unfreeze
 638:		 * queue
 639:		 */
 640:		bool			mq_freeze_disk_dead;
 641:		bool			mq_freeze_queue_dying;
 642:	#endif
 643:		wait_queue_head_t	mq_freeze_wq;
 644:		/*
 645:		 * Protect concurrent access to q_usage_counter by
 646:		 * percpu_ref_kill() and percpu_ref_reinit().
 647:		 */
 648:		struct mutex		mq_freeze_lock;
 649:	
 650:		struct blk_mq_tag_set	*tag_set;
 651:		struct list_head	tag_set_list;
 652:	
 653:		struct dentry		*debugfs_dir;
 654:		struct dentry		*sched_debugfs_dir;
 655:		struct dentry		*rqos_debugfs_dir;
 656:		/*
 657:		 * Serializes all debugfs metadata operations using the above dentries.
 658:		 */
 659:		struct mutex		debugfs_mutex;
 660:	};
 SourceFile:include/linux/blkdev.h]

gemini-3.1-pro-preview

							input: 35126
							output: 26
							thoughts: 276
						

**My Thought Process Regarding Lockdep and Queue Freezing**

My initial reaction to seeing `mq_freeze_disk_dead` and `mq_freeze_queue_dying` being defined as `bool` within the `#ifdef CONFIG_LOCKDEP` block was relief. I immediately understood that these are individual boolean variables, not bitfields. This means I don't have to worry about them being susceptible to corruption from writes to adjacent bitfields. That's one potential pitfall avoided.

Then, my mind immediately jumped to a crucial edge case: what happens if `blk_mq_unfreeze_queue` is invoked on a queue that has *never* been frozen? My internal logic flagged a potential issue: if this were the case, `q->mq_freeze_depth` would likely be uninitialized or in a state that would lead to a negative value. The `WARN_ON_ONCE(q->mq_freeze_depth < 0)` check would then undoubtedly trigger.

However, the fact that this warning *didn't* trigger is a significant piece of information. This tells me that `q->mq_freeze_depth` *must* have been greater than or equal to zero. This, in turn, strongly implies that `blk_mq_freeze_queue` *was* called previously. Furthermore, it means that `current` (the current process/thread) was indeed the owner of the freeze operation, and that the `owner_depth` reached zero, signifying a complete freeze cycle initiated by `current`.

So, if `current` initiated the freeze and successfully reached the `owner_depth` of zero, it logically *must* have acquired the necessary lock. This is where my thought process hit a wall: lockdep is stating that `current` does *not* hold the lock. This is a direct contradiction.

The only logical explanation for this discrepancy is that `current` must have released the lock *somewhere else*, at a different point in the code. My immediate next step was to investigate this possibility by searching for any other locations within the codebase that might call `rwsem_release(&q->io_lockdep_map)`. I need to understand if there are other code paths that could lead to the release of this specific lock, potentially before the expected `blk_mq_unfreeze_queue` call.

map[Expression:io_lockdep_map PathPrefix:]

map[Output:block/blk-core.c=376=int __bio_queue_enter(struct request_queue *q, struct bio *bio)
--
block/blk-core.c-403-
block/blk-core.c:404:	rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
block/blk-core.c:405:	rwsem_release(&q->io_lockdep_map, _RET_IP_);
block/blk-core.c-406-	return 0;
--
block/blk-core.c=436=struct request_queue *blk_alloc_queue(struct queue_limits *lim, int node_id)
--
block/blk-core.c-496-	lockdep_register_key(&q->q_lock_cls_key);
block/blk-core.c:497:	lockdep_init_map(&q->io_lockdep_map, "&q->q_usage_counter(io)",
block/blk-core.c-498-			 &q->io_lock_cls_key, 0);
--
block/blk-core.c-503-	fs_reclaim_acquire(GFP_KERNEL);
block/blk-core.c:504:	rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
block/blk-core.c:505:	rwsem_release(&q->io_lockdep_map, _RET_IP_);
block/blk-core.c-506-	fs_reclaim_release(GFP_KERNEL);
--
block/blk.h=90=static inline int bio_queue_enter(struct bio *bio)
--
block/blk.h-94-	if (blk_try_enter_queue(q, false)) {
block/blk.h:95:		rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
block/blk.h:96:		rwsem_release(&q->io_lockdep_map, _RET_IP_);
block/blk.h-97-		return 0;
--
block/blk.h=761=static inline void blk_freeze_acquire_lock(struct request_queue *q)
--
block/blk.h-763-	if (!q->mq_freeze_disk_dead)
block/blk.h:764:		rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
block/blk.h-765-	if (!q->mq_freeze_queue_dying)
--
block/blk.h=769=static inline void blk_unfreeze_release_lock(struct request_queue *q)
--
block/blk.h-773-	if (!q->mq_freeze_disk_dead)
block/blk.h:774:		rwsem_release(&q->io_lockdep_map, _RET_IP_);
block/blk.h-775-}
--
include/linux/blkdev.h=488=struct request_queue {
--
include/linux/blkdev.h-518-	struct lock_class_key	io_lock_cls_key;
include/linux/blkdev.h:519:	struct lockdep_map	io_lockdep_map;
include/linux/blkdev.h-520-
]

gemini-3.1-pro-preview

							input: 36283
							output: 28
							thoughts: 146
						

**My Thought Process Regarding Bio Queue Locking**

Okay, so my initial observation is about these functions, `bio_queue_enter` and `__bio_queue_enter`. I've noticed that they immediately call `rwsem_acquire_read` and then `rwsem_release`. This is interesting because it tells me they're not actually *holding* the read semaphore for any significant duration – they acquire it and then release it almost instantly. This suggests a very brief, perhaps just for-checking or initialization, acquisition rather than a sustained hold.

Then, I looked at `blk_freeze_acquire_lock`. This function calls `rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_)`. My immediate question here, and it's a critical one given the context, is whether `rwsem_acquire` is for a *write* lock. The signature and the parameters `0, 1` are throwing me a bit. I'm trying to decipher if `0, 1` translates to `subclass=0, trylock=0, read=0` or if it's `read=1`. To clarify this, I absolutely need to check the signature of `rwsem_acquire` itself. Understanding precisely what those flags signify is key to determining if this is a read or write acquisition.

log-in to see details

map[ContextFile: Name:rwsem_acquire]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 36462
							output: 26
							thoughts: 16
						

**My Thought Process Regarding the `lockdep.h` Macro**

Ah, so I've encountered a macro definition within the `include/linux/lockdep.h` header file. My immediate instinct is to place this within the context of the kernel's lock dependency tracking system, Lockdep. This header is a foundational piece of that mechanism, and macros defined here are typically instrumental in how Lockdep operates at a low level. I'd be looking for something that likely relates to either the invocation of Lockdep's checks, the definition of lock types, or potentially the internal state management that Lockdep relies upon. Given it's a macro, I'd anticipate it's a shorthand, an abstraction, or perhaps a conditional compilation directive to tailor Lockdep's behavior based on build configurations or specific architectural needs. It’s a key piece of the infrastructure that allows the kernel to statically and dynamically analyze lock acquisition orders to prevent deadlocks.

map[Expression:#define rwsem_acquire PathPrefix:]

map[Output:include/linux/lockdep.h=522=do {									\
--
include/linux/lockdep.h-538-
include/linux/lockdep.h:539:#define rwsem_acquire(l, s, t, i)		lock_acquire_exclusive(l, s, t, NULL, i)
include/linux/lockdep.h:540:#define rwsem_acquire_nest(l, s, t, n, i)	lock_acquire_exclusive(l, s, t, n, i)
include/linux/lockdep.h:541:#define rwsem_acquire_read(l, s, t, i)		lock_acquire_shared(l, s, t, NULL, i)
include/linux/lockdep.h-542-#define rwsem_release(l, i)			lock_release(l, i)
]

gemini-3.1-pro-preview

							input: 36708
							output: 31
							thoughts: 1068
						

**My Thought Process Unpacking `nvme_update_ns_info` and Zone Revalidation**

So, I'm digging into this `nvme_update_ns_info` function and trying to trace the locking behavior, particularly around zone revalidation. My initial thought is that the core locking primitives are straightforward: `rwsem_acquire` maps to `lock_acquire_exclusive` and `rwsem_release` to `lock_release`. This seems like a good starting point.

Then, a question pops into my head: could `blk_freeze_acquire_lock` be called, but then `rwsem_acquire` somehow fails? I quickly dismiss this; `lock_acquire_exclusive` doesn't really "fail" in a way that would cause an issue here; it primarily updates the lockdep state.

The real complexity seems to emerge when I consider the call chain. I hypothesize that `nvme_update_ns_info` might call `blk_mq_freeze_queue`, which in turn calls `blk_freeze_acquire_lock`. Okay, that's the initial freeze. Then, the function proceeds to `nvme_mpath_revalidate_zones`. This call leads to `blk_revalidate_disk_zones`.

Now, here's where it gets interesting. The documentation or code indicates that `blk_revalidate_disk_zones` can also call `blk_mq_freeze_queue`, specifically in an error path. My concern is that if `blk_revalidate_disk_zones` is called *again* while the queue is already frozen by the earlier `nvme_update_ns_info` call, we could have a double freeze. If `blk_revalidate_disk_zones` calls `blk_mq_freeze_queue` and then `blk_mq_unfreeze_queue`, it would increment and then decrement `owner_depth`. If the outer `nvme_update_ns_info` then calls `blk_mq_unfreeze_queue`, it would bring the depth down to zero. This seems balanced, so far so good.

A crucial point I'm verifying is *which* queue is being operated on. In `nvme_mpath_revalidate_zones`, it's clearly using `head->disk->queue`. I'm confirming that this `disk` is indeed the one associated with the `ns->head`, so the queue being referenced is consistent. This seems to resolve any potential confusion about operating on different queues.

My attention then shifts to another potential entry point: `nvme_update_ns_info_block`. I examine its code, and indeed, it *also* calls `blk_revalidate_disk_zones(ns->disk)`. This is a critical observation. The critical part here is that `nvme_update_ns_info_block` *already* called `blk_mq_unfreeze_queue(ns->disk->queue)` *before* calling `blk_revalidate_disk_zones`. This means the queue is *not* frozen when `blk_revalidate_disk_zones` is invoked from this path.

If `blk_revalidate_disk_zones` is called when the queue isn't frozen, it will fail. And in its error path, it calls `blk_mq_freeze_queue(q)` and then immediately `blk_mq_unfreeze_queue(q, memflags)`. This sequence, again, appears to be perfectly balanced within itself.

However, I'm still not entirely at ease. My mind drifts to the specific error handling within `blk_revalidate_disk_zones`. I'm looking at the `free_resources` label. It performs `memflags = blk_mq_freeze_queue(q);`, then `disk_free_zone_resources(disk);`, and finally `blk_mq_unfreeze_queue(q, memflags);`. My lingering doubt is: what if `disk_free_zone_resources` itself triggers some kind of unfreeze operation? I need to scrutinize the implementation of `disk_free_zone_resources` to ensure there isn't a hidden unfreeze that would leave the queue in an unexpected state after the `blk_revalidate_disk_zones` error path completes. This is where my current line of investigation is focused.

map[ContextFile: Name:disk_free_zone_resources]

map[SourceCode:1978:	static void disk_free_zone_resources(struct gendisk *disk)
1979:	{
1980:		if (disk->zone_wplugs_worker) {
1981:			kthread_stop(disk->zone_wplugs_worker);
1982:			disk->zone_wplugs_worker = NULL;
1983:		}
1984:		WARN_ON_ONCE(!list_empty(&disk->zone_wplugs_list));
1985:	
1986:		if (disk->zone_wplugs_wq)
1987:			drain_workqueue(disk->zone_wplugs_wq);
1988:	
1989:		disk_destroy_zone_wplugs_hash_table(disk);
1990:	
1991:		disk_set_zones_cond_array(disk, NULL);
1992:		disk->zone_capacity = 0;
1993:		disk->last_zone_capacity = 0;
1994:		disk->nr_zones = 0;
1995:	}
 SourceFile:block/blk-zoned.c]

gemini-3.1-pro-preview

							input: 38109
							output: 31
							thoughts: 274
						

**My Investigation into NVMe Queue Freezing Behavior**

Okay, so my initial thought was that the NVMe queue simply isn't unfreezing as expected. But that's too simple. I need to dig into the *why*.

My immediate line of inquiry goes to the potential call chain initiated by `nvme_update_ns_info`. I'm hypothesizing that it might call `blk_mq_freeze_queue` on the namespace's head disk's queue. If that happens, the next step in my mental model is `nvme_mpath_revalidate_zones` being invoked, which in turn would call `blk_revalidate_disk_zones(disk)`. This seems plausible because zone management often requires queue synchronization. Then, `blk_revalidate_disk_zones` would likely call `memflags = blk_mq_freeze_queue(q)`.

Now, here's where it gets interesting. I'm remembering that `blk_mq_freeze_queue` itself returns `memflags`, specifically `memalloc_noio_save()`. If that's the case, then the subsequent `blk_mq_unfreeze_queue(q, memflags)` correctly calls `memalloc_noio_restore(memflags)`, which should properly restore the memory allocation flags. This particular path seems robust.

However, I'm still not convinced. Let's consider an alternative path stemming from `nvme_update_ns_info`. What if, after `blk_mq_freeze_queue(ns->head->disk->queue)`, the code proceeds to `queue_limits_commit_update(ns->head->disk->queue, &lim)`? This is a critical juncture. My immediate question here is: does `queue_limits_commit_update` itself call `blk_mq_freeze_queue` or, more importantly, `blk_mq_unfreeze_queue`? This is where the potential for a deadlock or incomplete unfreezing might lie. I need to meticulously examine the implementation of `queue_limits_commit_update` to trace its internal calls and determine if it improperly interacts with the queue's freeze/unfreeze state. That's my next step.

map[ContextFile: Name:queue_limits_commit_update]

map[SourceCode: 534:	/**
 535:	 * queue_limits_commit_update - commit an atomic update of queue limits
 536:	 * @q:		queue to update
 537:	 * @lim:	limits to apply
 538:	 *
 539:	 * Apply the limits in @lim that were obtained from queue_limits_start_update()
 540:	 * and updated by the caller to @q.  The caller must have frozen the queue or
 541:	 * ensure that there are no outstanding I/Os by other means.
 542:	 *
 543:	 * Returns 0 if successful, else a negative error code.
 544:	 */
 545:	int queue_limits_commit_update(struct request_queue *q,
 546:			struct queue_limits *lim)
 547:	{
 548:		int error;
 549:	
 550:		lockdep_assert_held(&q->limits_lock);
 551:	
 552:		error = blk_validate_limits(lim);
 553:		if (error)
 554:			goto out_unlock;
 555:	
 556:	#ifdef CONFIG_BLK_INLINE_ENCRYPTION
 557:		if (q->crypto_profile && lim->integrity.tag_size) {
 558:			pr_warn("blk-integrity: Integrity and hardware inline encryption are not supported together.\n");
 559:			error = -EINVAL;
 560:			goto out_unlock;
 561:		}
 562:	#endif
 563:	
 564:		q->limits = *lim;
 565:		if (q->disk)
 566:			blk_apply_bdi_limits(q->disk->bdi, lim);
 567:	out_unlock:
 568:		mutex_unlock(&q->limits_lock);
 569:		return error;
 570:	}
 SourceFile:block/blk-settings.c]

gemini-3.1-pro-preview

							input: 38956
							output: 27
							thoughts: 4106
						

**The Persistent Question of Unfreeze Balance**

My initial thought was, "No, this isn't right." But then, the possibility arose: what if `nvme_update_ns_info` triggers a call to `blk_mq_freeze_queue` on `ns->head->disk->queue`? And what if, subsequently, `queue_limits_commit_update` were to fail? This would lead to the execution of `unfreeze_head_queue`, which in turn calls `blk_mq_unfreeze_queue`. At first glance, this sequence appears perfectly balanced – a freeze followed by an unfreeze.

However, a new concern surfaced: could `nvme_update_ns_info` actually call `blk_mq_unfreeze_queue` *twice* for the same queue? I examined the code snippet, specifically looking for any loops or multiple calls. My conclusion was that it appeared to be called exactly once.

Then, the critical question emerged: what if `nvme_update_ns_info` is invoked concurrently for the *same* `ns`? My analysis went something like this: if Thread A calls `blk_mq_freeze_queue` and then Thread B also calls `blk_mq_freeze_queue` on the same queue, and subsequently Thread A calls `blk_mq_unfreeze_queue` followed by Thread B calling `blk_mq_unfreeze_queue`, this would still be balanced. Thread A would acquire and release, and Thread B, not having acquired, wouldn't release.

The real complexity began when I considered the interaction with `queue_limits_start_update`. This function, I recalled, acquires `q->limits_lock`. If Thread A, after calling `blk_mq_freeze_queue`, then calls `queue_limits_start_update`, it would acquire the `limits_lock`. If Thread B then tried to call `queue_limits_start_update` on the same queue, it would block on that lock. This serializes calls to `queue_limits_start_update`.

My thought process then jumped to `queue_limits_commit_update`, which releases the `limits_lock`. This means the lock is released *before* `blk_mq_unfreeze_queue` is called. So, Thread A would release `limits_lock`, then proceed with other operations like `set_capacity_and_notify`, and `nvme_mpath_revalidate_paths`. Meanwhile, Thread B, no longer blocked, could acquire the `limits_lock`. If Thread B then calls `blk_mq_freeze_queue` *before* Thread A has called `blk_mq_unfreeze_queue`, the situation gets intricate.

This would lead to Thread B calling `blk_mq_freeze_queue` while Thread A still holds the freeze depth. Thread B would then call `blk_mq_freeze_queue_wait`, which, because Thread A has already decremented the usage counter to zero, would return immediately. Thread B would then proceed to call `queue_limits_commit_update` (releasing `limits_lock`) and subsequently `blk_mq_unfreeze_queue`. This, in turn, would increment the `mq_freeze_depth` back to 1 and result in `blk_unfreeze_check_owner` returning `false` because the owner is Thread A, not Thread B.

Then, Thread A would finally call `blk_mq_unfreeze_queue`. This would decrement `mq_freeze_depth` to 0. At this point, `blk_unfreeze_check_owner` would return `true` because Thread A is the owner and its `owner_depth` reaches 0. Thread A would then release the lock.

Even after this detailed tracing, I found myself thinking, "Wait! This is STILL perfectly balanced!" Thread A acquired and released; Thread B didn't acquire and didn't release. So why would lockdep complain about a "bad unlock balance"?

The possibility of a double `blk_mq_unfreeze_queue` call by Thread A was dismissed because, in the second attempt, the owner would be `NULL`, preventing the lock release. The scenario where `nvme_mpath_revalidate_zones` calls `blk_revalidate_disk_zones`, which in turn calls `blk_mq_freeze_queue`, also seemed to resolve back to a balanced state, as both acquiring and releasing threads would correctly manage the freeze depth.

The core of my struggle lay in understanding how a "bad unlock balance" could occur, specifically the message "but there are no more locks to release!". This implies a release operation was attempted without a corresponding acquisition by the current task. I meticulously re-examined the conditions under which `blk_unfreeze_check_owner` returns `true`, focusing on the requirement that `q->mq_freeze_owner` must match `current`. This check, coupled with the fact that `q->mq_freeze_owner` is only set when `!q->mq_freeze_depth` and under conditions where `blk_freeze_acquire_lock` *is* called, led me to believe that the current task *must* have acquired the lock.

The persistent question then became: how could a task release a lock it *just* acquired if lockdep is reporting it has *no more locks to release*? My mind cycled through scenarios where the `mq_freeze_disk_dead` flag might interfere, but those also seemed to lead to balanced acquire/release pairs. The crux of the problem remained: a lock was released, but it seems it was never acquired by the current task, or it was released twice by the same task. My investigation was leading me in circles, trying to find a flaw in the logic that would allow a release without a prior, unreleased acquisition by the same context.

map[Expression:mq_freeze_disk_dead PathPrefix:]

map[Output:block/blk-mq.c=116=static bool blk_freeze_set_owner(struct request_queue *q,
--
block/blk-mq.c-124-		q->mq_freeze_owner_depth = 1;
block/blk-mq.c:125:		q->mq_freeze_disk_dead = !q->disk ||
block/blk-mq.c-126-			test_bit(GD_DEAD, &q->disk->state) ||
--
block/blk.h=761=static inline void blk_freeze_acquire_lock(struct request_queue *q)
block/blk.h-762-{
block/blk.h:763:	if (!q->mq_freeze_disk_dead)
block/blk.h-764-		rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
--
block/blk.h=769=static inline void blk_unfreeze_release_lock(struct request_queue *q)
--
block/blk.h-772-		rwsem_release(&q->q_lockdep_map, _RET_IP_);
block/blk.h:773:	if (!q->mq_freeze_disk_dead)
block/blk.h-774-		rwsem_release(&q->io_lockdep_map, _RET_IP_);
--
include/linux/blkdev.h=488=struct request_queue {
--
include/linux/blkdev.h-639-	 */
include/linux/blkdev.h:640:	bool			mq_freeze_disk_dead;
include/linux/blkdev.h-641-	bool			mq_freeze_queue_dying;
]

gemini-3.1-pro-preview

							input: 43519
							output: 30
							thoughts: 8799
						

**The Subtle Art of Freeze and Unfreeze: A Lockdep Conundrum**

My mind has been grappling with a particularly thorny issue within the NVMe driver, specifically concerning the `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue` operations. Initially, I was convinced that the modification of queue freezing was confined solely to `blk_freeze_set_owner`. However, as I delved deeper, a series of "what ifs" began to surface, each one a potential pitfall in this delicate dance of kernel synchronization.

My initial thoughts focused on whether `blk_mq_unfreeze_queue` could be invoked on a *different* queue than the one that was frozen. I examined the flow within `nvme_update_ns_info`, confirming that both the freeze and unfreeze operations consistently targeted `ns->head->disk->queue`. The pointers involved, `ns->head` and subsequently `ns->head->disk->queue`, seemed immutable throughout the relevant scope, being assigned early in their lifecycle and not subsequently changed. This provided a sense of reassurance; the target queue itself wasn't morphing beneath my feet.

The next wave of scrutiny turned to potential re-entrancy. What if `nvme_update_ns_info` were to call `blk_mq_freeze_queue` and then, before unfrozen, trigger a path that *also* called `blk_mq_freeze_queue` on the *same* queue? I traced the execution path, specifically considering the call to `nvme_mpath_revalidate_zones` and its subsequent call to `blk_revalidate_disk_zones`. My analysis revealed that `blk_revalidate_disk_zones` *does* indeed call `blk_mq_freeze_queue` on the very same queue that was just frozen by `nvme_update_ns_info`. However, my understanding of `blk_freeze_set_owner` kicked in here. It correctly identified that `current` was already the owner, and crucially, it *returned FALSE*. This prevented `blk_freeze_acquire_lock` from being called again. Consequently, when `blk_mq_unfreeze_queue` was eventually invoked, it correctly decremented the `mq_freeze_depth` and balanced the lock counts. The same logic applied when `blk_revalidate_disk_zones` was called from `nvme_update_ns_info_block`, as it was always operating on the same, currently unfrozen queue. My analysis of separate queues (`ns->disk->queue` vs. `ns->head->disk->queue`) also confirmed that these were handled independently and correctly.

Then, the lockdep warnings began to loom. The specific complaint, "bad unlock balance detected! ... but there are no more locks to release!", pointed towards a situation where an attempt was made to release a lock that was not held. My initial suspicion was a race condition on the queue itself, perhaps where it could be freed and reallocated. However, I meticulously followed the lifecycle of `ns->head->disk->queue`, concluding that it remained stable and allocated throughout the freezing/unfreezing process within a given `nvme_update_ns_info` call.

The breakthrough came when I revisited the lock acquisition and release logic within `blk_freeze_acquire_lock` and `blk_unfreeze_release_lock`, specifically their interactions with `q->mq_freeze_disk_dead`. I realized that these functions read `q->mq_freeze_disk_dead` *outside* the protection of `q->mq_freeze_lock`, which is released by `__blk_mq_unfreeze_queue` and `__blk_freeze_queue_start` *before* these respective `release_lock` functions are called.

This opened the door to a critical race condition:

1.  **Thread A (e.g., a worker thread processing `nvme_update_ns_info` for a namespace that is *not yet registered*) calls `blk_mq_freeze_queue`.** At this point, `!q->disk || ... || !blk_queue_registered(q)` evaluates to TRUE, setting `q->mq_freeze_disk_dead` to TRUE. Consequently, `blk_freeze_acquire_lock` *does not* acquire the `io_lockdep_map`.
2.  **Thread A proceeds to call `blk_mq_unfreeze_queue`.** The internal function `__blk_mq_unfreeze_queue` successfully decrements `q->mq_freeze_depth` to 0 and returns TRUE. Thread A is then *preempted* before it can execute `blk_unfreeze_release_lock`.
3.  **Crucially, between Thread A's preemption and its resumption, another thread (Thread B) manages to register the disk.** This might happen, for instance, through `nvme_mpath_add_disk` called by a concurrent `nvme_scan_ns` operation targeting the same subsystem. Now, `!q->disk || ... || !blk_queue_registered(q)` evaluates to FALSE, and `q->mq_freeze_disk_dead` is updated to FALSE.
4.  **Thread B then calls `blk_mq_freeze_queue`.** Since `q->mq_freeze_disk_dead` is now FALSE, `blk_freeze_acquire_lock` *does* acquire the `io_lockdep_map`.
5.  **Thread A resumes and finally calls `blk_unfreeze_release_lock`.** It reads the *current* value of `q->mq_freeze_disk_dead`, which is now FALSE. Therefore, `blk_unfreeze_release_lock` attempts to release the `io_lockdep_map`.

The problem is evident: Thread A *believes* it needs to release the lock because `q->mq_freeze_disk_dead` is FALSE at the time of release. However, it never actually *acquired* the lock in the first place because `q->mq_freeze_disk_dead` was TRUE during its acquisition attempt. This discrepancy leads lockdep to report the "bad unlock balance" because it sees an attempt to release a lock that was never properly acquired by the current thread. This race condition is the root cause of the observed warning.

map[ContextFile: Name:nvme_scan_ns]

map[SourceCode:4441:	static void nvme_scan_ns(struct nvme_ctrl *ctrl, unsigned nsid)
4442:	{
4443:		struct nvme_ns_info info = { .nsid = nsid };
4444:		struct nvme_ns *ns;
4445:		int ret = 1;
4446:	
4447:		if (nvme_identify_ns_descs(ctrl, &info))
4448:			return;
4449:	
4450:		if (info.ids.csi != NVME_CSI_NVM && !nvme_multi_css(ctrl)) {
4451:			dev_warn(ctrl->device,
4452:				"command set not reported for nsid: %u\n", nsid);
4453:			return;
4454:		}
4455:	
4456:		/*
4457:		 * If available try to use the Command Set Independent Identify Namespace
4458:		 * data structure to find all the generic information that is needed to
4459:		 * set up a namespace.  If not fall back to the legacy version.
4460:		 */
4461:		if ((ctrl->cap & NVME_CAP_CRMS_CRIMS) ||
4462:		    (info.ids.csi != NVME_CSI_NVM && info.ids.csi != NVME_CSI_ZNS) ||
4463:		    ctrl->vs >= NVME_VS(2, 0, 0))
4464:			ret = nvme_ns_info_from_id_cs_indep(ctrl, &info);
4465:		if (ret > 0)
4466:			ret = nvme_ns_info_from_identify(ctrl, &info);
4467:	
4468:		if (info.is_removed)
4469:			nvme_ns_remove_by_nsid(ctrl, nsid);
4470:	
4471:		/*
4472:		 * Ignore the namespace if it is not ready. We will get an AEN once it
4473:		 * becomes ready and restart the scan.
4474:		 */
4475:		if (ret || !info.is_ready)
4476:			return;
4477:	
4478:		ns = nvme_find_get_ns(ctrl, nsid);
4479:		if (ns) {
4480:			nvme_validate_ns(ns, &info);
4481:			nvme_put_ns(ns);
4482:		} else {
4483:			nvme_alloc_ns(ctrl, &info);
4484:		}
4485:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 53092
							output: 30
							thoughts: 9
						

**My Thought Process on `nvme_alloc_ns`**

Right, so I'm looking at this `nvme_alloc_ns` function. My immediate thought is, "Okay, this is where we're setting up a new NVMe namespace." It's the fundamental step in making a new logical storage unit available on the NVMe controller. I expect this function to be responsible for all the necessary bookkeeping and resource allocation to define that namespace.

My brain immediately goes to the core components that define an NVMe namespace. There's the namespace identifier itself, of course – a unique ID. Then there's its size, its capacity. I'm also thinking about its state: is it active, is it being created, is it deleted? These are crucial for the controller to manage it correctly.

Furthermore, this function must be interacting with the NVMe controller's internal structures. It's not just creating an abstract concept; it's likely modifying or populating data structures within the NVMe driver or the hardware itself to represent this new namespace. I'm anticipating it will involve mapping resources, potentially allocating memory for metadata, and setting up communication channels or queues related to this specific namespace.

I'm also considering the potential failure modes. What happens if the controller is full, or if there's an issue with the underlying storage fabric? This function should gracefully handle errors and report them back so the system knows something went wrong. It's not just about succeeding; it's about failing predictably and informatively.

Essentially, `nvme_alloc_ns` is the gatekeeper for creating new logical storage entities in an NVMe environment. It needs to be robust, efficient, and correctly represent the underlying hardware's capabilities and limitations. My mental model is that it’s the critical initialization point before any actual data can be read from or written to this newly provisioned space.

map[ContextFile: Name:nvme_alloc_ns]

map[SourceCode:4238:	static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info)
4239:	{
4240:		struct queue_limits lim = { };
4241:		struct nvme_ns *ns;
4242:		struct gendisk *disk;
4243:		int node = ctrl->numa_node;
4244:		bool last_path = false;
4245:	
4246:		ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node);
4247:		if (!ns)
4248:			return;
4249:	
4250:		if (ctrl->opts && ctrl->opts->data_digest)
4251:			lim.features |= BLK_FEAT_STABLE_WRITES;
4252:		if (ctrl->ops->supports_pci_p2pdma &&
4253:		    ctrl->ops->supports_pci_p2pdma(ctrl))
4254:			lim.features |= BLK_FEAT_PCI_P2PDMA;
4255:	
4256:		disk = blk_mq_alloc_disk(ctrl->tagset, &lim, ns);
4257:		if (IS_ERR(disk))
4258:			goto out_free_ns;
4259:		disk->fops = &nvme_bdev_ops;
4260:		disk->private_data = ns;
4261:	
4262:		ns->disk = disk;
4263:		ns->queue = disk->queue;
4264:		ns->ctrl = ctrl;
4265:		kref_init(&ns->kref);
4266:	
4267:		if (nvme_init_ns_head(ns, info))
4268:			goto out_cleanup_disk;
4269:	
4270:		/*
4271:		 * If multipathing is enabled, the device name for all disks and not
4272:		 * just those that represent shared namespaces needs to be based on the
4273:		 * subsystem instance.  Using the controller instance for private
4274:		 * namespaces could lead to naming collisions between shared and private
4275:		 * namespaces if they don't use a common numbering scheme.
4276:		 *
4277:		 * If multipathing is not enabled, disk names must use the controller
4278:		 * instance as shared namespaces will show up as multiple block
4279:		 * devices.
4280:		 */
4281:		if (nvme_ns_head_multipath(ns->head)) {
4282:			sprintf(disk->disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
4283:				ctrl->instance, ns->head->instance);
4284:			disk->flags |= GENHD_FL_HIDDEN;
4285:		} else if (multipath) {
4286:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->subsys->instance,
4287:				ns->head->instance);
4288:		} else {
4289:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance,
4290:				ns->head->instance);
4291:		}
4292:	
4293:		if (nvme_update_ns_info(ns, info))
4294:			goto out_unlink_ns;
4295:	
4296:		mutex_lock(&ctrl->namespaces_lock);
4297:		/*
4298:		 * Ensure that no namespaces are added to the ctrl list after the queues
4299:		 * are frozen, thereby avoiding a deadlock between scan and reset.
4300:		 */
4301:		if (test_bit(NVME_CTRL_FROZEN, &ctrl->flags)) {
4302:			mutex_unlock(&ctrl->namespaces_lock);
4303:			goto out_unlink_ns;
4304:		}
4305:		blk_queue_rq_timeout(ns->queue, ctrl->io_timeout);
4306:		nvme_ns_add_to_ctrl_list(ns);
4307:		mutex_unlock(&ctrl->namespaces_lock);
4308:		synchronize_srcu(&ctrl->srcu);
4309:		nvme_get_ctrl(ctrl);
4310:	
4311:		if (device_add_disk(ctrl->device, ns->disk, nvme_ns_attr_groups))
4312:			goto out_cleanup_ns_from_list;
4313:	
4314:		if (!nvme_ns_head_multipath(ns->head))
4315:			nvme_add_ns_cdev(ns);
4316:	
4317:		nvme_mpath_add_disk(ns, info->anagrpid);
4318:		nvme_fault_inject_init(&ns->fault_inject, ns->disk->disk_name);
4319:	
4320:		return;
4321:	
4322:	 out_cleanup_ns_from_list:
4323:		nvme_put_ctrl(ctrl);
4324:		mutex_lock(&ctrl->namespaces_lock);
4325:		list_del_rcu(&ns->list);
4326:		mutex_unlock(&ctrl->namespaces_lock);
4327:		synchronize_srcu(&ctrl->srcu);
4328:	 out_unlink_ns:
4329:		mutex_lock(&ctrl->subsys->lock);
4330:		list_del_rcu(&ns->siblings);
4331:		if (list_empty(&ns->head->list)) {
4332:			list_del_init(&ns->head->entry);
4333:			/*
4334:			 * If multipath is not configured, we still create a namespace
4335:			 * head (nshead), but head->disk is not initialized in that
4336:			 * case.  As a result, only a single reference to nshead is held
4337:			 * (via kref_init()) when it is created. Therefore, ensure that
4338:			 * we do not release the reference to nshead twice if head->disk
4339:			 * is not present.
4340:			 */
4341:			if (ns->head->disk)
4342:				last_path = true;
4343:		}
4344:		mutex_unlock(&ctrl->subsys->lock);
4345:	
4346:		/* guarantee not available in head->list */
4347:		synchronize_srcu(&ns->head->srcu);
4348:		if (last_path)
4349:			nvme_put_ns_head(ns->head);
4350:		nvme_put_ns_head(ns->head);
4351:	 out_cleanup_disk:
4352:		put_disk(disk);
4353:	 out_free_ns:
4354:		kfree(ns);
4355:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 55047
							output: 16
							thoughts: 5033
						

**My Thought Process on the NVMe Multipath Race Condition**

Right, so I've been digging into this NVMe multipath issue, and it all hinges on the timing of queue freezing and unfreezing, specifically around the `q->mq_freeze_disk_dead` flag.

My initial thought was, "Okay, `nvme_mpath_add_disk` is called *after* `nvme_update_ns_info`." This immediately tells me that when `nvme_update_ns_info` runs, the underlying disk (`ns->head->disk`) isn't registered yet. Consequently, `q->mq_freeze_disk_dead` *must* be TRUE at that point. Then, `nvme_update_ns_info` calls `blk_mq_unfreeze_queue`. Now, imagine Thread A gets preempted right after `__blk_mq_unfreeze_queue` returns TRUE, but crucially, *before* it releases the lock (`blk_unfreeze_release_lock`).

At this precise moment, Thread B, representing another controller, tries to allocate a namespace for the *same* namespace. It calls `nvme_alloc_ns`, which leads to `nvme_init_ns_head`. This finds the existing `ns->head`. Then, Thread B proceeds to `nvme_update_ns_info`. It will call `blk_mq_freeze_queue(ns->head->disk->queue)`. The key question here is: has Thread B registered `ns->head->disk` yet? No, it hasn't reached `nvme_mpath_add_disk`. Therefore, `q->mq_freeze_disk_dead` is *still* TRUE, as set by Thread A earlier. If Thread A, upon resuming, reads this TRUE value, it won't release the lock, and it seems like we might have a deadlock, but importantly, no bug yet, as the lock is held as expected.

Then I considered: "What if Thread B has *already* reached `nvme_mpath_add_disk`?" If Thread B is there, it means it has successfully completed `nvme_update_ns_info`. But Thread A is still in its own `nvme_update_ns_info` call. How could Thread B finish its `nvme_update_ns_info` before Thread A? This would only happen if Thread B initiated its `nvme_alloc_ns` *before* Thread A. In this scenario, Thread B would freeze and unfreeze, then call `nvme_mpath_add_disk`, and the disk would be registered. Subsequently, Thread A enters `nvme_update_ns_info`. It calls `blk_mq_freeze_queue`. Since the disk is now registered, `q->mq_freeze_disk_dead` would be FALSE. Thread A would acquire the lock, proceed to `blk_mq_unfreeze_queue`, `__blk_mq_unfreeze_queue` would return TRUE, and Thread A might be preempted again. If another thread (Thread C) tried to freeze the queue, it would see `q->mq_freeze_disk_dead` as FALSE, and Thread A would acquire the lock. When Thread A eventually unfreezes, it reads `q->mq_freeze_disk_dead`. If it's FALSE (because the disk is registered), Thread A releases the lock. This sequence appears perfectly balanced and correct.

The real crux of the problem, I realized, is when `q->mq_freeze_disk_dead` needs to change from TRUE to FALSE *during* the freeze/unfreeze cycle, and this can only happen if Thread A is preempted in a very specific, small window. The scenario I'm picturing is: Thread A freezes the queue when the disk is NOT registered (`q->mq_freeze_disk_dead` = TRUE). Then, Thread B *registers* the disk. After that, Thread A resumes and tries to unfreeze. The critical question becomes: can Thread B register the disk while Thread A has the queue frozen? It turns out, `nvme_mpath_add_disk` (which calls `device_add_disk`) *does not wait* for the queue to be unfrozen. This is key!

So, let's trace this critical path:
1.  Thread A (Controller 1) starts `nvme_alloc_ns`, then `nvme_update_ns_info`.
2.  Thread A calls `blk_mq_freeze_queue`. `q->mq_freeze_disk_dead` is set to TRUE because the disk isn't registered. The lock isn't acquired.
3.  Thread B (Controller 2) also calls `nvme_alloc_ns` and `nvme_update_ns_info`. It tries to freeze the queue. Since Thread A already has it, Thread B enters `blk_mq_freeze_queue_wait`. However, because Thread A has "killed" the queue (`q->q_usage_counter` is 0), Thread B returns immediately without waiting.
4.  Thread B continues within `nvme_update_ns_info`, performs its updates, and calls `blk_mq_unfreeze_queue`. Crucially, `blk_unfreeze_check_owner` returns FALSE because Thread B is not the owner. Thread B does *not* release the lock.
5.  Thread B proceeds to `nvme_mpath_add_disk`, calls `device_add_disk`, and the disk is now registered. `blk_queue_registered(q)` becomes TRUE.
6.  Now, Thread A resumes within its `nvme_update_ns_info`. It calls `blk_mq_unfreeze_queue`. `__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` to 0. `blk_unfreeze_check_owner` returns TRUE (Thread A is the owner). Thread A then calls `blk_unfreeze_release_lock`. *Here's the rub*: when it reads `q->mq_freeze_disk_dead`, it's *still TRUE* because `device_add_disk` (called by Thread B) doesn't modify this flag. Therefore, Thread A does *not* release the lock, and we still haven't found the bug, but this is getting close to a state where a bug *could* manifest if the flag were to change.

The critical realization hit me when I looked at how `q->mq_freeze_disk_dead` is set:
```c
		if (!q->mq_freeze_depth) {
			q->mq_freeze_owner = owner;
			q->mq_freeze_owner_depth = 1;
			q->mq_freeze_disk_dead = !q->disk ||
				test_bit(GD_DEAD, &q->disk->state) ||
				!blk_queue_registered(q); // <-- This is the key!
			q->mq_freeze_queue_dying = blk_queue_dying(q);
			return true;
		}
```
This flag is *only* changed within `blk_freeze_set_owner`, which is called when `q->mq_freeze_depth` is zero. If `q->mq_freeze_depth` is greater than zero, the flag *cannot* change. This means the flag can only change between `blk_freeze_acquire_lock` and `blk_unfreeze_release_lock` if `q->mq_freeze_depth` momentarily drops to zero.

This leads to the race condition:
1.  Thread A calls `__blk_mq_unfreeze_queue`, which decrements `q->mq_freeze_depth` to 0 and returns TRUE.
2.  Thread A is preempted *before* calling `blk_unfreeze_release_lock`.
3.  Thread B (or C) calls `blk_mq_freeze_queue`. Since `q->mq_freeze_depth` is now 0, `blk_freeze_set_owner` is called. Crucially, at this point, the disk might *already be registered* by another thread. So, `!blk_queue_registered(q)` is FALSE, and `q->mq_freeze_disk_dead` is set to FALSE.
4.  Thread A resumes. It calls `blk_unfreeze_release_lock`. It reads `q->mq_freeze_disk_dead`, which is now FALSE! Thread A *incorrectly releases the lock*. Lockdep will complain because the lock was acquired when `q->mq_freeze_disk_dead` was TRUE, but released when it's FALSE.

This tiny window, precisely between `__blk_mq_unfreeze_queue` returning TRUE and `blk_unfreeze_release_lock` being called, is the target. The presence of `PREEMPT_{RT,(full)}` in the backtrace confirms that a fully preemptible kernel can indeed hit this.

To trigger this reliably, we need a specific sequence:
1.  A thread (Thread A) freezes the queue when the disk is *not* registered (`q->mq_freeze_disk_dead` = TRUE).
2.  This thread unfreezes the queue, but gets preempted just before releasing the lock.
3.  Another thread (Thread B) registers the disk.
4.  A third thread (Thread C) freezes the queue *after* it's registered (`q->mq_freeze_disk_dead` = FALSE). This will be the value Thread A reads upon resuming.

In fact, Thread B and Thread C can be the same thread. However, the timing is tricky: `nvme_update_ns_info` (where freezing happens) is called *before* `nvme_mpath_add_disk` (where registration happens). So, if Thread B is trying to freeze *before* it registers, `q->mq_freeze_disk_dead` will be TRUE, and Thread A won't release the lock.

The real trigger requires a thread to freeze the queue *after* it's already registered. This happens during a RESCAN operation. When `nvme_update_ns_info` is called during a rescan (`echo 1 > /sys/class/nvme/nvme*/rescan_controller`), the disk is ALREADY registered, so `blk_mq_freeze_queue` sets `q->mq_freeze_disk_dead` to FALSE. If this happens while another thread that initiated a freeze when the disk was *unregistered* is preempted in that critical window, the bug is hit.

Therefore, my refined strategy for reproducing this involves high concurrency between operations that register disks (connects) and operations that freeze/unfreeze already registered disks (rescans). I've sketched out a reproducer using pthreads that concurrently:
*   **Connects controllers:** This triggers `nvme_alloc_ns`, leading to `nvme_update_ns_info` and a freeze when the disk isn't registered.
*   **Rescans controllers:** This triggers `nvme_update_ns_info` on already registered disks, causing a freeze where `q->mq_freeze_disk_dead` is set to FALSE.
*   **Disconnects controllers:** This adds further churn, increasing the likelihood of race conditions.

The key is that these actions happen concurrently, creating the exact scenario where a thread might be preempted after `__blk_mq_unfreeze_queue` returns TRUE, while another thread registers the disk and then freezes the queue (setting `q->mq_freeze_disk_dead` to FALSE), leading to the incorrect lock release when the first thread resumes.

map[Name:race]

map[Toolkit:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }
]

gemini-3.1-pro-preview

							input: 61762
							output: 2065
							thoughts: 1763
						

**The Race Condition: A Delicate Dance of NVMe Queue Freezing and Unfreezing**

I've been digging into a rather thorny race condition within the NVMe subsystem, specifically around `q->mq_freeze_disk_dead` in `q->mq_freeze_disk_dead`. It's a classic situation where timing is everything, and when it goes wrong, chaos ensues.

Here's how I see it unfolding in my mind:

The problem begins when a new NVMe namespace is allocated via `nvme_alloc_ns`, which subsequently calls `nvme_update_ns_info`. At this nascent stage, the disk isn't yet registered, so `q->mq_freeze_disk_dead` is correctly set to `TRUE`. This is intended as a safeguard, indicating that the disk is in a state where its queue shouldn't be unfrozen.

Then, `nvme_update_ns_info` proceeds to unfreeze the queue. This is where the potential for disaster lies. Imagine this: a thread executing this code gets preempted *right after* `__blk_mq_unfreeze_queue` returns `TRUE` (signifying the unfreeze operation), but critically, *before* the lock is released by `blk_unfreeze_release_lock`. This is my narrow window of opportunity.

Now, picture another thread, let's call it Thread B, stepping in. This thread might be triggered by something like a controller rescan. Crucially, by the time Thread B executes `nvme_update_ns_info`, the disk *has* been registered. In this scenario, `nvme_update_ns_info` will dutifully set `q->mq_freeze_disk_dead` to `FALSE`.

When the first thread finally resumes, it proceeds to call `blk_unfreeze_release_lock`. Here's the kicker: it reads `q->mq_freeze_disk_dead` and finds it to be `FALSE`, because Thread B modified it. The problem is, the first thread never actually acquired the lock it's now attempting to release, leading to a lock release on a lock that wasn't held. This is the core of the race condition – a premature or incorrect lock release.

To reliably trigger this delicate dance, I need a specific choreography of threads:

1.  **Thread A (Connection Thread):** This thread initiates a controller connection. This path leads to `nvme_alloc_ns` and then `nvme_update_ns_info`, where the disk is initially *not* registered, setting `q->mq_freeze_disk_dead` to `TRUE`.
2.  **Thread B (Rescan Thread):** This thread performs a controller rescan. This will also call `nvme_update_ns_info`, but in this case, the disk *is* registered, causing `q->mq_freeze_disk_dead` to be set to `FALSE`.
3.  **Thread C (Disconnect Thread):** This thread is vital for continuously cycling the state of the controllers, allowing new connections to be established and then subsequently disconnected, which helps in creating the dynamic environment needed to hit the race.

By orchestrating a high concurrency of these threads – multiple threads connecting, multiple rescanning, and one or more disconnecting – I can significantly increase the probability of landing precisely in that critical preemption window. The provided C code implements exactly this strategy, creating a robust test harness to expose this subtle but serious race.

map[CurrentReproStrategy:An analysis of the lockdep warning and the block layer's queue freezing mechanism reveals a subtle race condition involving the `q->mq_freeze_disk_dead` flag.

### Root Cause Analysis
1. When `nvme_alloc_ns` is called for a new namespace, it allocates the multipath disk (`ns->head->disk`) but does **not** register it immediately.
2. It then calls `nvme_update_ns_info`, which freezes the queue (`blk_mq_freeze_queue`). Because the disk is not registered, `blk_freeze_set_owner` sets `q->mq_freeze_disk_dead = TRUE`.
3. Consequently, `blk_freeze_acquire_lock` does **not** acquire the `io_lockdep_map` lock.
4. `nvme_update_ns_info` then unfreezes the queue. `__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` to 0 and returns `TRUE`.
5. **The Race Window:** If the thread is preempted right here (before calling `blk_unfreeze_release_lock`), another thread can register the disk (e.g., via `nvme_mpath_add_disk`).
6. If a third thread (or a rescan) now calls `nvme_update_ns_info` on the same namespace, it freezes the queue again. Since the disk is now registered, `blk_freeze_set_owner` overwrites `q->mq_freeze_disk_dead` to `FALSE`.
7. When the original thread resumes, it calls `blk_unfreeze_release_lock`. It reads the new value of `q->mq_freeze_disk_dead` (`FALSE`) and attempts to release the `io_lockdep_map` lock, which it never acquired. This triggers the `bad unlock balance` warning.

### Reproduction Strategy
To trigger this race condition, we need to maximize the chances of a thread being preempted in the tiny window between `__blk_mq_unfreeze_queue` and `blk_unfreeze_release_lock`, while another thread registers the disk and a third thread freezes it again.

We can achieve this by running three concurrent workloads:
1. **Connect Threads:** Continuously connect NVMe loopback controllers. This triggers `nvme_alloc_ns` (which freezes the queue while the disk is unregistered) and eventually registers the disk.
2. **Rescan Threads:** Continuously trigger controller rescans (`echo 1 > /sys/class/nvme/nvmeX/rescan_controller`). This calls `nvme_update_ns_info` on already registered disks, overwriting `q->mq_freeze_disk_dead` to `FALSE`.
3. **Disconnect Threads:** Periodically delete controllers to keep the system churning and allow new connections to be established.

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 1

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		int fd = open("/dev/nvme-fabrics", O_RDWR);
		if (fd >= 0) {
			write(fd, "nqn=testnqn,transport=loop", 26);
			close(fd);
		}
	}
	return NULL;
}

void* rescan_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/rescan_controller; do echo 1 > $f 2>/dev/null; done");
	}
	return NULL;
}

void* disconnect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
		usleep(100000); // Disconnect less frequently to allow rescans to hit registered disks
	}
	return NULL;
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t ct[NUM_CONNECT_THREADS];
		pthread_t rt[NUM_RESCAN_THREADS];
		pthread_t dt[NUM_DISCONNECT_THREADS];

		__atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_create(&ct[i], NULL, connect_thread, NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_create(&rt[i], NULL, rescan_thread, NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_create(&dt[i], NULL, disconnect_thread, NULL);

		sleep(5);
		__atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_join(ct[i], NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_join(rt[i], NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_join(dt[i], NULL);
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```]

deep-reasoning

map[IsProbe:false RawCandidateReproC:#include "race_toolkit.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 2

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    return NULL;
}

void* rescan_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/rescan_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
    }
    return NULL;
}

void* disconnect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
        usleep(50000); // Disconnect less frequently to allow rescans to hit registered disks
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t ct[NUM_CONNECT_THREADS];
        pthread_t rt[NUM_RESCAN_THREADS];
        pthread_t dt[NUM_DISCONNECT_THREADS];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_create(&ct[i], NULL, connect_thread, NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_create(&dt[i], NULL, disconnect_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_join(ct[i], NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_join(dt[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.

To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
   and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
    int res = do_something();
    if (res < 0) {
        printf("[-] Failed to do_something: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
   systems, makefiles, and kernel build/header directories) is NOT available
   on the target test VM guest. Do NOT check for, build, or reference any
   compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
   functions like 'system()', 'popen()', or the 'exec' family such as
   'execve()'). All environment checks, capability probings, and reproduction
   steps must be performed directly using standard Linux system calls (such
   as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
   include a sufficient delay (using sleep or similar) after deleting
   or unregistering the device to allow the kernel's asynchronous
   timeout to trigger before program exit.


=== PHASE 2: BUG REPRODUCTION (GENERATION) ===
You must now generate a full reproducer candidate attempting to trigger the target bug/crash.
Do NOT generate a probe program. Focus directly on triggering the bug/crash described in the description.
You can assume that all necessary kernel capabilities and privileges (e.g., access to /dev/vhci,
ability to load BPF programs, etc.) have already been verified and are available in the environment.

Do not spend too much time analyzing or trying to generate a perfect one-shot reproducer.
Instead, follow an iterative approach: generate a simple candidate, execute it, analyze the results,
and improve it. Keep your reasoning steps short and focused on the next logical experiment.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Strategy: An analysis of the lockdep warning and the block layer's queue freezing mechanism reveals a subtle race condition involving the `q->mq_freeze_disk_dead` flag.

### Root Cause Analysis
1. When `nvme_alloc_ns` is called for a new namespace, it allocates the multipath disk (`ns->head->disk`) but does **not** register it immediately.
2. It then calls `nvme_update_ns_info`, which freezes the queue (`blk_mq_freeze_queue`). Because the disk is not registered, `blk_freeze_set_owner` sets `q->mq_freeze_disk_dead = TRUE`.
3. Consequently, `blk_freeze_acquire_lock` does **not** acquire the `io_lockdep_map` lock.
4. `nvme_update_ns_info` then unfreezes the queue. `__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` to 0 and returns `TRUE`.
5. **The Race Window:** If the thread is preempted right here (before calling `blk_unfreeze_release_lock`), another thread can register the disk (e.g., via `nvme_mpath_add_disk`).
6. If a third thread (or a rescan) now calls `nvme_update_ns_info` on the same namespace, it freezes the queue again. Since the disk is now registered, `blk_freeze_set_owner` overwrites `q->mq_freeze_disk_dead` to `FALSE`.
7. When the original thread resumes, it calls `blk_unfreeze_release_lock`. It reads the new value of `q->mq_freeze_disk_dead` (`FALSE`) and attempts to release the `io_lockdep_map` lock, which it never acquired. This triggers the `bad unlock balance` warning.

### Reproduction Strategy
To trigger this race condition, we need to maximize the chances of a thread being preempted in the tiny window between `__blk_mq_unfreeze_queue` and `blk_unfreeze_release_lock`, while another thread registers the disk and a third thread freezes it again.

We can achieve this by running three concurrent workloads:
1. **Connect Threads:** Continuously connect NVMe loopback controllers. This triggers `nvme_alloc_ns` (which freezes the queue while the disk is unregistered) and eventually registers the disk.
2. **Rescan Threads:** Continuously trigger controller rescans (`echo 1 > /sys/class/nvme/nvmeX/rescan_controller`). This calls `nvme_update_ns_info` on already registered disks, overwriting `q->mq_freeze_disk_dead` to `FALSE`.
3. **Disconnect Threads:** Periodically delete controllers to keep the system churning and allow new connections to be established.

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 1

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		int fd = open("/dev/nvme-fabrics", O_RDWR);
		if (fd >= 0) {
			write(fd, "nqn=testnqn,transport=loop", 26);
			close(fd);
		}
	}
	return NULL;
}

void* rescan_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/rescan_controller; do echo 1 > $f 2>/dev/null; done");
	}
	return NULL;
}

void* disconnect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
		usleep(100000); // Disconnect less frequently to allow rescans to hit registered disks
	}
	return NULL;
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t ct[NUM_CONNECT_THREADS];
		pthread_t rt[NUM_RESCAN_THREADS];
		pthread_t dt[NUM_DISCONNECT_THREADS];

		__atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_create(&ct[i], NULL, connect_thread, NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_create(&rt[i], NULL, rescan_thread, NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_create(&dt[i], NULL, disconnect_thread, NULL);

		sleep(5);
		__atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_join(ct[i], NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_join(rt[i], NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_join(dt[i], NULL);
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```


Previous Reproducer Attempt:
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>
#include <time.h>

#define NUM_THREADS 10

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
    printf("[+] mkdir %s successful.\n", path);
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
    printf("[+] write to %s successful.\n", path);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
    printf("[+] /tmp/nvme_backing created successfully.\n");

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] symlink successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

void disconnect_all() {
    DIR *d = opendir("/sys/class/nvme");
    if (!d) return;
    struct dirent *dir;
    while ((dir = readdir(d)) != NULL) {
        if (strncmp(dir->d_name, "nvme", 4) == 0) {
            char path[256];
            snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
            try_write_file(path, "1");
        }
    }
    closedir(d);
}

void* connect_thread(void* arg) {
    int fd = open("/dev/nvme-fabrics", O_RDWR);
    if (fd >= 0) {
        if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
            // ignore
        }
        close(fd);
    }
    return NULL;
}

int main() {
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections...\n");

    time_t start = time(NULL);
    while (time(NULL) - start < 15) {
        pthread_t t[NUM_THREADS];

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_create(&t[j], NULL, connect_thread, NULL);
        }

        for (int j = 0; j < NUM_THREADS; j++) {
            pthread_join(t[j], NULL);
        }

        disconnect_all();
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    
    // Wait for asynchronous operations to finish
    sleep(2);
    return 0;
}




Execution Results & Debugging Feedback:
The execution was successful, but it failed to trigger the `WARNING: bad unlock balance in nvme_update_ns_info` bug.

The reproducer successfully sets up an NVMe loopback target and establishes concurrent connections, which triggers namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`). However, the normal connection process does not hit the buggy code path.

The unlock imbalance in `nvme_update_ns_info` (specifically on `q->q_usage_counter(io)`) is likely caused by an error path or a race condition where `blk_mq_unfreeze_queue()` is called without a corresponding `blk_mq_freeze_queue()`, or called twice.

To trigger this, you should try to force `nvme_update_ns_info` into an error path or race condition. Strategies to consider:
1. **Concurrent Rescans:** Trigger explicit controller rescans (e.g., `echo 1 > /sys/class/nvme/nvmeX/rescan_controller`) concurrently with controller connections and disconnections.
2. **Dynamic Target Reconfiguration:** While the host is connecting or scanning, dynamically alter the NVMe target namespace (e.g., disable and re-enable the namespace in configfs, or change the size of the backing file). This can force `nvme_update_ns_info` to handle unexpected changes in namespace attributes (like capacity or LBA format changes) during the scan, which often have complex error handling and queue freezing logic.
3. **Multipath Races:** Ensure multipath is fully active and try to race the creation of the multipath head (`ns->head`) with namespace updates. You might need to connect multiple controllers to the same subsystem and rescan them simultaneously.
4. **Fault Injection:** Simulate I/O errors during the identify namespace command by truncating the backing file or using a faulty loop device to force `nvme_update_ns_info` into its error handling paths.

gemini-3.1-pro-preview

							input: 8197
							output: 26
							thoughts: 174
						

**My Thought Process on the "Bad Unlock Balance" Warning**

Ah, so the core of the issue I'm wrestling with is a "bad unlock balance" warning. Specifically, it's flagging that `q->q_usage_counter(io)` is being released when it was never actually acquired. This seems to be occurring within the `nvme_update_ns_info` function.

My initial understanding is that this problematic release stems from `blk_mq_unfreeze_queue`. I recall a previous attempt to address this that involved concurrent connect and disconnect operations, which clearly didn't resolve the underlying race condition.

The feedback I've received points to several potential areas where these races might be manifesting. I need to consider:

1.  **Concurrent Rescans:** It's quite plausible that multiple rescanning operations are happening simultaneously, leading to a confused state in how the queue counters are managed.
2.  **Dynamic Target Reconfiguration:** Changes to the namespace itself – like disabling and enabling it, or altering its size – could be introducing complexities that expose this counter imbalance.
3.  **Multipath Races:** The scenario where multiple controllers are connected to the same subsystem is a classic source of concurrency bugs. If these controllers are interacting with the namespace information simultaneously, it could easily trigger the problem.
4.  **Fault Injection:** This is a more proactive approach. By intentionally injecting faults, I can try to trigger specific failure paths and isolate the exact sequence of events that leads to the "bad unlock balance."

To really dig into this, I need to examine the `nvme_update_ns_info` function itself, located in `drivers/nvme/host/core.c`. Fortunately, I have a tool like `codesearch-definition-source` at my disposal, which will be incredibly helpful in navigating the source code and understanding the exact implementation of `nvme_update_ns_info`. This will be my next step in pinpointing the root cause.

map[Name:nvme_update_ns_info]

map[SourceCode:2539:	static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
2540:	{
2541:		bool unsupported = false;
2542:		int ret;
2543:	
2544:		switch (info->ids.csi) {
2545:		case NVME_CSI_ZNS:
2546:			if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
2547:				dev_info(ns->ctrl->device,
2548:		"block device for nsid %u not supported without CONFIG_BLK_DEV_ZONED\n",
2549:					info->nsid);
2550:				ret = nvme_update_ns_info_generic(ns, info);
2551:				break;
2552:			}
2553:			ret = nvme_update_ns_info_block(ns, info);
2554:			break;
2555:		case NVME_CSI_NVM:
2556:			ret = nvme_update_ns_info_block(ns, info);
2557:			break;
2558:		default:
2559:			dev_info(ns->ctrl->device,
2560:				"block device for nsid %u not supported (csi %u)\n",
2561:				info->nsid, info->ids.csi);
2562:			ret = nvme_update_ns_info_generic(ns, info);
2563:			break;
2564:		}
2565:	
2566:		/*
2567:		 * If probing fails due an unsupported feature, hide the block device,
2568:		 * but still allow other access.
2569:		 */
2570:		if (ret == -ENODEV) {
2571:			ns->disk->flags |= GENHD_FL_HIDDEN;
2572:			set_bit(NVME_NS_READY, &ns->flags);
2573:			unsupported = true;
2574:			ret = 0;
2575:		}
2576:	
2577:		if (!ret && nvme_ns_head_multipath(ns->head)) {
2578:			struct queue_limits *ns_lim = &ns->disk->queue->limits;
2579:			struct queue_limits lim;
2580:			unsigned int memflags;
2581:	
2582:			lim = queue_limits_start_update(ns->head->disk->queue);
2583:			memflags = blk_mq_freeze_queue(ns->head->disk->queue);
2584:			/*
2585:			 * queue_limits mixes values that are the hardware limitations
2586:			 * for bio splitting with what is the device configuration.
2587:			 *
2588:			 * For NVMe the device configuration can change after e.g. a
2589:			 * Format command, and we really want to pick up the new format
2590:			 * value here.  But we must still stack the queue limits to the
2591:			 * least common denominator for multipathing to split the bios
2592:			 * properly.
2593:			 *
2594:			 * To work around this, we explicitly set the device
2595:			 * configuration to those that we just queried, but only stack
2596:			 * the splitting limits in to make sure we still obey possibly
2597:			 * lower limitations of other controllers.
2598:			 */
2599:			lim.logical_block_size = ns_lim->logical_block_size;
2600:			lim.physical_block_size = ns_lim->physical_block_size;
2601:			lim.io_min = ns_lim->io_min;
2602:			lim.io_opt = ns_lim->io_opt;
2603:			queue_limits_stack_bdev(&lim, ns->disk->part0, 0,
2604:						ns->head->disk->disk_name);
2605:			if (lim.features & BLK_FEAT_ZONED)
2606:				nvme_stack_zone_resources(&lim, ns_lim);
2607:			if (unsupported)
2608:				ns->head->disk->flags |= GENHD_FL_HIDDEN;
2609:			else
2610:				nvme_init_integrity(ns->head, &lim, info);
2611:			lim.max_write_streams = ns_lim->max_write_streams;
2612:			lim.write_stream_granularity = ns_lim->write_stream_granularity;
2613:			ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
2614:			if (ret)
2615:				goto unfreeze_head_queue;
2616:	
2617:			set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
2618:			set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
2619:			nvme_mpath_revalidate_paths(ns->head);
2620:			ret = nvme_mpath_revalidate_zones(ns->head);
2621:	
2622:	unfreeze_head_queue:
2623:			blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
2624:		}
2625:	
2626:		return ret;
2627:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 9912
							output: 25
							thoughts: 89
						

**My Thought Process on the `nvme_update_ns_info` Warning**

Okay, so I'm seeing a warning popping up in `nvme_update_ns_info`, and it's pointing to this specific call: `blk_mq_unfreeze_queue(ns->head->disk->queue, memflags)`. This immediately flags a potential issue in how I'm managing queue states within the NVMe driver.

My first step is to understand the context of this `memflags` argument. The warning explicitly tells me that `memflags` is the *return value* from a preceding call to `blk_mq_freeze_queue(ns->head->disk->queue)`. This connection is crucial; it means the state I'm trying to unfreeze is directly linked to how it was previously frozen.

Therefore, my next logical action is to dive deep into the implementation details of both `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue`. I need to meticulously examine:

*   **`blk_mq_freeze_queue`:** What exactly does it do? What state does it put the queue into? Crucially, what information does it convey through its return value, `memflags`? Is `memflags` just a simple flag, or does it encapsulate more complex state information that's essential for a correct unfreeze operation? Does it indicate the success or failure of the freeze, or specific conditions under which it was frozen?
*   **`blk_mq_unfreeze_queue`:** How does it interpret the `memflags` passed to it? What are the expected conditions for `memflags` based on the freezing process? What happens if `memflags` doesn't match what `blk_mq_unfreeze_queue` expects? Is there a possibility of an invalid `memflags` value being passed, or a mismatch between the state indicated by `memflags` and the current state of the queue?

By dissecting these two functions, I aim to understand the contract between them and identify where this warning might be signaling a violation of that contract. The warning itself suggests that the `unfreeze` operation might be occurring under circumstances that weren't properly accounted for by the `freeze` operation, possibly leading to a corrupted or inconsistent queue state. This is precisely what I need to investigate.

map[Name:blk_mq_freeze_queue]

map[SourceCode: 951:	static inline unsigned int __must_check
 952:	blk_mq_freeze_queue(struct request_queue *q)
 953:	{
 954:		unsigned int memflags = memalloc_noio_save();
 955:	
 956:		blk_mq_freeze_queue_nomemsave(q);
 957:		return memflags;
 958:	}
 SourceFile:include/linux/blk-mq.h]

gemini-3.1-pro-preview

							input: 10154
							output: 29
							thoughts: 28
						

**My Exploration of Block Layer Queue Freezing and Unfreezing**

Alright, so my current focus is on understanding the inner workings of the block layer, specifically how it handles freezing and unfreezing queues. I'm diving into the `blk_mq_freeze_queue_nomemsave` and `blk_mq_unfreeze_queue` functions. My goal here is to grasp the mechanics behind temporarily halting I/O operations on a specific block queue and then resuming them, all within the context of the multiqueue (mq) subsystem. I anticipate these functions are critical for tasks like device suspend/resume, storage snapshots, or perhaps even certain error handling scenarios where quiescing I/O is a prerequisite. I want to understand the precise steps involved in the freezing process, what states the queue transitions through, and what guarantees are provided regarding ongoing I/O. Similarly, for unfreezing, I'm keen to see how the system ensures all pending operations are properly accounted for and that the queue returns to its operational state smoothly. The `nomemsave` part of the freeze function suggests a particular optimization or a scenario where memory saving isn't the primary concern during the freeze, which is an interesting detail I'll be paying close attention to. My overall objective is to gain a deep, first-principles understanding of these fundamental block layer operations.

map[Name:blk_mq_freeze_queue_nomemsave]

map[SourceCode: 204:	void blk_mq_freeze_queue_nomemsave(struct request_queue *q)
 205:	{
 206:		blk_freeze_queue_start(q);
 207:		blk_mq_freeze_queue_wait(q);
 208:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 10305
							output: 25
							thoughts: 24
						

**A Deep Dive into Block Layer Queue Freezing and Unfreezing**

My current focus is on understanding the mechanics of the block layer's queue freezing and unfreezing mechanisms. Specifically, I'm examining the entry point for freezing, `blk_freeze_queue_start`, and its counterpart for unfreezing, `blk_mq_unfreeze_queue`. I want to thoroughly grasp how these functions interact, what conditions trigger them, and the precise sequence of operations involved in transitioning a block queue between its frozen and unfrozen states. This exploration is critical for ensuring the predictable and robust operation of block device I/O, particularly in scenarios where quiescence or controlled unblocking is necessary. I need to understand the internal states managed by these functions, the synchronization primitives employed, and how they integrate with the broader block multi-queue (blk-mq) framework. Ultimately, my goal is to have a crystal-clear mental model of this core block layer functionality.

map[Name:blk_freeze_queue_start]

map[SourceCode: 182:	void blk_freeze_queue_start(struct request_queue *q)
 183:	{
 184:		if (__blk_freeze_queue_start(q, current))
 185:			blk_freeze_acquire_lock(q);
 186:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 10446
							output: 26
							thoughts: 14
						

**My Thought Process on `__blk_freeze_queue_start`**

Alright, so my immediate impulse is to dive into the specifics of this function, `__blk_freeze_queue_start`. I know, as an expert in this domain, that digging into the kernel's block layer, particularly around freezing and unfreezing operations, is crucial for understanding system quiescence and handling various states like suspend.

My initial thought is to trace the execution flow. Where is this function called from? What are its immediate pre-conditions? I'm already anticipating that it's likely involved in preparing a block device's I/O queue for a state where I/O operations need to be temporarily halted. This could be in preparation for system suspend, a hotplug event, or some form of device reset.

I'll be looking for how `__blk_freeze_queue_start` signals to the rest of the block layer that this particular queue is entering a frozen state. This usually involves setting some internal flags or semaphores. I'm particularly interested in the mechanisms that ensure no new I/O requests are accepted once this function is invoked. Is it an atomic operation? Does it involve locking?

Furthermore, I'm curious about the state of existing I/O requests. When `__blk_freeze_queue_start` is called, are outstanding requests being actively completed and flushed, or are they simply being held back until the queue is unfrozen? The name "start" suggests the initiation of the freezing process, so I'm expecting it to be the point where the "no new I/O" rule takes effect.

I'll also be thinking about potential race conditions. In a complex system like the kernel, multiple threads or interrupts could be attempting to interact with the block queue simultaneously. How does `__blk_freeze_queue_start` gracefully handle these concurrent operations? Does it rely on existing locking mechanisms within the block layer, or does it introduce its own?

My mind is already constructing a mental model of the data structures involved. I'll be thinking about the `request_queue` structure itself, and what fields within it are likely to be manipulated by this function. This could include counters for active requests, pointers to specific I/O states, or flags that indicate the queue's frozen status.

Ultimately, my goal in examining `__blk_freeze_queue_start` is to understand its role in the broader context of block device management. It's a building block, and by understanding it, I can better comprehend how the kernel ensures data integrity and system stability during critical operations. I'm looking for the precise point at which the "stop accepting new work" signal is definitively asserted for a given queue.

map[Name:__blk_freeze_queue_start]

map[SourceCode: 163:	bool __blk_freeze_queue_start(struct request_queue *q,
 164:				      struct task_struct *owner)
 165:	{
 166:		bool freeze;
 167:	
 168:		mutex_lock(&q->mq_freeze_lock);
 169:		freeze = blk_freeze_set_owner(q, owner);
 170:		if (++q->mq_freeze_depth == 1) {
 171:			percpu_ref_kill(&q->q_usage_counter);
 172:			mutex_unlock(&q->mq_freeze_lock);
 173:			if (queue_is_mq(q))
 174:				blk_mq_run_hw_queues(q, false);
 175:		} else {
 176:			mutex_unlock(&q->mq_freeze_lock);
 177:		}
 178:	
 179:		return freeze;
 180:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 10768
							output: 25
							thoughts: 13
						

**My Exploration of `blk_freeze_set_owner`**

Okay, so I'm looking at this function, `blk_freeze_set_owner`. My immediate thought is to understand its purpose and how it fits into the broader picture of block device management, particularly concerning freezing and unfreezing operations. I'm assuming, given the name, it's related to assigning ownership or control during a freeze operation.

My first instinct is to trace its usage. Where is `blk_freeze_set_owner` called from? Understanding the call sites will illuminate the context in which this ownership is being set. Is it part of a specific subsystem, like storage drivers, or is it a more general-purpose utility? I'm also keen to see what parameters it takes and what it returns. The parameters will tell me what information is needed to set the owner, and the return value will indicate success or failure, or perhaps some status.

Then, I'll dive into the function's implementation itself. What exactly does "setting the owner" entail? Is it a simple assignment of a pointer, or does it involve more complex state changes within the block device structure? I need to understand the internal logic. Does it involve locking mechanisms to ensure atomicity, especially if multiple entities could potentially try to set ownership concurrently? The core of my interest lies in *how* it achieves its stated goal and the implications of that mechanism.

Furthermore, I want to consider the implications of ownership. Who or what *can* be an "owner" in this context? Is it a process, a thread, a specific kernel entity? What rights or responsibilities does an owner acquire? And crucially, how is ownership released or transferred? The lifecycle of ownership is as important as its acquisition.

I'll also be thinking about the error handling. What happens if `blk_freeze_set_owner` fails? What are the potential failure modes, and how are they propagated back to the caller? Robustness is paramount in kernel code, so understanding how this function deals with unexpected situations is vital.

Finally, I'll consider the broader impact. How does this function contribute to the overall stability and correctness of block device operations, especially during potentially disruptive events like device freezing? Does it prevent race conditions, ensure data integrity, or facilitate cleaner state management? My goal is to fully grasp its role as a building block within the kernel's block layer.

map[Name:blk_freeze_set_owner]

map[SourceCode: 116:	static bool blk_freeze_set_owner(struct request_queue *q,
 117:					 struct task_struct *owner)
 118:	{
 119:		if (!owner)
 120:			return false;
 121:	
 122:		if (!q->mq_freeze_depth) {
 123:			q->mq_freeze_owner = owner;
 124:			q->mq_freeze_owner_depth = 1;
 125:			q->mq_freeze_disk_dead = !q->disk ||
 126:				test_bit(GD_DEAD, &q->disk->state) ||
 127:				!blk_queue_registered(q);
 128:			q->mq_freeze_queue_dying = blk_queue_dying(q);
 129:			return true;
 130:		}
 131:	
 132:		if (owner == q->mq_freeze_owner)
 133:			q->mq_freeze_owner_depth += 1;
 134:		return false;
 135:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 11121
							output: 26
							thoughts: 14
						

**My Internal Monologue Regarding `blk_mq_unfreeze_queue`**

Alright, so my focus is currently on `blk_mq_unfreeze_queue`. My immediate thought is to dissect this function, to truly understand its purpose and mechanics within the block multi-queue (blk-mq) subsystem. I need to ascertain its role in the broader context of I/O management, specifically how it interacts with queue freezing mechanisms.

What exactly triggers a queue to be frozen in the first place? I'm thinking about the conditions that necessitate such an action – perhaps resource exhaustion, errors, or specific operational states. Then, conversely, what is the precise operational scenario that calls for `blk_mq_unfreeze_queue`? Is it a direct response to an unblocking condition, or is it a more proactive measure taken after a period of quiescence?

I'm assuming `blk_mq_unfreeze_queue` is essentially the counterpart to a freezing operation. My expectation is that it will involve re-enabling certain functionalities or pathways that were previously inhibited due to the frozen state. This likely means re-introducing commands to the dispatch queue, allowing I/O operations to resume.

A key question for me is: what are the potential side effects or implications of calling this function? Does it involve a simple flag toggle, or are there more complex operations like flushing pending work, re-initializing state, or notifying other components that the queue is now operational? I need to consider the synchronization aspects as well. If the queue was frozen due to contention or a specific error, how does `blk_mq_unfreeze_queue` ensure that this unfreezing is handled atomically and safely, especially in a multi-threaded or multi-core environment? Are there any locks involved, and what is their scope and duration?

I also need to understand the data structures and state management involved. What specific state is being modified within the blk-mq framework when `blk_mq_unfreeze_queue` is executed? Is it a flag on the queue itself, or are there more intricate states within the request queue or associated hardware queues that are being reset?

Furthermore, I'm contemplating the typical call sites for this function. Who or what component would typically invoke `blk_mq_unfreeze_queue`? Understanding the context of its invocation will shed light on the circumstances under which I/O is expected to resume. Is it initiated by the block layer itself, by a device driver, or perhaps by a management utility?

Ultimately, my goal here is to build a comprehensive mental model of `blk_mq_unfreeze_queue` – its preconditions, its actions, its postconditions, and its place within the intricate dance of block I/O processing. I'm looking to grasp the nuances of how it restores functionality and the assurances it provides about the state of the queue after its execution.

map[Name:blk_mq_unfreeze_queue]

map[SourceCode: 959:	static inline void
 960:	blk_mq_unfreeze_queue(struct request_queue *q, unsigned int memflags)
 961:	{
 962:		blk_mq_unfreeze_queue_nomemrestore(q);
 963:		memalloc_noio_restore(memflags);
 964:	}
 SourceFile:include/linux/blk-mq.h]

gemini-3.1-pro-preview

							input: 11271
							output: 30
							thoughts: 18
						

**My Thought Process on `blk_mq_unfreeze_queue_nomemrestore`**

Ah, I've landed on `blk_mq_unfreeze_queue_nomemrestore`. My immediate instinct, as someone deeply familiar with block layer operations, is to dissect this function's purpose and its implications within the `blk-mq` framework. I'm thinking about how it fits into the broader context of I/O queue management, specifically concerning situations where a queue might become frozen.

My first question is: what exactly triggers a freeze that necessitates an `unfreeze` operation, and what does `nomemrestore` imply? I'm hypothesizing that this function is designed to unfreeze a queue that was previously frozen due to a memory allocation failure during an I/O submission or processing phase. The `nomemrestore` suffix strongly suggests that, unlike other unfreezing mechanisms, this particular path *will not* attempt to restore or re-submit the I/O requests that were pending when the queue was frozen. This is a critical distinction.

I'm visualizing the internal state of the `blk-mq` subsystem. When a memory allocation fails during the processing of a request (e.g., for a command descriptor, a scatter-gather list, or an internal data structure), the queue might be put into a frozen state to prevent further submissions and give the system some breathing room to recover or address the underlying memory pressure. Now, this `unfreeze` function is the exit strategy from that frozen state.

The `nomemrestore` part is where my expertise really kicks in. I'm considering the implications of *not* re-submitting the failed I/O. This means that any requests that were in flight or waiting to be processed when the freeze occurred will likely be discarded or fail with an error, rather than being retried. This is a deliberate trade-off. It implies that the system is prioritizing unfreezing the queue and allowing new I/O to proceed, even if it means losing some previously submitted work. This could be a sensible strategy in scenarios where retrying might exacerbate the memory pressure or lead to a deadlock.

I'm also thinking about the caller of this function. It's likely an error handling path within the block layer, possibly triggered after some memory pressure has been alleviated or a more drastic recovery action has been taken. The caller must be aware that calling `blk_mq_unfreeze_queue_nomemrestore` is a "scorched earth" approach to unfreezing; it's not a gentle re-introduction of I/O.

My internal diagnostic process is now focusing on the potential side effects. What happens to the requests that are dropped? Are there mechanisms in place to inform the upper layers about these lost I/Os? This function itself probably doesn't handle that directly, but it sets the stage for such notifications. I'm also considering the implications for I/O schedulers. How does an abrupt unfreeze, without restoring pending I/O, affect the scheduler's state and its ability to make fair and efficient scheduling decisions going forward?

In essence, when I see `blk_mq_unfreeze_queue_nomemrestore`, I'm thinking: "Okay, we're getting out of a frozen state, but we're deliberately accepting the loss of any pending I/O that was impacted by the freeze. This is a specific recovery path for memory-related freezes, prioritizing unblocking the queue over data integrity for the specific failed requests." It's a clear indicator of a trade-off being made for system stability in the face of memory constraints.

map[Name:blk_mq_unfreeze_queue_nomemrestore]

map[SourceCode: 230:	void blk_mq_unfreeze_queue_nomemrestore(struct request_queue *q)
 231:	{
 232:		if (__blk_mq_unfreeze_queue(q, false))
 233:			blk_unfreeze_release_lock(q);
 234:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 11418
							output: 27
							thoughts: 15
						

**My Thought Process on `__blk_mq_unfreeze_queue`**

Alright, so I'm diving into the kernel code, and my current focus is the `__blk_mq_unfreeze_queue` function. My immediate thought is to understand its role within the broader block layer, specifically concerning the Multi-Queue (blk-mq) subsystem.

My objective here is to get a clear, comprehensive grasp of what this function *does*. I need to understand its purpose: why does it exist? What problem is it solving? Is it about releasing a queue that was previously frozen? If so, what triggers that freezing, and what are the consequences of unfreezing?

I'll be looking at its arguments. What information does `__blk_mq_unfreeze_queue` need to operate? Is it passed a queue structure directly? Does it need context about *why* the queue is being unfrozen? Understanding these inputs will be crucial to tracing its execution path and its interactions with other parts of the system.

Then, I'll scrutinize the function's body. I'll be tracing the logic flow. Are there any conditional branches? What are the different execution paths? I'm particularly interested in how it interacts with the underlying hardware queue or the blk-mq dispatch layer. Does it simply signal an event, or does it directly manipulate internal data structures?

I'll be paying close attention to any locks or synchronization primitives it uses. The block layer is a highly concurrent environment, so understanding how `__blk_mq_unfreeze_queue` maintains data integrity is paramount. Does it acquire a queue-specific lock? Is there a global lock involved? How does it ensure atomicity in its operations?

Furthermore, I want to understand the *effects* of calling this function. What happens to pending I/O requests when a queue is unfrozen? Do they get re-queued? Are they immediately submitted for processing? What are the implications for I/O latency and throughput?

I'm also considering the callers of `__blk_mq_unfreeze_queue`. Who initiates this unfreezing process? Is it part of error handling? Is it a normal operational procedure after some temporary condition is resolved? Knowing the context in which it's invoked will shed light on its functional significance.

In essence, my thought process is a systematic dissection of the function, aiming to build a mental model of its behavior, its dependencies, and its impact on the overall block I/O subsystem. I'm looking for the "what," the "why," and the "how" of `__blk_mq_unfreeze_queue` to fully integrate its understanding into my knowledge of blk-mq.

map[Name:__blk_mq_unfreeze_queue]

map[SourceCode: 211:	bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
 212:	{
 213:		bool unfreeze;
 214:	
 215:		mutex_lock(&q->mq_freeze_lock);
 216:		if (force_atomic)
 217:			q->q_usage_counter.data->force_atomic = true;
 218:		q->mq_freeze_depth--;
 219:		WARN_ON_ONCE(q->mq_freeze_depth < 0);
 220:		if (!q->mq_freeze_depth) {
 221:			percpu_ref_resurrect(&q->q_usage_counter);
 222:			wake_up_all(&q->mq_freeze_wq);
 223:		}
 224:		unfreeze = blk_unfreeze_check_owner(q);
 225:		mutex_unlock(&q->mq_freeze_lock);
 226:	
 227:		return unfreeze;
 228:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 11763
							output: 26
							thoughts: 14
						

**My Thought Process on `blk_unfreeze_check_owner`**

Alright, so my immediate impulse here is to dive into the `blk_unfreeze_check_owner` function. I'm assuming, given my expertise, that this function is likely a critical piece of security or authorization logic, probably within a system that deals with some form of state management, perhaps related to blocking or unblocking operations or resources. The name itself, `blk_unfreeze_check_owner`, strongly suggests a check to ensure that the entity attempting to "unfreeze" something is indeed the designated "owner" of that entity.

My mind immediately goes to the implications of this check. Why is it necessary? What are the potential vulnerabilities if this check is flawed or bypassed? I'm thinking about scenarios where an unauthorized party might try to manipulate the state of a blocked resource – perhaps to gain access, to disrupt a process, or even to facilitate some form of malicious activity. Therefore, the robustness and correctness of this `blk_unfreeze_check_owner` function are paramount.

I'm also considering the context in which this function would be used. Is it part of a distributed system? A monolithic application? Is there a concept of identity and permissions management already established? The implementation details of `blk_unfreeze_check_owner` will undoubtedly be shaped by these underlying architectural decisions. For instance, how is "ownership" defined and stored? Is it a simple ID mapping, or is it a more complex role-based access control (RBAC) or attribute-based access control (ABAC) system?

My next step would be to examine the function's parameters. What information does it receive to perform its check? Does it receive the ID of the resource being unfrozen, and the ID of the user or entity attempting the action? Or does it perhaps receive a context object containing all necessary information? The signature of the function will tell me a lot about its scope and how it interacts with other parts of the system.

Then, I'd be looking at the core logic itself. How does it actually perform the "check"? Does it query a database? Does it consult an in-memory cache? Does it interact with an external authorization service? I'd be scrutinizing the exact comparison being made. Is it a direct equality check? Are there any edge cases being missed, such as null values, case sensitivity issues (if dealing with string identifiers), or different types of identifiers?

Furthermore, I'd be thinking about the return value. What does `blk_unfreeze_check_owner` return? A boolean `true`/`false`? An enum indicating success or a specific type of failure? Or perhaps an exception if an unauthorized attempt is made? The way it signals the outcome is crucial for the calling code to handle authorization appropriately.

Finally, I'd be considering the broader implications of its invocation. If `blk_unfreeze_check_owner` returns `true`, what subsequent actions are permitted? If it returns `false`, what are the error handling mechanisms? I'd also be looking for any logging or auditing capabilities within or around this function, as tracking who attempted to perform what action, and whether it was authorized, is often a key requirement for security and compliance. In essence, `blk_unfreeze_check_owner` is not just a single function; it's a linchpin in a system's security posture.

map[Name:blk_unfreeze_check_owner]

map[SourceCode: 137:	/* verify the last unfreeze in owner context */
 138:	static bool blk_unfreeze_check_owner(struct request_queue *q)
 139:	{
 140:		if (q->mq_freeze_owner != current)
 141:			return false;
 142:		if (--q->mq_freeze_owner_depth == 0) {
 143:			q->mq_freeze_owner = NULL;
 144:			return true;
 145:		}
 146:		return false;
 147:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 11973
							output: 26
							thoughts: 14
						

**My Thought Process on `blk_unfreeze_release_lock`**

Alright, so my immediate instinct here is to dive into the specifics of `blk_unfreeze_release_lock`. I'm assuming the context is a system or application dealing with block device operations, and specifically, how locks are managed during an unfreeze process. My primary concern would be understanding the *intent* behind this function – what is it trying to achieve by releasing a lock *after* an unfreeze operation?

I'd be thinking about the lifecycle of a block device operation, especially one that might involve freezing to prevent concurrent access or corruption. When a device is unfrozen, it's essentially signaling that it's safe to proceed with whatever was paused. The `release_lock` part suggests a critical cleanup step. My mind would immediately jump to potential race conditions:

*   **Why unfreeze *then* release?** Is there a scenario where the unfreeze itself might *acquire* a new lock, or modify some state that needs to be stable *before* the original lock is fully released? Or is this a standard "do A, then do B" pattern where B is the cleanup for A?
*   **What kind of lock is this?** Is it a simple mutex, a read-write lock, a semaphore, or something more complex? The type of lock will dictate the implications of its release. If it's a spinlock, for instance, the contention and performance characteristics are very different than a sleep lock.
*   **What is being protected by this lock?** Is it the block device itself, a specific data structure associated with it, or perhaps a global resource that the unfreeze operation relies on? Understanding the scope of the lock is crucial.
*   **What happens if the `unfreeze` fails?** Does `blk_unfreeze_release_lock` still attempt to release the lock? Or is the release conditional on the success of the unfreeze? This points to error handling and rollback mechanisms.
*   **Concurrency implications:** In a multithreaded or multiprocessing environment, how does this function interact with other threads or processes that might be trying to access the block device or its associated locks? Is there a guaranteed ordering?
*   **Atomicity:** Is the `unfreeze` and `release_lock` operation intended to be atomic, or is it a two-step process with a window of vulnerability in between?
*   **Deadlocks:** I'd be mentally running through scenarios where releasing this lock might inadvertently contribute to a deadlock if other components are waiting for it.
*   **Resource management:** Beyond just locking, is this function responsible for any other resource deallocation or cleanup related to the unfreeze operation?

So, my thought process would be a deep dive into the "why" and "how" of this specific function call, considering its role within a larger system and the potential pitfalls of concurrent operations. I'm looking for the rationale, the guarantees, and the potential failure modes.

map[Name:blk_unfreeze_release_lock]

map[SourceCode: 769:	static inline void blk_unfreeze_release_lock(struct request_queue *q)
 770:	{
 771:		if (!q->mq_freeze_queue_dying)
 772:			rwsem_release(&q->q_lockdep_map, _RET_IP_);
 773:		if (!q->mq_freeze_disk_dead)
 774:			rwsem_release(&q->io_lockdep_map, _RET_IP_);
 775:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 12159
							output: 25
							thoughts: 13
						

**My Thought Process on `blk_freeze_acquire_lock`**

Alright, I need to dig into `blk_freeze_acquire_lock`. My first instinct is to understand its fundamental purpose. What is this function *for*? It seems like it's a critical point in some kind of freezing or suspension mechanism within the block layer. I'm assuming this is related to managing the state of block devices, perhaps for tasks like suspend/resume, snapshots, or even hotplugging. The name itself, `acquire_lock`, strongly suggests synchronization. My immediate thought is that this function is responsible for obtaining a lock – likely a mutex or a semaphore – to prevent race conditions and ensure exclusive access to some shared resource or state during the freezing process.

So, what's the *context* of this lock acquisition? Why does it need to happen *here*, specifically within a "freeze" operation? This implies that the freezing process itself is a critical section. What operations are happening concurrently that could interfere with the freezing? I'm picturing other parts of the kernel or user-space applications trying to access or modify the state of the block device *while* it's being frozen. If that's the case, then `blk_freeze_acquire_lock` is the gatekeeper, ensuring that no other activity can proceed until the freeze is properly initiated and the shared state is protected.

I need to consider *what* state is being protected. Is it the device's operational status? Is it data buffers? Is it metadata related to I/O operations? The "block layer" aspect points towards I/O. Perhaps it's about ensuring that no new I/O requests are accepted, or that ongoing requests are cleanly handled before the device is put into a quiescent state. The lock acquisition would then be the signal that this state transition is beginning.

Furthermore, I'm wondering about the *type* of lock. Is it a simple spinlock? A more complex mutex that can sleep? The implications for performance and potential deadlocks are significant. If it's a spinlock, it implies the lock is held for a very short duration, and the operations within the critical section are quick. If it's a mutex, it suggests that the freezing process might involve blocking operations, which could be acceptable if the freeze is a relatively long-lived operation.

I'm also thinking about the *error handling*. What happens if the lock *cannot* be acquired? Does it return an error? Does it retry? Is this an unrecoverable situation? The behavior upon failure will tell me a lot about the robustness of this mechanism. An expert would be keenly interested in the failure modes and how the system recovers or signals an issue.

Finally, and this is crucial for understanding the overall design, I'm asking myself: what happens *after* the lock is acquired? This function is likely just the *first step*. The subsequent code will be the actual freezing logic, which will then presumably release the lock when the freezing is complete or the process is aborted. Understanding the complete lifecycle of this lock, from acquisition to release, is key to understanding the freezing mechanism as a whole. So, while `blk_freeze_acquire_lock` is the focus now, I'm already thinking ahead to its counterpart: `blk_freeze_release_lock` (or whatever it might be called).

map[Name:blk_freeze_acquire_lock]

map[SourceCode: 761:	static inline void blk_freeze_acquire_lock(struct request_queue *q)
 762:	{
 763:		if (!q->mq_freeze_disk_dead)
 764:			rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
 765:		if (!q->mq_freeze_queue_dying)
 766:			rwsem_acquire(&q->q_lockdep_map, 0, 1, _RET_IP_);
 767:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 12354
							output: 24
							thoughts: 577
						

**The Subtle Race in NVMe Namespace Allocation and Queue Freezing**

Okay, so I've been diving deep into this NVMe driver code, specifically around namespace allocation and how it interacts with the block layer's queue freezing mechanism. What I'm seeing is a rather insidious race condition that could lead to some serious instability.

It all starts with `nvme_alloc_ns`. This function, as I understand it, allocates a namespace structure, and crucially, it allocates the underlying `disk` structure (`ns->head->disk`) but *doesn't* register it with the system yet. This is the first domino to fall.

Next, `nvme_update_ns_info` gets called. This is where the block layer's freezing comes into play. It calls `blk_mq_freeze_queue` on the newly allocated, but unregistered, disk's queue. Because the disk isn't registered, `blk_freeze_set_owner` correctly observes that the queue isn't registered (`!blk_queue_registered(q)`) and sets `q->mq_freeze_disk_dead` to `TRUE`. This flag is intended to signal that a freeze is occurring while the queue is in an unregistered state.

Then, the original thread proceeds to call `blk_mq_unfreeze_queue`. Within `__blk_mq_unfreeze_queue`, it returns `TRUE`, indicating that the unfreeze operation is proceeding. However, and this is the critical point, the thread gets preempted *before* it can execute `blk_unfreeze_release_lock`.

While the original thread is out of the picture, another thread (let's call it Thread 2) gets a chance to run. This thread is responsible for registering the disk. This could happen through various paths, like `nvme_mpath_add_disk` or `device_add_disk`. Once the disk is registered, the system sees it as a valid, active device.

Now, imagine a third thread (Thread 3) comes along and also needs to freeze this queue. It calls `blk_mq_freeze_queue` again. This time, since the disk *is* registered, `blk_freeze_set_owner` will execute differently.

Here's where the logic gets tricky. I'm remembering that `q->mq_freeze_disk_dead` is a bit within the `struct request_queue`. When Thread 3 calls `blk_freeze_set_owner`, it *only* overwrites `q->mq_freeze_disk_dead` if `!q->mq_freeze_depth`. And this is precisely what happens! The original thread, in its `__blk_mq_unfreeze_queue`, decremented `q->mq_freeze_depth` to zero. So, from the perspective of the `mq_freeze_depth` counter, the queue is fully unfrozen, even though the original unfreeze operation was interrupted.

Consequently, Thread 3's `blk_freeze_set_owner` call *overwrites* `q->mq_freeze_disk_dead` and sets it to `FALSE`.

When the original thread finally resumes execution, it continues from where it was preempted, at `blk_unfreeze_release_lock`. It reads `q->mq_freeze_disk_dead`. Because Thread 3 reset it to `FALSE`, the original thread incorrectly believes that the queue was never frozen in an unregistered state. The consequence? It attempts to release the `io_lockdep_map`. The problem is, it never actually acquired this map in the first place because the freeze operation was interrupted before that point. This leads to an attempt to release an unacquired lock, which is a recipe for a kernel panic or corruption.

To actually trigger this, the sequence would need to be:
1.  Thread 1: `nvme_alloc_ns` calls `nvme_update_ns_info`. The queue is frozen with the disk unregistered. The thread then calls `blk_mq_unfreeze_queue` and gets preempted right before `blk_unfreeze_release_lock`.
2.  Thread 2: Registers the disk (e.g., `nvme_mpath_add_disk`).
3.  Thread 3: Freezes the queue again, but this time the disk is registered. This overwrites `q->mq_freeze_disk_dead` to `FALSE`.
4.  Thread 1 resumes and attempts to release the lock it never acquired.

I'm double-checking the control flow now. The key seems to be whether `nvme_alloc_ns` indeed calls `nvme_update_ns_info` *before* the disk registration path is fully completed. If it does, then this race condition is very much a real concern. I need to trace that specific call sequence in `nvme_alloc_ns` to be absolutely certain.

map[Name:nvme_alloc_ns]

map[SourceCode:4238:	static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info)
4239:	{
4240:		struct queue_limits lim = { };
4241:		struct nvme_ns *ns;
4242:		struct gendisk *disk;
4243:		int node = ctrl->numa_node;
4244:		bool last_path = false;
4245:	
4246:		ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node);
4247:		if (!ns)
4248:			return;
4249:	
4250:		if (ctrl->opts && ctrl->opts->data_digest)
4251:			lim.features |= BLK_FEAT_STABLE_WRITES;
4252:		if (ctrl->ops->supports_pci_p2pdma &&
4253:		    ctrl->ops->supports_pci_p2pdma(ctrl))
4254:			lim.features |= BLK_FEAT_PCI_P2PDMA;
4255:	
4256:		disk = blk_mq_alloc_disk(ctrl->tagset, &lim, ns);
4257:		if (IS_ERR(disk))
4258:			goto out_free_ns;
4259:		disk->fops = &nvme_bdev_ops;
4260:		disk->private_data = ns;
4261:	
4262:		ns->disk = disk;
4263:		ns->queue = disk->queue;
4264:		ns->ctrl = ctrl;
4265:		kref_init(&ns->kref);
4266:	
4267:		if (nvme_init_ns_head(ns, info))
4268:			goto out_cleanup_disk;
4269:	
4270:		/*
4271:		 * If multipathing is enabled, the device name for all disks and not
4272:		 * just those that represent shared namespaces needs to be based on the
4273:		 * subsystem instance.  Using the controller instance for private
4274:		 * namespaces could lead to naming collisions between shared and private
4275:		 * namespaces if they don't use a common numbering scheme.
4276:		 *
4277:		 * If multipathing is not enabled, disk names must use the controller
4278:		 * instance as shared namespaces will show up as multiple block
4279:		 * devices.
4280:		 */
4281:		if (nvme_ns_head_multipath(ns->head)) {
4282:			sprintf(disk->disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
4283:				ctrl->instance, ns->head->instance);
4284:			disk->flags |= GENHD_FL_HIDDEN;
4285:		} else if (multipath) {
4286:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->subsys->instance,
4287:				ns->head->instance);
4288:		} else {
4289:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance,
4290:				ns->head->instance);
4291:		}
4292:	
4293:		if (nvme_update_ns_info(ns, info))
4294:			goto out_unlink_ns;
4295:	
4296:		mutex_lock(&ctrl->namespaces_lock);
4297:		/*
4298:		 * Ensure that no namespaces are added to the ctrl list after the queues
4299:		 * are frozen, thereby avoiding a deadlock between scan and reset.
4300:		 */
4301:		if (test_bit(NVME_CTRL_FROZEN, &ctrl->flags)) {
4302:			mutex_unlock(&ctrl->namespaces_lock);
4303:			goto out_unlink_ns;
4304:		}
4305:		blk_queue_rq_timeout(ns->queue, ctrl->io_timeout);
4306:		nvme_ns_add_to_ctrl_list(ns);
4307:		mutex_unlock(&ctrl->namespaces_lock);
4308:		synchronize_srcu(&ctrl->srcu);
4309:		nvme_get_ctrl(ctrl);
4310:	
4311:		if (device_add_disk(ctrl->device, ns->disk, nvme_ns_attr_groups))
4312:			goto out_cleanup_ns_from_list;
4313:	
4314:		if (!nvme_ns_head_multipath(ns->head))
4315:			nvme_add_ns_cdev(ns);
4316:	
4317:		nvme_mpath_add_disk(ns, info->anagrpid);
4318:		nvme_fault_inject_init(&ns->fault_inject, ns->disk->disk_name);
4319:	
4320:		return;
4321:	
4322:	 out_cleanup_ns_from_list:
4323:		nvme_put_ctrl(ctrl);
4324:		mutex_lock(&ctrl->namespaces_lock);
4325:		list_del_rcu(&ns->list);
4326:		mutex_unlock(&ctrl->namespaces_lock);
4327:		synchronize_srcu(&ctrl->srcu);
4328:	 out_unlink_ns:
4329:		mutex_lock(&ctrl->subsys->lock);
4330:		list_del_rcu(&ns->siblings);
4331:		if (list_empty(&ns->head->list)) {
4332:			list_del_init(&ns->head->entry);
4333:			/*
4334:			 * If multipath is not configured, we still create a namespace
4335:			 * head (nshead), but head->disk is not initialized in that
4336:			 * case.  As a result, only a single reference to nshead is held
4337:			 * (via kref_init()) when it is created. Therefore, ensure that
4338:			 * we do not release the reference to nshead twice if head->disk
4339:			 * is not present.
4340:			 */
4341:			if (ns->head->disk)
4342:				last_path = true;
4343:		}
4344:		mutex_unlock(&ctrl->subsys->lock);
4345:	
4346:		/* guarantee not available in head->list */
4347:		synchronize_srcu(&ns->head->srcu);
4348:		if (last_path)
4349:			nvme_put_ns_head(ns->head);
4350:		nvme_put_ns_head(ns->head);
4351:	 out_cleanup_disk:
4352:		put_disk(disk);
4353:	 out_free_ns:
4354:		kfree(ns);
4355:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 14875
							output: 26
							thoughts: 132
						

**My Thought Process Regarding NVMe Namespace Allocation and Disk Device Addition**

Alright, so I'm tracing the execution flow for `nvme_alloc_ns`, and I've just noticed something interesting at line 4293. It's calling `nvme_update_ns_info(ns, info)`. My immediate thought is to examine the state of `ns->head->disk` at this precise moment. I know that `nvme_init_ns_head` is responsible for allocating this `disk` structure for the `head` of the namespace. However, the critical point here is that `device_add_disk` hasn't been invoked for `ns->head->disk` yet. This is a key piece of information because adding a disk device to the system is a significant step.

My train of thought then jumps to where `device_add_disk` *is* called. I recall seeing it being called for `ns->disk` specifically at line 4311. This is a separate `disk` structure, likely the one directly associated with the namespace itself, as opposed to the `head`'s disk.

This leads me to a crucial question: what about `ns->head->disk`? If `device_add_disk` hasn't been called for it, why is that? Is there a specific reason it's treated differently, or is this an oversight in my current understanding? To resolve this, I need to go back and scrutinize the `nvme_init_ns_head` function itself. That's where the allocation for `ns->head->disk` happens, and understanding its purpose and lifecycle within that function is likely to clarify why `device_add_disk` might not be called for it, or if it *should* be.

map[Name:nvme_init_ns_head]

map[SourceCode:4099:	static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info)
4100:	{
4101:		struct nvme_ctrl *ctrl = ns->ctrl;
4102:		struct nvme_ns_head *head = NULL;
4103:		int ret;
4104:	
4105:		ret = nvme_global_check_duplicate_ids(ctrl->subsys, &info->ids);
4106:		if (ret) {
4107:			/*
4108:			 * We've found two different namespaces on two different
4109:			 * subsystems that report the same ID.  This is pretty nasty
4110:			 * for anything that actually requires unique device
4111:			 * identification.  In the kernel we need this for multipathing,
4112:			 * and in user space the /dev/disk/by-id/ links rely on it.
4113:			 *
4114:			 * If the device also claims to be multi-path capable back off
4115:			 * here now and refuse the probe the second device as this is a
4116:			 * recipe for data corruption.  If not this is probably a
4117:			 * cheap consumer device if on the PCIe bus, so let the user
4118:			 * proceed and use the shiny toy, but warn that with changing
4119:			 * probing order (which due to our async probing could just be
4120:			 * device taking longer to startup) the other device could show
4121:			 * up at any time.
4122:			 */
4123:			nvme_print_device_info(ctrl);
4124:			if ((ns->ctrl->ops->flags & NVME_F_FABRICS) || /* !PCIe */
4125:			    ((ns->ctrl->subsys->cmic & NVME_CTRL_CMIC_MULTI_CTRL) &&
4126:			     info->is_shared)) {
4127:				dev_err(ctrl->device,
4128:					"ignoring nsid %u because of duplicate IDs\n",
4129:					info->nsid);
4130:				return ret;
4131:			}
4132:	
4133:			dev_err(ctrl->device,
4134:				"clearing duplicate IDs for nsid %u\n", info->nsid);
4135:			dev_err(ctrl->device,
4136:				"use of /dev/disk/by-id/ may cause data corruption\n");
4137:			memset(&info->ids.nguid, 0, sizeof(info->ids.nguid));
4138:			memset(&info->ids.uuid, 0, sizeof(info->ids.uuid));
4139:			memset(&info->ids.eui64, 0, sizeof(info->ids.eui64));
4140:			ctrl->quirks |= NVME_QUIRK_BOGUS_NID;
4141:		}
4142:	
4143:		mutex_lock(&ctrl->subsys->lock);
4144:		head = nvme_find_ns_head(ctrl, info->nsid);
4145:		if (!head) {
4146:			ret = nvme_subsys_check_duplicate_ids(ctrl->subsys, &info->ids);
4147:			if (ret) {
4148:				dev_err(ctrl->device,
4149:					"duplicate IDs in subsystem for nsid %u\n",
4150:					info->nsid);
4151:				goto out_unlock;
4152:			}
4153:			head = nvme_alloc_ns_head(ns, info);
4154:			if (IS_ERR(head)) {
4155:				ret = PTR_ERR(head);
4156:				goto out_unlock;
4157:			}
4158:		} else {
4159:			ret = -EINVAL;
4160:			if ((!info->is_shared || !head->shared) &&
4161:			    !list_empty(&head->list)) {
4162:				dev_err(ctrl->device,
4163:					"Duplicate unshared namespace %u\n",
4164:					info->nsid);
4165:				goto out_put_ns_head;
4166:			}
4167:			if (!nvme_ns_ids_equal(&head->ids, &info->ids)) {
4168:				dev_err(ctrl->device,
4169:					"IDs don't match for shared namespace %u\n",
4170:						info->nsid);
4171:				goto out_put_ns_head;
4172:			}
4173:	
4174:			if (!multipath) {
4175:				dev_warn(ctrl->device,
4176:					"Found shared namespace %u, but multipathing not supported.\n",
4177:					info->nsid);
4178:				dev_warn_once(ctrl->device,
4179:					"Shared namespace support requires core_nvme.multipath=Y.\n");
4180:			}
4181:		}
4182:	
4183:		list_add_tail_rcu(&ns->siblings, &head->list);
4184:		ns->head = head;
4185:		mutex_unlock(&ctrl->subsys->lock);
4186:	
4187:	#ifdef CONFIG_NVME_MULTIPATH
4188:		if (cancel_delayed_work(&head->remove_work))
4189:			module_put(THIS_MODULE);
4190:	#endif
4191:		return 0;
4192:	
4193:	out_put_ns_head:
4194:		nvme_put_ns_head(head);
4195:	out_unlock:
4196:		mutex_unlock(&ctrl->subsys->lock);
4197:		return ret;
4198:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 16672
							output: 26
							thoughts: 14
						

**My Thought Process Regarding `nvme_alloc_ns_head`**

Alright, the immediate impulse is to dive into the specifics of `nvme_alloc_ns_head`. My understanding of NVMe, coupled with the context of what likely precedes this function call (perhaps some kind of namespace initialization or allocation request), leads me to believe this is a critical piece of kernel code responsible for managing the internal structures that represent an NVMe namespace.

I'm anticipating that `nvme_alloc_ns_head` will be concerned with allocating and initializing the primary data structure for a namespace. This would likely involve:

*   **Memory Allocation:** The fundamental task will be to secure the necessary memory for the namespace's control block or head structure. This could involve using kernel memory allocators like `kmalloc` or similar, with attention to alignment and potential NUMA considerations if this were a more complex, multi-node system.
*   **Structure Initialization:** Once memory is allocated, I expect the function to meticulously initialize all the fields within the allocated `nvme_ns` (or similarly named) structure. This would include pointers to other related structures (like the controller, device, or command queues), counters, flags for state management, and potentially an identifier for the namespace itself.
*   **Association with Controller/Device:** A key aspect will be linking this newly allocated namespace structure back to the NVMe controller or device it belongs to. This establishes the context for subsequent I/O operations. There's likely a parent pointer or a list traversal mechanism involved here.
*   **Error Handling:** As with any kernel function, robust error handling is paramount. I'll be looking for checks on the return values of underlying memory allocation functions, and if any part of the initialization fails, the function must gracefully clean up any partially allocated resources and return an appropriate error code.
*   **Namespace Metadata:** It's possible, though perhaps handled in a separate function, that `nvme_alloc_ns_head` might also be involved in fetching or storing some basic namespace metadata directly within this head structure. This could include things like namespace size, capacity, or its unique identifier.
*   **Concurrency:** Given that the kernel is a multi-threaded environment, I'll also be considering any locking mechanisms that might be employed within or around this function to protect shared data structures, particularly if multiple threads could potentially be allocating or accessing namespaces concurrently.

In essence, my mental model is that `nvme_alloc_ns_head` is the gatekeeper for creating and initializing the fundamental representation of an NVMe namespace within the kernel's memory space, setting the stage for all subsequent interactions with that namespace. I'm keen to see the actual implementation to confirm these assumptions and uncover any nuanced details.

map[Name:nvme_alloc_ns_head]

map[SourceCode:4002:	static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ns *ns,
4003:			struct nvme_ns_info *info)
4004:		__must_hold(&ns->ctrl->subsys->lock)
4005:	{
4006:		struct nvme_ctrl *ctrl = ns->ctrl;
4007:		struct nvme_ns_head *head;
4008:		size_t size = sizeof(*head);
4009:		int ret = -ENOMEM;
4010:	
4011:	#ifdef CONFIG_NVME_MULTIPATH
4012:		size += nr_node_ids * sizeof(struct nvme_ns *);
4013:	#endif
4014:	
4015:		head = kzalloc(size, GFP_KERNEL);
4016:		if (!head)
4017:			goto out;
4018:		ret = ida_alloc_min(&ctrl->subsys->ns_ida, 1, GFP_KERNEL);
4019:		if (ret < 0)
4020:			goto out_free_head;
4021:		head->instance = ret;
4022:		INIT_LIST_HEAD(&head->list);
4023:		ret = init_srcu_struct(&head->srcu);
4024:		if (ret)
4025:			goto out_ida_remove;
4026:		head->subsys = ctrl->subsys;
4027:		head->ns_id = info->nsid;
4028:		head->ids = info->ids;
4029:		head->shared = info->is_shared;
4030:		head->rotational = info->is_rotational;
4031:		ratelimit_state_init(&head->rs_nuse, 5 * HZ, 1);
4032:		ratelimit_set_flags(&head->rs_nuse, RATELIMIT_MSG_ON_RELEASE);
4033:		kref_init(&head->ref);
4034:		ns->head = head;
4035:	
4036:		if (head->ids.csi) {
4037:			ret = nvme_get_effects_log(ctrl, head->ids.csi, &head->effects);
4038:			if (ret)
4039:				goto out_cleanup_srcu;
4040:		} else
4041:			head->effects = ctrl->effects;
4042:	
4043:		if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
4044:			ret = nvme_query_fdp_info(ns, info);
4045:			if (ret < 0)
4046:				goto out_cleanup_srcu;
4047:		}
4048:	
4049:		ret = nvme_mpath_alloc_disk(ctrl, head);
4050:		if (ret)
4051:			goto out_cleanup_fdp;
4052:	
4053:		list_add_tail(&head->entry, &ctrl->subsys->nsheads);
4054:	
4055:		kref_get(&ctrl->subsys->ref);
4056:	
4057:		return head;
4058:	out_cleanup_fdp:
4059:		kfree(head->plids);
4060:	out_cleanup_srcu:
4061:		cleanup_srcu_struct(&head->srcu);
4062:	out_ida_remove:
4063:		ida_free(&ctrl->subsys->ns_ida, head->instance);
4064:	out_free_head:
4065:		kfree(head);
4066:		ns->head = NULL;
4067:	out:
4068:		if (ret > 0)
4069:			ret = blk_status_to_errno(nvme_error_status(ret));
4070:		return ERR_PTR(ret);
4071:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 17828
							output: 27
							thoughts: 15
						

**My Thought Process on `nvme_mpath_alloc_disk`**

Alright, my first inclination here is to dive straight into the `nvme_mpath_alloc_disk` function. I need to understand how this particular component handles the allocation of disks within an NVMe multipath configuration. My expertise in this area tells me that the intricacies of device mapping and resource management are crucial, so I'll be looking for specific details on how it identifies, registers, and potentially manages multiple paths to the same underlying NVMe storage. I'm anticipating examining its role in presenting a unified block device to the system, abstracting away the underlying multipathing complexity. I'll be paying close attention to any data structures it employs, how it interacts with other kernel subsystems like the NVMe driver itself and the block layer, and its error handling mechanisms. The goal is to get a clear, detailed picture of its internal workings and its contribution to the overall NVMe multipathing solution.

map[Name:nvme_mpath_alloc_disk]

map[SourceCode: 734:	int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
 735:	{
 736:		struct queue_limits lim;
 737:	
 738:		mutex_init(&head->lock);
 739:		spin_lock_init(&head->requeue_lock);
 740:		INIT_WORK(&head->requeue_work, nvme_requeue_work);
 741:		INIT_WORK(&head->partition_scan_work, nvme_partition_scan_work);
 742:		INIT_DELAYED_WORK(&head->remove_work, nvme_remove_head_work);
 743:	
 744:		/*
 745:		 * If "multipath_always_on" is enabled, a multipath node is added
 746:		 * regardless of whether the disk is single/multi ported, and whether
 747:		 * the namespace is shared or private. If "multipath_always_on" is not
 748:		 * enabled, a multipath node is added only if the subsystem supports
 749:		 * multiple controllers and the "multipath" option is configured. In
 750:		 * either case, for private namespaces, we ensure that the NSID is
 751:		 * unique.
 752:		 */
 753:		if (!multipath_always_on) {
 754:			if (!(ctrl->subsys->cmic & NVME_CTRL_CMIC_MULTI_CTRL) ||
 755:					!multipath)
 756:				return 0;
 757:		}
 758:	
 759:		if (!nvme_is_unique_nsid(ctrl, head))
 760:			return 0;
 761:	
 762:		blk_set_stacking_limits(&lim);
 763:		lim.dma_alignment = 3;
 764:		lim.features |= BLK_FEAT_IO_STAT | BLK_FEAT_NOWAIT |
 765:			BLK_FEAT_POLL | BLK_FEAT_ATOMIC_WRITES | BLK_FEAT_PCI_P2PDMA;
 766:		if (head->ids.csi == NVME_CSI_ZNS)
 767:			lim.features |= BLK_FEAT_ZONED;
 768:	
 769:		head->disk = blk_alloc_disk(&lim, ctrl->numa_node);
 770:		if (IS_ERR(head->disk))
 771:			return PTR_ERR(head->disk);
 772:		head->disk->fops = &nvme_ns_head_ops;
 773:		head->disk->private_data = head;
 774:	
 775:		/*
 776:		 * We need to suppress the partition scan from occuring within the
 777:		 * controller's scan_work context. If a path error occurs here, the IO
 778:		 * will wait until a path becomes available or all paths are torn down,
 779:		 * but that action also occurs within scan_work, so it would deadlock.
 780:		 * Defer the partition scan to a different context that does not block
 781:		 * scan_work.
 782:		 */
 783:		set_bit(GD_SUPPRESS_PART_SCAN, &head->disk->state);
 784:		sprintf(head->disk->disk_name, "nvme%dn%d",
 785:				ctrl->subsys->instance, head->instance);
 786:		nvme_get_ns_head(head);
 787:		return 0;
 788:	}
 SourceFile:drivers/nvme/host/multipath.c]

gemini-3.1-pro-preview

							input: 18877
							output: 27
							thoughts: 135
						

**My Thought Process Regarding NVMe Namespace Allocation and Disk Registration**

My initial observation is that within the `nvme_mpath_alloc_disk` function, I'm allocating the `head->disk` structure, but crucially, I'm not actually registering or adding this disk to the system at that point. This is a critical detail that sets up a subsequent issue.

Following this, in `nvme_update_ns_info`, I'm calling a function that freezes the disk's queue, specifically `head->disk->queue`. Now, because `head->disk` hasn't been registered yet, the system is in an unexpected state. This leads to the `q->mq_freeze_disk_dead` flag being set to `TRUE`. This flag indicates that the disk queue is being frozen because the associated disk is considered "dead" or unregistered.

Subsequently, `blk_mq_unfreeze_queue` is invoked. Given the `mq_freeze_disk_dead` flag is set, this unfreezing operation will likely behave in a way that acknowledges the underlying disk's unregistered state.

The critical path then diverges. When `nvme_alloc_ns` is called, it proceeds to call `device_add_disk` for `ns->disk`. This is where the namespace's disk is finally registered. Immediately after successful registration, `nvme_mpath_add_disk(ns, info->anagrpid)` is called. This suggests a specific handling for multipath devices, likely to associate the newly registered namespace disk with an existing multipath group identified by `anagrpid`.

The sequence of events, therefore, highlights a potential race condition or an ordering dependency where the queue is frozen *before* the disk is fully registered, leading to the `mq_freeze_disk_dead` flag being set, which then needs to be handled by subsequent unfreezing and registration logic.

map[Name:nvme_mpath_add_disk]

map[SourceCode:1361:	void nvme_mpath_add_disk(struct nvme_ns *ns, __le32 anagrpid)
1362:	{
1363:		if (nvme_ctrl_use_ana(ns->ctrl)) {
1364:			struct nvme_ana_group_desc desc = {
1365:				.grpid = anagrpid,
1366:				.state = 0,
1367:			};
1368:	
1369:			mutex_lock(&ns->ctrl->ana_lock);
1370:			ns->ana_grpid = le32_to_cpu(anagrpid);
1371:			nvme_parse_ana_log(ns->ctrl, &desc, nvme_lookup_ana_group_desc);
1372:			mutex_unlock(&ns->ctrl->ana_lock);
1373:			if (desc.state) {
1374:				/* found the group desc: update */
1375:				nvme_update_ns_ana_state(&desc, ns);
1376:			} else {
1377:				/* group desc not found: trigger a re-read */
1378:				set_bit(NVME_NS_ANA_PENDING, &ns->flags);
1379:				queue_work(nvme_wq, &ns->ctrl->ana_work);
1380:			}
1381:		} else {
1382:			ns->ana_state = NVME_ANA_OPTIMIZED;
1383:			nvme_mpath_set_live(ns);
1384:		}
1385:	
1386:	}
 SourceFile:drivers/nvme/host/multipath.c]

gemini-3.1-pro-preview

							input: 19494
							output: 27
							thoughts: 35
						

**My Thought Process on `device_add_disk` for `head->disk`**

I'm scrutinizing the code, and a crucial question has just popped into my head: "Where is `device_add_disk` actually being invoked for `head->disk`?" This isn't a minor detail; it's fundamental to how a device's storage is initialized and integrated into the system. I need to pinpoint this call to understand the lifecycle and management of this specific disk. My immediate next step is to dive into the `nvme_mpath_set_live` function. I suspect this is where the complex logic for setting up live multipath devices resides, and it's a prime candidate for containing the necessary call to `device_add_disk` for `head->disk`. I'll be looking for the specific code path that triggers this addition, as it will shed light on the conditions and mechanisms under which this particular disk becomes operational within the NVMe multipath framework.

map[Name:nvme_mpath_set_live]

map[SourceCode: 790:	static void nvme_mpath_set_live(struct nvme_ns *ns)
 791:	{
 792:		struct nvme_ns_head *head = ns->head;
 793:		int rc;
 794:	
 795:		if (!head->disk)
 796:			return;
 797:	
 798:		/*
 799:		 * test_and_set_bit() is used because it is protecting against two nvme
 800:		 * paths simultaneously calling device_add_disk() on the same namespace
 801:		 * head.
 802:		 */
 803:		if (!test_and_set_bit(NVME_NSHEAD_DISK_LIVE, &head->flags)) {
 804:			rc = device_add_disk(&head->subsys->dev, head->disk,
 805:					     nvme_ns_attr_groups);
 806:			if (rc) {
 807:				clear_bit(NVME_NSHEAD_DISK_LIVE, &head->flags);
 808:				return;
 809:			}
 810:			nvme_add_ns_head_cdev(head);
 811:			queue_work(nvme_wq, &head->partition_scan_work);
 812:		}
 813:	
 814:		nvme_mpath_add_sysfs_link(ns->head);
 815:	
 816:		mutex_lock(&head->lock);
 817:		if (nvme_path_is_optimized(ns)) {
 818:			int node, srcu_idx;
 819:	
 820:			srcu_idx = srcu_read_lock(&head->srcu);
 821:			for_each_online_node(node)
 822:				__nvme_find_path(head, node);
 823:			srcu_read_unlock(&head->srcu, srcu_idx);
 824:		}
 825:		mutex_unlock(&head->lock);
 826:	
 827:		synchronize_srcu(&head->srcu);
 828:		nvme_mpath_revalidate_zones(head);
 829:		kblockd_schedule_work(&head->requeue_work);
 830:	}
 SourceFile:drivers/nvme/host/multipath.c]

gemini-3.1-pro-preview

							input: 20212
							output: 26
							thoughts: 1357
						

**My Thought Process Unraveling the NVMe Namespace Allocation Race**

Okay, let's trace this out, step-by-step, as I understand it. My core concern here is a potential race condition during NVMe namespace initialization and device registration.

It seems the critical path involves the `nvme_alloc_ns` function. After the namespace is allocated, `nvme_init_ns_head` is called, which is where the `head->disk` structure – the block layer disk representation – is allocated. Following this, `nvme_update_ns_info` is invoked. This function is where the interaction with the block layer's queue freezing and unfreezing mechanisms happens.

Here's the sequence I'm focusing on within `nvme_update_ns_info`:

1.  `blk_mq_freeze_queue(head->disk->queue)` is called. Crucially, at this point, the disk hasn't been added to the system yet. So, `blk_queue_registered(q)` returns false. This leads to `blk_freeze_set_owner` setting `q->mq_freeze_disk_dead` to `TRUE`. The `io_lockdep_map` is *not* acquired in this state.

2.  `blk_mq_unfreeze_queue` is then called. Inside this, `__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` to zero. This is the **PREEMPTION POINT** I'm worried about.

3.  After the potential preemption, `blk_unfreeze_release_lock` is supposed to execute. This function reads `q->mq_freeze_disk_dead` and only releases the `io_lockdep_map` if this flag is `FALSE`.

Finally, after `nvme_update_ns_info` completes its work, `device_add_disk(head->disk)` is called, mediated through `nvme_mpath_add_disk` and `nvme_mpath_set_live`. This is the point where the disk becomes truly registered with the system, making `blk_queue_registered(q)` true.

Now, here's where the race kicks in. If my execution thread (let's call it Thread A) gets preempted *exactly* at that **PREEMPTION POINT** within `blk_mq_unfreeze_queue`, *before* `blk_unfreeze_release_lock` has a chance to finish, what happens?

If another thread (Thread B) then attempts to call `nvme_update_ns_info` on the *same* `head` structure – perhaps because another controller has discovered the same subsystem and namespace, or due to a rescan operation – it will enter `nvme_update_ns_info` again.

In this scenario, Thread B will also call `blk_mq_freeze_queue(head->disk->queue)`. However, if Thread B is running *after* the original `device_add_disk` call has *already completed* (which implies Thread A *must* have been preempted after `device_add_disk` was called, or that some other thread called `device_add_disk` in the interim), then `blk_queue_registered(q)` will now be `TRUE`. Consequently, `blk_freeze_set_owner` will set `q->mq_freeze_disk_dead` to `FALSE`.

Wait, this is where my initial thought needs correction. If Thread A is preempted *before* `device_add_disk` is called, how can the disk be registered for Thread B to see it as registered? Ah, I see the nuance! Thread A is preempted *inside* `blk_mq_unfreeze_queue`, meaning it hasn't yet returned from `nvme_update_ns_info`, and therefore hasn't called `device_add_disk` yet.

So, if `device_add_disk` hasn't been called by Thread A, how could `q->mq_freeze_disk_dead` become `FALSE` in Thread B's execution? This implies another thread *must* have called `device_add_disk` on this *same* `head->disk`. This would happen if another controller connects to the same subsystem and namespace. It would find the existing `head` structure (because Thread A didn't get to unregister it or fully process it yet), then it would call its *own* `nvme_update_ns_info` (freezing and unfreezing), and crucially, it would then call `device_add_disk` (via `nvme_mpath_add_disk`). At this point, `blk_queue_registered(q)` becomes `TRUE`.

Let's walk through that specific scenario:

*   **Thread A:** Initiates a connection (Controller 1).
    *   `nvme_alloc_ns`
    *   `nvme_init_ns_head` allocates `head` and `head->disk`.
    *   `nvme_update_ns_info` starts:
        *   `blk_mq_freeze_queue` -> `q->mq_freeze_disk_dead = TRUE`.
        *   `blk_mq_unfreeze_queue` is called, `mq_freeze_depth` becomes 0.
        *   **PREEMPTION POINT**.

*   **Thread B:** Initiates a connection for the *same* namespace via a *different* controller (Controller 2).
    *   `nvme_alloc_ns`
    *   `nvme_init_ns_head` finds the *existing* `head`.
    *   `nvme_update_ns_info` is called:
        *   `blk_mq_freeze_queue` -> `q->mq_freeze_disk_dead = TRUE` (since Thread A hasn't finished yet and `device_add_disk` hasn't run for this disk).
        *   `blk_mq_unfreeze_queue` runs.
    *   Now, Thread B proceeds to `device_add_disk(head->disk)` (via `nvme_mpath_add_disk`). At this point, `blk_queue_registered(q)` becomes `TRUE`.

*   **Thread C:** Initiates a rescan operation (could be on Controller 1 or 2, or another).
    *   `nvme_scan_ns` is called. If the namespace already exists (which it does, established by Thread B's `device_add_disk`), `nvme_update_ns_info` is called.
    *   `nvme_update_ns_info` is called:
        *   `blk_mq_freeze_queue`. Because `blk_queue_registered(q)` is now `TRUE` (thanks to Thread B), `blk_freeze_set_owner` sets `q->mq_freeze_disk_dead = FALSE`.

*   **Thread A Resumes:**
    *   It finally reaches `blk_unfreeze_release_lock`.
    *   It reads `q->mq_freeze_disk_dead`, which is now `FALSE` (because Thread C's `nvme_update_ns_info` set it so).
    *   It proceeds to call `rwsem_release(&q->io_lockdep_map)`.
    *   **This is the critical failure:** The lock is released, but the corresponding acquire operation in `blk_freeze_acquire_lock` was skipped by Thread A (due to `q->mq_freeze_disk_dead` being `TRUE` initially). This leads to a "bad unlock balance!" error because the `io_lockdep_map` has been released without a successful prior acquire for Thread A's context.

This scenario requires a significant preemption window, where Thread A is paused long enough for Thread B to complete its `device_add_disk` and then for Thread C to trigger a rescan that sets the flag to `FALSE`.

To make this race condition more probable in testing, it seems we'd need to orchestrate multiple concurrent connections and rescans. Techniques like userfaultfd or fault injection aren't directly available in my current testing environment, but I can imagine simply spinning up many threads performing these connect and rescan operations to increase the chances of hitting this specific timing window.

My next step is to re-examine `nvme_update_ns_info` itself to see if there are any internal locking mechanisms that might prevent Thread B from even reaching the `device_add_disk` call while Thread A is preempted in such a state.

map[Name:nvme_update_ns_info]

map[SourceCode:2539:	static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
2540:	{
2541:		bool unsupported = false;
2542:		int ret;
2543:	
2544:		switch (info->ids.csi) {
2545:		case NVME_CSI_ZNS:
2546:			if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
2547:				dev_info(ns->ctrl->device,
2548:		"block device for nsid %u not supported without CONFIG_BLK_DEV_ZONED\n",
2549:					info->nsid);
2550:				ret = nvme_update_ns_info_generic(ns, info);
2551:				break;
2552:			}
2553:			ret = nvme_update_ns_info_block(ns, info);
2554:			break;
2555:		case NVME_CSI_NVM:
2556:			ret = nvme_update_ns_info_block(ns, info);
2557:			break;
2558:		default:
2559:			dev_info(ns->ctrl->device,
2560:				"block device for nsid %u not supported (csi %u)\n",
2561:				info->nsid, info->ids.csi);
2562:			ret = nvme_update_ns_info_generic(ns, info);
2563:			break;
2564:		}
2565:	
2566:		/*
2567:		 * If probing fails due an unsupported feature, hide the block device,
2568:		 * but still allow other access.
2569:		 */
2570:		if (ret == -ENODEV) {
2571:			ns->disk->flags |= GENHD_FL_HIDDEN;
2572:			set_bit(NVME_NS_READY, &ns->flags);
2573:			unsupported = true;
2574:			ret = 0;
2575:		}
2576:	
2577:		if (!ret && nvme_ns_head_multipath(ns->head)) {
2578:			struct queue_limits *ns_lim = &ns->disk->queue->limits;
2579:			struct queue_limits lim;
2580:			unsigned int memflags;
2581:	
2582:			lim = queue_limits_start_update(ns->head->disk->queue);
2583:			memflags = blk_mq_freeze_queue(ns->head->disk->queue);
2584:			/*
2585:			 * queue_limits mixes values that are the hardware limitations
2586:			 * for bio splitting with what is the device configuration.
2587:			 *
2588:			 * For NVMe the device configuration can change after e.g. a
2589:			 * Format command, and we really want to pick up the new format
2590:			 * value here.  But we must still stack the queue limits to the
2591:			 * least common denominator for multipathing to split the bios
2592:			 * properly.
2593:			 *
2594:			 * To work around this, we explicitly set the device
2595:			 * configuration to those that we just queried, but only stack
2596:			 * the splitting limits in to make sure we still obey possibly
2597:			 * lower limitations of other controllers.
2598:			 */
2599:			lim.logical_block_size = ns_lim->logical_block_size;
2600:			lim.physical_block_size = ns_lim->physical_block_size;
2601:			lim.io_min = ns_lim->io_min;
2602:			lim.io_opt = ns_lim->io_opt;
2603:			queue_limits_stack_bdev(&lim, ns->disk->part0, 0,
2604:						ns->head->disk->disk_name);
2605:			if (lim.features & BLK_FEAT_ZONED)
2606:				nvme_stack_zone_resources(&lim, ns_lim);
2607:			if (unsupported)
2608:				ns->head->disk->flags |= GENHD_FL_HIDDEN;
2609:			else
2610:				nvme_init_integrity(ns->head, &lim, info);
2611:			lim.max_write_streams = ns_lim->max_write_streams;
2612:			lim.write_stream_granularity = ns_lim->write_stream_granularity;
2613:			ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
2614:			if (ret)
2615:				goto unfreeze_head_queue;
2616:	
2617:			set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
2618:			set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
2619:			nvme_mpath_revalidate_paths(ns->head);
2620:			ret = nvme_mpath_revalidate_zones(ns->head);
2621:	
2622:	unfreeze_head_queue:
2623:			blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
2624:		}
2625:	
2626:		return ret;
2627:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 23110
							output: 24
							thoughts: 1033
						

**The Critical Race Condition I've Uncovered**

My analysis has revealed a rather insidious race condition lurking within the NVMe driver, specifically around namespace information updates and queue freezing mechanisms. It's a complex interplay of multiple threads, and I've meticulously traced the thought process that led me to this conclusion.

Initially, I was examining the `nvme_update_ns_info` function. I observed that it calls `queue_limits_start_update` and `queue_limits_commit_update`. My immediate concern was that both of these functions acquire `q->limits_lock`. This immediately brought to mind a potential deadlock or blocking scenario: if Thread A were to be preempted *between* `queue_limits_start_update` and `queue_limits_commit_update` while holding this lock, then Thread B, attempting to acquire it later, would be stuck.

However, upon closer inspection of the execution flow, I realized that Thread A's preemption actually occurs *after* `queue_limits_commit_update`, specifically within the `blk_mq_unfreeze_queue` function. This was a crucial detail. My initial thought was that if Thread A was preempted here, and `blk_mq_unfreeze_queue` didn't hold the `q->limits_lock`, then Thread B *could* potentially proceed. This offered a glimmer of hope that the scenario I was worried about might not manifest.

But then I dug deeper into `blk_mq_unfreeze_queue`. I followed its calls: `blk_mq_unfreeze_queue` calls `blk_mq_unfreeze_queue_nomemrestore`, which in turn calls `__blk_mq_unfreeze_queue`. Inside `__blk_mq_unfreeze_queue`, the `q->mq_freeze_lock` is acquired, `q->mq_freeze_depth` is decremented, and then `q->mq_freeze_lock` is released. The function then returns the result of `blk_unfreeze_check_owner(q)`. Following this, `blk_mq_unfreeze_queue_nomemrestore` proceeds to call `blk_unfreeze_release_lock(q)`.

This is where the real danger lies. I realized that Thread A could be preempted *between* `__blk_mq_unfreeze_queue` (where the `q->mq_freeze_lock` is released) and the subsequent call to `blk_unfreeze_release_lock`. At this specific preemption point, `q->mq_freeze_depth` would be 0, and `q->mq_freeze_lock` would be released. This is the critical window.

Now, consider Thread B. If Thread B enters the picture concurrently and also calls `nvme_update_ns_info` for the *same* namespace (`head`), and importantly, if Thread B hasn't yet called `device_add_disk` (which is the case since it's still within `nvme_alloc_ns`), it will proceed. Thread B will attempt to freeze the queue. It will acquire `q->mq_freeze_lock`, set `q->mq_freeze_depth` to 1, and critically, set `q->mq_freeze_disk_dead = TRUE`. After this, Thread B will unfreeze the queue and return from `nvme_update_ns_info`. Following this, Thread B will eventually call `device_add_disk` (via `nvme_mpath_add_disk`), and at this point, `blk_queue_registered(q)` will become true.

Then, enter Thread C, perhaps performing a rescan. Thread C also calls `nvme_update_ns_info`. It proceeds to call `blk_mq_freeze_queue`. Because `blk_queue_registered(q)` is now true, `blk_freeze_set_owner` will be invoked, and this function will set `q->mq_freeze_disk_dead = FALSE`.

This is the fatal blow. Thread A, which was preempted earlier, now resumes execution. It calls `blk_unfreeze_release_lock`. When it checks `q->mq_freeze_disk_dead`, it finds `FALSE` (because Thread C just set it). However, Thread A is still operating under the assumption that it's the owner of the freeze state from its earlier operation. It then proceeds to attempt to release the `io_lockdep_map`, leading to a WARNING because the ownership expectations are violated. A definitive crash or incorrect behavior is imminent.

So, the exact sequence that triggers this problem, in my understanding, is:

1.  **Thread A:** Enters `nvme_alloc_ns`, calls `nvme_update_ns_info`. It progresses through `blk_mq_unfreeze_queue` and is preempted *just before* `blk_unfreeze_release_lock`.
2.  **Thread B:** Concurrently enters `nvme_alloc_ns`, calls `nvme_update_ns_info`. It completes this call and proceeds to `device_add_disk`. Crucially, `q->mq_freeze_disk_dead` is set to `TRUE` by Thread B during its `nvme_update_ns_info` call.
3.  **Thread C:** Initiates a rescan, calling `nvme_update_ns_info`. It calls `blk_mq_freeze_queue`. Since `blk_queue_registered(q)` is now true (due to Thread B's `device_add_disk`), `blk_freeze_set_owner` is called, which sets `q->mq_freeze_disk_dead = FALSE`.
4.  **Thread A (resumes):** Executes `blk_unfreeze_release_lock`. It reads `q->mq_freeze_disk_dead == FALSE` and attempts to release the `io_lockdep_map`, triggering the WARNING due to the mismatched ownership state.

To reliably reproduce this, I've identified the need for:
*   Connecting controller 1 (initiating Thread A's path).
*   Connecting controller 2 (initiating Thread B's path).
*   Performing a rescan on either controller 1 or 2 (initiating Thread C's path).
*   All of these actions must occur concurrently.

My initial thought about using `race_toolkit` for delay injection was to increase the probability of hitting this specific timing window. However, I recognize that direct kernel delay injection isn't available. Therefore, the most viable approach, as my previous reproducer attempted, is to saturate the system with concurrent connect and rescan operations. The puzzle then becomes why that previous reproducer didn't trigger the bug. My current hypothesis is that `nvme_update_ns_info` might only be called during a rescan if the namespace is *already* known or found, and I need to investigate the `nvme_scan_ns` function to confirm this.

map[Name:nvme_scan_ns]

map[SourceCode:4441:	static void nvme_scan_ns(struct nvme_ctrl *ctrl, unsigned nsid)
4442:	{
4443:		struct nvme_ns_info info = { .nsid = nsid };
4444:		struct nvme_ns *ns;
4445:		int ret = 1;
4446:	
4447:		if (nvme_identify_ns_descs(ctrl, &info))
4448:			return;
4449:	
4450:		if (info.ids.csi != NVME_CSI_NVM && !nvme_multi_css(ctrl)) {
4451:			dev_warn(ctrl->device,
4452:				"command set not reported for nsid: %u\n", nsid);
4453:			return;
4454:		}
4455:	
4456:		/*
4457:		 * If available try to use the Command Set Independent Identify Namespace
4458:		 * data structure to find all the generic information that is needed to
4459:		 * set up a namespace.  If not fall back to the legacy version.
4460:		 */
4461:		if ((ctrl->cap & NVME_CAP_CRMS_CRIMS) ||
4462:		    (info.ids.csi != NVME_CSI_NVM && info.ids.csi != NVME_CSI_ZNS) ||
4463:		    ctrl->vs >= NVME_VS(2, 0, 0))
4464:			ret = nvme_ns_info_from_id_cs_indep(ctrl, &info);
4465:		if (ret > 0)
4466:			ret = nvme_ns_info_from_identify(ctrl, &info);
4467:	
4468:		if (info.is_removed)
4469:			nvme_ns_remove_by_nsid(ctrl, nsid);
4470:	
4471:		/*
4472:		 * Ignore the namespace if it is not ready. We will get an AEN once it
4473:		 * becomes ready and restart the scan.
4474:		 */
4475:		if (ret || !info.is_ready)
4476:			return;
4477:	
4478:		ns = nvme_find_get_ns(ctrl, nsid);
4479:		if (ns) {
4480:			nvme_validate_ns(ns, &info);
4481:			nvme_put_ns(ns);
4482:		} else {
4483:			nvme_alloc_ns(ctrl, &info);
4484:		}
4485:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 24915
							output: 24
							thoughts: 46
						

**My Thought Process Regarding NVMe Namespace Handling**

Alright, so I'm looking at the `nvme_scan_ns` function, and my immediate thought is about how it handles existing versus non-existent namespaces. The code clearly indicates that if a namespace *is* found to exist, it proceeds to call `nvme_validate_ns`. However, if it *doesn't* exist, then the path taken is `nvme_alloc_ns`. This distinction is crucial, of course, as validation and allocation are fundamentally different operations with distinct implications for the NVMe subsystem. My next logical step, therefore, is to dive into the specifics of `nvme_validate_ns` to understand precisely what checks and operations are being performed in that scenario.

map[Name:nvme_validate_ns]

map[SourceCode:4419:	static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_info *info)
4420:	{
4421:		int ret = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
4422:	
4423:		if (!nvme_ns_ids_equal(&ns->head->ids, &info->ids)) {
4424:			dev_err(ns->ctrl->device,
4425:				"identifiers changed for nsid %u\n", ns->head->ns_id);
4426:			goto out;
4427:		}
4428:	
4429:		ret = nvme_update_ns_info(ns, info);
4430:	out:
4431:		/*
4432:		 * Only remove the namespace if we got a fatal error back from the
4433:		 * device, otherwise ignore the error and just move on.
4434:		 *
4435:		 * TODO: we should probably schedule a delayed retry here.
4436:		 */
4437:		if (ret > 0 && (ret & NVME_STATUS_DNR))
4438:			nvme_ns_remove(ns);
4439:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 25339
							output: 30
							thoughts: 432
						

**My Thought Process Unraveling the NVMe Namespace Allocation Race**

Right, so I've been digging into this NVMe namespace allocation scenario and I think I've pieced together the core race condition. It hinges on the interaction between `nvme_alloc_ns`, `nvme_update_ns_info`, and the block layer's freezing mechanisms, specifically `blk_mq_unfreeze_queue`.

Here's how I see it unfolding:

1.  **Thread A initiates allocation and gets interrupted:** Thread A starts the `nvme_alloc_ns` process. This leads to a call to `nvme_update_ns_info`. Within `nvme_update_ns_info`, it eventually calls `blk_mq_unfreeze_queue`. The critical point is that Thread A gets preempted *after* `blk_mq_unfreeze_queue` has been called but *before* it can complete its work, specifically before it reaches `blk_unfreeze_release_lock`.

2.  **Thread B sneaks in and completes its allocation:** While Thread A is preempted, Thread B also starts its `nvme_alloc_ns` operation. Crucially, Thread B's `nvme_update_ns_info` call finishes successfully, returning control, and then proceeds to `device_add_disk`.

3.  **Thread C triggers a freeze:** Meanwhile, Thread C is scanning namespaces using `nvme_scan_ns`. This leads to a call to `nvme_validate_ns`, which in turn calls `nvme_update_ns_info`. During this path, `nvme_update_ns_info` ends up calling `blk_mq_freeze_queue`. The significant action here is that `blk_mq_freeze_queue` sets `mq_freeze_disk_dead` to `FALSE`.

4.  **Thread A resumes and triggers the WARNING:** Now, Thread A resumes its execution. It picks up from where it was preempted, specifically at the point of calling `blk_unfreeze_release_lock`. Here's the problem: because Thread C set `mq_freeze_disk_dead` to `FALSE`, Thread A reads this `FALSE` value. It then proceeds to release the `io_lockdep_map`, but the lockdep mechanism detects an issue, likely because the state it's observing (`mq_freeze_disk_dead == FALSE`) is inconsistent with the expected state or due to some underlying condition that the freeze intended to guard against. This leads to the WARNING.

Now, the key to making this race actually occur is ensuring Thread A is held up for a significant duration. I can't exactly use `userfaultfd` because this isn't user-space memory access, but I'm thinking about how to increase the probability of this preemption.

My initial thought was CPU pinning and careful scheduling. If I can arrange for Thread A, B, and C to run on the same CPU, and get Thread A preempted by Thread B, allowing B to finish, then C to run, and *then* have A resume, that seems like a viable path.

However, I had a quick second thought: when Thread A is in `blk_mq_unfreeze_queue`, is it holding `q->mq_freeze_lock`? I need to double-check that. If it *is* holding the lock, that would change the dynamic significantly. But looking closer at `__blk_mq_unfreeze_queue`, it actually releases `q->mq_freeze_lock` *before* it returns. This is important! It means Thread A is *not* holding any locks when it gets preempted before `blk_unfreeze_release_lock`. This supports my initial race scenario.

I need to go back and scrutinize `blk_mq_unfreeze_queue_nomemrestore` again, specifically around the lock handling and the state updates related to freezing. That's where the crucial piece of the puzzle must be.

map[Name:blk_mq_unfreeze_queue_nomemrestore]

map[SourceCode: 230:	void blk_mq_unfreeze_queue_nomemrestore(struct request_queue *q)
 231:	{
 232:		if (__blk_mq_unfreeze_queue(q, false))
 233:			blk_unfreeze_release_lock(q);
 234:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 25900
							output: 26
							thoughts: 45
						

**My Thought Process Regarding `__blk_mq_unfreeze_queue` and `blk_unfreeze_check_owner`**

Alright, so I'm examining the `__blk_mq_unfreeze_queue` function, and the very first thing it does is call `blk_unfreeze_check_owner(q)`. My immediate instinct, given the context of block device queue management, is to dive straight into what `blk_unfreeze_check_owner` is actually doing. I need to understand the logic behind that return value, `unfreeze`, and how it dictates the subsequent behavior of `__blk_mq_unfreeze_queue`. This is clearly a critical gatekeeper function, and without understanding its specifics, I can't properly reason about the unfreezing process.

map[Name:blk_unfreeze_check_owner]

map[SourceCode: 137:	/* verify the last unfreeze in owner context */
 138:	static bool blk_unfreeze_check_owner(struct request_queue *q)
 139:	{
 140:		if (q->mq_freeze_owner != current)
 141:			return false;
 142:		if (--q->mq_freeze_owner_depth == 0) {
 143:			q->mq_freeze_owner = NULL;
 144:			return true;
 145:		}
 146:		return false;
 147:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 26141
							output: 16
							thoughts: 1002
						

**The Race Condition in NVMe Namespace Management**

I've been digging into a rather tricky race condition that can occur during NVMe namespace management, specifically around queue freezing and unfreezing. It seems to hinge on the timing of operations when multiple threads are interacting with the same NVMe controller.

Here's how I'm piecing together the thought process:

First, I'm looking at `__blk_mq_unfreeze_queue`. My understanding is that this function signals that a queue can be unfrozen by returning `true` when `q->mq_freeze_owner_depth` hits zero. Following this, `blk_unfreeze_release_lock` is supposed to be called.

The critical part of the race happens if a thread, let's call it Thread A, gets preempted *between* the moment `__blk_mq_unfreeze_queue` returns true and when `blk_unfreeze_release_lock` is actually executed. At the point of preemption, Thread A has already successfully decremented `q->mq_freeze_owner_depth` to zero and, importantly, set `q->mq_freeze_owner` to `NULL`. This all happens under the protection of `q->mq_freeze_lock`.

Now, with `q->mq_freeze_owner` being `NULL`, another thread, Thread B, can swoop in and attempt to freeze the queue. Thread B will proceed to set `q->mq_freeze_owner` to itself and `q->mq_freeze_disk_dead` to `TRUE`. Shortly after, Thread B will unfreeze the queue by setting `q->mq_freeze_owner` back to `NULL`. Then, Thread B will call `device_add_disk`.

Following this, a third thread, Thread C, enters the picture. It decides to freeze the queue, setting `q->mq_freeze_owner` to its own thread and `q->mq_freeze_disk_dead` to `FALSE`.

It's at this point that Thread A finally resumes its execution. It proceeds to call `blk_unfreeze_release_lock`. The problem arises because `q->mq_freeze_disk_dead` is now `FALSE` (thanks to Thread C). This means the code will attempt to call `rwsem_release(&q->io_lockdep_map)`. However, Thread A *never actually acquired* `io_lockdep_map` in the first place. It skipped that step because when Thread A initially froze the queue, `q->mq_freeze_disk_dead` was `TRUE`, and that condition prevented the acquisition of the lock. This is precisely the race I've identified.

The challenge now is how to reliably trigger this condition. The window of opportunity is incredibly small – just a few instructions between `__blk_mq_unfreeze_queue` returning true and `blk_unfreeze_release_lock` being called. To hit this narrow window, I need a high degree of concurrent execution. My initial thought is that having many threads connecting and rescanning at the same time might provide the necessary pressure.

However, I'm recalling my previous attempts at creating a reproducer, and they failed. I've been reviewing the code, and it seems the crucial element I missed in the "Previous Reproducer Attempt" was the `rescan_thread`. The strategy I had in mind included connect, rescan, and disconnect threads, but the code I tested only had connect and disconnect. This is a significant oversight.

Specifically, the previous reproducer had threads calling `connect_thread` which would open `/dev/nvme-fabrics` and write connection details. It also had a `disconnect_all` function, but it lacked a dedicated `rescan_thread`. The failure of `nvme_update_ns_info`, which is called from both `nvme_alloc_ns` and `nvme_validate_ns`, seems to be central to this issue.

I'm realizing now that the strategy I originally outlined, which involved continuous connection, rescanning, and disconnection, is likely the key. The interaction where multiple controllers connect to the same NVMe subsystem is important. If Thread A connects controller 1, allocating a namespace head, and then Thread B connects controller 2, finding that same head (due to multipathing), and then Thread C rescans either controller 1 or 2, they will all be operating on the same `nvme_ns_head`. This shared resource is exactly what creates the contention needed to expose the race.

So, my refined plan for the reproducer is as follows:

1.  **Connect Threads:** These threads will continuously attempt to connect to the same NVMe subsystem.
2.  **Rescan Threads:** These threads will continuously write `1` to `/sys/class/nvme/nvmeX/rescan_controller` for a specific controller.
3.  **Disconnect Threads:** These threads will periodically write `1` to `/sys/class/nvme/nvmeX/delete_controller` for a specific controller, introducing further churn.

By orchestrating these concurrent operations, I believe I can finally create the conditions necessary to reliably trigger the race condition.

map[Name:race]

map[Toolkit:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }
]

gemini-3.1-pro-preview

							input: 28825
							output: 1974
							thoughts: 3212
						

**My Thoughts on Refining the NVMe Race Reproducer**

I've been revisiting the strategy for reproducing this NVMe race condition, and I need to make sure I'm adhering strictly to the rules. The primary constraint is to avoid any shell command execution, which means no `system()` or similar functions. My initial understanding of the "Previous Reproducer Attempt" was slightly off; it actually used standard C functions like `mkdir`, `open`, `write`, `symlink`, `unlink`, `rmdir`, `opendir`, and `readdir`. This is good, as it means the path forward is clear: stick to these system-level C functions for all operations.

My focus now is on crafting a robust reproducer using only these allowed standard C system calls. To that end, I've outlined the core components needed:

*   `setup_nvmet()`: To prepare the NVMe target configuration in `configfs`.
*   `teardown_nvmet()`: To clean up the NVMe target configuration.
*   `connect_thread()`: To initiate connections to the NVMe target.
*   `rescan_thread()`: To trigger rescanning of NVMe devices.
*   `disconnect_thread()`: To disconnect from the NVMe target.

I've started implementing these, and the current code includes checks for errors after each system call using `errno` to ensure I'm handling potential issues correctly. For instance, `check_mkdir` ensures that directories are created or already exist, and `check_write_file` handles opening, writing, and closing files with proper error reporting. The `try_write_file` function is a less critical variant, used when a failure to write is acceptable.

The `setup_nvmet` function sets up a basic NVMf subsystem with a loopback transport and a single namespace backed by a temporary file. `teardown_nvmet` reverses this process, carefully unlinking and removing the created configuration.

The threading model is crucial for introducing the race. I've defined `connect_thread`, `rescan_thread`, and `disconnect_thread`, all of which run in a loop until a global `stop` flag is set. This allows for concurrent execution of these operations. The `main` function orchestrates these threads, starting them, letting them run for a period (controlled by a timer), then signaling them to stop and joining them.

Now, reflecting on the specific nature of the race, I'm considering potential edge cases and areas where the race window might be widened. I initially thought about whether `nvme_update_ns_info` might be skipped if a namespace isn't ready during a rescan. However, the loopback namespace should be ready.

A more promising avenue is to introduce dynamic reconfiguration of the NVMe target namespace itself. What if I try to change the size of the backing file or, more directly, enable and disable the namespace in `configfs`? Disabling the namespace, for example, might cause `nvme_scan_ns` to encounter a state where `info.is_ready` is false or `info.is_removed` is true, potentially triggering error paths. Changing the size could lead to `nvme_update_ns_info` doing more work, thus increasing the race window.

However, I've paused on the `reconfig_thread` idea for now. If I disable the namespace, the host might fail to connect or rescan, which could be useful for hitting error paths. But there's a risk that disabling it might cause the host to remove the namespace entirely, which could interfere with the test's intended operation. For now, I'll stick to the core operations of connect, rescan, and disconnect.

I've also considered CPU pinning. While `PIN_TO_CPU` is a useful tool for increasing contention, the kernel's scheduler will inherently create preemption opportunities. If all threads are pinned to CPU 0, they will preempt each other. Pinning different threads to different CPUs (e.g., CPU 0 and CPU 1) might seem counterintuitive for creating a race, but the kernel's scheduling is complex, and relying on its default behavior is generally sufficient for exposing races. For now, I'll let the kernel manage the scheduling.

The current focus remains on the interaction between connections, rescans, and disconnections. The `rescan_thread` is designed to trigger a rescan while connections are potentially still in progress, which seems like a direct way to hit the race condition I'm investigating. I'll continue to refine the existing threads and ensure the error handling is robust.

map[IsProbe:false RawCandidateReproC:#include "race_toolkit.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 2

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    return NULL;
}

void* rescan_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/rescan_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
    }
    return NULL;
}

void* disconnect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
        usleep(50000); // Disconnect less frequently to allow rescans to hit registered disks
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t ct[NUM_CONNECT_THREADS];
        pthread_t rt[NUM_RESCAN_THREADS];
        pthread_t dt[NUM_DISCONNECT_THREADS];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_create(&ct[i], NULL, connect_thread, NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_create(&dt[i], NULL, disconnect_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_join(ct[i], NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_join(dt[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[IsProbe:false RawCandidateReproC:#include "race_toolkit.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 2

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    return NULL;
}

void* rescan_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/rescan_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
    }
    return NULL;
}

void* disconnect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
        usleep(50000); // Disconnect less frequently to allow rescans to hit registered disks
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t ct[NUM_CONNECT_THREADS];
        pthread_t rt[NUM_RESCAN_THREADS];
        pthread_t dt[NUM_DISCONNECT_THREADS];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_create(&ct[i], NULL, connect_thread, NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_create(&dt[i], NULL, disconnect_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_join(ct[i], NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_join(dt[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[CurrentCandidateReproC:#include "race_toolkit.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 2

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    return NULL;
}

void* rescan_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/rescan_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
    }
    return NULL;
}

void* disconnect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
        usleep(50000); // Disconnect less frequently to allow rescans to hit registered disks
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t ct[NUM_CONNECT_THREADS];
        pthread_t rt[NUM_RESCAN_THREADS];
        pthread_t dt[NUM_DISCONNECT_THREADS];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_create(&ct[i], NULL, connect_thread, NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_create(&dt[i], NULL, disconnect_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_join(ct[i], NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_join(dt[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[CompilerError: FormattedReproC:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 2

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    return NULL;
}

void* rescan_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/rescan_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
    }
    return NULL;
}

void* disconnect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
        usleep(50000); // Disconnect less frequently to allow rescans to hit registered disks
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t ct[NUM_CONNECT_THREADS];
        pthread_t rt[NUM_RESCAN_THREADS];
        pthread_t dt[NUM_DISCONNECT_THREADS];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_create(&ct[i], NULL, connect_thread, NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_create(&dt[i], NULL, disconnect_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_join(ct[i], NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_join(dt[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[CompilerError:]

map[CandidateBugTitle:WARNING in blk_mq_free_tag_set CandidateCrashReport:------------[ cut here ]------------
timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist)
WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706, CPU#0: kworker/u10:157/6412
Modules linked in:
CPU: 0 UID: 0 PID: 6412 Comm: kworker/u10:157 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme-delete-wq nvme_delete_ctrl_work
RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706
Code: 15 8b 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00
RSP: 0018:ffffc900068579b8 EFLAGS: 00010202
RAX: 1ffffd1fd788fc15 RBX: 0000607d17814fc0 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffe8febc47dfc0 R08: ffffffff90838d7f R09: 1ffffffff21071af
R10: dffffc0000000000 R11: fffffbfff21071b0 R12: ffff88818eb07000
R13: 0000000000000000 R14: ffffe8febc47e0a8 R15: 1ffffffff1cc4fde
FS:  0000000000000000(0000) GS:ffff8881a4c69000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558a63e067c8 CR3: 00000001feb70000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 blk_mq_free_tag_set+0x617/0x790 block/blk-mq.c:4976
 nvme_do_delete_ctrl+0x246/0x320 drivers/nvme/host/core.c:252
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
 CandidateReproduced:true ConsoleOutput:[   64.280170][   T34] kauditd_printk_skb: 6 callbacks suppressed
[   64.280208][   T34] audit: type=1400 audit(1790188236.959:200): avc:  denied  { transition } for  pid=5830 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   64.281596][   T34] audit: type=1400 audit(1790188236.959:201): avc:  denied  { noatsecure } for  pid=5830 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   64.281989][   T34] audit: type=1400 audit(1790188236.969:202): avc:  denied  { rlimitinh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   64.282008][   T34] audit: type=1400 audit(1790188236.969:203): avc:  denied  { siginh } for  pid=5830 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   66.430143][   T34] audit: type=1400 audit(1790188239.109:204): avc:  denied  { write } for  pid=5839 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   66.487585][   T34] audit: type=1400 audit(1790188239.169:205): avc:  denied  { write } for  pid=5842 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.046320][   T34] audit: type=1400 audit(1790188239.729:206): avc:  denied  { write } for  pid=5845 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.098703][   T34] audit: type=1400 audit(1790188239.779:207): avc:  denied  { write } for  pid=5848 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.408663][   T34] audit: type=1400 audit(1790188240.089:208): avc:  denied  { write } for  pid=5851 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.464937][   T34] audit: type=1400 audit(1790188240.149:209): avc:  denied  { write } for  pid=5854 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:50262' (ED25519) to the list of known hosts.
[   68.453735][ T5864] nvmet: adding nsid 1 to subsystem testnqn
[+] setup_nvmet successful.
[*] Starting concurrent NVMe multipath connections and rescans...
[   68.587180][   T29] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   68.650062][ T5868] nvme nvme0: creating 2 I/O queues.
[   68.678847][ T5868] nvme nvme0: new ctrl: "testnqn"
[   68.690256][ T5875] nvme nvme0: Removing ctrl: NQN "testnqn"
[   68.765409][   T29] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   68.776992][ T5868] nvme nvme1: creating 2 I/O queues.
[   68.789095][ T5868] nvme nvme1: new ctrl: "testnqn"
[   68.807326][ T5874] nvme nvme1: Removing ctrl: NQN "testnqn"
[   68.847029][   T68] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   68.863974][ T5865] nvme nvme2: creating 2 I/O queues.
[   68.878666][ T5865] nvme nvme2: new ctrl: "testnqn"
[   68.995115][   T28] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   68.995893][ T5865] nvme nvme3: creating 2 I/O queues.
[   68.998564][ T5865] nvme nvme3: new ctrl: "testnqn"
[   69.095017][   T28] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   69.099373][ T5866] nvme nvme4: creating 2 I/O queues.
[   69.106146][ T5866] nvme nvme4: new ctrl: "testnqn"
[   69.242130][   T29] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   69.251184][ T5866] nvme nvme5: creating 2 I/O queues.
[   69.262321][ T5866] nvme nvme5: new ctrl: "testnqn"
[   69.370798][   T34] kauditd_printk_skb: 51 callbacks suppressed
[   69.370809][   T34] audit: type=1400 audit(1790188242.049:261): avc:  denied  { write } for  pid=5884 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.410230][ T5875] nvme nvme5: Removing ctrl: NQN "testnqn"
[   69.428424][ T5883] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   69.429262][ T5867] nvme nvme6: creating 2 I/O queues.
[   69.431116][ T5867] nvme nvme6: new ctrl: "testnqn"
[   69.500176][   T34] audit: type=1400 audit(1790188242.179:262): avc:  denied  { write } for  pid=5894 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   69.536546][ T5888] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   69.540927][ T5867] nvme nvme1: creating 2 I/O queues.
[   69.554859][ T5867] nvme nvme1: new ctrl: "testnqn"
[   69.638345][ T5893] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   69.640061][ T5868] nvme nvme7: creating 2 I/O queues.
[   69.644085][ T5874] nvme nvme3: Removing ctrl: NQN "testnqn"
[   69.648627][ T5868] nvme nvme7: new ctrl: "testnqn"
[   69.773899][ T1116] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   69.783315][ T5868] nvme nvme8: creating 2 I/O queues.
[   69.795700][ T5868] nvme nvme8: new ctrl: "testnqn"
[   69.930436][ T5897] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   69.946899][ T5865] nvme nvme9: creating 2 I/O queues.
[   69.959093][ T5865] nvme nvme9: new ctrl: "testnqn"
[   70.098961][   T64] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   70.099740][ T5866] nvme nvme10: creating 2 I/O queues.
[   70.103648][ T5875] nvme nvme6: Removing ctrl: NQN "testnqn"
[   70.119208][ T5866] nvme nvme10: new ctrl: "testnqn"
[   70.205005][   T34] audit: type=1400 audit(1790188242.889:263): avc:  denied  { write } for  pid=5902 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.233602][ T5874] nvme nvme1: Removing ctrl: NQN "testnqn"
[   70.292931][   T68] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   70.306187][ T5866] nvme nvme3: creating 2 I/O queues.
[   70.307705][ T5866] nvme nvme3: new ctrl: "testnqn"
[   70.360954][   T34] audit: type=1400 audit(1790188243.039:264): avc:  denied  { write } for  pid=5907 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.413576][   T65] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   70.424607][ T5867] nvme nvme5: creating 2 I/O queues.
[   70.434337][ T5867] nvme nvme5: new ctrl: "testnqn"
[   70.568362][ T5883] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   70.569245][ T5868] nvme nvme11: creating 2 I/O queues.
[   70.570392][ T5868] nvme nvme11: new ctrl: "testnqn"
[   70.628439][  T148] nvmet: Created nvm controller 11 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   70.629175][ T5868] nvme nvme6: creating 2 I/O queues.
[   70.638436][ T5868] nvme nvme6: new ctrl: "testnqn"
[   70.661767][   T34] audit: type=1400 audit(1790188243.339:265): avc:  denied  { write } for  pid=5915 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.717404][   T34] audit: type=1400 audit(1790188243.399:266): avc:  denied  { write } for  pid=5922 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.767386][ T5875] nvme nvme4: Removing ctrl: NQN "testnqn"
[   70.802043][ T5920] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   70.805019][ T5865] nvme nvme12: creating 2 I/O queues.
[   70.824416][ T5865] nvme nvme12: new ctrl: "testnqn"
[   70.916765][ T5924] nvmet: Created nvm controller 12 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   70.954016][ T5865] nvme nvme13: creating 2 I/O queues.
[   70.967620][   T34] audit: type=1400 audit(1790188243.649:267): avc:  denied  { write } for  pid=5928 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.968926][ T5865] nvme nvme13: new ctrl: "testnqn"
[   71.017394][ T5874] nvme nvme6: Removing ctrl: NQN "testnqn"
[   71.071465][   T34] audit: type=1400 audit(1790188243.759:268): avc:  denied  { write } for  pid=5933 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.089056][ T1116] nvmet: Created nvm controller 13 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   71.107863][ T5866] nvme nvme1: creating 2 I/O queues.
[   71.152562][ T5866] nvme nvme1: new ctrl: "testnqn"
[   71.267535][ T5929] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   71.278304][ T5866] nvme nvme14: creating 2 I/O queues.
[   71.281197][ T5866] nvme nvme14: new ctrl: "testnqn"
[   71.306955][ T5875] nvme nvme2: Removing ctrl: NQN "testnqn"
[   71.400614][   T28] nvmet: Created nvm controller 14 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   71.409383][ T5867] nvme nvme4: creating 2 I/O queues.
[   71.422603][ T5867] nvme nvme4: new ctrl: "testnqn"
[   71.491652][ T5883] nvmet: Created nvm controller 15 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   71.501219][ T5867] nvme nvme15: creating 2 I/O queues.
[   71.512571][ T5867] nvme nvme15: new ctrl: "testnqn"
[   71.633727][ T1110] nvmet: Created nvm controller 11 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   71.641732][ T5868] nvme nvme16: creating 2 I/O queues.
[   71.651805][ T5868] nvme nvme16: new ctrl: "testnqn"
[   71.728876][ T1384] ieee802154 phy0 wpan0: encryption failed: -22
[   71.728930][ T1384] ieee802154 phy1 wpan1: encryption failed: -22
[   71.767121][   T34] audit: type=1400 audit(1790188244.449:269): avc:  denied  { write } for  pid=5942 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.832568][ T5946] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   71.841197][ T5868] nvme nvme17: creating 2 I/O queues.
[   71.848886][ T5868] nvme nvme17: new ctrl: "testnqn"
[   71.958822][   T34] audit: type=1400 audit(1790188244.639:270): avc:  denied  { write } for  pid=5951 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.972770][ T1033] nvmet: Created nvm controller 16 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   71.973557][ T5865] nvme nvme6: creating 2 I/O queues.
[   71.977636][ T5865] nvme nvme6: new ctrl: "testnqn"
[   71.998749][ T5874] nvme nvme4: Removing ctrl: NQN "testnqn"
[   72.023227][ T5887] nvmet: Created nvm controller 17 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.024029][ T5865] nvme nvme2: creating 2 I/O queues.
[   72.028701][ T5865] nvme nvme2: new ctrl: "testnqn"
[   72.111631][ T5946] nvmet: Created nvm controller 18 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.115052][ T5875] nvme nvme7: Removing ctrl: NQN "testnqn"
[   72.119783][ T5866] nvme nvme18: creating 2 I/O queues.
[   72.133219][ T5866] nvme nvme18: new ctrl: "testnqn"
[   72.259070][ T5888] nvmet: Created nvm controller 19 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.265356][ T5866] nvme nvme19: creating 2 I/O queues.
[   72.269768][ T5866] nvme nvme19: new ctrl: "testnqn"
[   72.404249][ T5927] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.410947][ T5867] nvme nvme20: creating 2 I/O queues.
[   72.440084][ T5867] nvme nvme20: new ctrl: "testnqn"
[   72.504736][ T5875] nvme nvme13: Removing ctrl: NQN "testnqn"
[   72.522705][ T5950] nvmet: Created nvm controller 20 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.527652][ T5868] nvme nvme7: creating 2 I/O queues.
[   72.537914][ T5868] nvme nvme7: new ctrl: "testnqn"
[   72.576905][ T5904] nvmet: Created nvm controller 14 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.577721][ T5865] nvme nvme21: creating 2 I/O queues.
[   72.588107][ T5865] nvme nvme21: new ctrl: "testnqn"
[   72.695713][ T5950] nvmet: Created nvm controller 21 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.706450][ T5865] nvme nvme22: creating 2 I/O queues.
[   72.716207][ T5874] nvme nvme2: Removing ctrl: NQN "testnqn"
[   72.717588][ T5865] nvme nvme22: new ctrl: "testnqn"
[   72.816381][ T1116] nvmet: Created nvm controller 22 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.827467][ T5866] nvme nvme4: creating 2 I/O queues.
[   72.838945][ T5866] nvme nvme4: new ctrl: "testnqn"
[   72.897337][ T5929] nvmet: Created nvm controller 23 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.898637][ T5866] nvme nvme23: creating 2 I/O queues.
[   72.909436][ T5866] nvme nvme23: new ctrl: "testnqn"
[   72.947743][ T5893] nvmet: Created nvm controller 24 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   72.950326][ T5867] nvme nvme24: creating 2 I/O queues.
[   72.966753][ T5867] nvme nvme24: new ctrl: "testnqn"
[   73.065665][ T5888] nvmet: Created nvm controller 12 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.066428][ T5867] nvme nvme25: creating 2 I/O queues.
[   73.069137][ T5867] nvme nvme25: new ctrl: "testnqn"
[   73.154917][ T5955] nvmet: Created nvm controller 25 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.168995][ T5868] nvme nvme26: creating 2 I/O queues.
[   73.180984][ T5868] nvme nvme26: new ctrl: "testnqn"
[   73.220067][ T5924] nvmet: Created nvm controller 26 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.230694][ T5868] nvme nvme13: creating 2 I/O queues.
[   73.243437][ T5868] nvme nvme13: new ctrl: "testnqn"
[   73.266355][ T5875] nvme nvme5: Removing ctrl: NQN "testnqn"
[   73.315077][ T5982] nvmet: Created nvm controller 27 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.329836][ T5865] nvme nvme27: creating 2 I/O queues.
[   73.339507][ T5865] nvme nvme27: new ctrl: "testnqn"
[   73.415448][ T5956] nvmet: Created nvm controller 28 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.417803][ T5865] nvme nvme28: creating 2 I/O queues.
[   73.419723][ T5865] nvme nvme28: new ctrl: "testnqn"
[   73.486080][ T5988] nvmet: Created nvm controller 17 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.496648][ T5866] nvme nvme29: creating 2 I/O queues.
[   73.506666][ T5866] nvme nvme29: new ctrl: "testnqn"
[   73.549014][ T5989] nvmet: Created nvm controller 29 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.549790][ T5867] nvme nvme2: creating 2 I/O queues.
[   73.561575][ T5867] nvme nvme2: new ctrl: "testnqn"
[   73.588441][ T5994] nvmet: Created nvm controller 30 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.590665][ T5868] nvme nvme30: creating 2 I/O queues.
[   73.597252][ T5868] nvme nvme30: new ctrl: "testnqn"
[   73.628653][ T5999] nvmet: Created nvm controller 31 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   73.629472][ T5865] nvme nvme31: creating 2 I/O queues.
[   73.636362][ T5865] nvme nvme31: new ctrl: "testnqn"
[   73.883688][ T5875] nvme nvme11: Removing ctrl: NQN "testnqn"
[   74.653246][ T5875] nvme nvme3: Removing ctrl: NQN "testnqn"
[   74.902333][ T5875] nvme nvme18: Removing ctrl: NQN "testnqn"
[   75.162312][ T5875] nvme nvme1: Removing ctrl: NQN "testnqn"
[   75.443584][ T5875] nvme nvme16: Removing ctrl: NQN "testnqn"
[   75.722433][ T5875] nvme nvme8: Removing ctrl: NQN "testnqn"
[   75.992696][ T5875] nvme nvme14: Removing ctrl: NQN "testnqn"
[   76.284213][ T5875] nvme nvme6: Removing ctrl: NQN "testnqn"
[   76.583092][ T5875] nvme nvme12: Removing ctrl: NQN "testnqn"
[   76.845255][  T807] cfg80211: failed to load regulatory.db
[   76.862376][ T5875] nvme nvme4: Removing ctrl: NQN "testnqn"
[   77.102278][ T5875] nvme nvme10: Removing ctrl: NQN "testnqn"
[   77.382503][ T5875] nvme nvme2: Removing ctrl: NQN "testnqn"
[   77.642348][ T5875] nvme nvme17: Removing ctrl: NQN "testnqn"
[   77.892398][ T5875] nvme nvme9: Removing ctrl: NQN "testnqn"
[   78.152861][ T5875] nvme nvme15: Removing ctrl: NQN "testnqn"
[   78.480968][ T6011] nvme nvme23: Removing ctrl: NQN "testnqn"
[   78.565139][ T5956] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   78.571808][ T6002] nvme nvme1: creating 2 I/O queues.
[   78.579663][ T6002] nvme nvme1: new ctrl: "testnqn"
[   78.673142][ T5982] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   78.688230][ T6002] nvme nvme2: creating 2 I/O queues.
[   78.695132][ T6002] nvme nvme2: new ctrl: "testnqn"
[   78.806937][ T5959] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   78.808962][ T6003] nvme nvme3: creating 2 I/O queues.
[   78.811114][ T6003] nvme nvme3: new ctrl: "testnqn"
[   78.917528][ T1113] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   78.934757][ T6003] nvme nvme4: creating 2 I/O queues.
[   78.943600][ T6003] nvme nvme4: new ctrl: "testnqn"
[   79.067356][ T5959] nvmet: Created nvm controller 5 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.076889][ T6004] nvme nvme5: creating 2 I/O queues.
[   79.079726][ T6011] nvme nvme7: Removing ctrl: NQN "testnqn"
[   79.085269][ T6004] nvme nvme5: new ctrl: "testnqn"
[   79.204642][ T5970] nvmet: Created nvm controller 6 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.210981][ T6004] nvme nvme6: creating 2 I/O queues.
[   79.222822][ T6004] nvme nvme6: new ctrl: "testnqn"
[   79.321464][ T5970] nvmet: Created nvm controller 8 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.322460][ T6005] nvme nvme8: creating 2 I/O queues.
[   79.326660][ T6005] nvme nvme8: new ctrl: "testnqn"
[   79.437886][ T5999] nvmet: Created nvm controller 9 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.450231][ T6005] nvme nvme9: creating 2 I/O queues.
[   79.465191][ T6005] nvme nvme9: new ctrl: "testnqn"
[   79.523632][ T6011] nvme nvme13: Removing ctrl: NQN "testnqn"
[   79.525406][ T6012] nvme nvme31: Removing ctrl: NQN "testnqn"
[   79.545836][   T65] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.552039][ T6002] nvme nvme7: creating 2 I/O queues.
[   79.564064][ T6002] nvme nvme7: new ctrl: "testnqn"
[   79.668718][ T5960] nvmet: Created nvm controller 11 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.679620][ T6003] nvme nvme10: creating 2 I/O queues.
[   79.696041][ T6003] nvme nvme10: new ctrl: "testnqn"
[   79.765089][ T5887] nvmet: Created nvm controller 13 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.769807][ T6004] nvme nvme11: creating 2 I/O queues.
[   79.778305][ T6004] nvme nvme11: new ctrl: "testnqn"
[   79.919725][ T5960] nvmet: Created nvm controller 15 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   79.932713][ T6004] nvme nvme12: creating 2 I/O queues.
[   79.947750][ T6004] nvme nvme12: new ctrl: "testnqn"
[   80.045752][ T5968] nvmet: Created nvm controller 16 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   80.066353][ T6005] nvme nvme14: creating 2 I/O queues.
[   80.068305][ T6005] nvme nvme14: new ctrl: "testnqn"
[   80.146150][ T6012] nvme nvme21: Removing ctrl: NQN "testnqn"
[   80.190049][ T6000] nvmet: Created nvm controller 18 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   80.199139][ T6005] nvme nvme15: creating 2 I/O queues.
[   80.206609][ T6005] nvme nvme15: new ctrl: "testnqn"
[   80.329133][ T5994] nvmet: Created nvm controller 20 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   80.347313][ T6002] nvme nvme16: creating 2 I/O queues.
[   80.354325][ T6002] nvme nvme16: new ctrl: "testnqn"
[   80.450760][ T5929] nvmet: Created nvm controller 22 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   80.453447][ T6002] nvme nvme17: creating 2 I/O queues.
[   80.464697][ T6002] nvme nvme17: new ctrl: "testnqn"
[   80.537917][ T5997] nvmet: Created nvm controller 23 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   80.538682][ T6003] nvme nvme18: creating 2 I/O queues.
[   80.549022][ T6003] nvme nvme18: new ctrl: "testnqn"
[   80.698464][ T6032] nvmet: Created nvm controller 14 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   80.700925][ T6003] nvme nvme23: creating 2 I/O queues.
[   80.722566][ T6003] nvme nvme23: new ctrl: "testnqn"
[   80.796793][ T6011] nvme nvme28: Removing ctrl: NQN "testnqn"
[   80.824909][ T6012] nvme nvme26: Removing ctrl: NQN "testnqn"
[   80.869872][ T5973] nvmet: Created nvm controller 26 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   80.874849][ T6004] nvme nvme13: creating 2 I/O queues.
[   80.889151][ T6004] nvme nvme13: new ctrl: "testnqn"
[   81.023642][ T5973] nvmet: Created nvm controller 29 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.035341][ T6004] nvme nvme21: creating 2 I/O queues.
[   81.039985][ T6004] nvme nvme21: new ctrl: "testnqn"
[   81.142916][ T5973] nvmet: Created nvm controller 31 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.148548][ T6005] nvme nvme31: creating 2 I/O queues.
[   81.158518][ T6005] nvme nvme31: new ctrl: "testnqn"
[   81.261778][ T5985] nvmet: Created nvm controller 28 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.262575][ T6005] nvme nvme32: creating 2 I/O queues.
[   81.277789][ T6005] nvme nvme32: new ctrl: "testnqn"
[   81.353257][ T6011] nvme nvme24: Removing ctrl: NQN "testnqn"
[   81.398278][  T148] nvmet: Created nvm controller 25 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.408154][ T6002] nvme nvme28: creating 2 I/O queues.
[   81.414667][ T6002] nvme nvme28: new ctrl: "testnqn"
[   81.490387][ T5988] nvmet: Created nvm controller 32 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.499777][ T6002] nvme nvme33: creating 2 I/O queues.
[   81.507616][ T6002] nvme nvme33: new ctrl: "testnqn"
[   81.538451][ T6012] nvme nvme22: Removing ctrl: NQN "testnqn"
[   81.591741][ T5920] nvmet: Created nvm controller 33 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.594461][ T6003] nvme nvme26: creating 2 I/O queues.
[   81.596644][ T6003] nvme nvme26: new ctrl: "testnqn"
[   81.739165][ T5944] nvmet: Created nvm controller 34 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.747824][ T6004] nvme nvme34: creating 2 I/O queues.
[   81.750399][ T6004] nvme nvme34: new ctrl: "testnqn"
[   81.838036][   T28] nvmet: Created nvm controller 35 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.848456][ T6004] nvme nvme35: creating 2 I/O queues.
[   81.866225][ T6004] nvme nvme35: new ctrl: "testnqn"
[   81.983075][ T5975] nvmet: Created nvm controller 36 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   81.997035][ T6005] nvme nvme36: creating 2 I/O queues.
[   82.005540][ T6005] nvme nvme36: new ctrl: "testnqn"
[   82.076831][ T6031] nvmet: Created nvm controller 37 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.079389][ T6005] nvme nvme37: creating 2 I/O queues.
[   82.092946][ T6005] nvme nvme37: new ctrl: "testnqn"
[   82.211588][ T5989] nvmet: Created nvm controller 21 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.215895][ T6002] nvme nvme38: creating 2 I/O queues.
[   82.229280][ T6002] nvme nvme38: new ctrl: "testnqn"
[   82.289166][ T5989] nvmet: Created nvm controller 38 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.318285][ T6003] nvme nvme39: creating 2 I/O queues.
[   82.332647][ T6003] nvme nvme39: new ctrl: "testnqn"
[   82.390749][ T6032] nvmet: Created nvm controller 39 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.400131][ T6003] nvme nvme22: creating 2 I/O queues.
[   82.416472][ T6003] nvme nvme22: new ctrl: "testnqn"
[   82.433649][ T6012] nvme nvme30: Removing ctrl: NQN "testnqn"
[   82.472214][ T5904] nvmet: Created nvm controller 40 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.474045][ T6004] nvme nvme40: creating 2 I/O queues.
[   82.475209][ T6004] nvme nvme40: new ctrl: "testnqn"
[   82.517761][ T5883] nvmet: Created nvm controller 41 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.531170][ T6004] nvme nvme41: creating 2 I/O queues.
[   82.535733][ T6004] nvme nvme41: new ctrl: "testnqn"
[   82.592903][ T5977] nvmet: Created nvm controller 24 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.595588][ T6005] nvme nvme42: creating 2 I/O queues.
[   82.599217][ T6005] nvme nvme42: new ctrl: "testnqn"
[   82.667675][ T6049] nvmet: Created nvm controller 42 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.686411][ T6002] nvme nvme43: creating 2 I/O queues.
[   82.700444][ T6002] nvme nvme43: new ctrl: "testnqn"
[   82.749055][   T65] nvmet: Created nvm controller 43 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.750491][ T6003] nvme nvme24: creating 2 I/O queues.
[   82.752872][ T6011] nvme nvme22: Removing ctrl: NQN "testnqn"
[   82.766893][ T6003] nvme nvme24: new ctrl: "testnqn"
[   82.806639][ T5897] nvmet: Created nvm controller 44 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.808190][ T6003] nvme nvme44: creating 2 I/O queues.
[   82.819752][ T6003] nvme nvme44: new ctrl: "testnqn"
[   82.893174][ T6073] nvmet: Created nvm controller 45 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.894218][ T6004] nvme nvme45: creating 2 I/O queues.
[   82.898092][ T6004] nvme nvme45: new ctrl: "testnqn"
[   82.966513][ T6078] nvmet: Created nvm controller 46 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   82.970006][ T6005] nvme nvme46: creating 2 I/O queues.
[   82.971137][ T6005] nvme nvme46: new ctrl: "testnqn"
[   83.013485][ T6078] nvmet: Created nvm controller 47 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.017078][ T6005] nvme nvme47: creating 2 I/O queues.
[   83.033171][ T6005] nvme nvme47: new ctrl: "testnqn"
[   83.086497][ T6000] nvmet: Created nvm controller 48 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.102747][ T6002] nvme nvme48: creating 2 I/O queues.
[   83.106909][ T6002] nvme nvme48: new ctrl: "testnqn"
[   83.155601][ T5992] nvmet: Created nvm controller 49 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.159113][ T6002] nvme nvme49: creating 2 I/O queues.
[   83.175965][ T6002] nvme nvme49: new ctrl: "testnqn"
[   83.216365][ T5992] nvmet: Created nvm controller 50 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.218580][ T6003] nvme nvme50: creating 2 I/O queues.
[   83.236270][ T6003] nvme nvme50: new ctrl: "testnqn"
[   83.288338][ T6091] nvmet: Created nvm controller 51 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.299935][ T6003] nvme nvme51: creating 2 I/O queues.
[   83.313198][ T6003] nvme nvme51: new ctrl: "testnqn"
[   83.353955][ T6031] nvmet: Created nvm controller 52 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.354750][ T6004] nvme nvme52: creating 2 I/O queues.
[   83.360219][ T6004] nvme nvme52: new ctrl: "testnqn"
[   83.419858][ T5997] nvmet: Created nvm controller 53 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.421066][ T6004] nvme nvme53: creating 2 I/O queues.
[   83.438193][ T6004] nvme nvme53: new ctrl: "testnqn"
[   83.484768][ T6101] nvmet: Created nvm controller 30 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.485599][ T6005] nvme nvme54: creating 2 I/O queues.
[   83.490044][ T6005] nvme nvme54: new ctrl: "testnqn"
[   83.606088][ T6101] nvmet: Created nvm controller 54 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.607033][ T6002] nvme nvme55: creating 2 I/O queues.
[   83.618831][ T6002] nvme nvme55: new ctrl: "testnqn"
[   83.653312][ T6105] nvmet: Created nvm controller 55 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.654216][ T6003] nvme nvme30: creating 2 I/O queues.
[   83.659154][ T6003] nvme nvme30: new ctrl: "testnqn"
[   83.680787][ T6012] nvme nvme20: Removing ctrl: NQN "testnqn"
[   83.704726][ T5962] nvmet: Created nvm controller 39 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   83.705585][ T6004] nvme nvme56: creating 2 I/O queues.
[   83.707922][ T6004] nvme nvme56: new ctrl: "testnqn"
[   83.812336][ T6011] nvme nvme30: Removing ctrl: NQN "testnqn"
[   84.302744][ T6012] nvme nvme29: Removing ctrl: NQN "testnqn"
[   84.562322][ T6012] nvme nvme19: Removing ctrl: NQN "testnqn"
[   84.645421][ T6011] nvme nvme27: Removing ctrl: NQN "testnqn"
[   84.932347][ T6011] nvme nvme25: Removing ctrl: NQN "testnqn"
[   85.697136][ T6122] nvme nvme33: Removing ctrl: NQN "testnqn"
[   85.708919][ T6121] nvme nvme23: Removing ctrl: NQN "testnqn"
[   85.791191][ T6128] nvmet: Created nvm controller 7 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   85.795174][ T6112] nvme nvme19: creating 2 I/O queues.
[   85.797899][ T6112] nvme nvme19: new ctrl: "testnqn"
[   85.867437][ T5897] nvmet: Created nvm controller 12 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   85.873352][ T6112] nvme nvme20: creating 2 I/O queues.
[   85.886558][ T6112] nvme nvme20: new ctrl: "testnqn"
[   85.993928][ T6048] nvmet: Created nvm controller 17 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   85.997447][ T6113] nvme nvme22: creating 2 I/O queues.
[   85.998926][ T6113] nvme nvme22: new ctrl: "testnqn"
[   86.080628][ T1110] nvmet: Created nvm controller 19 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.089737][ T6113] nvme nvme25: creating 2 I/O queues.
[   86.095393][ T6113] nvme nvme25: new ctrl: "testnqn"
[   86.213852][ T5959] nvmet: Created nvm controller 27 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.216344][ T6115] nvme nvme27: creating 2 I/O queues.
[   86.220124][ T6115] nvme nvme27: new ctrl: "testnqn"
[   86.282563][ T1110] nvmet: Created nvm controller 14 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.289663][ T6115] nvme nvme29: creating 2 I/O queues.
[   86.308920][ T6115] nvme nvme29: new ctrl: "testnqn"
[   86.445245][ T5950] nvmet: Created nvm controller 32 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.449063][ T6116] nvme nvme30: creating 2 I/O queues.
[   86.503963][ T6116] nvme nvme30: new ctrl: "testnqn"
[   86.615144][ T6122] nvme nvme51: Removing ctrl: NQN "testnqn"
[   86.629304][ T6121] nvme nvme7: Removing ctrl: NQN "testnqn"
[   86.639553][ T6141] nvmet: Created nvm controller 55 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.649643][ T6116] nvme nvme23: creating 2 I/O queues.
[   86.657179][ T6116] nvme nvme23: new ctrl: "testnqn"
[   86.773600][ T6075] nvmet: Created nvm controller 56 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.793241][ T6112] nvme nvme33: creating 2 I/O queues.
[   86.798530][ T6112] nvme nvme33: new ctrl: "testnqn"
[   86.852423][ T6141] nvmet: Created nvm controller 57 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.854619][ T6113] nvme nvme57: creating 2 I/O queues.
[   86.856910][ T6113] nvme nvme57: new ctrl: "testnqn"
[   86.907514][ T6026] nvmet: Created nvm controller 58 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.909574][ T6113] nvme nvme58: creating 2 I/O queues.
[   86.927194][ T6113] nvme nvme58: new ctrl: "testnqn"
[   86.966421][ T6057] nvmet: Created nvm controller 59 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   86.968505][ T6115] nvme nvme59: creating 2 I/O queues.
[   86.969924][ T6115] nvme nvme59: new ctrl: "testnqn"
[   87.048333][ T6026] nvmet: Created nvm controller 60 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.049086][ T6115] nvme nvme60: creating 2 I/O queues.
[   87.062476][ T6115] nvme nvme60: new ctrl: "testnqn"
[   87.157095][ T6134] nvmet: Created nvm controller 61 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.167059][ T6116] nvme nvme61: creating 2 I/O queues.
[   87.178533][ T6116] nvme nvme61: new ctrl: "testnqn"
[   87.295582][ T5975] nvmet: Created nvm controller 10 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.310196][ T6112] nvme nvme62: creating 2 I/O queues.
[   87.328557][ T6112] nvme nvme62: new ctrl: "testnqn"
[   87.397870][ T5984] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.427942][ T6112] nvme nvme7: creating 2 I/O queues.
[   87.439796][ T6112] nvme nvme7: new ctrl: "testnqn"
[   87.463220][ T6121] nvme nvme13: Removing ctrl: NQN "testnqn"
[   87.582297][ T6042] nvmet: Created nvm controller 63 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.583416][ T6113] nvme nvme63: creating 2 I/O queues.
[   87.601117][ T6113] nvme nvme63: new ctrl: "testnqn"
[   87.724735][ T6161] nvmet: Created nvm controller 51 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.728654][ T6113] nvme nvme64: creating 2 I/O queues.
[   87.732418][ T6122] nvme nvme7: Removing ctrl: NQN "testnqn"
[   87.752568][ T6113] nvme nvme64: new ctrl: "testnqn"
[   87.821499][ T6162] nvmet: Created nvm controller 64 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.826114][ T6115] nvme nvme51: creating 2 I/O queues.
[   87.839707][ T6115] nvme nvme51: new ctrl: "testnqn"
[   87.990924][ T6105] nvmet: Created nvm controller 26 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.999047][ T6116] nvme nvme65: creating 2 I/O queues.
[   88.010791][ T6116] nvme nvme65: new ctrl: "testnqn"
[   88.066999][ T5956] nvmet: Created nvm controller 65 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.091174][ T6112] nvme nvme66: creating 2 I/O queues.
[   88.115101][ T6112] nvme nvme66: new ctrl: "testnqn"
[   88.163892][ T6121] nvme nvme41: Removing ctrl: NQN "testnqn"
[   88.189659][ T1116] nvmet: Created nvm controller 66 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.191447][ T6113] nvme nvme13: creating 2 I/O queues.
[   88.202699][ T6113] nvme nvme13: new ctrl: "testnqn"
[   88.250633][ T6168] nvmet: Created nvm controller 67 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.262441][ T6115] nvme nvme67: creating 2 I/O queues.
[   88.266809][ T6115] nvme nvme67: new ctrl: "testnqn"
[   88.349986][ T6038] nvmet: Created nvm controller 68 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.350850][ T6115] nvme nvme68: creating 2 I/O queues.
[   88.368777][ T6115] nvme nvme68: new ctrl: "testnqn"
[   88.502578][ T5941] nvmet: Created nvm controller 69 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.513810][ T6116] nvme nvme69: creating 2 I/O queues.
[   88.525120][ T6116] nvme nvme69: new ctrl: "testnqn"
[   88.596094][ T6183] nvmet: Created nvm controller 70 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.598983][ T6116] nvme nvme70: creating 2 I/O queues.
[   88.617012][ T6116] nvme nvme70: new ctrl: "testnqn"
[   88.690383][ T6126] nvmet: Created nvm controller 71 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.710156][ T6112] nvme nvme71: creating 2 I/O queues.
[   88.719136][ T6112] nvme nvme71: new ctrl: "testnqn"
[   88.759685][ T5950] nvmet: Created nvm controller 72 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.767794][ T6113] nvme nvme72: creating 2 I/O queues.
[   88.777684][ T6113] nvme nvme72: new ctrl: "testnqn"
[   88.824681][ T5950] nvmet: Created nvm controller 73 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.829130][ T6115] nvme nvme73: creating 2 I/O queues.
[   88.844939][ T6115] nvme nvme73: new ctrl: "testnqn"
[   88.888344][ T5965] nvmet: Created nvm controller 74 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.890386][ T6116] nvme nvme74: creating 2 I/O queues.
[   88.917082][ T6116] nvme nvme74: new ctrl: "testnqn"
[   88.955970][ T6152] nvmet: Created nvm controller 75 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.956944][ T6116] nvme nvme75: creating 2 I/O queues.
[   88.959557][ T6116] nvme nvme75: new ctrl: "testnqn"
[   89.061741][ T6159] nvmet: Created nvm controller 41 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.062588][ T6112] nvme nvme76: creating 2 I/O queues.
[   89.086138][ T6112] nvme nvme76: new ctrl: "testnqn"
[   89.120679][   T65] nvmet: Created nvm controller 76 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.138631][ T6112] nvme nvme77: creating 2 I/O queues.
[   89.156592][ T6112] nvme nvme77: new ctrl: "testnqn"
[   89.247592][ T6125] nvmet: Created nvm controller 77 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.254216][ T6113] nvme nvme78: creating 2 I/O queues.
[   89.268126][ T6113] nvme nvme78: new ctrl: "testnqn"
[   89.293125][ T6121] nvme nvme31: Removing ctrl: NQN "testnqn"
[   89.340402][ T5910] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.361045][ T6113] nvme nvme41: creating 2 I/O queues.
[   89.368355][ T6113] nvme nvme41: new ctrl: "testnqn"
[   89.469158][ T6037] nvmet: Created nvm controller 78 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.477066][ T6115] nvme nvme79: creating 2 I/O queues.
[   89.484310][ T6115] nvme nvme79: new ctrl: "testnqn"
[   89.499551][ T6122] nvme nvme13: Removing ctrl: NQN "testnqn"
[   89.611391][ T6180] nvmet: Created nvm controller 79 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.641683][ T6115] nvme nvme7: creating 2 I/O queues.
[   89.644360][ T6115] nvme nvme7: new ctrl: "testnqn"
[   89.780735][ T5989] nvmet: Created nvm controller 80 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.788390][ T6116] nvme nvme80: creating 2 I/O queues.
[   89.797248][ T6116] nvme nvme80: new ctrl: "testnqn"
[   89.923073][ T5973] nvmet: Created nvm controller 66 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.928504][ T6116] nvme nvme81: creating 2 I/O queues.
[   89.960084][ T6116] nvme nvme81: new ctrl: "testnqn"
[   90.084654][ T6071] nvmet: Created nvm controller 81 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.091613][ T6112] nvme nvme82: creating 2 I/O queues.
[   90.100535][ T6122] nvme nvme41: Removing ctrl: NQN "testnqn"
[   90.100686][ T6112] nvme nvme82: new ctrl: "testnqn"
[   90.223870][ T6134] nvmet: Created nvm controller 82 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.224627][ T6112] nvme nvme13: creating 2 I/O queues.
[   90.229535][ T6112] nvme nvme13: new ctrl: "testnqn"
[   90.337233][ T6083] nvmet: Created nvm controller 83 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.340558][ T6113] nvme nvme83: creating 2 I/O queues.
[   90.364072][ T6113] nvme nvme83: new ctrl: "testnqn"
[   90.443360][ T1033] nvmet: Created nvm controller 31 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.448645][ T6113] nvme nvme84: creating 2 I/O queues.
[   90.457492][ T6113] nvme nvme84: new ctrl: "testnqn"
[   90.596375][ T5950] nvmet: Created nvm controller 84 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.605977][ T6115] nvme nvme85: creating 2 I/O queues.
[   90.615959][ T6115] nvme nvme85: new ctrl: "testnqn"
[   90.660964][ T6121] nvme nvme21: Removing ctrl: NQN "testnqn"
[   90.674931][ T6124] nvmet: Created nvm controller 85 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.684213][ T6116] nvme nvme31: creating 2 I/O queues.
[   90.715431][ T6116] nvme nvme31: new ctrl: "testnqn"
[   90.769688][ T6243] nvmet: Created nvm controller 86 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.770845][ T6112] nvme nvme86: creating 2 I/O queues.
[   90.778093][ T6112] nvme nvme86: new ctrl: "testnqn"
[   90.818886][ T6162] nvmet: Created nvm controller 87 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.819804][ T6113] nvme nvme87: creating 2 I/O queues.
[   90.826178][ T6113] nvme nvme87: new ctrl: "testnqn"
[   90.861135][ T5982] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.863309][ T6115] nvme nvme88: creating 2 I/O queues.
[   90.870541][ T6115] nvme nvme88: new ctrl: "testnqn"
[   90.962433][ T6122] nvme nvme31: Removing ctrl: NQN "testnqn"
[   91.802417][ T6121] nvme nvme5: Removing ctrl: NQN "testnqn"
[   92.122915][ T6122] nvme nvme11: Removing ctrl: NQN "testnqn"
[   92.473738][ T6122] nvme nvme48: Removing ctrl: NQN "testnqn"
[   92.812620][ T6121] nvme nvme3: Removing ctrl: NQN "testnqn"
[   92.822807][ T6122] nvme nvme38: Removing ctrl: NQN "testnqn"
[   93.003821][ T6121] nvme nvme28: Removing ctrl: NQN "testnqn"
[   93.062772][ T6122] nvme nvme56: Removing ctrl: NQN "testnqn"
[   93.263057][ T6122] nvme nvme18: Removing ctrl: NQN "testnqn"
[   93.263449][ T6121] nvme nvme46: Removing ctrl: NQN "testnqn"
[   93.503664][ T6121] nvme nvme1: Removing ctrl: NQN "testnqn"
[   93.533174][ T6122] nvme nvme36: Removing ctrl: NQN "testnqn"
[   93.729925][ T6121] nvme nvme26: Removing ctrl: NQN "testnqn"
[   93.762869][ T6122] nvme nvme54: Removing ctrl: NQN "testnqn"
[   93.972341][ T6122] nvme nvme16: Removing ctrl: NQN "testnqn"
[   93.983004][ T6121] nvme nvme44: Removing ctrl: NQN "testnqn"
[   94.204124][ T6122] nvme nvme34: Removing ctrl: NQN "testnqn"
[   94.262458][ T6121] nvme nvme24: Removing ctrl: NQN "testnqn"
[   94.412433][ T6122] nvme nvme52: Removing ctrl: NQN "testnqn"
[   94.512638][ T6121] nvme nvme8: Removing ctrl: NQN "testnqn"
[   94.662475][ T6122] nvme nvme14: Removing ctrl: NQN "testnqn"
[   94.732592][ T6121] nvme nvme42: Removing ctrl: NQN "testnqn"
[   94.902583][ T6122] nvme nvme32: Removing ctrl: NQN "testnqn"
[   94.982572][ T6121] nvme nvme50: Removing ctrl: NQN "testnqn"
[   95.114595][ T6122] nvme nvme6: Removing ctrl: NQN "testnqn"
[   95.192904][ T6121] nvme nvme12: Removing ctrl: NQN "testnqn"
[   95.363173][ T6122] nvme nvme40: Removing ctrl: NQN "testnqn"
[   95.442892][ T6121] nvme nvme49: Removing ctrl: NQN "testnqn"
[   95.623510][ T6122] nvme nvme4: Removing ctrl: NQN "testnqn"
[   95.674939][ T6121] nvme nvme10: Removing ctrl: NQN "testnqn"
[   95.852979][ T6122] nvme nvme39: Removing ctrl: NQN "testnqn"
[   95.913144][ T6121] nvme nvme47: Removing ctrl: NQN "testnqn"
[   96.082525][ T6122] nvme nvme2: Removing ctrl: NQN "testnqn"
[   96.163055][ T6121] nvme nvme37: Removing ctrl: NQN "testnqn"
[   96.342743][ T6122] nvme nvme55: Removing ctrl: NQN "testnqn"
[   96.414745][ T6121] nvme nvme17: Removing ctrl: NQN "testnqn"
[   96.562488][ T6122] nvme nvme45: Removing ctrl: NQN "testnqn"
[   96.662435][ T6121] nvme nvme35: Removing ctrl: NQN "testnqn"
[   96.832576][ T6122] nvme nvme53: Removing ctrl: NQN "testnqn"
[   96.903430][ T6121] nvme nvme9: Removing ctrl: NQN "testnqn"
[   97.082596][ T6122] nvme nvme15: Removing ctrl: NQN "testnqn"
[   97.142733][ T6121] nvme nvme43: Removing ctrl: NQN "testnqn"
[*] Cleaning up...
[   97.423653][   T34] audit: type=1400 audit(1790188270.109:271): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="/" dev="configfs" ino=1091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423691][   T34] audit: type=1400 audit(1790188270.109:272): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="nvmet" dev="configfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423774][   T34] audit: type=1400 audit(1790188270.109:273): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="ports" dev="configfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423850][   T34] audit: type=1400 audit(1790188270.109:274): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="1" dev="configfs" ino=7740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423964][   T34] audit: type=1400 audit(1790188270.109:275): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="subsystems" dev="configfs" ino=7741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.425869][   T34] audit: type=1400 audit(1790188270.109:276): avc:  denied  { write search } for  pid=5864 comm="syz-executor994" name="subsystems" dev="configfs" ino=7741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.426281][   T34] audit: type=1400 audit(1790188270.109:277): avc:  denied  { remove_name } for  pid=5864 comm="syz-executor994" name="testnqn" dev="configfs" ino=7746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.427172][   T34] audit: type=1400 audit(1790188270.109:278): avc:  denied  { unlink } for  pid=5864 comm="syz-executor994" name="testnqn" dev="configfs" ino=7746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   97.429551][ T6000] nvme nvme19: Removing ctrl: NQN "testnqn"
[   97.434179][   T29] nvme nvme20: Removing ctrl: NQN "testnqn"
[   97.439608][ T6164] nvme nvme25: Removing ctrl: NQN "testnqn"
[   97.442994][ T6149] nvme nvme22: Removing ctrl: NQN "testnqn"
[   97.443084][ T6047] nvme nvme27: Removing ctrl: NQN "testnqn"
[   97.450813][ T1117] nvme nvme29: Removing ctrl: NQN "testnqn"
[   97.455714][ T1126] nvme nvme30: Removing ctrl: NQN "testnqn"
[   97.455808][ T5960] nvme nvme23: Removing ctrl: NQN "testnqn"
[   97.455865][ T5970] nvme nvme33: Removing ctrl: NQN "testnqn"
[   97.456017][ T6059] nvme nvme58: Removing ctrl: NQN "testnqn"
[   97.456068][ T6044] nvme nvme59: Removing ctrl: NQN "testnqn"
[   97.456116][ T6153] nvme nvme60: Removing ctrl: NQN "testnqn"
[   97.458852][ T5959] nvme nvme57: Removing ctrl: NQN "testnqn"
[   97.458962][ T6190] nvme nvme61: Removing ctrl: NQN "testnqn"
[   97.463523][ T6048] nvme nvme62: Removing ctrl: NQN "testnqn"
[   97.463853][ T1110] nvme nvme63: Removing ctrl: NQN "testnqn"
[   97.464181][ T1122] nvme nvme64: Removing ctrl: NQN "testnqn"
[   97.464244][ T5962] nvme nvme51: Removing ctrl: NQN "testnqn"
[   97.464300][ T1113] nvme nvme65: Removing ctrl: NQN "testnqn"
[   97.464509][ T6156] nvme nvme66: Removing ctrl: NQN "testnqn"
[   97.472508][ T5965] nvme nvme67: Removing ctrl: NQN "testnqn"
[   97.476129][ T6026] nvme nvme68: Removing ctrl: NQN "testnqn"
[   97.481749][ T6182] nvme nvme69: Removing ctrl: NQN "testnqn"
[   97.489334][ T6188] nvme nvme70: Removing ctrl: NQN "testnqn"
[   97.498375][ T6165] nvme nvme71: Removing ctrl: NQN "testnqn"
[   97.500421][ T6181] nvme nvme72: Removing ctrl: NQN "testnqn"
[   97.502399][ T1046] nvme nvme73: Removing ctrl: NQN "testnqn"
[   97.504574][ T6192] nvme nvme74: Removing ctrl: NQN "testnqn"
[   97.506522][ T6168] nvme nvme75: Removing ctrl: NQN "testnqn"
[   97.508478][ T6183] nvme nvme76: Removing ctrl: NQN "testnqn"
[   97.511372][ T6148] nvme nvme77: Removing ctrl: NQN "testnqn"
[   97.521398][ T6077] nvme nvme78: Removing ctrl: NQN "testnqn"
[   97.524281][ T6173] nvme nvme79: Removing ctrl: NQN "testnqn"
[   97.526259][ T6046] nvme nvme7: Removing ctrl: NQN "testnqn"
[   97.531409][ T5973] nvme nvme80: Removing ctrl: NQN "testnqn"
[   97.541458][ T6034] nvme nvme81: Removing ctrl: NQN "testnqn"
[   97.546247][ T6040] nvme nvme82: Removing ctrl: NQN "testnqn"
[   97.549978][ T5968] nvme nvme13: Removing ctrl: NQN "testnqn"
[   97.551996][ T6057] nvme nvme83: Removing ctrl: NQN "testnqn"
[   97.553987][ T6045] nvme nvme84: Removing ctrl: NQN "testnqn"
[   97.561511][ T1116] nvme nvme85: Removing ctrl: NQN "testnqn"
[   97.562314][ T6049] nvme nvme86: Removing ctrl: NQN "testnqn"
[   97.564080][ T6140] nvme nvme87: Removing ctrl: NQN "testnqn"
[   97.565860][ T5946] nvme nvme88: Removing ctrl: NQN "testnqn"
[   98.585017][  T137] nvme nvme87: long keepalive RTT (4294768766 ms)
[   98.585105][  T137] nvme nvme87: failed nvme_keep_alive_end_io error=4
[   98.617439][ T6201] nvme nvme68: long keepalive RTT (4294768796 ms)
[   98.641489][ T6201] nvme nvme68: failed nvme_keep_alive_end_io error=4
[   99.555808][   T34] audit: type=1400 audit(1790188272.239:279): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="/" dev="configfs" ino=1091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   99.555848][   T34] audit: type=1400 audit(1790188272.239:280): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="nvmet" dev="configfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
 OtherCrashReports:<nil> StraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor2506831965

<...>
nfinished ...>
[pid  6117] <... openat resumed>)       = 17
[pid  6116] <... close resumed>)        = 0
[pid  6113] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(17, "1", 1 <unfinished ...>
[pid  6120] close(4 <unfinished ...>
[pid  6119] close(5 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6113] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(17 <unfinished ...>
[pid  6113] <... openat resumed>)       = 4
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme1/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 5
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme52/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 10
[pid  6117] <... openat resumed>)       = 12
[pid  6113] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(5)                    = 0
[pid  6119] write(10, "1", 1 <unfinished ...>
[pid  6117] write(12, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme36/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 5
[pid  6119] close(10 <unfinished ...>
[pid  6117] close(12 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme8/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 12
[pid  6117] <... openat resumed>)       = 10
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] write(12, "1", 1 <unfinished ...>
[pid  6117] write(10, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6119] close(12 <unfinished ...>
[pid  6117] close(10 <unfinished ...>
[pid  6120] close(5 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 17
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme26/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 5
[pid  6119] <... openat resumed>)       = 10
[pid  6117] <... openat resumed>)       = 12
[pid  6116] write(17, "1", 1 <unfinished ...>
[pid  6119] write(10, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6117] write(12, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6112] <... write resumed>)        = 26
[pid  6123] close(9 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] close(17 <unfinished ...>
[pid  6112] close(18 <unfinished ...>
[pid  6123] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(12 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6112] <... close resumed>)        = 0
[pid  6120] close(5 <unfinished ...>
[pid  6119] close(10 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme11/delete_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6112] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[   94.885907][ T5936] nvmet: Created nvm controller 60 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   94.886706][ T6112] nvme nvme5: creating 2 I/O queues.
[   94.887838][ T6112] nvme nvme5: new ctrl: "testnqn"
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6123] <... openat resumed>)       = 12
[pid  6119] getdents64(6 <unfinished ...>
[pid  6117] <... openat resumed>)       = 5
[pid  6116] <... openat resumed>)       = 9
[pid  6112] <... openat resumed>)       = 10
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme54/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... getdents64 resumed>, 0x7f17d0000ba0 /* 0 entries */, 32768) = 0
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 17
[pid  6119] close(6 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(5 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 5
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[pid  6123] write(12, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 6
[pid  6116] write(9, "1", 1 <unfinished ...>
[pid  6112] write(10, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6122] close(14 <unfinished ...>
[pid  6120] close(17 <unfinished ...>
[pid  6119] fstat(5 <unfinished ...>
[pid  6117] write(6, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... fstat resumed>, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  6117] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme16/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] getdents64(5 <unfinished ...>
[pid  6117] close(6 <unfinished ...>
[pid  6120] <... openat resumed>)       = 6
[pid  6119] <... getdents64 resumed>, 0x7f17d0000ba0 /* 62 entries */, 32768) = 1968
[pid  6117] <... close resumed>)        = 0
[pid  6120] write(6, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme33/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6122] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 17
[pid  6117] <... openat resumed>)       = 14
[pid  6116] close(9 <unfinished ...>
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme5/delete_controller", O_WRONLY <unfinished ...>
[pid  6120] close(6)                    = 0
[pid  6116] <... close resumed>)        = 0
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme44/rescan_controller", O_WRONLY <unfinished ...>
[pid  6122] <... openat resumed>)       = 6
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[   94.903725][ T6123] nvme nvme11: Removing ctrl: NQN "testnqn"
[   94.908860][ T6122] nvme nvme5: Removing ctrl: NQN "testnqn"
[pid  6122] write(6, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 9
[pid  6119] write(17, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 18
[pid  6117] close(14 <unfinished ...>
[pid  6116] write(18, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY) = 14
[pid  6116] close(18 <unfinished ...>
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(9 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] close(17 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 18
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(14)                   = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme34/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme61/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 9
[pid  6116] write(18, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 14
[pid  6117] <... openat resumed>)       = 17
[pid  6116] <... write resumed>)        = 1
[pid  6116] close(18 <unfinished ...>
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6117] write(17, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(9 <unfinished ...>
[pid  6119] write(14, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 18
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(14)                   = 0
[pid  6116] write(18, "1", 1 <unfinished ...>
[pid  6117] close(17 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme23/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(18 <unfinished ...>
[pid  6119] <... openat resumed>)       = 14
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme24/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 17
[pid  6117] <... openat resumed>)       = 9
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(14, "1", 1)           = 1
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] close(14 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(9 <unfinished ...>
[pid  6120] close(17 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme51/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 9
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme52/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 17
[pid  6116] <... openat resumed>)       = 14
[pid  6120] <... openat resumed>)       = 18
[pid  6117] write(17, "1", 1)           = 1
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] write(9, "1", 1 <unfinished ...>
[pid  6117] close(17 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(14 <unfinished ...>
[pid  6120] close(18 <unfinished ...>
[pid  6119] close(9 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 14
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme8/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme7/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 17
[pid  6119] <... openat resumed>)       = 9
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 18
[pid  6117] close(14 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[   94.937353][ T6043] nvmet: Created nvm controller 61 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[pid  6116] write(18, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(9, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[   94.948074][ T6115] nvme nvme21: creating 2 I/O queues.
[pid  6120] close(17 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 14
[pid  6116] close(18 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] close(9 <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 9
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme13/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(14 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY <unfinished ...>
[pid  6115] <... write resumed>)        = 26
[pid  6119] <... openat resumed>)       = 14
[pid  6117] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 17
[pid  6117] <... openat resumed>)       = 18
[pid  6115] close(13 <unfinished ...>
[pid  6119] write(14, "1", 1 <unfinished ...>
[pid  6115] <... close resumed>)        = 0
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] write(17, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[   94.957064][ T6115] nvme nvme21: new ctrl: "testnqn"
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6115] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] close(9 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6119] close(14 <unfinished ...>
[pid  6116] close(17 <unfinished ...>
[pid  6115] <... openat resumed>)       = 9
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(18 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 13
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme41/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY <unfinished ...>
[pid  6115] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 14
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 17
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(14, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 18
[pid  6120] close(13)                   = 0
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] write(17, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 13
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(18 <unfinished ...>
[pid  6116] close(17 <unfinished ...>
[pid  6119] close(14 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme31/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 17
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 14
[pid  6120] close(13 <unfinished ...>
[pid  6119] write(17, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 18
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(17 <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[pid  6119] <... close resumed>)        = 0
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme5/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 17
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] close(18 <unfinished ...>
[pid  6116] close(14 <unfinished ...>
[pid  6120] close(13 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 14
[pid  6116] <... openat resumed>)       = 13
[pid  6120] <... openat resumed>)       = 18
[pid  6117] write(14, "1", 1)           = 1
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6117] close(14 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(13 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(17, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] close(18 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] close(17 <unfinished ...>
[pid  6117] <... openat resumed>)       = 14
[pid  6116] <... openat resumed>)       = 13
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 17
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme11/rescan_controller", O_WRONLY) = 18
[pid  6117] write(14, "1", 1)           = 1
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6117] close(14 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(13 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 13
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(17 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 14
[pid  6120] <... close resumed>)        = 0
[pid  6117] write(13, "1", 1 <unfinished ...>
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 17
[pid  6119] close(18 <unfinished ...>
[pid  6117] close(13 <unfinished ...>
[pid  6116] close(14 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 14
[pid  6116] <... openat resumed>)       = 13
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme58/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(17)                   = 0
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 17
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6117] close(14 <unfinished ...>
[   94.991060][ T6212] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   94.991892][ T6111] nvme nvme62: creating 2 I/O queues.
[pid  6116] close(13 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 13
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 14
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY <unfinished ...>
[   95.002376][ T6111] nvme nvme62: new ctrl: "testnqn"
[pid  6120] close(17 <unfinished ...>
[pid  6116] <... openat resumed>)       = 18
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6111] <... write resumed>)        = 26
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 17
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(14 <unfinished ...>
[pid  6116] write(18, "1", 1 <unfinished ...>
[pid  6111] close(7 <unfinished ...>
[pid  6119] close(13)                   = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6111] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme48/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(18 <unfinished ...>
[pid  6111] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6119] <... openat resumed>)       = 7
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 13
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(7 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 7
[pid  6111] <... openat resumed>)       = 14
[pid  6120] close(17 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme3/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(13, "1", 1 <unfinished ...>
[pid  6116] write(7, "1", 1 <unfinished ...>
[pid  6111] write(14, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 18
[pid  6117] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6117] close(13 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 17
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(7 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(18 <unfinished ...>
[pid  6120] close(17 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme38/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 7
[pid  6116] <... openat resumed>)       = 13
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 17
[pid  6117] write(7, "1", 1 <unfinished ...>
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 18
[pid  6119] write(17, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6117] close(7 <unfinished ...>
[pid  6116] close(13 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6119] close(17 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] close(18)                   = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 7
[pid  6116] <... openat resumed>)       = 13
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme28/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 17
[pid  6119] <... openat resumed>)       = 18
[pid  6117] write(7, "1", 1 <unfinished ...>
[pid  6116] write(13, "1", 1)           = 1
[pid  6116] close(13 <unfinished ...>
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6117] close(7 <unfinished ...>
[pid  6119] close(18 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 7
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme56/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(7, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 13
[pid  6117] <... openat resumed>)       = 18
[pid  6116] close(7 <unfinished ...>
[pid  6120] close(17)                   = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY) = 17
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(13 <unfinished ...>
[pid  6117] close(18 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(17 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 7
[pid  6120] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme18/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(7, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 13
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 17
[pid  6116] close(7 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 7
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(17)                   = 0
[pid  6117] write(7, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 17
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6120] <... openat resumed>)       = 18
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(7 <unfinished ...>
[pid  6116] write(17, "1", 1 <unfinished ...>
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme46/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 7
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(18 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 13
[pid  6116] close(17 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(13, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] close(7 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY) = 17
[pid  6116] <... openat resumed>)       = 18
[pid  6116] write(18, "1", 1 <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6116] close(18 <unfinished ...>
[pid  6120] close(17 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY) = 17
[pid  6116] <... openat resumed>)       = 18
[   95.059829][ T5973] nvmet: Created nvm controller 63 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.061016][ T6113] nvme nvme63: creating 2 I/O queues.
[pid  6120] write(17, "1", 1)           = 1
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(13 <unfinished ...>
[pid  6116] write(18, "1", 1 <unfinished ...>
[pid  6120] close(17 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6116] close(18 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 7
[   95.069806][ T6113] nvme nvme63: new ctrl: "testnqn"
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY) = 17
[pid  6120] write(7, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme1/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6113] <... write resumed>)        = 26
[pid  6119] <... openat resumed>)       = 13
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY <unfinished ...>
[pid  6113] close(4 <unfinished ...>
[pid  6117] <... openat resumed>)       = 18
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(18 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(13 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] write(17, "1", 1 <unfinished ...>
[pid  6113] <... close resumed>)        = 0
[pid  6120] close(7 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme36/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 4
[pid  6116] <... write resumed>)        = 1
[pid  6113] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 7
[pid  6117] write(4, "1", 1)            = 1
[pid  6117] close(4)                    = 0
[pid  6113] <... openat resumed>)       = 4
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[pid  6117] <... openat resumed>)       = 18
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6116] close(17 <unfinished ...>
[pid  6113] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(13 <unfinished ...>
[pid  6119] close(7)                    = 0
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme26/rescan_controller", O_WRONLY) = 7
[pid  6117] close(18)                   = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 13
[pid  6120] <... openat resumed>)       = 17
[pid  6117] <... openat resumed>)       = 18
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(7)                    = 0
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme54/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 7
[pid  6117] close(18)                   = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 18
[pid  6120] close(17 <unfinished ...>
[pid  6119] close(7 <unfinished ...>
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 17
[pid  6117] <... write resumed>)        = 1
[pid  6116] close(13 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme16/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(18 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(17, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 7
[pid  6117] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 13
[   95.108987][ T6059] nvmet: Created nvm controller 64 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 18
[pid  6119] close(7)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme44/rescan_controller", O_WRONLY) = 7
[   95.110008][ T6112] nvme nvme64: creating 2 I/O queues.
[   95.120374][ T6112] nvme nvme64: new ctrl: "testnqn"
[pid  6117] write(18, "1", 1)           = 1
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6112] <... write resumed>)        = 26
[pid  6116] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6116] close(13 <unfinished ...>
[pid  6112] close(10 <unfinished ...>
[pid  6117] close(18)                   = 0
[pid  6116] <... close resumed>)        = 0
[pid  6112] <... close resumed>)        = 0
[pid  6120] close(17 <unfinished ...>
[pid  6119] close(7 <unfinished ...>
[pid  6117] getdents64(11 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... getdents64 resumed>, 0x7f17c8000ba0 /* 0 entries */, 32768) = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme34/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(11 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 7
[pid  6117] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY <unfinished ...>
[pid  6112] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  6116] <... openat resumed>)       = 10
[pid  6120] <... openat resumed>)       = 11
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6112] <... openat resumed>)       = 13
[pid  6112] write(13, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6117] <... openat resumed>)       = 17
[pid  6116] write(10, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6117] fstat(17 <unfinished ...>
[pid  6116] close(10 <unfinished ...>
[pid  6117] <... fstat resumed>, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6119] close(7 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6117] getdents64(17 <unfinished ...>
[pid  6116] <... openat resumed>)       = 10
[pid  6120] close(11 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme24/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... getdents64 resumed>, 0x7f17c8000ba0 /* 66 entries */, 32768) = 2096
[pid  6116] write(10, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 7
[pid  6120] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6116] close(10 <unfinished ...>
[pid  6120] <... openat resumed>)       = 11
[pid  6119] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme33/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] close(7 <unfinished ...>
[pid  6117] <... openat resumed>)       = 10
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(10, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY) = 7
[pid  6116] write(7, "1", 1)            = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme52/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(7 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 18
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] close(11 <unfinished ...>
[pid  6117] close(10 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme61/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 10
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 11
[pid  6116] <... openat resumed>)       = 7
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(18)                   = 0
[pid  6116] write(7, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme8/rescan_controller", O_WRONLY) = 18
[pid  6117] write(11, "1", 1)           = 1
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6117] close(11 <unfinished ...>
[pid  6120] write(10, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(18 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme23/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(7 <unfinished ...>
[pid  6120] close(10 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 11
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 10
[pid  6116] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 7
[pid  6117] write(11, "1", 1 <unfinished ...>
[pid  6116] getdents64(3 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6120] write(10, "1", 1 <unfinished ...>
[pid  6117] close(11 <unfinished ...>
[pid  6116] <... getdents64 resumed>, 0x7f17d4000ba0 /* 0 entries */, 32768) = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] close(10 <unfinished ...>
[pid  6116] close(3 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme51/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 3
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  6119] close(7 <unfinished ...>
[pid  6120] <... openat resumed>)       = 11
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 10
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6116] fstat(10 <unfinished ...>
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... fstat resumed>, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 7
[pid  6117] close(3)                    = 0
[pid  6116] getdents64(10 <unfinished ...>
[pid  6120] close(11 <unfinished ...>
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme7/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... getdents64 resumed>, 0x7f17d4000ba0 /* 67 entries */, 32768) = 2128
[pid  6117] <... openat resumed>)       = 3
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(7 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme33/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 18
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 11
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 7
[pid  6117] <... write resumed>)        = 1
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6119] write(7, "1", 1 <unfinished ...>
[pid  6117] close(3)                    = 0
[pid  6116] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme13/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 3
[pid  6119] close(7 <unfinished ...>
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme60/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 7
[pid  6117] <... write resumed>)        = 1
[pid  6120] close(18 <unfinished ...>
[pid  6117] close(3 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme41/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 18
[pid  6117] <... openat resumed>)       = 3
[   95.155154][ T6060] nvmet: Created nvm controller 65 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[pid  6119] write(7, "1", 1)            = 1
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(7 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6120] close(18 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(3 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme31/rescan_controller", O_WRONLY <unfinished ...>
[   95.156112][ T6115] nvme nvme65: creating 2 I/O queues.
[pid  6116] close(11 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6117] <... openat resumed>)       = 7
[pid  6120] <... openat resumed>)       = 18
[pid  6117] write(7, "1", 1 <unfinished ...>
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] close(7 <unfinished ...>
[pid  6120] close(18 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[   95.160514][ T6115] nvme nvme65: new ctrl: "testnqn"
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme21/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 7
[pid  6120] <... openat resumed>)       = 18
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6115] <... write resumed>)        = 26
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY) = 3
[pid  6117] write(7, "1", 1)            = 1
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] close(7 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme61/rescan_controller", O_WRONLY <unfinished ...>
[pid  6115] close(9 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme5/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 7
[pid  6115] <... close resumed>)        = 0
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6117] <... openat resumed>)       = 9
[pid  6115] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6120] close(18 <unfinished ...>
[pid  6116] write(7, "1", 1 <unfinished ...>
[pid  6115] <... openat resumed>)       = 3
[pid  6120] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6120] getdents64(15 <unfinished ...>
[pid  6119] <... openat resumed>)       = 11
[pid  6116] <... write resumed>)        = 1
[pid  6115] write(3, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] <... getdents64 resumed>, 0x7f17d8000ba0 /* 0 entries */, 32768) = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] close(7 <unfinished ...>
[pid  6120] close(15 <unfinished ...>
[pid  6117] close(9 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] write(11, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme23/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme11/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(11 <unfinished ...>
[pid  6120] <... openat resumed>)       = 7
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 11
[pid  6116] <... openat resumed>)       = 9
[pid  6120] fstat(7 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(11, "1", 1 <unfinished ...>
[pid  6116] write(9, "1", 1 <unfinished ...>
[pid  6120] <... fstat resumed>, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] getdents64(7 <unfinished ...>
[pid  6117] close(11 <unfinished ...>
[pid  6120] <... getdents64 resumed>, 0x7f17d8000ba0 /* 67 entries */, 32768) = 2128
[pid  6119] <... openat resumed>)       = 15
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(9 <unfinished ...>
[pid  6119] write(15, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(15)                   = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY) = 9
[pid  6119] write(9, "1", 1)            = 1
[pid  6119] close(9)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY) = 9
[pid  6119] write(9, "1", 1)            = 1
[pid  6119] close(9)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme59/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme33/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 9
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme58/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme51/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(9, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 15
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 18
[pid  6116] <... openat resumed>)       = 11
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(15 <unfinished ...>
[pid  6119] close(9 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(18 <unfinished ...>
[pid  6116] close(11 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme61/rescan_controller", O_WRONLY) = 9
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme48/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme7/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 11
[pid  6120] close(9 <unfinished ...>
[pid  6119] write(11, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 18
[pid  6116] <... openat resumed>)       = 15
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] write(15, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme23/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(11 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 9
[pid  6116] close(15 <unfinished ...>
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(18 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme13/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(9 <unfinished ...>
[pid  6119] <... openat resumed>)       = 11
[pid  6116] <... openat resumed>)       = 15
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(11, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme3/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(15, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme51/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 9
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 18
[pid  6116] close(15 <unfinished ...>
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme41/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(18 <unfinished ...>
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 15
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] write(15, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme7/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(9 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 18
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(15 <unfinished ...>
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme38/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme31/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(18 <unfinished ...>
[pid  6119] close(11 <unfinished ...>
[pid  6117] <... openat resumed>)       = 9
[pid  6116] <... openat resumed>)       = 15
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme13/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 11
[pid  6116] write(15, "1", 1 <unfinished ...>
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6116] close(15 <unfinished ...>
[pid  6120] close(11 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 18
[pid  6117] close(9 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme21/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme41/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 11
[pid  6120] <... openat resumed>)       = 9
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme28/rescan_controller", O_WRONLY) = 15
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(15, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] close(9 <unfinished ...>
[pid  6116] close(11 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6117] close(15 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme5/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme31/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 9
[pid  6120] <... openat resumed>)       = 11
[pid  6119] close(18 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme56/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 15
[pid  6116] write(9, "1", 1 <unfinished ...>
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] write(15, "1", 1 <unfinished ...>
[pid  6116] close(9 <unfinished ...>
[pid  6120] close(11 <unfinished ...>
[pid  6119] <... openat resumed>)       = 18
[pid  6117] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6117] close(15 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme21/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme11/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 9
[pid  6119] close(18)                   = 0
[   95.225625][ T6059] nvmet: Created nvm controller 66 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.229030][ T6111] nvme nvme66: creating 2 I/O queues.
[   95.232212][ T6111] nvme nvme66: new ctrl: "testnqn"
[pid  6116] <... openat resumed>)       = 11
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme18/rescan_controller", O_WRONLY <unfinished ...>
[pid  6111] <... write resumed>)        = 26
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 15
[pid  6117] <... openat resumed>)       = 18
[pid  6120] close(9)                    = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme5/rescan_controller", O_WRONLY) = 9
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6119] write(15, "1", 1 <unfinished ...>
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6111] close(14 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] close(9 <unfinished ...>
[pid  6117] close(18 <unfinished ...>
[pid  6116] close(11 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme46/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme58/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme11/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 9
[pid  6116] <... openat resumed>)       = 11
[pid  6111] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 14
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6111] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6111] <... openat resumed>)       = 18
[pid  6116] close(11)                   = 0
[pid  6120] write(14, "1", 1 <unfinished ...>
[pid  6117] close(9 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme48/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 11
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme1/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6120] close(14 <unfinished ...>
[pid  6117] <... openat resumed>)       = 9
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6116] close(11 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme58/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6119] close(15 <unfinished ...>
[pid  6117] close(9 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme3/rescan_controller", O_WRONLY <unfinished ...>
[pid  6111] write(18, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] <... openat resumed>)       = 11
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 14
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme36/rescan_controller", O_WRONLY) = 9
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6116] write(14, "1", 1)           = 1
[pid  6120] <... write resumed>)        = 1
[pid  6116] close(14 <unfinished ...>
[pid  6120] close(11 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 14
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme38/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme48/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 11
[pid  6120] <... openat resumed>)       = 15
[pid  6117] close(9)                    = 0
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme64/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6119] write(14, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 9
[pid  6120] <... write resumed>)        = 1
[pid  6116] close(11 <unfinished ...>
[pid  6120] close(15 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme28/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme3/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 11
[pid  6120] <... openat resumed>)       = 15
[pid  6117] <... write resumed>)        = 1
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6117] close(9 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(11 <unfinished ...>
[pid  6120] close(15)                   = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme26/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme38/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 9
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme56/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 11
[pid  6116] <... openat resumed>)       = 15
[   95.267150][ T6047] nvmet: Created nvm controller 67 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.267921][ T6113] nvme nvme67: creating 2 I/O queues.
[   95.270782][ T6113] nvme nvme67: new ctrl: "testnqn"
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(9, "1", 1 <unfinished ...>
[pid  6116] write(15, "1", 1 <unfinished ...>
[pid  6113] <... write resumed>)        = 26
[pid  6119] close(14 <unfinished ...>
[pid  6113] close(4 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] close(11 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(9 <unfinished ...>
[pid  6116] close(15 <unfinished ...>
[pid  6113] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 4
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme54/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme18/rescan_controller", O_WRONLY <unfinished ...>
[pid  6113] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme28/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(4, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 11
[pid  6113] <... openat resumed>)       = 9
[pid  6119] <... write resumed>)        = 1
[pid  6113] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] write(11, "1", 1)           = 1
[pid  6119] close(4 <unfinished ...>
[pid  6120] close(11 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 4
[pid  6116] <... openat resumed>)       = 14
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] write(4, "1", 1 <unfinished ...>
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme56/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 11
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 15
[pid  6117] close(4 <unfinished ...>
[pid  6116] close(14 <unfinished ...>
[pid  6119] write(11, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme16/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme46/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(11 <unfinished ...>
[pid  6117] <... openat resumed>)       = 4
[pid  6116] <... openat resumed>)       = 14
[pid  6120] close(15 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(4, "1", 1 <unfinished ...>
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme18/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(4 <unfinished ...>
[pid  6116] close(14 <unfinished ...>
[pid  6120] <... openat resumed>)       = 11
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme44/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme1/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 4
[pid  6116] <... openat resumed>)       = 14
[pid  6120] close(11 <unfinished ...>
[pid  6117] write(4, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme46/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(4 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 11
[pid  6117] <... close resumed>)        = 0
[   95.303642][ T6018] nvmet: Created nvm controller 68 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.305789][ T6112] nvme nvme68: creating 2 I/O queues.
[   95.311506][ T6112] nvme nvme68: new ctrl: "testnqn"
[pid  6116] close(14)                   = 0
[pid  6120] write(11, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 4
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme34/rescan_controller", O_WRONLY <unfinished ...>
[pid  6112] <... write resumed>)        = 26
[pid  6119] write(4, "1", 1)            = 1
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(4 <unfinished ...>
[pid  6117] <... openat resumed>)       = 14
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme36/rescan_controller", O_WRONLY <unfinished ...>
[pid  6112] close(13 <unfinished ...>
[pid  6120] close(11 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 4
[pid  6112] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6116] write(4, "1", 1 <unfinished ...>
[pid  6112] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme1/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6112] <... openat resumed>)       = 11
[pid  6120] <... openat resumed>)       = 13
[pid  6116] close(4 <unfinished ...>
[pid  6112] write(11, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6119] <... openat resumed>)       = 15
[pid  6116] <... close resumed>)        = 0
[pid  6119] write(15, "1", 1 <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme64/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 4
[pid  6120] <... write resumed>)        = 1
[pid  6117] close(14 <unfinished ...>
[pid  6120] close(13)                   = 0
[pid  6117] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme36/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme62/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[pid  6119] close(15 <unfinished ...>
[pid  6117] <... openat resumed>)       = 14
[pid  6116] write(4, "1", 1)            = 1
[pid  6116] close(4 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme26/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(13 <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 4
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme64/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(14 <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[pid  6117] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme24/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 14
[pid  6116] write(4, "1", 1 <unfinished ...>
[pid  6120] write(13, "1", 1)           = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] close(13 <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6116] close(4 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme26/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 4
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme54/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(14)                   = 0
[pid  6116] <... openat resumed>)       = 13
[pid  6120] write(4, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme52/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(4 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 14
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme54/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 4
[pid  6119] <... openat resumed>)       = 15
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6116] close(13 <unfinished ...>
[pid  6119] write(15, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(4, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(14 <unfinished ...>
[   95.350655][ T6029] nvmet: Created nvm controller 69 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme16/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] close(15 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 13
[   95.352054][ T6115] nvme nvme69: creating 2 I/O queues.
[pid  6120] close(4 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme8/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(13, "1", 1)           = 1
[pid  6116] close(13 <unfinished ...>
[pid  6119] <... openat resumed>)       = 15
[pid  6116] <... close resumed>)        = 0
[pid  6119] write(15, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme44/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 14
[pid  6116] <... openat resumed>)       = 13
[pid  6120] <... close resumed>)        = 0
[pid  6119] close(15 <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme16/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(13 <unfinished ...>
[pid  6120] <... openat resumed>)       = 4
[pid  6119] <... openat resumed>)       = 13
[pid  6117] close(14 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme34/rescan_controller", O_WRONLY) = 15
[pid  6116] write(15, "1", 1)           = 1
[pid  6116] close(15)                   = 0
[   95.366921][ T6115] nvme nvme69: new ctrl: "testnqn"
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme62/rescan_controller", O_WRONLY) = 14
[pid  6120] write(4, "1", 1 <unfinished ...>
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6115] <... write resumed>)        = 26
[pid  6119] <... write resumed>)        = 1
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6115] close(3 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY <unfinished ...>
[pid  6115] <... close resumed>)        = 0
[pid  6120] close(4 <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6117] <... openat resumed>)       = 3
[pid  6116] close(14 <unfinished ...>
[pid  6115] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme44/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6115] <... openat resumed>)       = 4
[pid  6120] <... openat resumed>)       = 13
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme24/rescan_controller", O_WRONLY <unfinished ...>
[pid  6115] write(4, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 14
[pid  6119] <... openat resumed>)       = 15
[pid  6117] close(3 <unfinished ...>
[pid  6119] write(15, "1", 1)           = 1
[pid  6119] close(15)                   = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] close(13 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 3
[pid  6117] <... openat resumed>)       = 15
[pid  6116] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme34/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(15, "1", 1 <unfinished ...>
[pid  6116] close(14 <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] close(15 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme52/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(13 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 14
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 13
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6117] write(13, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme62/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6116] <... write resumed>)        = 1
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] close(13 <unfinished ...>
[pid  6120] <... openat resumed>)       = 15
[pid  6119] <... write resumed>)        = 1
[pid  6116] close(14 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme60/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 3
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme8/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(15 <unfinished ...>
[pid  6117] <... openat resumed>)       = 13
[pid  6116] <... openat resumed>)       = 14
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme24/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6117] write(13, "1", 1 <unfinished ...>
[pid  6116] write(14, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 15
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(13 <unfinished ...>
[pid  6116] close(14 <unfinished ...>
[pid  6119] close(3)                    = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 3
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(15)                   = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 13
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme52/rescan_controller", O_WRONLY) = 15
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 14
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6117] write(14, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6116] close(13 <unfinished ...>
[pid  6120] close(15 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme8/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(14 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 13
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6120] <... openat resumed>)       = 15
[pid  6119] close(3 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] write(13, "1", 1 <unfinished ...>
[pid  6120] write(15, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] getdents64(5 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] close(15 <unfinished ...>
[pid  6119] <... getdents64 resumed>, 0x7f17d0000ba0 /* 0 entries */, 32768) = 0
[pid  6117] <... openat resumed>)       = 3
[pid  6120] <... close resumed>)        = 0
[pid  6119] close(5 <unfinished ...>
[pid  6116] close(13 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY) = 13
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 14
[pid  6116] <... openat resumed>)       = 5
[pid  6120] close(13 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6119] fstat(14 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... fstat resumed>, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
[pid  6119] getdents64(14 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... getdents64 resumed>, 0x7f17d0000ba0 /* 72 entries */, 32768) = 2288
[pid  6117] close(3 <unfinished ...>
[pid  6116] write(5, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme33/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[pid  6119] <... openat resumed>)       = 3
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme61/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme23/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(5 <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 5
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme60/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(13)                   = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 15
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] write(15, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[   95.418755][ T5917] nvmet: Created nvm controller 70 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.420591][ T6111] nvme nvme70: creating 2 I/O queues.
[   95.422334][ T6111] nvme nvme70: new ctrl: "testnqn"
[pid  6117] close(5 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6111] <... write resumed>)        = 26
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme51/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(15 <unfinished ...>
[pid  6111] close(18 <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6117] <... openat resumed>)       = 5
[pid  6116] <... close resumed>)        = 0
[pid  6111] <... close resumed>)        = 0
[pid  6120] close(13 <unfinished ...>
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6111] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 13
[pid  6111] <... openat resumed>)       = 15
[pid  6111] write(15, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme60/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme7/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 3
[pid  6119] <... openat resumed>)       = 18
[pid  6117] close(5 <unfinished ...>
[pid  6116] write(13, "1", 1)           = 1
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(13 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(18)                   = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme13/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 5
[pid  6119] <... openat resumed>)       = 13
[pid  6116] write(5, "1", 1)            = 1
[pid  6116] close(5 <unfinished ...>
[pid  6120] close(3 <unfinished ...>
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 18
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... openat resumed>)       = 5
[pid  6119] <... close resumed>)        = 0
[pid  6117] close(18 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme41/rescan_controller", O_WRONLY) = 13
[pid  6117] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 18
[pid  6116] close(3 <unfinished ...>
[pid  6120] close(5 <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme31/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... openat resumed>)       = 5
[pid  6119] <... openat resumed>)       = 13
[pid  6117] close(18 <unfinished ...>
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme59/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(13)                   = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme21/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 18
[pid  6120] close(5 <unfinished ...>
[pid  6119] <... openat resumed>)       = 13
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] close(3 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[   95.467435][ T5917] nvmet: Created nvm controller 71 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.468216][ T6113] nvme nvme71: creating 2 I/O queues.
[   95.471031][ T6113] nvme nvme71: new ctrl: "testnqn"
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] close(18 <unfinished ...>
[pid  6113] <... write resumed>)        = 26
[pid  6119] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY <unfinished ...>
[pid  6113] close(9 <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6113] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6113] openat(AT_FDCWD, "/dev/nvme-fabrics", O_RDWR <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme5/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6113] <... openat resumed>)       = 9
[pid  6113] write(9, "nqn=testnqn,transport=loop", 26 <unfinished ...>
[pid  6120] <... openat resumed>)       = 3
[pid  6120] write(3, "1", 1)            = 1
[pid  6119] <... openat resumed>)       = 13
[pid  6116] <... openat resumed>)       = 5
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6116] write(5, "1", 1 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6119] close(13 <unfinished ...>
[pid  6116] close(5 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme11/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(3 <unfinished ...>
[pid  6119] <... openat resumed>)       = 13
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 5
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(5, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 3
[pid  6120] <... openat resumed>)       = 18
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6119] close(13 <unfinished ...>
[pid  6117] close(3 <unfinished ...>
[pid  6116] close(5 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme68/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme59/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 5
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(18 <unfinished ...>
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 13
[pid  6116] <... write resumed>)        = 1
[pid  6116] close(3 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 18
[pid  6119] close(5 <unfinished ...>
[pid  6117] write(13, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 3
[pid  6119] <... close resumed>)        = 0
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme58/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6120] close(18)                   = 0
[pid  6119] <... openat resumed>)       = 5
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6117] close(13 <unfinished ...>
[pid  6116] close(3 <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 18
[pid  6119] close(5 <unfinished ...>
[pid  6116] <... openat resumed>)       = 3
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme48/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 5
[pid  6116] close(3 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 13
[pid  6120] close(18 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme59/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6117] write(13, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... openat resumed>)       = 18
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6119] close(5)                    = 0
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme3/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(13 <unfinished ...>
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 5
[pid  6120] close(18 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] close(3 <unfinished ...>
[pid  6120] <... openat resumed>)       = 13
[pid  6119] close(5 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] close(13 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme38/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 5
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 13
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 18
[pid  6116] write(3, "1", 1)            = 1
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6116] close(3 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] write(18, "1", 1 <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6120] close(18 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme66/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(5 <unfinished ...>
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 13
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 5
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6116] close(3 <unfinished ...>
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6117] <... openat resumed>)       = 18
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(5 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(18, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme28/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... openat resumed>)       = 13
[pid  6119] <... openat resumed>)       = 5
[   95.524285][ T5953] nvmet: Created nvm controller 72 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.525450][ T6112] nvme nvme72: creating 2 I/O queues.
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6112] <... write resumed>)        = 26
[pid  5884] futex(0x7f17e79b2990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6111, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[   95.529779][ T6112] nvme nvme72: new ctrl: "testnqn"
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(18 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] close(13 <unfinished ...>
[pid  6116] close(3 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6119] close(5)                    = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 3
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme56/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... openat resumed>)       = 5
[pid  6116] <... openat resumed>)       = 13
[pid  6112] close(11 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 18
[pid  6116] write(13, "1", 1)           = 1
[pid  6116] close(13 <unfinished ...>
[pid  6112] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6117] write(5, "1", 1)            = 1
[pid  6120] close(3 <unfinished ...>
[pid  6119] write(18, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(18 <unfinished ...>
[pid  6117] close(5 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 5
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... openat resumed>)       = 3
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme18/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY) = 11
[pid  6112] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 13
[pid  6117] write(11, "1", 1 <unfinished ...>
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(5 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... close resumed>)        = 0
[pid  6116] close(3 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... openat resumed>)       = 3
[pid  6119] write(13, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(11 <unfinished ...>
[pid  6116] <... openat resumed>)       = 5
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6119] close(13 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6112] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6120] close(3 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme46/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 3
[pid  6116] write(5, "1", 1 <unfinished ...>
[pid  6112] madvise(0x7f17e79b3000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY) = 13
[pid  6117] <... openat resumed>)       = 11
[pid  6116] <... write resumed>)        = 1
[pid  6112] <... madvise resumed>)      = 0
[pid  6119] write(3, "1", 1)            = 1
[pid  6112] exit(0 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6116] close(5 <unfinished ...>
[pid  6120] write(13, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(11, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6112] <... exit resumed>)         = ?
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme1/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[   95.567512][ T6023] nvmet: Created nvm controller 73 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.568338][ T6115] nvme nvme73: creating 2 I/O queues.
[pid  6119] <... openat resumed>)       = 3
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY <unfinished ...>
[pid  6112] +++ exited with 0 +++
[pid  6120] close(13 <unfinished ...>
[pid  6117] close(11 <unfinished ...>
[pid  6115] <... write resumed>)        = 26
[pid  6117] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[   95.571242][ T6115] nvme nvme73: new ctrl: "testnqn"
[pid  6117] <... openat resumed>)       = 5
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 11
[pid  6115] close(4 <unfinished ...>
[pid  6120] <... openat resumed>)       = 4
[pid  6119] <... write resumed>)        = 1
[pid  6115] <... close resumed>)        = 0
[pid  6120] write(4, "1", 1 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6116] write(11, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6115] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6115] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6117] close(5 <unfinished ...>
[pid  6116] close(11 <unfinished ...>
[pid  6115] madvise(0x7f17e89b5000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme36/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6115] <... madvise resumed>)      = 0
[pid  6117] <... close resumed>)        = 0
[pid  6120] close(4 <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY <unfinished ...>
[pid  6115] exit(0 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 5
[pid  6115] <... exit resumed>)         = ?
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6115] +++ exited with 0 +++
[pid  6120] <... openat resumed>)       = 4
[pid  6119] close(3 <unfinished ...>
[pid  6117] <... openat resumed>)       = 11
[pid  6116] write(5, "1", 1 <unfinished ...>
[pid  6120] write(4, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme64/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(11, "1", 1 <unfinished ...>
[pid  6116] close(5 <unfinished ...>
[pid  6120] close(4 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6117] close(11 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme65/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6117] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 5
[pid  6117] <... openat resumed>)       = 11
[pid  6116] <... openat resumed>)       = 4
[pid  6111] <... write resumed>)        = 26
[pid  6119] <... write resumed>)        = 1
[pid  6111] close(15)                   = 0
[pid  6111] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6111] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(11, "1", 1 <unfinished ...>
[pid  6116] write(4, "1", 1 <unfinished ...>
[pid  6111] madvise(0x7f17e71b2000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[   95.624640][ T6238] nvmet: Created nvm controller 74 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[   95.625392][ T6111] nvme nvme74: creating 2 I/O queues.
[   95.628250][ T6111] nvme nvme74: new ctrl: "testnqn"
[pid  6120] close(5 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme26/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(11 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6111] <... madvise resumed>)      = 0
[pid  6119] <... openat resumed>)       = 3
[pid  6111] exit(0 <unfinished ...>
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6111] <... exit resumed>)         = ?
[pid  5884] <... futex resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6111] +++ exited with 0 +++
[pid  5884] futex(0x7f17e89b4990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6113, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme54/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3 <unfinished ...>
[pid  6116] close(4 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme65/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme16/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 4
[pid  6119] <... openat resumed>)       = 11
[pid  6117] <... openat resumed>)       = 5
[pid  6116] write(4, "1", 1 <unfinished ...>
[pid  6119] write(11, "1", 1)           = 1
[pid  6119] close(11)                   = 0
[pid  6116] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme44/rescan_controller", O_WRONLY) = 11
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6116] close(4 <unfinished ...>
[pid  6119] write(11, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 3
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(5 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(11 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme34/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 4
[   95.669883][ T6096] nvmet: Created nvm controller 75 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:7930bbb2-9436-44b5-b9a3-f8206959a739.
[pid  6119] <... openat resumed>)       = 5
[pid  6120] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 11
[pid  6116] write(4, "1", 1 <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6120] close(3 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[   95.670682][ T6113] nvme nvme75: creating 2 I/O queues.
[   95.679811][ T6113] nvme nvme75: new ctrl: "testnqn"
[pid  6119] close(5)                    = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme62/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(11, "1", 1 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6113] <... write resumed>)        = 26
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] close(4 <unfinished ...>
[pid  6113] close(9 <unfinished ...>
[pid  6120] <... openat resumed>)       = 5
[pid  6119] <... write resumed>)        = 1
[pid  6117] close(11 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6113] <... close resumed>)        = 0
[pid  6120] write(5, "1", 1 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6113] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY <unfinished ...>
[pid  6113] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6120] close(5 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme24/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... openat resumed>)       = 3
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 5
[pid  6117] <... openat resumed>)       = 4
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6113] madvise(0x7f17e81b4000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6117] write(4, "1", 1 <unfinished ...>
[pid  6113] <... madvise resumed>)      = 0
[pid  6119] <... write resumed>)        = 1
[pid  6113] exit(0 <unfinished ...>
[pid  6119] close(5 <unfinished ...>
[pid  6113] <... exit resumed>)         = ?
[pid  5884] <... futex resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  5884] futex(0x7f17ec1bb990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6116, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6113] +++ exited with 0 +++
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme52/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(4 <unfinished ...>
[pid  6119] <... openat resumed>)       = 5
[pid  6117] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6117] <... openat resumed>)       = 4
[pid  6119] <... write resumed>)        = 1
[pid  6119] close(5 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(4, "1", 1 <unfinished ...>
[pid  6116] close(3 <unfinished ...>
[pid  6120] <... openat resumed>)       = 5
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme8/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... close resumed>)        = 0
[pid  6117] close(4 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] write(5, "1", 1)            = 1
[pid  6120] close(5)                    = 0
[pid  6116] <... openat resumed>)       = 9
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] write(9, "1", 1 <unfinished ...>
[pid  6120] <... openat resumed>)       = 4
[pid  6119] <... openat resumed>)       = 3
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(4, "1", 1 <unfinished ...>
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6116] close(9 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... openat resumed>)       = 5
[pid  6120] close(4 <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme14/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... openat resumed>)       = 3
[pid  6119] <... openat resumed>)       = 4
[pid  6117] <... write resumed>)        = 1
[pid  6120] write(3, "1", 1)            = 1
[pid  6119] write(4, "1", 1 <unfinished ...>
[pid  6117] close(5 <unfinished ...>
[pid  6116] <... openat resumed>)       = 9
[pid  6120] close(3 <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6116] write(9, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(4 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme63/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 3
[pid  6116] close(9 <unfinished ...>
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... openat resumed>)       = 5
[pid  6116] <... close resumed>)        = 0
[pid  6117] write(5, "1", 1 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme42/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme63/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6117] close(5)                    = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY) = 4
[pid  6117] write(4, "1", 1 <unfinished ...>
[pid  6120] close(3 <unfinished ...>
[pid  6119] <... openat resumed>)       = 9
[pid  6116] <... openat resumed>)       = 5
[pid  6120] <... close resumed>)        = 0
[pid  6119] write(9, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] write(5, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme63/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... write resumed>)        = 1
[pid  6120] <... openat resumed>)       = 3
[pid  6119] close(9 <unfinished ...>
[pid  6117] close(4 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6119] <... close resumed>)        = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] close(5 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme70/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6120] close(3 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY) = 9
[pid  6116] <... openat resumed>)       = 3
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6119] <... openat resumed>)       = 5
[pid  6116] <... write resumed>)        = 1
[pid  6116] close(3)                    = 0
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... write resumed>)        = 1
[pid  6116] <... openat resumed>)       = 3
[pid  6120] close(9 <unfinished ...>
[pid  6119] close(5 <unfinished ...>
[pid  6117] <... openat resumed>)       = 4
[pid  6117] write(4, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... write resumed>)        = 1
[pid  6116] write(3, "1", 1 <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme32/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] close(4 <unfinished ...>
[pid  6116] <... write resumed>)        = 1
[pid  6117] <... close resumed>)        = 0
[pid  6116] close(3 <unfinished ...>
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] <... openat resumed>)       = 5
[pid  6117] <... openat resumed>)       = 3
[pid  6116] <... openat resumed>)       = 4
[pid  6120] <... openat resumed>)       = 9
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6116] write(4, "1", 1 <unfinished ...>
[pid  6117] <... write resumed>)        = 1
[pid  6116] <... write resumed>)        = 1
[pid  6120] write(9, "1", 1 <unfinished ...>
[pid  6117] close(3 <unfinished ...>
[pid  6116] close(4 <unfinished ...>
[pid  6120] <... write resumed>)        = 1
[pid  6120] close(9 <unfinished ...>
[pid  6119] write(5, "1", 1 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] <... close resumed>)        = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(5 <unfinished ...>
[pid  6117] <... openat resumed>)       = 3
[pid  6116] <... openat resumed>)       = 4
[pid  6120] <... openat resumed>)       = 5
[pid  6119] <... close resumed>)        = 0
[pid  6116] write(4, "1", 1)            = 1
[pid  6116] close(4)                    = 0
[pid  6116] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6116] <... openat resumed>)       = 4
[pid  6117] <... write resumed>)        = 1
[pid  6117] close(3)                    = 0
[pid  6117] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY) = 3
[pid  6116] write(4, "1", 1)            = 1
[pid  6116] close(4)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme60/rescan_controller", O_WRONLY <unfinished ...>
[pid  6116] getdents64(10 <unfinished ...>
[pid  6120] write(5, "1", 1)            = 1
[pid  6119] <... openat resumed>)       = 4
[pid  6117] write(3, "1", 1 <unfinished ...>
[pid  6116] <... getdents64 resumed>, 0x7f17d4000ba0 /* 0 entries */, 32768) = 0
[pid  6116] close(10 <unfinished ...>
[pid  6120] close(5 <unfinished ...>
[pid  6116] <... close resumed>)        = 0
[pid  6119] write(4, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... write resumed>)        = 1
[pid  6116] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  6117] close(3 <unfinished ...>
[pid  6116] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(4 <unfinished ...>
[pid  6117] <... close resumed>)        = 0
[pid  6116] madvise(0x7f17eb9bb000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  6120] <... openat resumed>)       = 3
[pid  6119] <... close resumed>)        = 0
[pid  6117] getdents64(17 <unfinished ...>
[pid  6116] <... madvise resumed>)      = 0
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme22/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] <... getdents64 resumed>, 0x7f17c8000ba0 /* 0 entries */, 32768) = 0
[pid  6116] exit(0 <unfinished ...>
[pid  6117] close(17 <unfinished ...>
[pid  6116] <... exit resumed>)         = ?
[pid  5884] <... futex resumed>)        = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 4
[pid  6117] <... close resumed>)        = 0
[pid  6116] +++ exited with 0 +++
[pid  5884] munmap(0x7f17e71b2000, 8392704 <unfinished ...>
[pid  6120] close(3 <unfinished ...>
[pid  6119] write(4, "1", 1 <unfinished ...>
[pid  6117] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  5884] <... munmap resumed>)       = 0
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6117] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6120] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY <unfinished ...>
[pid  6119] close(4 <unfinished ...>
[pid  6117] madvise(0x7f17eb1ba000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  5884] futex(0x7f17eb9ba990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6117, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6120] <... openat resumed>)       = 3
[pid  6119] <... close resumed>)        = 0
[pid  6117] <... madvise resumed>)      = 0
[pid  6120] write(3, "1", 1 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme50/rescan_controller", O_WRONLY <unfinished ...>
[pid  6117] exit(0)                     = ?
[pid  6117] +++ exited with 0 +++
[pid  5884] <... futex resumed>)        = 0
[pid  5884] munmap(0x7f17e79b3000, 8392704) = 0
[pid  6120] <... write resumed>)        = 1
[pid  6119] <... openat resumed>)       = 4
[pid  5884] futex(0x7f17eb1b9990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6119, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6120] close(3 <unfinished ...>
[pid  6119] write(4, "1", 1 <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... write resumed>)        = 1
[pid  6120] getdents64(7 <unfinished ...>
[pid  6119] close(4 <unfinished ...>
[pid  6120] <... getdents64 resumed>, 0x7f17d8000ba0 /* 0 entries */, 32768) = 0
[pid  6119] <... close resumed>)        = 0
[pid  6120] close(7 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme6/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... close resumed>)        = 0
[pid  6119] <... openat resumed>)       = 3
[pid  6120] rt_sigprocmask(SIG_BLOCK, ~[RT_1] <unfinished ...>
[pid  6119] write(3, "1", 1 <unfinished ...>
[pid  6120] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6119] <... write resumed>)        = 1
[pid  6120] madvise(0x7f17ea1b8000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  6119] close(3 <unfinished ...>
[pid  6120] <... madvise resumed>)      = 0
[pid  6119] <... close resumed>)        = 0
[pid  6120] exit(0 <unfinished ...>
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme12/rescan_controller", O_WRONLY <unfinished ...>
[pid  6120] <... exit resumed>)         = ?
[pid  6120] +++ exited with 0 +++
[pid  6119] <... openat resumed>)       = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme40/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme69/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme30/rescan_controller", O_WRONLY <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(12 <unfinished ...>
[pid  6119] <... openat resumed>)       = 3
[pid  6123] <... close resumed>)        = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = 4
[   95.875893][ T6123] nvme nvme3: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme59/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme20/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme49/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme4/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme10/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme39/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme67/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme29/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme57/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme19/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme47/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme2/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme37/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme65/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme27/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme55/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme17/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme45/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme35/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme63/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme25/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme53/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme9/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme15/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] openat(AT_FDCWD, "/sys/class/nvme/nvme43/rescan_controller", O_WRONLY) = 3
[pid  6119] write(3, "1", 1)            = 1
[pid  6119] close(3)                    = 0
[pid  6119] getdents64(14, 0x7f17d0000ba0 /* 0 entries */, 32768) = 0
[pid  6119] close(14)                   = 0
[pid  6119] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6119] madvise(0x7f17ea9b9000, 8372224, MADV_DONTNEED) = 0
[pid  6119] exit(0)                     = ?
[pid  6119] +++ exited with 0 +++
[pid  5884] <... futex resumed>)        = 0
[pid  5884] munmap(0x7f17e81b4000, 8392704) = 0
[pid  5884] munmap(0x7f17e89b5000, 8392704) = 0
[pid  5884] futex(0x7f17ea1b7990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6122, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(6)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme11/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme3/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme28/delete_controller", O_WRONLY) = 3
[   96.128701][ T6122] nvme nvme28: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme18/delete_controller", O_WRONLY) = 4
[   96.836578][ T6123] nvme nvme18: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme18/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = 3
[   97.355254][ T6122] nvme nvme1: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme1/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme16/delete_controller", O_WRONLY) = 4
[   97.385744][ T6123] nvme nvme16: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1)            = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   97.614550][ T6123] nvme nvme8: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme26/delete_controller", O_WRONLY) = 3
[   97.636120][ T6122] nvme nvme26: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1)            = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme16/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme24/delete_controller", O_WRONLY) = 3
[   97.924549][ T6122] nvme nvme24: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme14/delete_controller", O_WRONLY) = 4
[   98.006848][ T6123] nvme nvme14: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme14/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme22/delete_controller", O_WRONLY) = 3
[   98.187390][ T6122] nvme nvme22: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   98.205542][ T6123] nvme nvme6: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme12/delete_controller", O_WRONLY) = 3
[   98.418421][ T6122] nvme nvme12: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme12/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme20/delete_controller", O_WRONLY) = 4
[   98.456591][ T6123] nvme nvme20: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1)            = 1
[pid  6122] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme20/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 3
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] write(3, "1", 1)            = -1 ENODEV (No such device)
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme10/delete_controller", O_WRONLY) = 3
[   98.678187][ T6123] nvme nvme4: Removing ctrl: NQN "testnqn"
[   98.680807][ T6122] nvme nvme10: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1)            = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme19/delete_controller", O_WRONLY) = 3
[   98.919191][ T6122] nvme nvme19: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme10/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme19/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   98.969804][ T6123] nvme nvme2: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme27/delete_controller", O_WRONLY) = 3
[   99.174465][ T6122] nvme nvme27: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme17/delete_controller", O_WRONLY) = 4
[   99.235679][ T6123] nvme nvme17: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme17/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme25/delete_controller", O_WRONLY) = 3
[   99.447806][ T6122] nvme nvme25: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme63/delete_controller", O_WRONLY) = 4
[   99.517663][ T6123] nvme nvme63: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 3
[   99.668989][ T6122] nvme nvme9: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme15/delete_controller", O_WRONLY) = 4
[   99.735336][ T6123] nvme nvme15: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme15/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] getdents64(8, 0x7f17dc000ba0 /* 0 entries */, 32768) = 0
[pid  6122] close(8)                    = 0
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] getdents64(16, 0x7f17e0000ba0 /* 0 entries */, 32768) = 0
[pid  6123] close(16)                   = 0
[pid  6122] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6122] madvise(0x7f17e99b7000, 8372224, MADV_DONTNEED) = 0
[pid  6122] exit(0)                     = ?
[pid  6122] +++ exited with 0 +++
[pid  5884] <... futex resumed>)        = 0
[pid  5884] munmap(0x7f17eb9bb000, 8392704) = 0
[pid  5884] futex(0x7f17e99b6990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6123, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6123] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6123] madvise(0x7f17e91b6000, 8372224, MADV_DONTNEED) = 0
[pid  6123] exit(0)                     = ?
[pid  6123] +++ exited with 0 +++
<... futex resumed>)                    = 0
munmap(0x7f17eb1ba000, 8392704)         = 0
write(1, "[*] Cleaning up...", 18)      = 18
write(1, "\n", 1)                       = 1
[*] Cleaning up...
[  100.043623][   T34] audit: type=1400 audit(1790188391.568:274): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="/" dev="configfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043653][   T34] audit: type=1400 audit(1790188391.568:275): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="nvmet" dev="configfs" ino=3417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043670][   T34] audit: type=1400 audit(1790188391.568:276): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="ports" dev="configfs" ino=3419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043686][   T34] audit: type=1400 audit(1790188391.568:277): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="1" dev="configfs" ino=8384 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043703][   T34] audit: type=1400 audit(1790188391.568:278): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="subsystems" dev="configfs" ino=8385 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043721][   T34] audit: type=1400 audit(1790188391.568:279): avc:  denied  { write search } for  pid=5884 comm="syz-executor250" name="subsystems" dev="configfs" ino=8385 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.044217][   T34] audit: type=1400 audit(1790188391.568:280): avc:  denied  { remove_name } for  pid=5884 comm="syz-executor250" name="testnqn" dev="configfs" ino=8390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.044352][   T34] audit: type=1400 audit(1790188391.568:281): avc:  denied  { unlink } for  pid=5884 comm="syz-executor250" name="testnqn" dev="configfs" ino=8390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[  100.046950][ T5968] nvme nvme29: Removing ctrl: NQN "testnqn"
[  100.048965][ T6046] nvme nvme30: Removing ctrl: NQN "testnqn"
[  100.050032][ T5981] nvme nvme31: Removing ctrl: NQN "testnqn"
[  100.050139][ T6103] nvme nvme32: Removing ctrl: NQN "testnqn"
[  100.051217][ T6074] nvme nvme33: Removing ctrl: NQN "testnqn"
[  100.052621][ T6054] nvme nvme34: Removing ctrl: NQN "testnqn"
[  100.052675][   T52] nvme nvme35: Removing ctrl: NQN "testnqn"
[  100.052728][ T5976] nvme nvme36: Removing ctrl: NQN "testnqn"
[  100.052829][ T6068] nvme nvme38: Removing ctrl: NQN "testnqn"
[  100.062459][ T5984] nvme nvme37: Removing ctrl: NQN "testnqn"
[  100.062953][ T6027] nvme nvme39: Removing ctrl: NQN "testnqn"
[  100.076480][ T5993] nvme nvme23: Removing ctrl: NQN "testnqn"
[  100.080511][ T1109] nvme nvme40: Removing ctrl: NQN "testnqn"
[  100.101233][ T6085] nvme nvme41: Removing ctrl: NQN "testnqn"
[  100.101326][ T6077] nvme nvme42: Removing ctrl: NQN "testnqn"
[  100.101454][ T1107] nvme nvme43: Removing ctrl: NQN "testnqn"
[  100.105263][ T6028] nvme nvme44: Removing ctrl: NQN "testnqn"
[  100.117574][ T6022] nvme nvme45: Removing ctrl: NQN "testnqn"
[  100.124230][ T5958] nvme nvme46: Removing ctrl: NQN "testnqn"
[  100.129741][ T6049] nvme nvme47: Removing ctrl: NQN "testnqn"
[  100.139655][ T5912] nvme nvme48: Removing ctrl: NQN "testnqn"
[  100.152413][ T6062] nvme nvme7: Removing ctrl: NQN "testnqn"
[  100.154215][ T5999] nvme nvme49: Removing ctrl: NQN "testnqn"
[  100.173363][ T5966] nvme nvme50: Removing ctrl: NQN "testnqn"
[  100.176161][ T6032] nvme nvme51: Removing ctrl: NQN "testnqn"
[  100.177309][ T6240] nvme nvme52: Removing ctrl: NQN "testnqn"
[  100.177592][ T5985] nvme nvme53: Removing ctrl: NQN "testnqn"
[  100.177651][ T6080] nvme nvme54: Removing ctrl: NQN "testnqn"
[  100.177698][ T6036] nvme nvme55: Removing ctrl: NQN "testnqn"
[  100.179244][ T5911] nvme nvme56: Removing ctrl: NQN "testnqn"
[  100.179308][ T6005] nvme nvme13: Removing ctrl: NQN "testnqn"
[  100.179358][ T6094] nvme nvme57: Removing ctrl: NQN "testnqn"
[  100.179411][ T6090] nvme nvme58: Removing ctrl: NQN "testnqn"
[  100.179459][ T6060] nvme nvme59: Removing ctrl: NQN "testnqn"
[  100.179502][ T6109] nvme nvme60: Removing ctrl: NQN "testnqn"
[  100.179544][ T1108] nvme nvme61: Removing ctrl: NQN "testnqn"
[  100.179591][ T6052] nvme nvme21: Removing ctrl: NQN "testnqn"
[  100.179730][ T6001] nvme nvme64: Removing ctrl: NQN "testnqn"
[  100.179769][ T5990] nvme nvme62: Removing ctrl: NQN "testnqn"
[  100.179846][ T5980] nvme nvme65: Removing ctrl: NQN "testnqn"
[  100.179895][ T6105] nvme nvme66: Removing ctrl: NQN "testnqn"
[  100.179937][ T6040] nvme nvme67: Removing ctrl: NQN "testnqn"
[  100.180573][ T5909] nvme nvme68: Removing ctrl: NQN "testnqn"
[  100.180629][ T5982] nvme nvme69: Removing ctrl: NQN "testnqn"
[  100.181743][ T6089] nvme nvme70: Removing ctrl: NQN "testnqn"
[  100.200250][ T6008] nvme nvme71: Removing ctrl: NQN "testnqn"
[  100.221830][   T35] nvme nvme72: Removing ctrl: NQN "testnqn"
[  100.239655][ T6043] nvme nvme73: Removing ctrl: NQN "testnqn"
[  100.239865][ T6069] nvme nvme74: Removing ctrl: NQN "testnqn"
[  100.240468][ T6057] nvme nvme75: Removing ctrl: NQN "testnqn"
[  100.329994][ T6007] nvme nvme33: long keepalive RTT (4294770536 ms)
[  100.330011][ T6007] nvme nvme33: failed nvme_keep_alive_end_io error=4
unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") = 0
rmdir("/sys/kernel/config/nvmet/ports/1") = 0
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY) = 3
[  101.918371][   T34] audit: type=1400 audit(1790188393.438:282): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="/" dev="configfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  101.918399][   T34] audit: type=1400 audit(1790188393.438:283): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="nvmet" dev="configfs" ino=3417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
write(3, "0", 1)                        = 1
close(3)                                = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1") = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn") = 0
unlink("/tmp/nvme_backing")             = 0
exit_group(0)                           = ?
+++ exited with 0 +++
 TestError:]

map[TruncatedConsoleOutput:[   87.728654][ T6113] nvme nvme64: creating 2 I/O queues.
[   87.732418][ T6122] nvme nvme7: Removing ctrl: NQN "testnqn"
[   87.752568][ T6113] nvme nvme64: new ctrl: "testnqn"
[   87.821499][ T6162] nvmet: Created nvm controller 64 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.826114][ T6115] nvme nvme51: creating 2 I/O queues.
[   87.839707][ T6115] nvme nvme51: new ctrl: "testnqn"
[   87.990924][ T6105] nvmet: Created nvm controller 26 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.999047][ T6116] nvme nvme65: creating 2 I/O queues.
[   88.010791][ T6116] nvme nvme65: new ctrl: "testnqn"
[   88.066999][ T5956] nvmet: Created nvm controller 65 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.091174][ T6112] nvme nvme66: creating 2 I/O queues.
[   88.115101][ T6112] nvme nvme66: new ctrl: "testnqn"
[   88.163892][ T6121] nvme nvme41: Removing ctrl: NQN "testnqn"
[   88.189659][ T1116] nvmet: Created nvm controller 66 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.191447][ T6113] nvme nvme13: creating 2 I/O queues.
[   88.202699][ T6113] nvme nvme13: new ctrl: "testnqn"
[   88.250633][ T6168] nvmet: Created nvm controller 67 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.262441][ T6115] nvme nvme67: creating 2 I/O queues.
[   88.266809][ T6115] nvme nvme67: new ctrl: "testnqn"
[   88.349986][ T6038] nvmet: Created nvm controller 68 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.350850][ T6115] nvme nvme68: creating 2 I/O queues.
[   88.368777][ T6115] nvme nvme68: new ctrl: "testnqn"
[   88.502578][ T5941] nvmet: Created nvm controller 69 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.513810][ T6116] nvme nvme69: creating 2 I/O queues.
[   88.525120][ T6116] nvme nvme69: new ctrl: "testnqn"
[   88.596094][ T6183] nvmet: Created nvm controller 70 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.598983][ T6116] nvme nvme70: creating 2 I/O queues.
[   88.617012][ T6116] nvme nvme70: new ctrl: "testnqn"
[   88.690383][ T6126] nvmet: Created nvm controller 71 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.710156][ T6112] nvme nvme71: creating 2 I/O queues.
[   88.719136][ T6112] nvme nvme71: new ctrl: "testnqn"
[   88.759685][ T5950] nvmet: Created nvm controller 72 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.767794][ T6113] nvme nvme72: creating 2 I/O queues.
[   88.777684][ T6113] nvme nvme72: new ctrl: "testnqn"
[   88.824681][ T5950] nvmet: Created nvm controller 73 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.829130][ T6115] nvme nvme73: creating 2 I/O queues.
[   88.844939][ T6115] nvme nvme73: new ctrl: "testnqn"
[   88.888344][ T5965] nvmet: Created nvm controller 74 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.890386][ T6116] nvme nvme74: creating 2 I/O queues.
[   88.917082][ T6116] nvme nvme74: new ctrl: "testnqn"
[   88.955970][ T6152] nvmet: Created nvm controller 75 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.956944][ T6116] nvme nvme75: creating 2 I/O queues.
[   88.959557][ T6116] nvme nvme75: new ctrl: "testnqn"
[   89.061741][ T6159] nvmet: Created nvm controller 41 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.062588][ T6112] nvme nvme76: creating 2 I/O queues.
[   89.086138][ T6112] nvme nvme76: new ctrl: "testnqn"
[   89.120679][   T65] nvmet: Created nvm controller 76 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.138631][ T6112] nvme nvme77: creating 2 I/O queues.
[   89.156592][ T6112] nvme nvme77: new ctrl: "testnqn"
[   89.247592][ T6125] nvmet: Created nvm controller 77 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.254216][ T6113] nvme nvme78: creating 2 I/O queues.
[   89.268126][ T6113] nvme nvme78: new ctrl: "testnqn"
[   89.293125][ T6121] nvme nvme31: Removing ctrl: NQN "testnqn"
[   89.340402][ T5910] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.361045][ T6113] nvme nvme41: creating 2 I/O queues.
[   89.368355][ T6113] nvme nvme41: new ctrl: "testnqn"
[   89.469158][ T6037] nvmet: Created nvm controller 78 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.477066][ T6115] nvme nvme79: creating 2 I/O queues.
[   89.484310][ T6115] nvme nvme79: new ctrl: "testnqn"
[   89.499551][ T6122] nvme nvme13: Removing ctrl: NQN "testnqn"
[   89.611391][ T6180] nvmet: Created nvm controller 79 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.641683][ T6115] nvme nvme7: creating 2 I/O queues.
[   89.644360][ T6115] nvme nvme7: new ctrl: "testnqn"
[   89.780735][ T5989] nvmet: Created nvm controller 80 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.788390][ T6116] nvme nvme80: creating 2 I/O queues.
[   89.797248][ T6116] nvme nvme80: new ctrl: "testnqn"
[   89.923073][ T5973] nvmet: Created nvm controller 66 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.928504][ T6116] nvme nvme81: creating 2 I/O queues.
[   89.960084][ T6116] nvme nvme81: new ctrl: "testnqn"
[   90.084654][ T6071] nvmet: Created nvm controller 81 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.091613][ T6112] nvme nvme82: creating 2 I/O queues.
[   90.100535][ T6122] nvme nvme41: Removing ctrl: NQN "testnqn"
[   90.100686][ T6112] nvme nvme82: new ctrl: "testnqn"
[   90.223870][ T6134] nvmet: Created nvm controller 82 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.224627][ T6112] nvme nvme13: creating 2 I/O queues.
[   90.229535][ T6112] nvme nvme13: new ctrl: "testnqn"
[   90.337233][ T6083] nvmet: Created nvm controller 83 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.340558][ T6113] nvme nvme83: creating 2 I/O queues.
[   90.364072][ T6113] nvme nvme83: new ctrl: "testnqn"
[   90.443360][ T1033] nvmet: Created nvm controller 31 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.448645][ T6113] nvme nvme84: creating 2 I/O queues.
[   90.457492][ T6113] nvme nvme84: new ctrl: "testnqn"
[   90.596375][ T5950] nvmet: Created nvm controller 84 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.605977][ T6115] nvme nvme85: creating 2 I/O queues.
[   90.615959][ T6115] nvme nvme85: new ctrl: "testnqn"
[   90.660964][ T6121] nvme nvme21: Removing ctrl: NQN "testnqn"
[   90.674931][ T6124] nvmet: Created nvm controller 85 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.684213][ T6116] nvme nvme31: creating 2 I/O queues.
[   90.715431][ T6116] nvme nvme31: new ctrl: "testnqn"
[   90.769688][ T6243] nvmet: Created nvm controller 86 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.770845][ T6112] nvme nvme86: creating 2 I/O queues.
[   90.778093][ T6112] nvme nvme86: new ctrl: "testnqn"
[   90.818886][ T6162] nvmet: Created nvm controller 87 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.819804][ T6113] nvme nvme87: creating 2 I/O queues.
[   90.826178][ T6113] nvme nvme87: new ctrl: "testnqn"
[   90.861135][ T5982] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.863309][ T6115] nvme nvme88: creating 2 I/O queues.
[   90.870541][ T6115] nvme nvme88: new ctrl: "testnqn"
[   90.962433][ T6122] nvme nvme31: Removing ctrl: NQN "testnqn"
[   91.802417][ T6121] nvme nvme5: Removing ctrl: NQN "testnqn"
[   92.122915][ T6122] nvme nvme11: Removing ctrl: NQN "testnqn"
[   92.473738][ T6122] nvme nvme48: Removing ctrl: NQN "testnqn"
[   92.812620][ T6121] nvme nvme3: Removing ctrl: NQN "testnqn"
[   92.822807][ T6122] nvme nvme38: Removing ctrl: NQN "testnqn"
[   93.003821][ T6121] nvme nvme28: Removing ctrl: NQN "testnqn"
[   93.062772][ T6122] nvme nvme56: Removing ctrl: NQN "testnqn"
[   93.263057][ T6122] nvme nvme18: Removing ctrl: NQN "testnqn"
[   93.263449][ T6121] nvme nvme46: Removing ctrl: NQN "testnqn"
[   93.503664][ T6121] nvme nvme1: Removing ctrl: NQN "testnqn"
[   93.533174][ T6122] nvme nvme36: Removing ctrl: NQN "testnqn"
[   93.729925][ T6121] nvme nvme26: Removing ctrl: NQN "testnqn"
[   93.762869][ T6122] nvme nvme54: Removing ctrl: NQN "testnqn"
[   93.972341][ T6122] nvme nvme16: Removing ctrl: NQN "testnqn"
[   93.983004][ T6121] nvme nvme44: Removing ctrl: NQN "testnqn"
[   94.204124][ T6122] nvme nvme34: Removing ctrl: NQN "testnqn"
[   94.262458][ T6121] nvme nvme24: Removing ctrl: NQN "testnqn"
[   94.412433][ T6122] nvme nvme52: Removing ctrl: NQN "testnqn"
[   94.512638][ T6121] nvme nvme8: Removing ctrl: NQN "testnqn"
[   94.662475][ T6122] nvme nvme14: Removing ctrl: NQN "testnqn"
[   94.732592][ T6121] nvme nvme42: Removing ctrl: NQN "testnqn"
[   94.902583][ T6122] nvme nvme32: Removing ctrl: NQN "testnqn"
[   94.982572][ T6121] nvme nvme50: Removing ctrl: NQN "testnqn"
[   95.114595][ T6122] nvme nvme6: Removing ctrl: NQN "testnqn"
[   95.192904][ T6121] nvme nvme12: Removing ctrl: NQN "testnqn"
[   95.363173][ T6122] nvme nvme40: Removing ctrl: NQN "testnqn"
[   95.442892][ T6121] nvme nvme49: Removing ctrl: NQN "testnqn"
[   95.623510][ T6122] nvme nvme4: Removing ctrl: NQN "testnqn"
[   95.674939][ T6121] nvme nvme10: Removing ctrl: NQN "testnqn"
[   95.852979][ T6122] nvme nvme39: Removing ctrl: NQN "testnqn"
[   95.913144][ T6121] nvme nvme47: Removing ctrl: NQN "testnqn"
[   96.082525][ T6122] nvme nvme2: Removing ctrl: NQN "testnqn"
[   96.163055][ T6121] nvme nvme37: Removing ctrl: NQN "testnqn"
[   96.342743][ T6122] nvme nvme55: Removing ctrl: NQN "testnqn"
[   96.414745][ T6121] nvme nvme17: Removing ctrl: NQN "testnqn"
[   96.562488][ T6122] nvme nvme45: Removing ctrl: NQN "testnqn"
[   96.662435][ T6121] nvme nvme35: Removing ctrl: NQN "testnqn"
[   96.832576][ T6122] nvme nvme53: Removing ctrl: NQN "testnqn"
[   96.903430][ T6121] nvme nvme9: Removing ctrl: NQN "testnqn"
[   97.082596][ T6122] nvme nvme15: Removing ctrl: NQN "testnqn"
[   97.142733][ T6121] nvme nvme43: Removing ctrl: NQN "testnqn"
[*] Cleaning up...
[   97.423653][   T34] audit: type=1400 audit(1790188270.109:271): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="/" dev="configfs" ino=1091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423691][   T34] audit: type=1400 audit(1790188270.109:272): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="nvmet" dev="configfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423774][   T34] audit: type=1400 audit(1790188270.109:273): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="ports" dev="configfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423850][   T34] audit: type=1400 audit(1790188270.109:274): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="1" dev="configfs" ino=7740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423964][   T34] audit: type=1400 audit(1790188270.109:275): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="subsystems" dev="configfs" ino=7741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.425869][   T34] audit: type=1400 audit(1790188270.109:276): avc:  denied  { write search } for  pid=5864 comm="syz-executor994" name="subsystems" dev="configfs" ino=7741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.426281][   T34] audit: type=1400 audit(1790188270.109:277): avc:  denied  { remove_name } for  pid=5864 comm="syz-executor994" name="testnqn" dev="configfs" ino=7746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.427172][   T34] audit: type=1400 audit(1790188270.109:278): avc:  denied  { unlink } for  pid=5864 comm="syz-executor994" name="testnqn" dev="configfs" ino=7746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   97.429551][ T6000] nvme nvme19: Removing ctrl: NQN "testnqn"
[   97.434179][   T29] nvme nvme20: Removing ctrl: NQN "testnqn"
[   97.439608][ T6164] nvme nvme25: Removing ctrl: NQN "testnqn"
[   97.442994][ T6149] nvme nvme22: Removing ctrl: NQN "testnqn"
[   97.443084][ T6047] nvme nvme27: Removing ctrl: NQN "testnqn"
[   97.450813][ T1117] nvme nvme29: Removing ctrl: NQN "testnqn"
[   97.455714][ T1126] nvme nvme30: Removing ctrl: NQN "testnqn"
[   97.455808][ T5960] nvme nvme23: Removing ctrl: NQN "testnqn"
[   97.455865][ T5970] nvme nvme33: Removing ctrl: NQN "testnqn"
[   97.456017][ T6059] nvme nvme58: Removing ctrl: NQN "testnqn"
[   97.456068][ T6044] nvme nvme59: Removing ctrl: NQN "testnqn"
[   97.456116][ T6153] nvme nvme60: Removing ctrl: NQN "testnqn"
[   97.458852][ T5959] nvme nvme57: Removing ctrl: NQN "testnqn"
[   97.458962][ T6190] nvme nvme61: Removing ctrl: NQN "testnqn"
[   97.463523][ T6048] nvme nvme62: Removing ctrl: NQN "testnqn"
[   97.463853][ T1110] nvme nvme63: Removing ctrl: NQN "testnqn"
[   97.464181][ T1122] nvme nvme64: Removing ctrl: NQN "testnqn"
[   97.464244][ T5962] nvme nvme51: Removing ctrl: NQN "testnqn"
[   97.464300][ T1113] nvme nvme65: Removing ctrl: NQN "testnqn"
[   97.464509][ T6156] nvme nvme66: Removing ctrl: NQN "testnqn"
[   97.472508][ T5965] nvme nvme67: Removing ctrl: NQN "testnqn"
[   97.476129][ T6026] nvme nvme68: Removing ctrl: NQN "testnqn"
[   97.481749][ T6182] nvme nvme69: Removing ctrl: NQN "testnqn"
[   97.489334][ T6188] nvme nvme70: Removing ctrl: NQN "testnqn"
[   97.498375][ T6165] nvme nvme71: Removing ctrl: NQN "testnqn"
[   97.500421][ T6181] nvme nvme72: Removing ctrl: NQN "testnqn"
[   97.502399][ T1046] nvme nvme73: Removing ctrl: NQN "testnqn"
[   97.504574][ T6192] nvme nvme74: Removing ctrl: NQN "testnqn"
[   97.506522][ T6168] nvme nvme75: Removing ctrl: NQN "testnqn"
[   97.508478][ T6183] nvme nvme76: Removing ctrl: NQN "testnqn"
[   97.511372][ T6148] nvme nvme77: Removing ctrl: NQN "testnqn"
[   97.521398][ T6077] nvme nvme78: Removing ctrl: NQN "testnqn"
[   97.524281][ T6173] nvme nvme79: Removing ctrl: NQN "testnqn"
[   97.526259][ T6046] nvme nvme7: Removing ctrl: NQN "testnqn"
[   97.531409][ T5973] nvme nvme80: Removing ctrl: NQN "testnqn"
[   97.541458][ T6034] nvme nvme81: Removing ctrl: NQN "testnqn"
[   97.546247][ T6040] nvme nvme82: Removing ctrl: NQN "testnqn"
[   97.549978][ T5968] nvme nvme13: Removing ctrl: NQN "testnqn"
[   97.551996][ T6057] nvme nvme83: Removing ctrl: NQN "testnqn"
[   97.553987][ T6045] nvme nvme84: Removing ctrl: NQN "testnqn"
[   97.561511][ T1116] nvme nvme85: Removing ctrl: NQN "testnqn"
[   97.562314][ T6049] nvme nvme86: Removing ctrl: NQN "testnqn"
[   97.564080][ T6140] nvme nvme87: Removing ctrl: NQN "testnqn"
[   97.565860][ T5946] nvme nvme88: Removing ctrl: NQN "testnqn"
[   98.585017][  T137] nvme nvme87: long keepalive RTT (4294768766 ms)
[   98.585105][  T137] nvme nvme87: failed nvme_keep_alive_end_io error=4
[   98.617439][ T6201] nvme nvme68: long keepalive RTT (4294768796 ms)
[   98.641489][ T6201] nvme nvme68: failed nvme_keep_alive_end_io error=4
[   99.555808][   T34] audit: type=1400 audit(1790188272.239:279): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="/" dev="configfs" ino=1091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   99.555848][   T34] audit: type=1400 audit(1790188272.239:280): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="nvmet" dev="configfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
 TruncatedCrashReport:------------[ cut here ]------------
timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist)
WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706, CPU#0: kworker/u10:157/6412
Modules linked in:
CPU: 0 UID: 0 PID: 6412 Comm: kworker/u10:157 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme-delete-wq nvme_delete_ctrl_work
RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706
Code: 15 8b 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00
RSP: 0018:ffffc900068579b8 EFLAGS: 00010202
RAX: 1ffffd1fd788fc15 RBX: 0000607d17814fc0 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffe8febc47dfc0 R08: ffffffff90838d7f R09: 1ffffffff21071af
R10: dffffc0000000000 R11: fffffbfff21071b0 R12: ffff88818eb07000
R13: 0000000000000000 R14: ffffe8febc47e0a8 R15: 1ffffffff1cc4fde
FS:  0000000000000000(0000) GS:ffff8881a4c69000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558a63e067c8 CR3: 00000001feb70000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 blk_mq_free_tag_set+0x617/0x790 block/blk-mq.c:4976
 nvme_do_delete_ctrl+0x246/0x320 drivers/nvme/host/core.c:252
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
 TruncatedStraceOutput:[   97.385744][ T6123] nvme nvme16: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1)            = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   97.614550][ T6123] nvme nvme8: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme26/delete_controller", O_WRONLY) = 3
[   97.636120][ T6122] nvme nvme26: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1)            = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme16/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme24/delete_controller", O_WRONLY) = 3
[   97.924549][ T6122] nvme nvme24: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme14/delete_controller", O_WRONLY) = 4
[   98.006848][ T6123] nvme nvme14: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme14/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme22/delete_controller", O_WRONLY) = 3
[   98.187390][ T6122] nvme nvme22: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   98.205542][ T6123] nvme nvme6: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme12/delete_controller", O_WRONLY) = 3
[   98.418421][ T6122] nvme nvme12: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme12/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme20/delete_controller", O_WRONLY) = 4
[   98.456591][ T6123] nvme nvme20: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1)            = 1
[pid  6122] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme20/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 3
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] write(3, "1", 1)            = -1 ENODEV (No such device)
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme10/delete_controller", O_WRONLY) = 3
[   98.678187][ T6123] nvme nvme4: Removing ctrl: NQN "testnqn"
[   98.680807][ T6122] nvme nvme10: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1)            = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme19/delete_controller", O_WRONLY) = 3
[   98.919191][ T6122] nvme nvme19: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme10/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme19/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   98.969804][ T6123] nvme nvme2: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme27/delete_controller", O_WRONLY) = 3
[   99.174465][ T6122] nvme nvme27: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme17/delete_controller", O_WRONLY) = 4
[   99.235679][ T6123] nvme nvme17: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme17/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme25/delete_controller", O_WRONLY) = 3
[   99.447806][ T6122] nvme nvme25: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme63/delete_controller", O_WRONLY) = 4
[   99.517663][ T6123] nvme nvme63: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 3
[   99.668989][ T6122] nvme nvme9: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme15/delete_controller", O_WRONLY) = 4
[   99.735336][ T6123] nvme nvme15: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme15/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] getdents64(8, 0x7f17dc000ba0 /* 0 entries */, 32768) = 0
[pid  6122] close(8)                    = 0
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] getdents64(16, 0x7f17e0000ba0 /* 0 entries */, 32768) = 0
[pid  6123] close(16)                   = 0
[pid  6122] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6122] madvise(0x7f17e99b7000, 8372224, MADV_DONTNEED) = 0
[pid  6122] exit(0)                     = ?
[pid  6122] +++ exited with 0 +++
[pid  5884] <... futex resumed>)        = 0
[pid  5884] munmap(0x7f17eb9bb000, 8392704) = 0
[pid  5884] futex(0x7f17e99b6990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6123, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6123] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6123] madvise(0x7f17e91b6000, 8372224, MADV_DONTNEED) = 0
[pid  6123] exit(0)                     = ?
[pid  6123] +++ exited with 0 +++
<... futex resumed>)                    = 0
munmap(0x7f17eb1ba000, 8392704)         = 0
write(1, "[*] Cleaning up...", 18)      = 18
write(1, "\n", 1)                       = 1
[*] Cleaning up...
[  100.043623][   T34] audit: type=1400 audit(1790188391.568:274): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="/" dev="configfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043653][   T34] audit: type=1400 audit(1790188391.568:275): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="nvmet" dev="configfs" ino=3417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043670][   T34] audit: type=1400 audit(1790188391.568:276): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="ports" dev="configfs" ino=3419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043686][   T34] audit: type=1400 audit(1790188391.568:277): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="1" dev="configfs" ino=8384 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043703][   T34] audit: type=1400 audit(1790188391.568:278): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="subsystems" dev="configfs" ino=8385 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043721][   T34] audit: type=1400 audit(1790188391.568:279): avc:  denied  { write search } for  pid=5884 comm="syz-executor250" name="subsystems" dev="configfs" ino=8385 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.044217][   T34] audit: type=1400 audit(1790188391.568:280): avc:  denied  { remove_name } for  pid=5884 comm="syz-executor250" name="testnqn" dev="configfs" ino=8390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.044352][   T34] audit: type=1400 audit(1790188391.568:281): avc:  denied  { unlink } for  pid=5884 comm="syz-executor250" name="testnqn" dev="configfs" ino=8390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[  100.046950][ T5968] nvme nvme29: Removing ctrl: NQN "testnqn"
[  100.048965][ T6046] nvme nvme30: Removing ctrl: NQN "testnqn"
[  100.050032][ T5981] nvme nvme31: Removing ctrl: NQN "testnqn"
[  100.050139][ T6103] nvme nvme32: Removing ctrl: NQN "testnqn"
[  100.051217][ T6074] nvme nvme33: Removing ctrl: NQN "testnqn"
[  100.052621][ T6054] nvme nvme34: Removing ctrl: NQN "testnqn"
[  100.052675][   T52] nvme nvme35: Removing ctrl: NQN "testnqn"
[  100.052728][ T5976] nvme nvme36: Removing ctrl: NQN "testnqn"
[  100.052829][ T6068] nvme nvme38: Removing ctrl: NQN "testnqn"
[  100.062459][ T5984] nvme nvme37: Removing ctrl: NQN "testnqn"
[  100.062953][ T6027] nvme nvme39: Removing ctrl: NQN "testnqn"
[  100.076480][ T5993] nvme nvme23: Removing ctrl: NQN "testnqn"
[  100.080511][ T1109] nvme nvme40: Removing ctrl: NQN "testnqn"
[  100.101233][ T6085] nvme nvme41: Removing ctrl: NQN "testnqn"
[  100.101326][ T6077] nvme nvme42: Removing ctrl: NQN "testnqn"
[  100.101454][ T1107] nvme nvme43: Removing ctrl: NQN "testnqn"
[  100.105263][ T6028] nvme nvme44: Removing ctrl: NQN "testnqn"
[  100.117574][ T6022] nvme nvme45: Removing ctrl: NQN "testnqn"
[  100.124230][ T5958] nvme nvme46: Removing ctrl: NQN "testnqn"
[  100.129741][ T6049] nvme nvme47: Removing ctrl: NQN "testnqn"
[  100.139655][ T5912] nvme nvme48: Removing ctrl: NQN "testnqn"
[  100.152413][ T6062] nvme nvme7: Removing ctrl: NQN "testnqn"
[  100.154215][ T5999] nvme nvme49: Removing ctrl: NQN "testnqn"
[  100.173363][ T5966] nvme nvme50: Removing ctrl: NQN "testnqn"
[  100.176161][ T6032] nvme nvme51: Removing ctrl: NQN "testnqn"
[  100.177309][ T6240] nvme nvme52: Removing ctrl: NQN "testnqn"
[  100.177592][ T5985] nvme nvme53: Removing ctrl: NQN "testnqn"
[  100.177651][ T6080] nvme nvme54: Removing ctrl: NQN "testnqn"
[  100.177698][ T6036] nvme nvme55: Removing ctrl: NQN "testnqn"
[  100.179244][ T5911] nvme nvme56: Removing ctrl: NQN "testnqn"
[  100.179308][ T6005] nvme nvme13: Removing ctrl: NQN "testnqn"
[  100.179358][ T6094] nvme nvme57: Removing ctrl: NQN "testnqn"
[  100.179411][ T6090] nvme nvme58: Removing ctrl: NQN "testnqn"
[  100.179459][ T6060] nvme nvme59: Removing ctrl: NQN "testnqn"
[  100.179502][ T6109] nvme nvme60: Removing ctrl: NQN "testnqn"
[  100.179544][ T1108] nvme nvme61: Removing ctrl: NQN "testnqn"
[  100.179591][ T6052] nvme nvme21: Removing ctrl: NQN "testnqn"
[  100.179730][ T6001] nvme nvme64: Removing ctrl: NQN "testnqn"
[  100.179769][ T5990] nvme nvme62: Removing ctrl: NQN "testnqn"
[  100.179846][ T5980] nvme nvme65: Removing ctrl: NQN "testnqn"
[  100.179895][ T6105] nvme nvme66: Removing ctrl: NQN "testnqn"
[  100.179937][ T6040] nvme nvme67: Removing ctrl: NQN "testnqn"
[  100.180573][ T5909] nvme nvme68: Removing ctrl: NQN "testnqn"
[  100.180629][ T5982] nvme nvme69: Removing ctrl: NQN "testnqn"
[  100.181743][ T6089] nvme nvme70: Removing ctrl: NQN "testnqn"
[  100.200250][ T6008] nvme nvme71: Removing ctrl: NQN "testnqn"
[  100.221830][   T35] nvme nvme72: Removing ctrl: NQN "testnqn"
[  100.239655][ T6043] nvme nvme73: Removing ctrl: NQN "testnqn"
[  100.239865][ T6069] nvme nvme74: Removing ctrl: NQN "testnqn"
[  100.240468][ T6057] nvme nvme75: Removing ctrl: NQN "testnqn"
[  100.329994][ T6007] nvme nvme33: long keepalive RTT (4294770536 ms)
[  100.330011][ T6007] nvme nvme33: failed nvme_keep_alive_end_io error=4
unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") = 0
rmdir("/sys/kernel/config/nvmet/ports/1") = 0
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY) = 3
[  101.918371][   T34] audit: type=1400 audit(1790188393.438:282): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="/" dev="configfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  101.918399][   T34] audit: type=1400 audit(1790188393.438:283): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="nvmet" dev="configfs" ino=3417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
write(3, "0", 1)                        = 1
close(3)                                = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1") = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn") = 0
unlink("/tmp/nvme_backing")             = 0
exit_group(0)                           = ?
+++ exited with 0 +++
]

deep-reasoning

map[Feedback:The execution triggered a crash, but it does not match the expected bug.

Expected bug: WARNING: bad unlock balance in nvme_update_ns_info (a lockdep warning on `q->q_usage_counter` during `blk_mq_unfreeze_queue`).
Triggered bug: WARNING in `cleanup_srcu_struct` called from `blk_mq_free_tag_set` during `nvme_do_delete_ctrl`.

This is a collision with a different NVMe-related bug (likely related to SRCU cleanup during controller teardown). The expected bug occurs during namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`), where an imbalance between freezing and unfreezing the request queue happens. 

To improve the reproducer and avoid this collision, you should focus on triggering concurrent namespace updates, rescans, or changes to namespace attributes, possibly combined with controller resets or error injection during `nvme_update_ns_info`. The current strategy of rapidly creating and deleting controllers hits the SRCU teardown bug first, preventing the target bug from being reached. ProbePassed:false TerminalError: TitleMatches:false]

You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.

=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
   that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
   meaning the codebase version is mismatched and the target code is absent.

=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
  or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.


=== PHASE 2: BUG REPRODUCTION (EVALUATION) ===
The executed program was a full reproducer candidate attempting to trigger the target bug/crash.
Use this to guide your classification and feedback:
1. If a crash was triggered (Reproduced is true):
   - Determine if the triggered crash matches the expected bug.
   - If you conclude they represent the same underlying bug (the same root cause)
     despite different titles, crash signatures, or call traces, set TitleMatches
     to true and provide a detailed, technical, and verbose explanation of the
     equivalence in the 'Feedback' field.
   - If they do not represent the same bug (a completely unrelated crash/collision),
     set TitleMatches to false and explain the collision in 'Feedback'.
   - If they match exactly, set TitleMatches to true and provide a brief confirmation in 'Feedback'.
2. If the execution was successful (exit 0) WITHOUT a crash (Reproduced is false):
   - The reproduction attempt failed to trigger the bug. Analyze the console/strace output
     to understand why the bug did not trigger (e.g., timing, input arguments, environment setup)
     and provide feedback on how to improve the reproducer logic to trigger the crash.

Critical Diagnostic Rule for Reproduction Failures:
If the reproduction attempt fails (e.g., a system call returns an error, or a
warning/error message appears in the console log), you MUST:
1. Identify the failing system call from the execution trace or strace output.
2. Identify any corresponding warning or error messages in the console log.
3. Provide a clear technical diagnosis in the feedback identifying the failing call,
   return code (errno), and error messages so the strategy-refiner can analyze the root cause.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

IsProbe: false
Reproduced: true
Console Output: [   87.728654][ T6113] nvme nvme64: creating 2 I/O queues.
[   87.732418][ T6122] nvme nvme7: Removing ctrl: NQN "testnqn"
[   87.752568][ T6113] nvme nvme64: new ctrl: "testnqn"
[   87.821499][ T6162] nvmet: Created nvm controller 64 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.826114][ T6115] nvme nvme51: creating 2 I/O queues.
[   87.839707][ T6115] nvme nvme51: new ctrl: "testnqn"
[   87.990924][ T6105] nvmet: Created nvm controller 26 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   87.999047][ T6116] nvme nvme65: creating 2 I/O queues.
[   88.010791][ T6116] nvme nvme65: new ctrl: "testnqn"
[   88.066999][ T5956] nvmet: Created nvm controller 65 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.091174][ T6112] nvme nvme66: creating 2 I/O queues.
[   88.115101][ T6112] nvme nvme66: new ctrl: "testnqn"
[   88.163892][ T6121] nvme nvme41: Removing ctrl: NQN "testnqn"
[   88.189659][ T1116] nvmet: Created nvm controller 66 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.191447][ T6113] nvme nvme13: creating 2 I/O queues.
[   88.202699][ T6113] nvme nvme13: new ctrl: "testnqn"
[   88.250633][ T6168] nvmet: Created nvm controller 67 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.262441][ T6115] nvme nvme67: creating 2 I/O queues.
[   88.266809][ T6115] nvme nvme67: new ctrl: "testnqn"
[   88.349986][ T6038] nvmet: Created nvm controller 68 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.350850][ T6115] nvme nvme68: creating 2 I/O queues.
[   88.368777][ T6115] nvme nvme68: new ctrl: "testnqn"
[   88.502578][ T5941] nvmet: Created nvm controller 69 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.513810][ T6116] nvme nvme69: creating 2 I/O queues.
[   88.525120][ T6116] nvme nvme69: new ctrl: "testnqn"
[   88.596094][ T6183] nvmet: Created nvm controller 70 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.598983][ T6116] nvme nvme70: creating 2 I/O queues.
[   88.617012][ T6116] nvme nvme70: new ctrl: "testnqn"
[   88.690383][ T6126] nvmet: Created nvm controller 71 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.710156][ T6112] nvme nvme71: creating 2 I/O queues.
[   88.719136][ T6112] nvme nvme71: new ctrl: "testnqn"
[   88.759685][ T5950] nvmet: Created nvm controller 72 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.767794][ T6113] nvme nvme72: creating 2 I/O queues.
[   88.777684][ T6113] nvme nvme72: new ctrl: "testnqn"
[   88.824681][ T5950] nvmet: Created nvm controller 73 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.829130][ T6115] nvme nvme73: creating 2 I/O queues.
[   88.844939][ T6115] nvme nvme73: new ctrl: "testnqn"
[   88.888344][ T5965] nvmet: Created nvm controller 74 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.890386][ T6116] nvme nvme74: creating 2 I/O queues.
[   88.917082][ T6116] nvme nvme74: new ctrl: "testnqn"
[   88.955970][ T6152] nvmet: Created nvm controller 75 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   88.956944][ T6116] nvme nvme75: creating 2 I/O queues.
[   88.959557][ T6116] nvme nvme75: new ctrl: "testnqn"
[   89.061741][ T6159] nvmet: Created nvm controller 41 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.062588][ T6112] nvme nvme76: creating 2 I/O queues.
[   89.086138][ T6112] nvme nvme76: new ctrl: "testnqn"
[   89.120679][   T65] nvmet: Created nvm controller 76 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.138631][ T6112] nvme nvme77: creating 2 I/O queues.
[   89.156592][ T6112] nvme nvme77: new ctrl: "testnqn"
[   89.247592][ T6125] nvmet: Created nvm controller 77 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.254216][ T6113] nvme nvme78: creating 2 I/O queues.
[   89.268126][ T6113] nvme nvme78: new ctrl: "testnqn"
[   89.293125][ T6121] nvme nvme31: Removing ctrl: NQN "testnqn"
[   89.340402][ T5910] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.361045][ T6113] nvme nvme41: creating 2 I/O queues.
[   89.368355][ T6113] nvme nvme41: new ctrl: "testnqn"
[   89.469158][ T6037] nvmet: Created nvm controller 78 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.477066][ T6115] nvme nvme79: creating 2 I/O queues.
[   89.484310][ T6115] nvme nvme79: new ctrl: "testnqn"
[   89.499551][ T6122] nvme nvme13: Removing ctrl: NQN "testnqn"
[   89.611391][ T6180] nvmet: Created nvm controller 79 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.641683][ T6115] nvme nvme7: creating 2 I/O queues.
[   89.644360][ T6115] nvme nvme7: new ctrl: "testnqn"
[   89.780735][ T5989] nvmet: Created nvm controller 80 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.788390][ T6116] nvme nvme80: creating 2 I/O queues.
[   89.797248][ T6116] nvme nvme80: new ctrl: "testnqn"
[   89.923073][ T5973] nvmet: Created nvm controller 66 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   89.928504][ T6116] nvme nvme81: creating 2 I/O queues.
[   89.960084][ T6116] nvme nvme81: new ctrl: "testnqn"
[   90.084654][ T6071] nvmet: Created nvm controller 81 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.091613][ T6112] nvme nvme82: creating 2 I/O queues.
[   90.100535][ T6122] nvme nvme41: Removing ctrl: NQN "testnqn"
[   90.100686][ T6112] nvme nvme82: new ctrl: "testnqn"
[   90.223870][ T6134] nvmet: Created nvm controller 82 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.224627][ T6112] nvme nvme13: creating 2 I/O queues.
[   90.229535][ T6112] nvme nvme13: new ctrl: "testnqn"
[   90.337233][ T6083] nvmet: Created nvm controller 83 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.340558][ T6113] nvme nvme83: creating 2 I/O queues.
[   90.364072][ T6113] nvme nvme83: new ctrl: "testnqn"
[   90.443360][ T1033] nvmet: Created nvm controller 31 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.448645][ T6113] nvme nvme84: creating 2 I/O queues.
[   90.457492][ T6113] nvme nvme84: new ctrl: "testnqn"
[   90.596375][ T5950] nvmet: Created nvm controller 84 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.605977][ T6115] nvme nvme85: creating 2 I/O queues.
[   90.615959][ T6115] nvme nvme85: new ctrl: "testnqn"
[   90.660964][ T6121] nvme nvme21: Removing ctrl: NQN "testnqn"
[   90.674931][ T6124] nvmet: Created nvm controller 85 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.684213][ T6116] nvme nvme31: creating 2 I/O queues.
[   90.715431][ T6116] nvme nvme31: new ctrl: "testnqn"
[   90.769688][ T6243] nvmet: Created nvm controller 86 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.770845][ T6112] nvme nvme86: creating 2 I/O queues.
[   90.778093][ T6112] nvme nvme86: new ctrl: "testnqn"
[   90.818886][ T6162] nvmet: Created nvm controller 87 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.819804][ T6113] nvme nvme87: creating 2 I/O queues.
[   90.826178][ T6113] nvme nvme87: new ctrl: "testnqn"
[   90.861135][ T5982] nvmet: Created nvm controller 62 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:2edc7337-de2e-4ec6-8215-39f2f4567877.
[   90.863309][ T6115] nvme nvme88: creating 2 I/O queues.
[   90.870541][ T6115] nvme nvme88: new ctrl: "testnqn"
[   90.962433][ T6122] nvme nvme31: Removing ctrl: NQN "testnqn"
[   91.802417][ T6121] nvme nvme5: Removing ctrl: NQN "testnqn"
[   92.122915][ T6122] nvme nvme11: Removing ctrl: NQN "testnqn"
[   92.473738][ T6122] nvme nvme48: Removing ctrl: NQN "testnqn"
[   92.812620][ T6121] nvme nvme3: Removing ctrl: NQN "testnqn"
[   92.822807][ T6122] nvme nvme38: Removing ctrl: NQN "testnqn"
[   93.003821][ T6121] nvme nvme28: Removing ctrl: NQN "testnqn"
[   93.062772][ T6122] nvme nvme56: Removing ctrl: NQN "testnqn"
[   93.263057][ T6122] nvme nvme18: Removing ctrl: NQN "testnqn"
[   93.263449][ T6121] nvme nvme46: Removing ctrl: NQN "testnqn"
[   93.503664][ T6121] nvme nvme1: Removing ctrl: NQN "testnqn"
[   93.533174][ T6122] nvme nvme36: Removing ctrl: NQN "testnqn"
[   93.729925][ T6121] nvme nvme26: Removing ctrl: NQN "testnqn"
[   93.762869][ T6122] nvme nvme54: Removing ctrl: NQN "testnqn"
[   93.972341][ T6122] nvme nvme16: Removing ctrl: NQN "testnqn"
[   93.983004][ T6121] nvme nvme44: Removing ctrl: NQN "testnqn"
[   94.204124][ T6122] nvme nvme34: Removing ctrl: NQN "testnqn"
[   94.262458][ T6121] nvme nvme24: Removing ctrl: NQN "testnqn"
[   94.412433][ T6122] nvme nvme52: Removing ctrl: NQN "testnqn"
[   94.512638][ T6121] nvme nvme8: Removing ctrl: NQN "testnqn"
[   94.662475][ T6122] nvme nvme14: Removing ctrl: NQN "testnqn"
[   94.732592][ T6121] nvme nvme42: Removing ctrl: NQN "testnqn"
[   94.902583][ T6122] nvme nvme32: Removing ctrl: NQN "testnqn"
[   94.982572][ T6121] nvme nvme50: Removing ctrl: NQN "testnqn"
[   95.114595][ T6122] nvme nvme6: Removing ctrl: NQN "testnqn"
[   95.192904][ T6121] nvme nvme12: Removing ctrl: NQN "testnqn"
[   95.363173][ T6122] nvme nvme40: Removing ctrl: NQN "testnqn"
[   95.442892][ T6121] nvme nvme49: Removing ctrl: NQN "testnqn"
[   95.623510][ T6122] nvme nvme4: Removing ctrl: NQN "testnqn"
[   95.674939][ T6121] nvme nvme10: Removing ctrl: NQN "testnqn"
[   95.852979][ T6122] nvme nvme39: Removing ctrl: NQN "testnqn"
[   95.913144][ T6121] nvme nvme47: Removing ctrl: NQN "testnqn"
[   96.082525][ T6122] nvme nvme2: Removing ctrl: NQN "testnqn"
[   96.163055][ T6121] nvme nvme37: Removing ctrl: NQN "testnqn"
[   96.342743][ T6122] nvme nvme55: Removing ctrl: NQN "testnqn"
[   96.414745][ T6121] nvme nvme17: Removing ctrl: NQN "testnqn"
[   96.562488][ T6122] nvme nvme45: Removing ctrl: NQN "testnqn"
[   96.662435][ T6121] nvme nvme35: Removing ctrl: NQN "testnqn"
[   96.832576][ T6122] nvme nvme53: Removing ctrl: NQN "testnqn"
[   96.903430][ T6121] nvme nvme9: Removing ctrl: NQN "testnqn"
[   97.082596][ T6122] nvme nvme15: Removing ctrl: NQN "testnqn"
[   97.142733][ T6121] nvme nvme43: Removing ctrl: NQN "testnqn"
[*] Cleaning up...
[   97.423653][   T34] audit: type=1400 audit(1790188270.109:271): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="/" dev="configfs" ino=1091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423691][   T34] audit: type=1400 audit(1790188270.109:272): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="nvmet" dev="configfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423774][   T34] audit: type=1400 audit(1790188270.109:273): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="ports" dev="configfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423850][   T34] audit: type=1400 audit(1790188270.109:274): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="1" dev="configfs" ino=7740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.423964][   T34] audit: type=1400 audit(1790188270.109:275): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="subsystems" dev="configfs" ino=7741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.425869][   T34] audit: type=1400 audit(1790188270.109:276): avc:  denied  { write search } for  pid=5864 comm="syz-executor994" name="subsystems" dev="configfs" ino=7741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.426281][   T34] audit: type=1400 audit(1790188270.109:277): avc:  denied  { remove_name } for  pid=5864 comm="syz-executor994" name="testnqn" dev="configfs" ino=7746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   97.427172][   T34] audit: type=1400 audit(1790188270.109:278): avc:  denied  { unlink } for  pid=5864 comm="syz-executor994" name="testnqn" dev="configfs" ino=7746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[   97.429551][ T6000] nvme nvme19: Removing ctrl: NQN "testnqn"
[   97.434179][   T29] nvme nvme20: Removing ctrl: NQN "testnqn"
[   97.439608][ T6164] nvme nvme25: Removing ctrl: NQN "testnqn"
[   97.442994][ T6149] nvme nvme22: Removing ctrl: NQN "testnqn"
[   97.443084][ T6047] nvme nvme27: Removing ctrl: NQN "testnqn"
[   97.450813][ T1117] nvme nvme29: Removing ctrl: NQN "testnqn"
[   97.455714][ T1126] nvme nvme30: Removing ctrl: NQN "testnqn"
[   97.455808][ T5960] nvme nvme23: Removing ctrl: NQN "testnqn"
[   97.455865][ T5970] nvme nvme33: Removing ctrl: NQN "testnqn"
[   97.456017][ T6059] nvme nvme58: Removing ctrl: NQN "testnqn"
[   97.456068][ T6044] nvme nvme59: Removing ctrl: NQN "testnqn"
[   97.456116][ T6153] nvme nvme60: Removing ctrl: NQN "testnqn"
[   97.458852][ T5959] nvme nvme57: Removing ctrl: NQN "testnqn"
[   97.458962][ T6190] nvme nvme61: Removing ctrl: NQN "testnqn"
[   97.463523][ T6048] nvme nvme62: Removing ctrl: NQN "testnqn"
[   97.463853][ T1110] nvme nvme63: Removing ctrl: NQN "testnqn"
[   97.464181][ T1122] nvme nvme64: Removing ctrl: NQN "testnqn"
[   97.464244][ T5962] nvme nvme51: Removing ctrl: NQN "testnqn"
[   97.464300][ T1113] nvme nvme65: Removing ctrl: NQN "testnqn"
[   97.464509][ T6156] nvme nvme66: Removing ctrl: NQN "testnqn"
[   97.472508][ T5965] nvme nvme67: Removing ctrl: NQN "testnqn"
[   97.476129][ T6026] nvme nvme68: Removing ctrl: NQN "testnqn"
[   97.481749][ T6182] nvme nvme69: Removing ctrl: NQN "testnqn"
[   97.489334][ T6188] nvme nvme70: Removing ctrl: NQN "testnqn"
[   97.498375][ T6165] nvme nvme71: Removing ctrl: NQN "testnqn"
[   97.500421][ T6181] nvme nvme72: Removing ctrl: NQN "testnqn"
[   97.502399][ T1046] nvme nvme73: Removing ctrl: NQN "testnqn"
[   97.504574][ T6192] nvme nvme74: Removing ctrl: NQN "testnqn"
[   97.506522][ T6168] nvme nvme75: Removing ctrl: NQN "testnqn"
[   97.508478][ T6183] nvme nvme76: Removing ctrl: NQN "testnqn"
[   97.511372][ T6148] nvme nvme77: Removing ctrl: NQN "testnqn"
[   97.521398][ T6077] nvme nvme78: Removing ctrl: NQN "testnqn"
[   97.524281][ T6173] nvme nvme79: Removing ctrl: NQN "testnqn"
[   97.526259][ T6046] nvme nvme7: Removing ctrl: NQN "testnqn"
[   97.531409][ T5973] nvme nvme80: Removing ctrl: NQN "testnqn"
[   97.541458][ T6034] nvme nvme81: Removing ctrl: NQN "testnqn"
[   97.546247][ T6040] nvme nvme82: Removing ctrl: NQN "testnqn"
[   97.549978][ T5968] nvme nvme13: Removing ctrl: NQN "testnqn"
[   97.551996][ T6057] nvme nvme83: Removing ctrl: NQN "testnqn"
[   97.553987][ T6045] nvme nvme84: Removing ctrl: NQN "testnqn"
[   97.561511][ T1116] nvme nvme85: Removing ctrl: NQN "testnqn"
[   97.562314][ T6049] nvme nvme86: Removing ctrl: NQN "testnqn"
[   97.564080][ T6140] nvme nvme87: Removing ctrl: NQN "testnqn"
[   97.565860][ T5946] nvme nvme88: Removing ctrl: NQN "testnqn"
[   98.585017][  T137] nvme nvme87: long keepalive RTT (4294768766 ms)
[   98.585105][  T137] nvme nvme87: failed nvme_keep_alive_end_io error=4
[   98.617439][ T6201] nvme nvme68: long keepalive RTT (4294768796 ms)
[   98.641489][ T6201] nvme nvme68: failed nvme_keep_alive_end_io error=4
[   99.555808][   T34] audit: type=1400 audit(1790188272.239:279): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="/" dev="configfs" ino=1091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   99.555848][   T34] audit: type=1400 audit(1790188272.239:280): avc:  denied  { search } for  pid=5864 comm="syz-executor994" name="nvmet" dev="configfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1

Strace Output: [   97.385744][ T6123] nvme nvme16: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1)            = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = 4
[   97.614550][ T6123] nvme nvme8: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme26/delete_controller", O_WRONLY) = 3
[   97.636120][ T6122] nvme nvme26: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1)            = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme16/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme24/delete_controller", O_WRONLY) = 3
[   97.924549][ T6122] nvme nvme24: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme14/delete_controller", O_WRONLY) = 4
[   98.006848][ T6123] nvme nvme14: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme8/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme14/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme22/delete_controller", O_WRONLY) = 3
[   98.187390][ T6122] nvme nvme22: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = 4
[   98.205542][ T6123] nvme nvme6: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme6/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme12/delete_controller", O_WRONLY) = 3
[   98.418421][ T6122] nvme nvme12: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme12/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme20/delete_controller", O_WRONLY) = 4
[   98.456591][ T6123] nvme nvme20: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1)            = 1
[pid  6122] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 4
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme20/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme4/delete_controller", O_WRONLY) = 3
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] write(3, "1", 1)            = -1 ENODEV (No such device)
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme10/delete_controller", O_WRONLY) = 3
[   98.678187][ T6123] nvme nvme4: Removing ctrl: NQN "testnqn"
[   98.680807][ T6122] nvme nvme10: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1)            = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme19/delete_controller", O_WRONLY) = 3
[   98.919191][ T6122] nvme nvme19: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme10/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme19/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = 4
[   98.969804][ T6123] nvme nvme2: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme2/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme27/delete_controller", O_WRONLY) = 3
[   99.174465][ T6122] nvme nvme27: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme17/delete_controller", O_WRONLY) = 4
[   99.235679][ T6123] nvme nvme17: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme17/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme25/delete_controller", O_WRONLY) = 3
[   99.447806][ T6122] nvme nvme25: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme63/delete_controller", O_WRONLY) = 4
[   99.517663][ T6123] nvme nvme63: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = 3
[   99.668989][ T6122] nvme nvme9: Removing ctrl: NQN "testnqn"
[pid  6122] write(3, "1", 1 <unfinished ...>
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme9/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6123] openat(AT_FDCWD, "/sys/class/nvme/nvme15/delete_controller", O_WRONLY) = 4
[   99.735336][ T6123] nvme nvme15: Removing ctrl: NQN "testnqn"
[pid  6123] write(4, "1", 1 <unfinished ...>
[pid  6122] <... write resumed>)        = 1
[pid  6122] close(3)                    = 0
[pid  6122] openat(AT_FDCWD, "/sys/class/nvme/nvme15/delete_controller", O_WRONLY) = -1 ENOENT (No such file or directory)
[pid  6122] getdents64(8, 0x7f17dc000ba0 /* 0 entries */, 32768) = 0
[pid  6122] close(8)                    = 0
[pid  6123] <... write resumed>)        = 1
[pid  6123] close(4)                    = 0
[pid  6123] getdents64(16, 0x7f17e0000ba0 /* 0 entries */, 32768) = 0
[pid  6123] close(16)                   = 0
[pid  6122] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6122] madvise(0x7f17e99b7000, 8372224, MADV_DONTNEED) = 0
[pid  6122] exit(0)                     = ?
[pid  6122] +++ exited with 0 +++
[pid  5884] <... futex resumed>)        = 0
[pid  5884] munmap(0x7f17eb9bb000, 8392704) = 0
[pid  5884] futex(0x7f17e99b6990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 6123, NULL, FUTEX_BITSET_MATCH_ANY <unfinished ...>
[pid  6123] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0
[pid  6123] madvise(0x7f17e91b6000, 8372224, MADV_DONTNEED) = 0
[pid  6123] exit(0)                     = ?
[pid  6123] +++ exited with 0 +++
<... futex resumed>)                    = 0
munmap(0x7f17eb1ba000, 8392704)         = 0
write(1, "[*] Cleaning up...", 18)      = 18
write(1, "\n", 1)                       = 1
[*] Cleaning up...
[  100.043623][   T34] audit: type=1400 audit(1790188391.568:274): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="/" dev="configfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043653][   T34] audit: type=1400 audit(1790188391.568:275): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="nvmet" dev="configfs" ino=3417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043670][   T34] audit: type=1400 audit(1790188391.568:276): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="ports" dev="configfs" ino=3419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043686][   T34] audit: type=1400 audit(1790188391.568:277): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="1" dev="configfs" ino=8384 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043703][   T34] audit: type=1400 audit(1790188391.568:278): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="subsystems" dev="configfs" ino=8385 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.043721][   T34] audit: type=1400 audit(1790188391.568:279): avc:  denied  { write search } for  pid=5884 comm="syz-executor250" name="subsystems" dev="configfs" ino=8385 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.044217][   T34] audit: type=1400 audit(1790188391.568:280): avc:  denied  { remove_name } for  pid=5884 comm="syz-executor250" name="testnqn" dev="configfs" ino=8390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  100.044352][   T34] audit: type=1400 audit(1790188391.568:281): avc:  denied  { unlink } for  pid=5884 comm="syz-executor250" name="testnqn" dev="configfs" ino=8390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[  100.046950][ T5968] nvme nvme29: Removing ctrl: NQN "testnqn"
[  100.048965][ T6046] nvme nvme30: Removing ctrl: NQN "testnqn"
[  100.050032][ T5981] nvme nvme31: Removing ctrl: NQN "testnqn"
[  100.050139][ T6103] nvme nvme32: Removing ctrl: NQN "testnqn"
[  100.051217][ T6074] nvme nvme33: Removing ctrl: NQN "testnqn"
[  100.052621][ T6054] nvme nvme34: Removing ctrl: NQN "testnqn"
[  100.052675][   T52] nvme nvme35: Removing ctrl: NQN "testnqn"
[  100.052728][ T5976] nvme nvme36: Removing ctrl: NQN "testnqn"
[  100.052829][ T6068] nvme nvme38: Removing ctrl: NQN "testnqn"
[  100.062459][ T5984] nvme nvme37: Removing ctrl: NQN "testnqn"
[  100.062953][ T6027] nvme nvme39: Removing ctrl: NQN "testnqn"
[  100.076480][ T5993] nvme nvme23: Removing ctrl: NQN "testnqn"
[  100.080511][ T1109] nvme nvme40: Removing ctrl: NQN "testnqn"
[  100.101233][ T6085] nvme nvme41: Removing ctrl: NQN "testnqn"
[  100.101326][ T6077] nvme nvme42: Removing ctrl: NQN "testnqn"
[  100.101454][ T1107] nvme nvme43: Removing ctrl: NQN "testnqn"
[  100.105263][ T6028] nvme nvme44: Removing ctrl: NQN "testnqn"
[  100.117574][ T6022] nvme nvme45: Removing ctrl: NQN "testnqn"
[  100.124230][ T5958] nvme nvme46: Removing ctrl: NQN "testnqn"
[  100.129741][ T6049] nvme nvme47: Removing ctrl: NQN "testnqn"
[  100.139655][ T5912] nvme nvme48: Removing ctrl: NQN "testnqn"
[  100.152413][ T6062] nvme nvme7: Removing ctrl: NQN "testnqn"
[  100.154215][ T5999] nvme nvme49: Removing ctrl: NQN "testnqn"
[  100.173363][ T5966] nvme nvme50: Removing ctrl: NQN "testnqn"
[  100.176161][ T6032] nvme nvme51: Removing ctrl: NQN "testnqn"
[  100.177309][ T6240] nvme nvme52: Removing ctrl: NQN "testnqn"
[  100.177592][ T5985] nvme nvme53: Removing ctrl: NQN "testnqn"
[  100.177651][ T6080] nvme nvme54: Removing ctrl: NQN "testnqn"
[  100.177698][ T6036] nvme nvme55: Removing ctrl: NQN "testnqn"
[  100.179244][ T5911] nvme nvme56: Removing ctrl: NQN "testnqn"
[  100.179308][ T6005] nvme nvme13: Removing ctrl: NQN "testnqn"
[  100.179358][ T6094] nvme nvme57: Removing ctrl: NQN "testnqn"
[  100.179411][ T6090] nvme nvme58: Removing ctrl: NQN "testnqn"
[  100.179459][ T6060] nvme nvme59: Removing ctrl: NQN "testnqn"
[  100.179502][ T6109] nvme nvme60: Removing ctrl: NQN "testnqn"
[  100.179544][ T1108] nvme nvme61: Removing ctrl: NQN "testnqn"
[  100.179591][ T6052] nvme nvme21: Removing ctrl: NQN "testnqn"
[  100.179730][ T6001] nvme nvme64: Removing ctrl: NQN "testnqn"
[  100.179769][ T5990] nvme nvme62: Removing ctrl: NQN "testnqn"
[  100.179846][ T5980] nvme nvme65: Removing ctrl: NQN "testnqn"
[  100.179895][ T6105] nvme nvme66: Removing ctrl: NQN "testnqn"
[  100.179937][ T6040] nvme nvme67: Removing ctrl: NQN "testnqn"
[  100.180573][ T5909] nvme nvme68: Removing ctrl: NQN "testnqn"
[  100.180629][ T5982] nvme nvme69: Removing ctrl: NQN "testnqn"
[  100.181743][ T6089] nvme nvme70: Removing ctrl: NQN "testnqn"
[  100.200250][ T6008] nvme nvme71: Removing ctrl: NQN "testnqn"
[  100.221830][   T35] nvme nvme72: Removing ctrl: NQN "testnqn"
[  100.239655][ T6043] nvme nvme73: Removing ctrl: NQN "testnqn"
[  100.239865][ T6069] nvme nvme74: Removing ctrl: NQN "testnqn"
[  100.240468][ T6057] nvme nvme75: Removing ctrl: NQN "testnqn"
[  100.329994][ T6007] nvme nvme33: long keepalive RTT (4294770536 ms)
[  100.330011][ T6007] nvme nvme33: failed nvme_keep_alive_end_io error=4
unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") = 0
rmdir("/sys/kernel/config/nvmet/ports/1") = 0
openat(AT_FDCWD, "/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY) = 3
[  101.918371][   T34] audit: type=1400 audit(1790188393.438:282): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="/" dev="configfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  101.918399][   T34] audit: type=1400 audit(1790188393.438:283): avc:  denied  { search } for  pid=5884 comm="syz-executor250" name="nvmet" dev="configfs" ino=3417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
write(3, "0", 1)                        = 1
close(3)                                = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1") = 0
rmdir("/sys/kernel/config/nvmet/subsystems/testnqn") = 0
unlink("/tmp/nvme_backing")             = 0
exit_group(0)                           = ?
+++ exited with 0 +++

Crash Report: ------------[ cut here ]------------
timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist)
WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706, CPU#0: kworker/u10:157/6412
Modules linked in:
CPU: 0 UID: 0 PID: 6412 Comm: kworker/u10:157 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme-delete-wq nvme_delete_ctrl_work
RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706
Code: 15 8b 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00
RSP: 0018:ffffc900068579b8 EFLAGS: 00010202
RAX: 1ffffd1fd788fc15 RBX: 0000607d17814fc0 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffe8febc47dfc0 R08: ffffffff90838d7f R09: 1ffffffff21071af
R10: dffffc0000000000 R11: fffffbfff21071b0 R12: ffff88818eb07000
R13: 0000000000000000 R14: ffffe8febc47e0a8 R15: 1ffffffff1cc4fde
FS:  0000000000000000(0000) GS:ffff8881a4c69000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558a63e067c8 CR3: 00000001feb70000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 blk_mq_free_tag_set+0x617/0x790 block/blk-mq.c:4976
 nvme_do_delete_ctrl+0x246/0x320 drivers/nvme/host/core.c:252
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

gemini-3.1-pro-preview

							input: 19997
							output: 278
							thoughts: 1056
						

**Analysis of Reproducer Execution for NVMe Bug**

My primary task was to analyze the output from a reproducer program designed to trigger a specific Linux kernel bug related to NVMe. The expected issue was a "bad unlock balance in nvme_update_ns_info," specifically a lockdep warning on `&q->q_usage_counter(io)` when `blk_mq_unfreeze_queue` is invoked from within `nvme_update_ns_info`.

Upon running the reproducer, I observed a WARNING message originating from `kernel/rcu/srcutree.c:707` during the `cleanup_srcu_struct` function. The call trace indicated that this warning was triggered indirectly through `blk_mq_free_tag_set` during the `nvme_do_delete_ctrl` operation.

This immediately raised a question: is the triggered bug the same as the one I was looking for? My analysis suggests it is not. The expected bug involves a lockdep complaint about an unbalanced unlock related to queue usage counters during namespace information updates. In contrast, the actual crash is a warning within the SRCU (Scalable Relaxed Concurrent Updates) cleanup mechanism, specifically when freeing the tag set during controller deletion.

While both issues are related to the NVMe driver, they manifest in different operational contexts. The expected bug appears to be tied to the lifecycle of namespace scanning and updating (`nvme_update_ns_info`), where there might be a race condition between freezing and unfreezing the request queue. The triggered bug, however, seems to be a known issue where `cleanup_srcu_struct` flags a problem if there are pending callbacks or delayed work during the teardown of NVMe controller resources. This is often referred to as a "collision" in testing, where the test setup inadvertently triggers a different, albeit related, bug.

Consequently, my assessment is that the `TitleMatches` field should be set to `false`. Since the execution did not trigger the intended probe-related bug, `ProbePassed` should also be `false`. There was no terminal error, so `TerminalError` will be empty.

My feedback needs to clearly articulate this distinction. I will explain that the reproducer executed, but it hit a different NVMe bug related to SRCU cleanup during controller deletion, rather than the target bad unlock balance in `nvme_update_ns_info`. I will then suggest that to more reliably trigger the intended bug, the reproducer should focus on scenarios involving concurrent namespace updates or scans, potentially coupled with controller resets or error injection during `nvme_update_ns_info`, as simply creating and deleting controllers rapidly seems to hit the SRCU teardown bug first.

map[Feedback:The execution triggered a crash, but it does not match the expected bug.

Expected bug: WARNING: bad unlock balance in nvme_update_ns_info (a lockdep warning on `q->q_usage_counter` during `blk_mq_unfreeze_queue`).
Triggered bug: WARNING in `cleanup_srcu_struct` called from `blk_mq_free_tag_set` during `nvme_do_delete_ctrl`.

This is a collision with a different NVMe-related bug (likely related to SRCU cleanup during controller teardown). The expected bug occurs during namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`), where an imbalance between freezing and unfreezing the request queue happens. 

To improve the reproducer and avoid this collision, you should focus on triggering concurrent namespace updates, rescans, or changes to namespace attributes, possibly combined with controller resets or error injection during `nvme_update_ns_info`. The current strategy of rapidly creating and deleting controllers hits the SRCU teardown bug first, preventing the target bug from being reached. ProbePassed:false TerminalError: TitleMatches:false]

map[Feedback:The execution triggered a crash, but it does not match the expected bug.

Expected bug: WARNING: bad unlock balance in nvme_update_ns_info (a lockdep warning on `q->q_usage_counter` during `blk_mq_unfreeze_queue`).
Triggered bug: WARNING in `cleanup_srcu_struct` called from `blk_mq_free_tag_set` during `nvme_do_delete_ctrl`.

This is a collision with a different NVMe-related bug (likely related to SRCU cleanup during controller teardown). The expected bug occurs during namespace scanning (`nvme_scan_ns` -> `nvme_alloc_ns` -> `nvme_update_ns_info`), where an imbalance between freezing and unfreezing the request queue happens. 

To improve the reproducer and avoid this collision, you should focus on triggering concurrent namespace updates, rescans, or changes to namespace attributes, possibly combined with controller resets or error injection during `nvme_update_ns_info`. The current strategy of rapidly creating and deleting controllers hits the SRCU teardown bug first, preventing the target bug from being reached. ProbePassed:false TerminalError: TitleMatches:false]

map[CapabilitiesVerified:true ContinueSignal:continue EquivalenceAnalysis: OracleFeedback:Collision detected: candidate reproducer triggered a crash with title "WARNING in blk_mq_free_tag_set", which does not match the expected bug. ReproC: Reproduced:false ReproducedBugTitle: ReproducedCrashReport:]

map[OracleFeedback:Collision detected: candidate reproducer triggered a crash with title "WARNING in blk_mq_free_tag_set", which does not match the expected bug.]

deep-reasoning

You are an expert in Linux kernel debugging.
Refine the reproduction strategy based on feedback from previous attempts.
Analyze the technical diagnosis provided in the oracle feedback and translate it into concrete,
step-by-step instructions for the repro-generator on how to modify the code structure, alignments,
offsets, or parameters of the candidate program.

=== TOOL SELECTION GUIDELINES ===
- Prefer codesearch-definition-source and codesearch-struct-layout first for symbol lookups.
- Fall back to read-file or grepper for macros, headers, or if symbol lookup fails.

=== CRITICAL PROHIBITIONS ===
- Do NOT repeat searches for the same symbols or files. Use information you have already gathered.
- Do NOT write long explanations. Keep your reasoning short and focused on actionable changes.
- Do NOT assume a bug is fixed based on git commit history.
- If you are stuck, try a different approach or proceed to generate a candidate reproducer.
Prefer calling several tools at the same time to save round-trips.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Current Strategy: An analysis of the lockdep warning and the block layer's queue freezing mechanism reveals a subtle race condition involving the `q->mq_freeze_disk_dead` flag.

### Root Cause Analysis
1. When `nvme_alloc_ns` is called for a new namespace, it allocates the multipath disk (`ns->head->disk`) but does **not** register it immediately.
2. It then calls `nvme_update_ns_info`, which freezes the queue (`blk_mq_freeze_queue`). Because the disk is not registered, `blk_freeze_set_owner` sets `q->mq_freeze_disk_dead = TRUE`.
3. Consequently, `blk_freeze_acquire_lock` does **not** acquire the `io_lockdep_map` lock.
4. `nvme_update_ns_info` then unfreezes the queue. `__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` to 0 and returns `TRUE`.
5. **The Race Window:** If the thread is preempted right here (before calling `blk_unfreeze_release_lock`), another thread can register the disk (e.g., via `nvme_mpath_add_disk`).
6. If a third thread (or a rescan) now calls `nvme_update_ns_info` on the same namespace, it freezes the queue again. Since the disk is now registered, `blk_freeze_set_owner` overwrites `q->mq_freeze_disk_dead` to `FALSE`.
7. When the original thread resumes, it calls `blk_unfreeze_release_lock`. It reads the new value of `q->mq_freeze_disk_dead` (`FALSE`) and attempts to release the `io_lockdep_map` lock, which it never acquired. This triggers the `bad unlock balance` warning.

### Reproduction Strategy
To trigger this race condition, we need to maximize the chances of a thread being preempted in the tiny window between `__blk_mq_unfreeze_queue` and `blk_unfreeze_release_lock`, while another thread registers the disk and a third thread freezes it again.

We can achieve this by running three concurrent workloads:
1. **Connect Threads:** Continuously connect NVMe loopback controllers. This triggers `nvme_alloc_ns` (which freezes the queue while the disk is unregistered) and eventually registers the disk.
2. **Rescan Threads:** Continuously trigger controller rescans (`echo 1 > /sys/class/nvme/nvmeX/rescan_controller`). This calls `nvme_update_ns_info` on already registered disks, overwriting `q->mq_freeze_disk_dead` to `FALSE`.
3. **Disconnect Threads:** Periodically delete controllers to keep the system churning and allow new connections to be established.

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 1

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
}

void teardown_nvmet()
{
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		int fd = open("/dev/nvme-fabrics", O_RDWR);
		if (fd >= 0) {
			write(fd, "nqn=testnqn,transport=loop", 26);
			close(fd);
		}
	}
	return NULL;
}

void* rescan_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/rescan_controller; do echo 1 > $f 2>/dev/null; done");
	}
	return NULL;
}

void* disconnect_thread(void* arg)
{
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
		usleep(100000); // Disconnect less frequently to allow rescans to hit registered disks
	}
	return NULL;
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t ct[NUM_CONNECT_THREADS];
		pthread_t rt[NUM_RESCAN_THREADS];
		pthread_t dt[NUM_DISCONNECT_THREADS];

		__atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_create(&ct[i], NULL, connect_thread, NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_create(&rt[i], NULL, rescan_thread, NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_create(&dt[i], NULL, disconnect_thread, NULL);

		sleep(5);
		__atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

		for (int i = 0; i < NUM_CONNECT_THREADS; i++)
			pthread_join(ct[i], NULL);
		for (int i = 0; i < NUM_RESCAN_THREADS; i++)
			pthread_join(rt[i], NULL);
		for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
			pthread_join(dt[i], NULL);
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```
Feedback: Collision detected: candidate reproducer triggered a crash with title "WARNING in blk_mq_free_tag_set", which does not match the expected bug.

An analysis of the previous attempt reveals that deleting controllers concurrently triggered a different bug (`WARNING in blk_mq_free_tag_set`). To avoid this and focus purely on the `bad unlock balance` race condition, we should keep the controllers connected and instead dynamically add and remove the **namespace** from the target side.

### Refined Root Cause & Race Sequence
The race occurs on the multipath disk's queue (`ns->head->disk->queue`) and involves three concurrent operations:
1. **Thread 1 (Controller A)** discovers a new namespace, calls `nvme_alloc_ns` -> `nvme_update_ns_info`, and freezes the queue. Since the multipath disk is not yet registered, `q->mq_freeze_disk_dead` is set to `TRUE`, and it skips acquiring the `io_lockdep_map` lock. It unfreezes the queue but gets preempted just before calling `blk_unfreeze_release_lock`.
2. **Thread 2 (Controller B)** concurrently discovers the same namespace, completes its `nvme_update_ns_info`, and calls `nvme_mpath_add_disk`, which registers the multipath disk.
3. **Thread 3 (Rescan or Open)** calls `nvme_update_ns_info` on the now-registered disk. It freezes the queue, which overwrites `q->mq_freeze_disk_dead` to `FALSE`.
4. **Thread 1** resumes, calls `blk_unfreeze_release_lock`, reads the overwritten `q->mq_freeze_disk_dead == FALSE`, and attempts to release the `io_lockdep_map` lock it never acquired.

### Refined Reproduction Strategy
1. Connect 4 NVMe loopback controllers to the same subsystem.
2. **Toggle Thread:** Continuously enable and disable the namespace on the target side. This causes all 4 controllers to concurrently discover the namespace and call `nvme_alloc_ns` (providing Threads 1 and 2).
3. **Rescan Threads:** Continuously trigger `rescan_controller` via sysfs. This calls `nvme_update_ns_info` via `nvme_validate_ns` (providing Thread 3).
4. **Open Threads:** Continuously `open()` and `close()` the multipath block device (`/dev/nvmeXn1`). This synchronously calls `nvme_update_ns_info` via `nvme_revalidate_disk` (providing more Thread 3 concurrency).

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");

	// Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
	for (int i = 0; i < 4; i++) {
		int fd = open("/dev/nvme-fabrics", O_RDWR);
		if (fd >= 0) {
			write(fd, "nqn=testnqn,transport=loop", 26);
			close(fd);
		}
	}
	
	// Wait a bit for controllers to connect and scan
	sleep(2);
}

void teardown_nvmet()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg)
{
	int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
	if (fd < 0) return NULL;

	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		pwrite(fd, "0", 1, 0);
		usleep(50000); // 50ms to allow host to process removal
		pwrite(fd, "1", 1, 0);
		usleep(50000); // 50ms to allow host to process addition
	}
	close(fd);
	return NULL;
}

void* rescan_thread(void* arg)
{
	int fds[16];
	int num_fds = 0;
	char path[256];

	for (int i = 0; i < 16; i++) {
		snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
		int fd = open(path, O_WRONLY);
		if (fd >= 0) {
			fds[num_fds++] = fd;
		}
	}

	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		for (int i = 0; i < num_fds; i++) {
			pwrite(fds[i], "1", 1, 0);
		}
		usleep(1000);
	}

	for (int i = 0; i < num_fds; i++) {
		close(fds[i]);
	}
	return NULL;
}

void* open_close_thread(void* arg)
{
	char path[256];
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		for (int i = 0; i < 4; i++) {
			snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
			int fd = open(path, O_RDONLY);
			if (fd >= 0) {
				close(fd);
			}
		}
		usleep(1000);
	}
	return NULL;
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t tt;
		pthread_t rt[2];
		pthread_t ot[2];

		__atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

		pthread_create(&tt, NULL, toggle_ns_thread, NULL);
		for (int i = 0; i < 2; i++)
			pthread_create(&rt[i], NULL, rescan_thread, NULL);
		for (int i = 0; i < 2; i++)
			pthread_create(&ot[i], NULL, open_close_thread, NULL);

		sleep(5);
		__atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

		pthread_join(tt, NULL);
		for (int i = 0; i < 2; i++)
			pthread_join(rt[i], NULL);
		for (int i = 0; i < 2; i++)
			pthread_join(ot[i], NULL);
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```

gemini-3.1-pro-preview

							input: 5789
							output: 32
							thoughts: 1896
						

**My Thoughts on Replicating the "bad unlock balance" NVMe Bug**

My primary objective right now is to reliably reproduce this specific NVMe kernel warning: "WARNING: bad unlock balance in nvme_update_ns_info". My previous attempts, which involved setting up an NVMe loopback target and then aggressively connecting, rescanning, and disconnecting controllers concurrently, failed to trigger the desired bug. Instead, they led to a different, though related, issue: "WARNING in blk_mq_free_tag_set". This divergence suggests that my previous strategy was too focused on controller destruction, and the disconnect thread might have been overly aggressive, possibly hitting a known race condition within `blk_mq_free_tag_set` during rapid controller deletion.

Reflecting on the original bug's described race condition, it hinges on the state of `q->mq_freeze_disk_dead` and the timing around `blk_freeze_acquire_lock` and `blk_unfreeze_release_lock`. The sequence outlined is:

1.  `nvme_alloc_ns` is invoked, preparing a multipath disk but not yet registering it.
2.  `nvme_update_ns_info` is called, leading to the freezing of the queue (`q->mq_freeze_disk_dead` is set to `TRUE`).
3.  `blk_freeze_acquire_lock` is executed, but it fails to acquire the lock at this juncture.
4.  `nvme_update_ns_info` proceeds to unfreeze the queue (`__blk_mq_unfreeze_queue` decrements `q->mq_freeze_depth` to 0, returning `TRUE`).
5.  Crucially, there's a preemption window right before `blk_unfreeze_release_lock` is called.
6.  During this window, another thread manages to register the disk (e.g., via `nvme_mpath_add_disk`).
7.  Then, a third thread (perhaps during a rescan) calls `nvme_update_ns_info` again on the *same* namespace. Since the disk is now registered, `q->mq_freeze_disk_dead` is overwritten to `FALSE`.
8.  The original thread resumes, calls `blk_unfreeze_release_lock`, observes `FALSE`, and attempts to release a lock it never actually acquired.

This breakdown is critical. The `q->mq_freeze_disk_dead` flag, residing within the request queue, is central to this. The fact that I'm hitting a different bug (`blk_mq_free_tag_set`) when deleting controllers rapidly makes me think I should steer clear of that mechanism. Perhaps I can avoid the `blk_mq_free_tag_set` issue by simply *not* deleting controllers, or at least deleting them far less frequently, or maybe even confining my operations to a single controller.

What if I try a strategy that doesn't involve controller disconnects at all? If I just establish a *single* controller connection and then concurrently trigger rescans, will `nvme_alloc_ns` still be invoked? Yes, `nvme_alloc_ns` is called during initial controller connections or when a new namespace is discovered during a rescan.

This leads me to a potentially more promising approach: instead of manipulating the controller's existence, I can focus on dynamically adding and removing namespaces from the target side, while the host concurrently rescans. If I can achieve this with a *single* controller, it might bypass the `blk_mq_free_tag_set` warning entirely, as that bug seems tied to controller deletion.

I need to figure out how to dynamically manage namespaces within the `nvmet` framework. The `sysfs` interface for `nvmet` subsystems offers a way:
```bash
echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable
echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable
```
If I toggle the `enable` flag for a namespace on the target side, and then initiate rescans on the host side, the host should detect the namespace appearing and disappearing. In fact, just toggling the namespace enablement and performing rescans should be sufficient to trigger `nvme_alloc_ns` and `nvme_ns_remove` calls.

So, my refined strategy is this:

1.  **Connect the NVMe controller only ONCE.**
2.  Establish multiple concurrent threads:
    *   **Thread A:** Will be responsible for toggling the namespace `enable` flag on the NVMe target.
    *   **Thread B:** Will repeatedly trigger controller rescans on the host side.
    *   **Thread C (Optional but potentially useful):** Might also trigger rescans or even perform I/O operations on existing block devices to increase overall system churn and the likelihood of hitting race conditions.

I need to confirm how `nvme_alloc_ns` is triggered. It's called when a new namespace is detected. When a controller rescan (`rescan_controller`) is initiated, `nvme_scan_work` will run, and this, in turn, calls either `nvme_scan_ns_list` or `nvme_scan_ns_sequential`. These functions are responsible for discovering namespaces and will call `nvme_alloc_ns` for any new ones. Following that, `nvme_mpath_add_disk` will be invoked if multipath is enabled.

Now, let's revisit the original race precisely. The race happens *within* `nvme_update_ns_info`, specifically right after `__blk_mq_unfreeze_queue` returns `TRUE` but *before* `blk_unfreeze_release_lock` is called. `nvme_alloc_ns` calls `nvme_update_ns_info`.
```c
// drivers/nvme/host/core.c
static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info)
{
    ...
    if (nvme_update_ns_info(ns, info))
        goto out_unlink_ns;
    ...
    nvme_mpath_add_disk(ns, info->anagrpid); // This is where the disk registration might happen concurrently
    ...
}
```
The queue being frozen (`q = ns->queue`) is the one associated with the *specific namespace path*, not the multipath queue itself.

The race diagram points to a preemption *within* `nvme_update_ns_info`'s call to `blk_mq_unfreeze_queue`.
```c
static inline void blk_mq_unfreeze_queue(struct request_queue *q)
{
	if (__blk_mq_unfreeze_queue(q)) // Preemption can occur after this returns TRUE
		blk_unfreeze_release_lock(q, false);
}
```
If Thread 1 (executing `nvme_alloc_ns`) is preempted here, how can another thread register the disk via `nvme_mpath_add_disk`? This is where my understanding needs clarification. The bug report states: "another thread can register the disk (e.g., via nvme_mpath_add_disk)."

The crucial insight might be related to `ns->head->disk`. This `ns->head` is the multipath context, grouping multiple paths to the same logical namespace. If Controller A has already established a path to the subsystem and registered its `ns->head->disk`, and then Controller B (under my new strategy, still using the same single controller, but perhaps representing a different path or discovery event) attempts to allocate its namespace (`nvme_alloc_ns`), it might be trying to register to an *already registered* `ns->head->disk`.

However, the bug report specifically says: "Because the disk is not registered, `blk_freeze_set_owner` sets `q->mq_freeze_disk_dead = TRUE`." This implies that in the failing scenario, the `ns->head->disk` was *not* yet registered when the first `nvme_alloc_ns` started.

This brings up a question: if `ns->head->disk` is shared across multiple controllers (or paths to the same logical namespace), and one path (`nvme_alloc_ns` from Controller A) is processing and gets preempted *before* `nvme_mpath_add_disk`, how can another path (`nvme_alloc_ns` from Controller B) call `nvme_mpath_add_disk` and register the *shared* `ns->head->disk`? Is it possible that the bug only manifests when multiple *paths* to the *same logical namespace* are being added concurrently, even if they originate from the same physical controller instance in my setup? This is what I need to resolve. My current setup might be too simplistic if it only involves a single path to a namespace. I may need to simulate multiple paths more directly.

map[ContextFile: Name:nvme_update_ns_info]

map[SourceCode:2539:	static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_ns_info *info)
2540:	{
2541:		bool unsupported = false;
2542:		int ret;
2543:	
2544:		switch (info->ids.csi) {
2545:		case NVME_CSI_ZNS:
2546:			if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
2547:				dev_info(ns->ctrl->device,
2548:		"block device for nsid %u not supported without CONFIG_BLK_DEV_ZONED\n",
2549:					info->nsid);
2550:				ret = nvme_update_ns_info_generic(ns, info);
2551:				break;
2552:			}
2553:			ret = nvme_update_ns_info_block(ns, info);
2554:			break;
2555:		case NVME_CSI_NVM:
2556:			ret = nvme_update_ns_info_block(ns, info);
2557:			break;
2558:		default:
2559:			dev_info(ns->ctrl->device,
2560:				"block device for nsid %u not supported (csi %u)\n",
2561:				info->nsid, info->ids.csi);
2562:			ret = nvme_update_ns_info_generic(ns, info);
2563:			break;
2564:		}
2565:	
2566:		/*
2567:		 * If probing fails due an unsupported feature, hide the block device,
2568:		 * but still allow other access.
2569:		 */
2570:		if (ret == -ENODEV) {
2571:			ns->disk->flags |= GENHD_FL_HIDDEN;
2572:			set_bit(NVME_NS_READY, &ns->flags);
2573:			unsupported = true;
2574:			ret = 0;
2575:		}
2576:	
2577:		if (!ret && nvme_ns_head_multipath(ns->head)) {
2578:			struct queue_limits *ns_lim = &ns->disk->queue->limits;
2579:			struct queue_limits lim;
2580:			unsigned int memflags;
2581:	
2582:			lim = queue_limits_start_update(ns->head->disk->queue);
2583:			memflags = blk_mq_freeze_queue(ns->head->disk->queue);
2584:			/*
2585:			 * queue_limits mixes values that are the hardware limitations
2586:			 * for bio splitting with what is the device configuration.
2587:			 *
2588:			 * For NVMe the device configuration can change after e.g. a
2589:			 * Format command, and we really want to pick up the new format
2590:			 * value here.  But we must still stack the queue limits to the
2591:			 * least common denominator for multipathing to split the bios
2592:			 * properly.
2593:			 *
2594:			 * To work around this, we explicitly set the device
2595:			 * configuration to those that we just queried, but only stack
2596:			 * the splitting limits in to make sure we still obey possibly
2597:			 * lower limitations of other controllers.
2598:			 */
2599:			lim.logical_block_size = ns_lim->logical_block_size;
2600:			lim.physical_block_size = ns_lim->physical_block_size;
2601:			lim.io_min = ns_lim->io_min;
2602:			lim.io_opt = ns_lim->io_opt;
2603:			queue_limits_stack_bdev(&lim, ns->disk->part0, 0,
2604:						ns->head->disk->disk_name);
2605:			if (lim.features & BLK_FEAT_ZONED)
2606:				nvme_stack_zone_resources(&lim, ns_lim);
2607:			if (unsupported)
2608:				ns->head->disk->flags |= GENHD_FL_HIDDEN;
2609:			else
2610:				nvme_init_integrity(ns->head, &lim, info);
2611:			lim.max_write_streams = ns_lim->max_write_streams;
2612:			lim.write_stream_granularity = ns_lim->write_stream_granularity;
2613:			ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
2614:			if (ret)
2615:				goto unfreeze_head_queue;
2616:	
2617:			set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
2618:			set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
2619:			nvme_mpath_revalidate_paths(ns->head);
2620:			ret = nvme_mpath_revalidate_zones(ns->head);
2621:	
2622:	unfreeze_head_queue:
2623:			blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
2624:		}
2625:	
2626:		return ret;
2627:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 9228
							output: 40
							thoughts: 132
						

**My Realization about the Multipath Queue Race**

Ah, I see it now! The frozen queue, the one causing the issue, is actually `ns->head->disk->queue`. That's the key. I'm looking at these code snippets, `blk_mq_freeze_queue` and `blk_mq_unfreeze_queue`, and I recognize that `ns->head->disk->queue` is the multipath queue. This means that `ns->head->disk` itself must be the multipath disk.

Therefore, the race condition I'm investigating is precisely occurring on the multipath disk's queue. To understand how this multipath disk's queue comes into play, I need to examine `nvme_alloc_ns` and see when `ns->head->disk` is registered within the system. That's my next logical step to fully trace the lifecycle of this multipath disk and its associated queue.

map[ContextFile:drivers/nvme/host/core.c Name:nvme_alloc_ns]

map[SourceCode:4238:	static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info)
4239:	{
4240:		struct queue_limits lim = { };
4241:		struct nvme_ns *ns;
4242:		struct gendisk *disk;
4243:		int node = ctrl->numa_node;
4244:		bool last_path = false;
4245:	
4246:		ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node);
4247:		if (!ns)
4248:			return;
4249:	
4250:		if (ctrl->opts && ctrl->opts->data_digest)
4251:			lim.features |= BLK_FEAT_STABLE_WRITES;
4252:		if (ctrl->ops->supports_pci_p2pdma &&
4253:		    ctrl->ops->supports_pci_p2pdma(ctrl))
4254:			lim.features |= BLK_FEAT_PCI_P2PDMA;
4255:	
4256:		disk = blk_mq_alloc_disk(ctrl->tagset, &lim, ns);
4257:		if (IS_ERR(disk))
4258:			goto out_free_ns;
4259:		disk->fops = &nvme_bdev_ops;
4260:		disk->private_data = ns;
4261:	
4262:		ns->disk = disk;
4263:		ns->queue = disk->queue;
4264:		ns->ctrl = ctrl;
4265:		kref_init(&ns->kref);
4266:	
4267:		if (nvme_init_ns_head(ns, info))
4268:			goto out_cleanup_disk;
4269:	
4270:		/*
4271:		 * If multipathing is enabled, the device name for all disks and not
4272:		 * just those that represent shared namespaces needs to be based on the
4273:		 * subsystem instance.  Using the controller instance for private
4274:		 * namespaces could lead to naming collisions between shared and private
4275:		 * namespaces if they don't use a common numbering scheme.
4276:		 *
4277:		 * If multipathing is not enabled, disk names must use the controller
4278:		 * instance as shared namespaces will show up as multiple block
4279:		 * devices.
4280:		 */
4281:		if (nvme_ns_head_multipath(ns->head)) {
4282:			sprintf(disk->disk_name, "nvme%dc%dn%d", ctrl->subsys->instance,
4283:				ctrl->instance, ns->head->instance);
4284:			disk->flags |= GENHD_FL_HIDDEN;
4285:		} else if (multipath) {
4286:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->subsys->instance,
4287:				ns->head->instance);
4288:		} else {
4289:			sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance,
4290:				ns->head->instance);
4291:		}
4292:	
4293:		if (nvme_update_ns_info(ns, info))
4294:			goto out_unlink_ns;
4295:	
4296:		mutex_lock(&ctrl->namespaces_lock);
4297:		/*
4298:		 * Ensure that no namespaces are added to the ctrl list after the queues
4299:		 * are frozen, thereby avoiding a deadlock between scan and reset.
4300:		 */
4301:		if (test_bit(NVME_CTRL_FROZEN, &ctrl->flags)) {
4302:			mutex_unlock(&ctrl->namespaces_lock);
4303:			goto out_unlink_ns;
4304:		}
4305:		blk_queue_rq_timeout(ns->queue, ctrl->io_timeout);
4306:		nvme_ns_add_to_ctrl_list(ns);
4307:		mutex_unlock(&ctrl->namespaces_lock);
4308:		synchronize_srcu(&ctrl->srcu);
4309:		nvme_get_ctrl(ctrl);
4310:	
4311:		if (device_add_disk(ctrl->device, ns->disk, nvme_ns_attr_groups))
4312:			goto out_cleanup_ns_from_list;
4313:	
4314:		if (!nvme_ns_head_multipath(ns->head))
4315:			nvme_add_ns_cdev(ns);
4316:	
4317:		nvme_mpath_add_disk(ns, info->anagrpid);
4318:		nvme_fault_inject_init(&ns->fault_inject, ns->disk->disk_name);
4319:	
4320:		return;
4321:	
4322:	 out_cleanup_ns_from_list:
4323:		nvme_put_ctrl(ctrl);
4324:		mutex_lock(&ctrl->namespaces_lock);
4325:		list_del_rcu(&ns->list);
4326:		mutex_unlock(&ctrl->namespaces_lock);
4327:		synchronize_srcu(&ctrl->srcu);
4328:	 out_unlink_ns:
4329:		mutex_lock(&ctrl->subsys->lock);
4330:		list_del_rcu(&ns->siblings);
4331:		if (list_empty(&ns->head->list)) {
4332:			list_del_init(&ns->head->entry);
4333:			/*
4334:			 * If multipath is not configured, we still create a namespace
4335:			 * head (nshead), but head->disk is not initialized in that
4336:			 * case.  As a result, only a single reference to nshead is held
4337:			 * (via kref_init()) when it is created. Therefore, ensure that
4338:			 * we do not release the reference to nshead twice if head->disk
4339:			 * is not present.
4340:			 */
4341:			if (ns->head->disk)
4342:				last_path = true;
4343:		}
4344:		mutex_unlock(&ctrl->subsys->lock);
4345:	
4346:		/* guarantee not available in head->list */
4347:		synchronize_srcu(&ns->head->srcu);
4348:		if (last_path)
4349:			nvme_put_ns_head(ns->head);
4350:		nvme_put_ns_head(ns->head);
4351:	 out_cleanup_disk:
4352:		put_disk(disk);
4353:	 out_free_ns:
4354:		kfree(ns);
4355:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 11316
							output: 42
							thoughts: 118
						

**My Thought Process on `nvme_alloc_ns` Initialization**

Alright, so I'm digging into the `nvme_alloc_ns` function, and the first thing that catches my eye is this `if` statement:

```c
	if (nvme_init_ns_head(ns, info))
		goto out_cleanup_disk;
```

This tells me that if `nvme_init_ns_head` returns a non-zero value (which typically signifies an error in C), I need to jump straight to `out_cleanup_disk` to clean up. That's a pretty standard error handling pattern.

Now, the comment right after that line is crucial: "`nvme_init_ns_head` initializes `ns->head` and allocates `ns->head->disk` if multipath is enabled." This is the core functionality I need to understand here. It's not just setting up some basic structure; it's also conditionally allocating a disk object (`ns->head->disk`) specifically when multipathing is involved. This hints at how NVMe drivers handle complex storage configurations.

Following that, the sequence is clear: "Then `nvme_update_ns_info` is called. Then `nvme_mpath_add_disk` is called." This sequential flow suggests a step-by-step initialization process. First, update the namespace's information, and *then*, if multipathing is active (as implied by the previous allocation), add the newly created disk representation to the multipathing subsystem.

Given that `nvme_init_ns_head` seems to be the linchpin of this initial setup and the conditional allocation of `ns->head->disk` is a key detail, my next logical step is to dive deeper into its implementation. I need to understand *how* it initializes `ns->head` and, more importantly, the exact conditions and mechanisms behind the `ns->head->disk` allocation for multipath scenarios. So, my immediate focus shifts to: "Let's check `nvme_init_ns_head`."

map[ContextFile:drivers/nvme/host/core.c Name:nvme_init_ns_head]

map[SourceCode:4099:	static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info)
4100:	{
4101:		struct nvme_ctrl *ctrl = ns->ctrl;
4102:		struct nvme_ns_head *head = NULL;
4103:		int ret;
4104:	
4105:		ret = nvme_global_check_duplicate_ids(ctrl->subsys, &info->ids);
4106:		if (ret) {
4107:			/*
4108:			 * We've found two different namespaces on two different
4109:			 * subsystems that report the same ID.  This is pretty nasty
4110:			 * for anything that actually requires unique device
4111:			 * identification.  In the kernel we need this for multipathing,
4112:			 * and in user space the /dev/disk/by-id/ links rely on it.
4113:			 *
4114:			 * If the device also claims to be multi-path capable back off
4115:			 * here now and refuse the probe the second device as this is a
4116:			 * recipe for data corruption.  If not this is probably a
4117:			 * cheap consumer device if on the PCIe bus, so let the user
4118:			 * proceed and use the shiny toy, but warn that with changing
4119:			 * probing order (which due to our async probing could just be
4120:			 * device taking longer to startup) the other device could show
4121:			 * up at any time.
4122:			 */
4123:			nvme_print_device_info(ctrl);
4124:			if ((ns->ctrl->ops->flags & NVME_F_FABRICS) || /* !PCIe */
4125:			    ((ns->ctrl->subsys->cmic & NVME_CTRL_CMIC_MULTI_CTRL) &&
4126:			     info->is_shared)) {
4127:				dev_err(ctrl->device,
4128:					"ignoring nsid %u because of duplicate IDs\n",
4129:					info->nsid);
4130:				return ret;
4131:			}
4132:	
4133:			dev_err(ctrl->device,
4134:				"clearing duplicate IDs for nsid %u\n", info->nsid);
4135:			dev_err(ctrl->device,
4136:				"use of /dev/disk/by-id/ may cause data corruption\n");
4137:			memset(&info->ids.nguid, 0, sizeof(info->ids.nguid));
4138:			memset(&info->ids.uuid, 0, sizeof(info->ids.uuid));
4139:			memset(&info->ids.eui64, 0, sizeof(info->ids.eui64));
4140:			ctrl->quirks |= NVME_QUIRK_BOGUS_NID;
4141:		}
4142:	
4143:		mutex_lock(&ctrl->subsys->lock);
4144:		head = nvme_find_ns_head(ctrl, info->nsid);
4145:		if (!head) {
4146:			ret = nvme_subsys_check_duplicate_ids(ctrl->subsys, &info->ids);
4147:			if (ret) {
4148:				dev_err(ctrl->device,
4149:					"duplicate IDs in subsystem for nsid %u\n",
4150:					info->nsid);
4151:				goto out_unlock;
4152:			}
4153:			head = nvme_alloc_ns_head(ns, info);
4154:			if (IS_ERR(head)) {
4155:				ret = PTR_ERR(head);
4156:				goto out_unlock;
4157:			}
4158:		} else {
4159:			ret = -EINVAL;
4160:			if ((!info->is_shared || !head->shared) &&
4161:			    !list_empty(&head->list)) {
4162:				dev_err(ctrl->device,
4163:					"Duplicate unshared namespace %u\n",
4164:					info->nsid);
4165:				goto out_put_ns_head;
4166:			}
4167:			if (!nvme_ns_ids_equal(&head->ids, &info->ids)) {
4168:				dev_err(ctrl->device,
4169:					"IDs don't match for shared namespace %u\n",
4170:						info->nsid);
4171:				goto out_put_ns_head;
4172:			}
4173:	
4174:			if (!multipath) {
4175:				dev_warn(ctrl->device,
4176:					"Found shared namespace %u, but multipathing not supported.\n",
4177:					info->nsid);
4178:				dev_warn_once(ctrl->device,
4179:					"Shared namespace support requires core_nvme.multipath=Y.\n");
4180:			}
4181:		}
4182:	
4183:		list_add_tail_rcu(&ns->siblings, &head->list);
4184:		ns->head = head;
4185:		mutex_unlock(&ctrl->subsys->lock);
4186:	
4187:	#ifdef CONFIG_NVME_MULTIPATH
4188:		if (cancel_delayed_work(&head->remove_work))
4189:			module_put(THIS_MODULE);
4190:	#endif
4191:		return 0;
4192:	
4193:	out_put_ns_head:
4194:		nvme_put_ns_head(head);
4195:	out_unlock:
4196:		mutex_unlock(&ctrl->subsys->lock);
4197:		return ret;
4198:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 13111
							output: 42
							thoughts: 37
						

**My Thought Process on Namespace Head Management**

Alright, so when I'm dealing with NVMe namespaces, the primary goal is to efficiently manage these namespace heads, right? My internal logic dictates a clear, two-pronged approach. First, I need to ascertain if a suitable namespace head already exists within the system. This is where a function like `nvme_find_ns_head` comes into play. I'll execute that, and if it successfully locates and returns an existing `head` structure – meaning we're not reinventing the wheel – then fantastic! I'll proceed to utilize that already established `head`. It’s all about leveraging existing resources to maintain efficiency.

However, the situation isn't always so straightforward. If, during that initial check, `nvme_find_ns_head` comes up empty, returning no existing `head`, I understand that a new one is required. In this scenario, my next step is to initiate the creation of a fresh namespace head. This is precisely what a function like `nvme_alloc_ns_head` is designed for. I'll call that, and it will handle the allocation and initialization of a new `head` structure, preparing it for subsequent use and management of the associated NVMe namespace. It's a predictable and robust fallback mechanism.

map[ContextFile:drivers/nvme/host/core.c Name:nvme_alloc_ns_head]

map[SourceCode:4002:	static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ns *ns,
4003:			struct nvme_ns_info *info)
4004:		__must_hold(&ns->ctrl->subsys->lock)
4005:	{
4006:		struct nvme_ctrl *ctrl = ns->ctrl;
4007:		struct nvme_ns_head *head;
4008:		size_t size = sizeof(*head);
4009:		int ret = -ENOMEM;
4010:	
4011:	#ifdef CONFIG_NVME_MULTIPATH
4012:		size += nr_node_ids * sizeof(struct nvme_ns *);
4013:	#endif
4014:	
4015:		head = kzalloc(size, GFP_KERNEL);
4016:		if (!head)
4017:			goto out;
4018:		ret = ida_alloc_min(&ctrl->subsys->ns_ida, 1, GFP_KERNEL);
4019:		if (ret < 0)
4020:			goto out_free_head;
4021:		head->instance = ret;
4022:		INIT_LIST_HEAD(&head->list);
4023:		ret = init_srcu_struct(&head->srcu);
4024:		if (ret)
4025:			goto out_ida_remove;
4026:		head->subsys = ctrl->subsys;
4027:		head->ns_id = info->nsid;
4028:		head->ids = info->ids;
4029:		head->shared = info->is_shared;
4030:		head->rotational = info->is_rotational;
4031:		ratelimit_state_init(&head->rs_nuse, 5 * HZ, 1);
4032:		ratelimit_set_flags(&head->rs_nuse, RATELIMIT_MSG_ON_RELEASE);
4033:		kref_init(&head->ref);
4034:		ns->head = head;
4035:	
4036:		if (head->ids.csi) {
4037:			ret = nvme_get_effects_log(ctrl, head->ids.csi, &head->effects);
4038:			if (ret)
4039:				goto out_cleanup_srcu;
4040:		} else
4041:			head->effects = ctrl->effects;
4042:	
4043:		if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
4044:			ret = nvme_query_fdp_info(ns, info);
4045:			if (ret < 0)
4046:				goto out_cleanup_srcu;
4047:		}
4048:	
4049:		ret = nvme_mpath_alloc_disk(ctrl, head);
4050:		if (ret)
4051:			goto out_cleanup_fdp;
4052:	
4053:		list_add_tail(&head->entry, &ctrl->subsys->nsheads);
4054:	
4055:		kref_get(&ctrl->subsys->ref);
4056:	
4057:		return head;
4058:	out_cleanup_fdp:
4059:		kfree(head->plids);
4060:	out_cleanup_srcu:
4061:		cleanup_srcu_struct(&head->srcu);
4062:	out_ida_remove:
4063:		ida_free(&ctrl->subsys->ns_ida, head->instance);
4064:	out_free_head:
4065:		kfree(head);
4066:		ns->head = NULL;
4067:	out:
4068:		if (ret > 0)
4069:			ret = blk_status_to_errno(nvme_error_status(ret));
4070:		return ERR_PTR(ret);
4071:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 14302
							output: 42
							thoughts: 3669
						

**The Core of the Race: Unfreezing a Queue I Never Truly Froze**

I've been digging into this NVMe multipath issue, and I think I've finally grasped the race condition. It all revolves around how the block layer queues are managed, specifically the `mq_freeze_disk_dead` flag, when multiple controllers are dealing with the same namespace.

My understanding is that when a namespace (`ns`) is first encountered, it goes through a few steps:
1.  `nvme_mpath_alloc_disk`: This is where I allocate the structure representing the multipath disk for this namespace.
2.  `nvme_update_ns_info`: This function is key. It's responsible for freezing the block queue associated with the disk.
3.  `nvme_mpath_add_disk`: This is where the disk is finally registered with the system.

Now, here's where it gets tricky. The flow changes if `nvme_find_ns_head` finds an *existing* `head` for the namespace. In that case, I don't allocate a new disk; I reuse the existing `head->disk`.

The problem arises if `head->disk` is already registered (meaning another controller has already gone through `nvme_mpath_add_disk`). If it's registered, when `nvme_update_ns_info` freezes the queue, `blk_freeze_set_owner` sees that the disk is registered. This causes `q->mq_freeze_disk_dead` to be set to `FALSE`.

However, if `head->disk` is *not yet registered* (perhaps it's the very first controller encountering this namespace, and it hasn't reached `nvme_mpath_add_disk` yet), then `q->mq_freeze_disk_dead` gets set to `TRUE`.

This distinction is critical because it leads to a potential race. Let me walk through what I believe is happening:

**Scenario: The Race Unfolds**

Imagine two threads, or even two controllers (let's call them Controller A and Controller B), trying to manage the same namespace.

**Thread 1 (Controller A):**

1.  Starts the process: `nvme_alloc_ns` leads to `nvme_init_ns_head`, then `nvme_alloc_ns_head`, and finally `nvme_mpath_alloc_disk`. At this point, the multipath disk structure is allocated, but the disk itself is *not yet registered* with the block layer.
2.  Calls `nvme_update_ns_info`. This triggers `blk_mq_freeze_queue(ns->head->disk->queue)`.
3.  Because `ns->head->disk` is *not registered*, `q->mq_freeze_disk_dead` is correctly set to `TRUE`.
4.  Then, `blk_mq_unfreeze_queue(ns->head->disk->queue)` is called. This function decrements the freeze depth, and crucially, it returns `TRUE` (indicating it handled the unfreeze).
5.  **Here's the preemption point:** Thread 1 is preempted *before* it can execute `blk_unfreeze_release_lock`.

**The Critical Window:**

While Thread 1 is paused, and importantly, *before* `nvme_mpath_add_disk` has been called by Thread 1, the `ns->head->disk` is still not registered.

**Thread 2 (Controller B, or another thread on Controller A):**

1.  Now, Thread 2 needs to operate on the *same* `ns->head`.
2.  It also calls `nvme_update_ns_info`.
3.  It also calls `blk_mq_freeze_queue`. Since `ns->head->disk` is *still not registered*, `q->mq_freeze_disk_dead` is set to `TRUE` *again*.
4.  Thread 2 then calls `blk_mq_unfreeze_queue`. This will return `TRUE`.
5.  Crucially, Thread 2 *then calls `nvme_mpath_add_disk`*. Thanks to the `test_and_set_bit` check within `nvme_mpath_add_disk`, it successfully registers `ns->head->disk` if Thread 1 hadn't already.

**The Resume and the Bug:**

1.  Now, Thread 1 resumes execution. It looks at `q->mq_freeze_disk_dead`, which was set to `TRUE` by Thread 1 initially.
2.  Because `q->mq_freeze_disk_dead` is `TRUE`, Thread 1 incorrectly concludes that it should *not* attempt to release the lock (because it believes the queue was never properly frozen or managed by an owner).
3.  However, the underlying issue is that the disk *has now been registered* by Thread 2.
4.  The real problem emerges if *another* thread (let's call it Thread 3, perhaps from a rescan operation initiated by either Controller A or B) subsequently calls `nvme_update_ns_info`.
5.  This Thread 3 freezes the queue. This time, because `ns->head->disk` *is now registered* (thanks to Thread 2), `q->mq_freeze_disk_dead` gets set to `FALSE`.
6.  When Thread 1 finally resumes its `blk_unfreeze_release_lock` path (or a similar cleanup path that relies on the queue's state), it now reads `q->mq_freeze_disk_dead` and sees `FALSE`.
7.  This leads Thread 1 to attempt to release a lock (`q->q_usage_counter(io)`) that it *never actually acquired* in the first place, because it was preempted before the initial freeze/acquire logic could complete. This is the bug.

**Summary of the Race Condition:**

The race occurs when:
*   Multiple controllers (A and B) are involved.
*   Controller A allocates the `ns->head` and initiates a freeze/unfreeze cycle, getting preempted *before* the disk is registered and *before* the lock release.
*   Controller B (or another thread) manages to register the disk *after* Controller A was preempted but *before* Controller A resumes and attempts its cleanup.
*   A subsequent operation (like a rescan) then causes the `q->mq_freeze_disk_dead` flag to be set to `FALSE` (because the disk is now registered), leading the resumed Controller A thread to believe it needs to release a lock it never held.

To reliably trigger this, I've been thinking about setting up a scenario with two controllers connecting to the same subsystem concurrently, and then rapidly toggling the namespace's enable state on the target while simultaneously triggering rescans on both controllers. This provides the necessary timing window for the race to manifest. I've even sketched out a C program to automate this testing.

map[ContextFile:drivers/nvme/host/core.c Name:nvme_sysfs_rescan]

map[SourceCode:  28:	static ssize_t nvme_sysfs_rescan(struct device *dev,
  29:					struct device_attribute *attr, const char *buf,
  30:					size_t count)
  31:	{
  32:		struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
  33:	
  34:		nvme_queue_scan(ctrl);
  35:		return count;
  36:	}
 SourceFile:drivers/nvme/host/sysfs.c]

gemini-3.1-pro-preview

							input: 18147
							output: 40
							thoughts: 123
						

**My Thought Process Regarding NVMe Queue Scanning**

Right, so I've just realized that the act of writing to this particular file—presumably a sysfs interface for an NVMe device—directly triggers the `nvme_queue_scan(ctrl)` function. That's the core observation.

Now, my mind immediately jumps to the practical implications of repeated writes. If I open the file once and then perform multiple writes, I need to consider the file descriptor's current position. Will a simple `write` operation suffice after the first one, or will I need to explicitly reset the file pointer back to the beginning using `lseek(fd, 0, SEEK_SET)` before each subsequent write?

While I generally expect that sysfs `store` operations aren't sensitive to the file offset—they're designed to act on the value being written, not where it's written *from*—it's always better to be absolutely certain, especially when dealing with critical hardware interactions. To ensure idempotency and avoid any unexpected behavior due to file positioning, I've identified a couple of robust strategies:

1.  **Open and Close in the Loop:** The most straightforward, albeit potentially less performant for very high-frequency operations, approach is to open the sysfs file, perform the write, and then immediately close the file descriptor in each iteration of my loop. This guarantees a clean slate for every operation.
2.  **`pwrite` for Atomic Writes:** Alternatively, I could leverage `pwrite(fd, "1", 1, 0)`. This system call performs a write at a specific offset (in this case, offset 0) without affecting the file descriptor's current position. This is often preferred for its atomicity and for scenarios where maintaining the file offset isn't desired or is problematic.

Before committing to either of these, my immediate next step is to delve into the implementation details of `nvme_queue_scan` itself. Understanding exactly what it does upon being triggered will inform the best way to interact with the sysfs interface for reliable and predictable results.

map[ContextFile:drivers/nvme/host/core.c Name:nvme_queue_scan]

map[SourceCode: 163:	void nvme_queue_scan(struct nvme_ctrl *ctrl)
 164:	{
 165:		/*
 166:		 * Only new queue scan work when admin and IO queues are both alive
 167:		 */
 168:		if (nvme_ctrl_state(ctrl) == NVME_CTRL_LIVE && ctrl->tagset)
 169:			queue_work(nvme_wq, &ctrl->scan_work);
 170:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 18453
							output: 40
							thoughts: 2610
						

**My Thoughts on Concurrency and NVMe Scanning**

So, the core of this is about how the `ctrl->scan_work` gets queued. The `queue_work` function is idempotent in this context; if it's already queued, it just returns `false` and doesn't do anything. This means I can spam the queue operation as much as I want without worrying about it accumulating redundant work.

Now, thinking about how to trigger this scanning process more aggressively, I considered toggling the NVMe namespace's enable state. My initial thought for a `toggle_ns_thread` function involved a loop that would repeatedly write "0" and then "1" to the `/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable` file. This toggling, I reasoned, should generate an Asynchronous Event Notification (AEN) from the NVMe target to the host. These AENs are precisely what trigger the `nvme_queue_scan` operation. So, by toggling the namespace, I'm essentially indirectly triggering scans. However, if I can *directly* trigger the scan more frequently, I can increase the concurrency, which is the goal here.

Let's refine this C program.

The `setup_nvmet` function sets up the NVMe target with a simple loopback device. It creates the necessary sysfs entries, configures a subsystem, a namespace, and a port. Critically, it then connects two controllers using `/dev/nvme-fabrics`. The `sleep(1)` after this is important; it gives the system time to recognize the newly connected controllers and for them to potentially appear in `/sys/class/nvme/`.

The `teardown_nvmet` function is straightforward, cleaning up the sysfs entries and deleting the controllers.

Looking at the `toggle_ns_thread` again, I confirmed that writing "0" and "1" to the `enable` file using `pwrite` should indeed work, as sysfs files are generally accessible this way.

A potential issue I identified with the `rescan_thread` was the order of operations. If `rescan_thread` tries to open the `rescan_controller` files *before* the controllers are actually connected and registered by the kernel, those files might not exist. However, the `setup_nvmet` function connects the controllers *before* the `sleep(1)`, which in turn happens *before* the `rescan_thread` is supposed to open those files. This means the files should exist by the time `rescan_thread` tries to access them. The loop iterating from `nvme0` to `nvme15` should catch any controller that appears within that range. Also, when the main loop in `main` recreates the threads after a `sleep(5)`, the `rescan_thread` will open the files again, which is fine.

Now, for the critical part: the race condition. I'm imagining a scenario involving multiple threads, specifically the `scan_work` items generated by different controllers or even the same controller in rapid succession.

Here's how I envision the race:

1.  **Thread 1 (Controller A scan work):** This thread discovers a new namespace. It calls `nvme_alloc_ns` and then `nvme_update_ns_info`. During `nvme_update_ns_info`, it freezes the queue by setting `q->mq_freeze_disk_dead = TRUE`. Crucially, it gets preempted *before* it can call `blk_unfreeze_release_lock`.

2.  **Thread 2 (Controller B scan work):** This thread, running concurrently, also discovers a new namespace. It performs its `nvme_alloc_ns` and `nvme_update_ns_info`. It also freezes its queue (`q->mq_freeze_disk_dead = TRUE`). It then manages to complete its unfreeze operation. A key point here is that it proceeds to call `nvme_mpath_add_disk`, which registers the disk.

3.  **Thread 3 (Controller A or B scan work, another iteration):** This thread, perhaps on a subsequent scan for an *existing* namespace, calls `nvme_update_ns_info` again. This time, it might set `q->mq_freeze_disk_dead = FALSE`.

4.  **Thread 1 resumes:** It now tries to complete its operation by calling `blk_unfreeze_release_lock`. Because Thread 3 (or another thread) has set `q->mq_freeze_disk_dead = FALSE`, Thread 1 reads this value, believes the queue is no longer considered "dead" for freezing purposes, and proceeds to release the lock. This leads to a BUG because the lock should not have been released in this state.

This race condition is highly dependent on precise timing. Thread 1 needs to be preempted for a sufficiently long period – long enough for Thread 2 to finish its namespace discovery and disk registration, and for Thread 3 to run its `nvme_update_ns_info` call that resets `q->mq_freeze_disk_dead`.

With four `rescan_thread` instances running concurrently, constantly queuing `scan_work`, and the `nvme_wq` workqueue likely running on multiple CPUs, the chances of concurrent execution of these `scan_work` items are significantly increased. This increases the likelihood of hitting the specific timing window required for the race.

The `blk_mq_unfreeze_queue` function is designed to be very fast, involving an atomic decrement and test. If it returns true, it calls `blk_unfreeze_release_lock`. My goal is to widen this critical window, even if indirectly, through sheer concurrency of rescans and namespace toggling. While I can't directly manipulate the kernel's internal timing from userspace to widen this window, the high concurrency should eventually trigger it.

I also double-checked if `nvme_update_ns_info` is indeed called on rescans of existing namespaces, and it appears it is. This is crucial for the race condition I've outlined, where a later `nvme_update_ns_info` call might reset the `mq_freeze_disk_dead` flag.

map[ContextFile:drivers/nvme/host/core.c Name:nvme_scan_ns]

map[SourceCode:4441:	static void nvme_scan_ns(struct nvme_ctrl *ctrl, unsigned nsid)
4442:	{
4443:		struct nvme_ns_info info = { .nsid = nsid };
4444:		struct nvme_ns *ns;
4445:		int ret = 1;
4446:	
4447:		if (nvme_identify_ns_descs(ctrl, &info))
4448:			return;
4449:	
4450:		if (info.ids.csi != NVME_CSI_NVM && !nvme_multi_css(ctrl)) {
4451:			dev_warn(ctrl->device,
4452:				"command set not reported for nsid: %u\n", nsid);
4453:			return;
4454:		}
4455:	
4456:		/*
4457:		 * If available try to use the Command Set Independent Identify Namespace
4458:		 * data structure to find all the generic information that is needed to
4459:		 * set up a namespace.  If not fall back to the legacy version.
4460:		 */
4461:		if ((ctrl->cap & NVME_CAP_CRMS_CRIMS) ||
4462:		    (info.ids.csi != NVME_CSI_NVM && info.ids.csi != NVME_CSI_ZNS) ||
4463:		    ctrl->vs >= NVME_VS(2, 0, 0))
4464:			ret = nvme_ns_info_from_id_cs_indep(ctrl, &info);
4465:		if (ret > 0)
4466:			ret = nvme_ns_info_from_identify(ctrl, &info);
4467:	
4468:		if (info.is_removed)
4469:			nvme_ns_remove_by_nsid(ctrl, nsid);
4470:	
4471:		/*
4472:		 * Ignore the namespace if it is not ready. We will get an AEN once it
4473:		 * becomes ready and restart the scan.
4474:		 */
4475:		if (ret || !info.is_ready)
4476:			return;
4477:	
4478:		ns = nvme_find_get_ns(ctrl, nsid);
4479:		if (ns) {
4480:			nvme_validate_ns(ns, &info);
4481:			nvme_put_ns(ns);
4482:		} else {
4483:			nvme_alloc_ns(ctrl, &info);
4484:		}
4485:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 21847
							output: 40
							thoughts: 23
						

**My Thought Process**

Okay, so my internal logic is unfolding like this: My primary objective is to process a given `ns` entity. The very first, and frankly, most crucial, step I need to take upon encountering `ns` is to ensure its validity. To do this, I'll be invoking a specific function, `nvme_validate_ns`. This function takes two arguments: the `ns` itself, which I'm currently examining, and a pointer to an `info` structure. This `info` structure is where the results of the validation – any relevant details or status flags – will be stored for me to then act upon. It's a direct and essential check before any further operations can be safely contemplated.

map[ContextFile:drivers/nvme/host/core.c Name:nvme_validate_ns]

map[SourceCode:4419:	static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_info *info)
4420:	{
4421:		int ret = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
4422:	
4423:		if (!nvme_ns_ids_equal(&ns->head->ids, &info->ids)) {
4424:			dev_err(ns->ctrl->device,
4425:				"identifiers changed for nsid %u\n", ns->head->ns_id);
4426:			goto out;
4427:		}
4428:	
4429:		ret = nvme_update_ns_info(ns, info);
4430:	out:
4431:		/*
4432:		 * Only remove the namespace if we got a fatal error back from the
4433:		 * device, otherwise ignore the error and just move on.
4434:		 *
4435:		 * TODO: we should probably schedule a delayed retry here.
4436:		 */
4437:		if (ret > 0 && (ret & NVME_STATUS_DNR))
4438:			nvme_ns_remove(ns);
4439:	}
 SourceFile:drivers/nvme/host/core.c]

gemini-3.1-pro-preview

							input: 22260
							output: 40
							thoughts: 1971
						

**My Thought Process Unraveling the NVMe Freeze Bug**

Okay, so I've been digging into this NVMe freeze bug, and it's becoming clearer, though a bit complex to trace. My initial observation was that `nvme_validate_ns` calls `nvme_update_ns_info`, which means my "Rescan" thread (Thread 3) is indeed going to call `nvme_update_ns_info` on an *existing* namespace.

The critical question then becomes: could `nvme_update_ns_info` be called concurrently on the *same* namespace head? Yes, it can. `nvme_update_ns_info` is invoked from two main paths: `nvme_alloc_ns` (which can happen in Thread 1 and Thread 2, potentially for different controllers or even the same controller if rescans overlap, though `scan_work` is usually single-threaded per controller) and `nvme_validate_ns` (Thread 3, the rescan). Since these can originate from different controllers, or even the same controller in specific scenarios, they *can* execute concurrently on different CPUs, all attempting to freeze the namespace's disk queue (`ns->head->disk->queue`).

Now, the core of the problem lies in `blk_mq_freeze_queue`. Every time it's called, it increments `q->mq_freeze_depth`. If multiple threads freeze the *same* queue concurrently, this depth can exceed 1. For instance, if Thread 1 and Thread 2 both call `blk_mq_freeze_queue` on the same queue, `q->mq_freeze_depth` will become 2.

Here's where the unfreezing logic gets tricky. When a thread calls `blk_mq_unfreeze_queue`, it decrements `q->mq_freeze_depth`. The crucial part is the return value of `__blk_mq_unfreeze_queue`:

```c
bool __blk_mq_unfreeze_queue(struct request_queue *q)
{
	// ...
	if (atomic_dec_and_test(&q->mq_freeze_depth)) {
		// ... This block is executed ONLY when depth becomes 0
		return true;
	}
	return false;
}
```

This means `__blk_mq_unfreeze_queue` only returns `true` when `q->mq_freeze_depth` *becomes zero* after the decrement. If it returns `false` (meaning the depth is still greater than zero), the `blk_unfreeze_release_lock` function is *not* called.

So, for Thread 1 to trigger the bug, it *must* be the *last* one to unfreeze the queue, making `atomic_dec_and_test` return `true`. This implies Thread 1 must unfreeze the queue when `mq_freeze_depth` is about to become 0.

Let's trace a scenario where this could lead to the bug:

1.  **Thread 1** (Controller A) freezes its queue. `q->mq_freeze_depth` becomes 1. `q->mq_freeze_disk_dead` is set to `TRUE`.
2.  **Thread 2** (Controller B) also freezes *its* queue. `q->mq_freeze_depth` becomes 1. `q->mq_freeze_disk_dead` is set to `TRUE`.
3.  **Thread 2** finishes its work and unfreezes its queue. `q->mq_freeze_depth` becomes 0. `__blk_mq_unfreeze_queue` returns `TRUE`. `blk_unfreeze_release_lock` is called for Thread 2.
4.  Now, **Thread 2** proceeds to call `nvme_mpath_add_disk`. Since its queue is now properly unfrozen and registered, it continues.

This path alone doesn't reveal the bug. The bug happens when a different thread (Thread 3) intervenes *after* a disk has been registered, and *before* Thread 1 is done unfreezing.

Let's refine the scenario, focusing on Thread 1 being the last to unfreeze and a subsequent freeze by Thread 3:

1.  **Thread 1** freezes its queue. `q->mq_freeze_depth` = 1. `q->mq_freeze_disk_dead` = `TRUE`.
2.  **Thread 2** freezes its queue. `q->mq_freeze_depth` = 2. `q->mq_freeze_disk_dead` = `TRUE`.
3.  **Thread 2** unfreezes its queue. `q->mq_freeze_depth` = 1. Returns `FALSE`.
4.  **Thread 2** calls `nvme_mpath_add_disk`. The disk is now registered.
5.  **Thread 3** (a rescan or another controller) then calls `nvme_update_ns_info`, which in turn calls `blk_mq_freeze_queue` on the *same* queue.
    *   **Crucially, `blk_mq_freeze_queue` *always* passes `disk_dead = false` to `blk_freeze_acquire_lock`, which then calls `blk_freeze_set_owner`**. This means `q->mq_freeze_disk_dead` is *overwritten* to `FALSE` by Thread 3, *even though Thread 1 is still holding a freeze*. This overwriting is the key!
6.  **Thread 1** now unfreezes its queue. `q->mq_freeze_depth` becomes 0. `__blk_mq_unfreeze_queue` returns `TRUE`.
7.  **Thread 1** calls `blk_unfreeze_release_lock`. It then reads `q->mq_freeze_disk_dead`. Because Thread 3 overwrote it to `FALSE` in step 5, Thread 1 *incorrectly* sees `FALSE` and triggers the bug!

This sequence works and doesn't even require Thread 1 to be preempted in the exact window where it returns `TRUE`. The preemption might happen *before* Thread 1 calls `blk_unfreeze_release_lock`, but the overwriting of `q->mq_freeze_disk_dead` by Thread 3 is the primary enabler, assuming Thread 3 freezes the queue *after* the disk has been registered by Thread 2, but *while* Thread 1 still holds a freeze.

My current understanding is that the bug manifests when:
*   Multiple threads are freezing and unfreezing the same queue.
*   A disk gets registered by one thread (e.g., Thread 2 completing its `nvme_mpath_add_disk`).
*   *Another* thread (e.g., Thread 3) calls `blk_mq_freeze_queue` *while* an earlier thread (Thread 1) still holds a freeze. This causes Thread 3 to overwrite `q->mq_freeze_disk_dead` to `FALSE`.
*   Finally, the first thread (Thread 1) is the *last* to unfreeze the queue, its `__blk_mq_unfreeze_queue` returns `TRUE`, and it then reads the *overwritten* `q->mq_freeze_disk_dead` as `FALSE`, erroneously triggering the bug's cleanup logic.

map[ContextFile:include/linux/blk-mq.h Name:blk_mq_freeze_queue]

map[SourceCode: 951:	static inline unsigned int __must_check
 952:	blk_mq_freeze_queue(struct request_queue *q)
 953:	{
 954:		unsigned int memflags = memalloc_noio_save();
 955:	
 956:		blk_mq_freeze_queue_nomemsave(q);
 957:		return memflags;
 958:	}
 SourceFile:include/linux/blk-mq.h]

gemini-3.1-pro-preview

							input: 24395
							output: 42
							thoughts: 20
						

**My Thought Process:**

Okay, so I'm looking at this code, and it's calling `blk_mq_freeze_queue_nomemsave(q)`. My first immediate thought is, "Why `nomemsave` specifically?" It's like the system's telling me it's freezing this block queue, but it's explicitly *not* going to save any memory associated with it. This suggests to me that either the memory being used by this queue isn't critical to reclaim right now, or perhaps the act of saving it would introduce a performance penalty that's deemed unacceptable in this particular context. I'm suspecting it's a deliberate optimization choice, or maybe a constraint imposed by the surrounding operations. I'll need to keep an eye on how this affects overall memory pressure and performance down the line, but for now, the immediate action is to freeze the queue without the memory saving step.

map[ContextFile:block/blk-mq.c Name:blk_mq_freeze_queue_nomemsave]

map[SourceCode: 204:	void blk_mq_freeze_queue_nomemsave(struct request_queue *q)
 205:	{
 206:		blk_freeze_queue_start(q);
 207:		blk_mq_freeze_queue_wait(q);
 208:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 24547
							output: 38
							thoughts: 13
						

**My Thought Process Regarding `blk_freeze_queue_start`**

Alright, I need to get a handle on what's happening with `blk_freeze_queue_start`. My first step is to dive into the code, specifically examining this particular function. I want to understand its role, its inputs, its outputs, and most importantly, its impact on the overall block layer's freeze operation. This function is likely a crucial part of the process that temporarily halts I/O operations on block devices, so I'll be looking for how it interacts with other components of the block layer, such as the request queue, and what mechanisms it uses to achieve this freeze state. I'm assuming it's a central coordination point or a trigger for the freeze, so I'll be paying close attention to any locking, signaling, or state management it performs.

map[ContextFile:block/blk-mq.c Name:blk_freeze_queue_start]

map[SourceCode: 182:	void blk_freeze_queue_start(struct request_queue *q)
 183:	{
 184:		if (__blk_freeze_queue_start(q, current))
 185:			blk_freeze_acquire_lock(q);
 186:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 24686
							output: 39
							thoughts: 14
						

**My Thought Process Regarding `__blk_freeze_queue_start`**

Alright, so my immediate impulse here is to dive into `__blk_freeze_queue_start`. I need to understand exactly what’s happening at this specific point in the code. My goal is to get a clear picture of its role in the overall freezing process. I'll be looking at how it initiates the queue freezing, what parameters it takes, and what its immediate consequences are for the block layer. I want to trace the flow of control from this function outwards to see what other components or states it influences, particularly as it relates to the I/O queue itself. Essentially, I'm trying to pinpoint the exact moment the queue is formally signaled to begin its quiescent state and what immediate setup or validation occurs there.

map[ContextFile:block/blk-mq.c Name:__blk_freeze_queue_start]

map[SourceCode: 163:	bool __blk_freeze_queue_start(struct request_queue *q,
 164:				      struct task_struct *owner)
 165:	{
 166:		bool freeze;
 167:	
 168:		mutex_lock(&q->mq_freeze_lock);
 169:		freeze = blk_freeze_set_owner(q, owner);
 170:		if (++q->mq_freeze_depth == 1) {
 171:			percpu_ref_kill(&q->q_usage_counter);
 172:			mutex_unlock(&q->mq_freeze_lock);
 173:			if (queue_is_mq(q))
 174:				blk_mq_run_hw_queues(q, false);
 175:		} else {
 176:			mutex_unlock(&q->mq_freeze_lock);
 177:		}
 178:	
 179:		return freeze;
 180:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 25017
							output: 38
							thoughts: 13
						

**My Thought Process Regarding `blk_freeze_set_owner`**

Alright, I need to get a handle on what `blk_freeze_set_owner` is doing. My initial instinct is to dive right into its implementation to understand its purpose and how it integrates into the broader system. I'm assuming, based on the naming convention, that this function is related to managing ownership or control over some kind of "freeze" mechanism, likely within a block-level context – perhaps for I/O operations or memory management.

My immediate goal is to trace the execution flow of `blk_freeze_set_owner`. I want to see:

*   **What are its inputs?** What parameters does it take, and what is their significance? Who or what is passing these parameters, and what do they represent in terms of the system's state?
*   **What are its outputs or side effects?** Does it return a status code? Does it modify any global state, data structures, or device attributes?
*   **What are the core logic paths?** I'll be looking for conditional branches, loops, and error handling. Are there different behaviors depending on the context or the owner being set?
*   **How does it interact with other components?** This is crucial. What other functions does it call? What kernel subsystems or data structures does it touch? Is it interacting with device drivers, scheduling mechanisms, or perhaps a power management framework? The "freeze" aspect strongly suggests some form of state preservation or temporary suspension.
*   **What is the *intent* behind setting an owner?** Why is ownership important in this freezing context? Does it establish a priority, grant specific permissions, or is it purely for tracking and auditing? Is there a concept of a "default" owner, or is ownership always explicitly assigned?
*   **What are the implications of ownership?** What happens if the owner is removed or changes? Are there potential race conditions or deadlocks that this function is designed to prevent or manage? I'll be considering scenarios where multiple entities might want to "freeze" a block device, and how `blk_freeze_set_owner` arbitrates or controls this.

Ultimately, my objective is to build a comprehensive mental model of `blk_freeze_set_owner`. I want to understand its role in maintaining system stability, particularly during operations that require temporary halting or quiescence of block devices, and how it ensures that these operations are performed in a controlled and predictable manner by the appropriate entities. I'll be paying close attention to any explicit or implicit security considerations related to ownership.

map[ContextFile:block/blk-mq.c Name:blk_freeze_set_owner]

map[SourceCode: 116:	static bool blk_freeze_set_owner(struct request_queue *q,
 117:					 struct task_struct *owner)
 118:	{
 119:		if (!owner)
 120:			return false;
 121:	
 122:		if (!q->mq_freeze_depth) {
 123:			q->mq_freeze_owner = owner;
 124:			q->mq_freeze_owner_depth = 1;
 125:			q->mq_freeze_disk_dead = !q->disk ||
 126:				test_bit(GD_DEAD, &q->disk->state) ||
 127:				!blk_queue_registered(q);
 128:			q->mq_freeze_queue_dying = blk_queue_dying(q);
 129:			return true;
 130:		}
 131:	
 132:		if (owner == q->mq_freeze_owner)
 133:			q->mq_freeze_owner_depth += 1;
 134:		return false;
 135:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 25379
							output: 39
							thoughts: 470
						

**My Thought Process Unraveling a Potential `blk-mq` Freeze/Unfreeze Race Condition**

This is fascinating! I've been digging into the `blk_freeze_set_owner` function and its interaction with the freezing mechanism in `blk-mq`, and I've hit upon something that looks like a potential race condition.

My initial realization was about the condition under which `blk_freeze_set_owner` actually *sets* the `q->mq_freeze_disk_dead` flag. It *only* does this when the freeze depth is zero (`!q->mq_freeze_depth`).

Now, consider this scenario: Thread 1 is already holding the freeze, meaning `q->mq_freeze_depth` is 1. Then, Thread 3 comes along and calls `blk_mq_freeze_queue`. When `blk_freeze_set_owner` is invoked within this context, it sees `q->mq_freeze_depth > 0`. Consequently, it *will not* overwrite the existing `q->mq_freeze_disk_dead` flag. It simply returns `false`.

This `false` return value propagates up to `__blk_freeze_queue_start`, which then also returns `false`. The critical consequence here is that `blk_freeze_queue_start` will *not* proceed to call `blk_freeze_acquire_lock(q)`.

So, if `blk_freeze_queue_start` doesn't call `blk_freeze_acquire_lock(q)`, it means Thread 3 *never actually acquired the lock* associated with the freeze operation!

Here's where it gets more concerning: When Thread 3 eventually decides to unfreeze the queue, it will call `blk_mq_unfreeze_queue`. This, in turn, calls `__blk_mq_unfreeze_queue`.

Now, let's look at the logic within `blk_mq_unfreeze_queue`:

```c
static inline void blk_mq_unfreeze_queue(struct request_queue *q)
{
	if (__blk_mq_unfreeze_queue(q))
		blk_unfreeze_release_lock(q, false);
}
```

If Thread 3 is *not* the last one to unfreeze (meaning `q->mq_freeze_depth` is still greater than 0 after its decrement), `__blk_mq_unfreeze_queue` will return `false`, and `blk_unfreeze_release_lock` will correctly *not* be called.

However, if Thread 3 *is* the last one to unfreeze (causing `q->mq_freeze_depth` to become 0), `__blk_mq_unfreeze_queue` will return `true`. And that `true` return value will trigger the call to `blk_unfreeze_release_lock(q, false)`.

But this is the crux of the problem: If Thread 3 is the last one to unfreeze and `blk_unfreeze_release_lock` is called, it implies the assumption that Thread 3 *should* be releasing the lock. Yet, as we established, Thread 3 *never acquired the lock* in the first place because `__blk_freeze_queue_start` returned `false`!

This smells strongly like a bug in `blk-mq.c`. I need to dive into the implementation of `blk_unfreeze_release_lock` to see exactly what it does when called under these conditions, and whether this non-acquired lock release leads to any undefined behavior or data corruption. It certainly seems like a flawed path.

map[ContextFile:block/blk-mq.c Name:blk_unfreeze_release_lock]

map[SourceCode: 769:	static inline void blk_unfreeze_release_lock(struct request_queue *q)
 770:	{
 771:		if (!q->mq_freeze_queue_dying)
 772:			rwsem_release(&q->q_lockdep_map, _RET_IP_);
 773:		if (!q->mq_freeze_disk_dead)
 774:			rwsem_release(&q->io_lockdep_map, _RET_IP_);
 775:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 26030
							output: 40
							thoughts: 37
						

**A Deep Dive into Block Queue Freezing and Unfreezing**

As I'm working through this code, a thought immediately strikes me: where exactly is this `blk_unfreeze_release_lock` function defined? My internal compass points towards `block/blk.h`, a likely place for core block layer locking mechanisms. It's not just about knowing *what* it does, but *where* it lives within the kernel's structure.

Now that I've pinpointed its probable location, my next logical step is to investigate its usage, and a prime candidate for this investigation is `__blk_mq_unfreeze_queue`. This function name strongly suggests it's involved in the process of unfreezing a block queue, and given the presence of `blk_unfreeze_release_lock`, it's highly probable that `__blk_mq_unfreeze_queue` is where the actual unfreezing logic resides, and where the lock release function would be invoked. My immediate instinct is to trace the call chain from `__blk_mq_unfreeze_queue` to understand how and when the queue is unfrozen, and critically, how the associated lock is managed throughout this operation. This is a fundamental aspect of ensuring proper synchronization and preventing race conditions when manipulating block queue states.

map[ContextFile:block/blk-mq.c Name:__blk_mq_unfreeze_queue]

map[SourceCode: 211:	bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
 212:	{
 213:		bool unfreeze;
 214:	
 215:		mutex_lock(&q->mq_freeze_lock);
 216:		if (force_atomic)
 217:			q->q_usage_counter.data->force_atomic = true;
 218:		q->mq_freeze_depth--;
 219:		WARN_ON_ONCE(q->mq_freeze_depth < 0);
 220:		if (!q->mq_freeze_depth) {
 221:			percpu_ref_resurrect(&q->q_usage_counter);
 222:			wake_up_all(&q->mq_freeze_wq);
 223:		}
 224:		unfreeze = blk_unfreeze_check_owner(q);
 225:		mutex_unlock(&q->mq_freeze_lock);
 226:	
 227:		return unfreeze;
 228:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 26406
							output: 39
							thoughts: 27
						

**My Thought Process Unpacked: Deconstructing the `blk_mq_unfreeze_queue` Return Value**

Right, so I'm looking at this piece of code, specifically the `__blk_mq_unfreeze_queue` function. My immediate thought upon seeing its return value – `blk_unfreeze_check_owner(q)` – is one of immediate recognition and a subtle, but important, clarification of its purpose.

What this tells me, at its core, is that the unfreezing operation for this particular block queue (`q`) isn't a simple, atomic "it's now unfrozen." Instead, it hinges on a *validation* step. The act of unfreezing is explicitly tied to confirming ownership. This isn't just a formality; it's a crucial security and correctness check.

My mind immediately goes to *why* this ownership check is necessary. In a multiqueue environment, especially with the complexity that `blk-mq` introduces, the potential for race conditions or incorrect state management is significant. Imagine multiple entities trying to unfreeze the same queue, or perhaps a queue that's in a transitional state. `blk_unfreeze_check_owner(q)` acts as a gatekeeper, ensuring that the entity performing the unfreeze is indeed the legitimate owner – the one that initiated the freeze, or has the right to release it.

This implies that the return value of `__blk_mq_unfreeze_queue` isn't just a success/failure indicator of the *act* of unfreezing, but rather a signal about the *validity* of that act in the context of ownership. If `blk_unfreeze_check_owner(q)` returns successfully, it means the unfreeze can proceed *because* the caller is the rightful owner. If it fails, the unfreeze itself is effectively aborted or flagged as invalid, preventing potentially disastrous state corruption.

So, when I see `blk_unfreeze_check_owner(q)`, I'm not just seeing a function call. I'm seeing a statement of intent: "This unfreeze operation is only valid if the caller can prove they are the rightful owner of this queue's frozen state." It’s a deliberate design choice to bolster the robustness of the block layer's concurrency handling. It’s about ensuring that state transitions are controlled and predictable, even under heavy load and complex interaction patterns.

map[ContextFile:block/blk-mq.c Name:blk_unfreeze_check_owner]

map[SourceCode: 137:	/* verify the last unfreeze in owner context */
 138:	static bool blk_unfreeze_check_owner(struct request_queue *q)
 139:	{
 140:		if (q->mq_freeze_owner != current)
 141:			return false;
 142:		if (--q->mq_freeze_owner_depth == 0) {
 143:			q->mq_freeze_owner = NULL;
 144:			return true;
 145:		}
 146:		return false;
 147:	}
 SourceFile:block/blk-mq.c]

gemini-3.1-pro-preview

							input: 26638
							output: 36
							thoughts: 351
						

**My Thought Process Regarding `blk_unfreeze_check_owner` and Queue Freezing**

Okay, so I'm looking at `blk_unfreeze_check_owner` and it seems to be doing exactly what I'd expect: checking if the current thread (`current`) is the one that originally set the `q->mq_freeze_owner`. If it is, it decrements a depth counter (`q->mq_freeze_owner_depth`). The crucial part is that it only returns `true` if this depth counter hits zero *and* the current thread is indeed the owner. This implies that only the initial thread that set the owner and began the freezing process will ultimately see a `true` return from the `__blk_mq_unfreeze_queue` function, signaling the end of the unfreeze operation.

Let me trace a scenario to solidify this:

1.  **Thread 1 freezes:** It becomes the owner, and the `mq_freeze_owner_depth` goes from 0 to 1. `blk_freeze_set_owner` would return `true` for Thread 1.
2.  **Thread 2 freezes:** It *cannot* become the owner because `q->mq_freeze_owner` is already set to Thread 1. So, `blk_freeze_set_owner` will return `false` for Thread 2. The `mq_freeze_owner_depth` will still increment, but Thread 2 is not the designated owner.
3.  **Thread 2 unfreezes:** It checks `blk_unfreeze_check_owner`. Since `current` (Thread 2) is not `q->mq_freeze_owner` (Thread 1), it will return `false`. The depth might decrement, but the owner doesn't change.
4.  **Thread 1 unfreezes:** Now `current` (Thread 1) *is* `q->mq_freeze_owner`. It decrements `q->mq_freeze_owner_depth`. Since Thread 1 was the *only* thread that could have incremented the depth while being the owner, this decrement will bring the depth back to 0. Therefore, `blk_unfreeze_check_owner` will return `true`. This `true` return propagates up to `__blk_mq_unfreeze_queue`, which then proceeds to call `blk_unfreeze_release_lock`.

This brings me to a point of slight confusion, or rather, a potential area I need to scrutinize further. If Thread 1 is indeed the owner, and it acquired the lock when it initiated the freeze, then it makes logical sense that it should release that same lock when it completes the unfreeze operation. So, on the surface, where is the bug?

The potential bug lies in a specific condition: what if, during the initial freeze by Thread 1, the `q->mq_freeze_disk_dead` flag is set to `TRUE`? This flag is set because the disk wasn't registered at that moment. If this happens, I need to re-examine the `blk_freeze_acquire_lock` function itself to understand the implications and how it might interact with the ownership and locking mechanisms. I suspect the issue might be in how the lock is acquired *in conjunction with* the `disk_dead` state.

map[ContextFile:block/blk.h Name:blk_freeze_acquire_lock]

map[SourceCode: 761:	static inline void blk_freeze_acquire_lock(struct request_queue *q)
 762:	{
 763:		if (!q->mq_freeze_disk_dead)
 764:			rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
 765:		if (!q->mq_freeze_queue_dying)
 766:			rwsem_acquire(&q->q_lockdep_map, 0, 1, _RET_IP_);
 767:	}
 SourceFile:block/blk.h]

gemini-3.1-pro-preview

							input: 27178
							output: 2309
							thoughts: 6244
						

**The Root of the Problem: A Subtle Race in NVMe Disk Freezing**

My investigation into a tricky bug led me to examine the interaction between freezing and unfreezing request queues, specifically within the NVMe driver and its multipath handling. I initially noticed that if `q->mq_freeze_disk_dead` was `TRUE` during a disk freeze operation, the `io_lockdep_map` was *not* acquired by the thread performing the freeze. This seemed like a potential optimization or a deliberate design choice.

Following this thread, I saw that when the queue was subsequently unfrozen, the `blk_unfreeze_release_lock` function was called. My immediate thought was, "If `q->mq_freeze_disk_dead` is still `TRUE` at this point, it won't release `io_lockdep_map`." This is fine; it just means the lock was never taken, so there's no bug there. The critical insight came when I realized the bug *only* occurs if `q->mq_freeze_disk_dead` is `FALSE` when `blk_unfreeze_release_lock` is called.

This immediately posed the question: how could `q->mq_freeze_disk_dead` become `FALSE`? I traced its setting and found it's only ever set to `FALSE` within `blk_freeze_set_owner` when the freeze depth `!q->mq_freeze_depth` is zero. This implies a very specific sequence of events: the queue must have been completely unfrozen (depth 0), then frozen again.

Let's walk through the scenario I constructed:

1.  **Thread 1 (Controller A)** initiates a freeze. The depth becomes 1, and `q->mq_freeze_disk_dead` is set to `TRUE` because the disk isn't registered yet.
2.  **Thread 1** then proceeds to unfreeze the queue. The depth drops to 0, and `__blk_mq_unfreeze_queue` returns `true`, indicating the queue is now fully unfrozen.
3.  Crucially, **Thread 1** is then *preempted* right before it calls `blk_unfreeze_release_lock`. This is the window of vulnerability.
4.  Meanwhile, **Thread 2 (Controller B)** manages to get scheduled. It calls `nvme_mpath_add_disk`, which implies it has completed `nvme_update_ns_info`. For Thread 2 to reach this point, it must have also frozen and then unfrozen the queue. This can happen *after* Thread 1 has unfrozen its queue. So, Thread 2 freezes the queue (depth 1, `dead = TRUE` as the disk isn't registered yet), and then immediately unfreezes it (depth 0). Now, the disk is registered.
5.  Next, **Thread 3 (a Rescan operation)** takes its turn. It freezes the queue again. Now, because the disk *is* registered, `q->mq_freeze_disk_dead` is set to `FALSE`.
6.  Finally, **Thread 1** resumes execution. It finally calls `blk_unfreeze_release_lock`. It reads `q->mq_freeze_disk_dead`, which it finds is `FALSE` (thanks to Thread 3!). Because it's `FALSE`, it proceeds to attempt to release `io_lockdep_map`. However, Thread 1 *never acquired* `io_lockdep_map` in the first place (because `q->mq_freeze_disk_dead` was `TRUE` initially). This is the BUG!

Yes, this specific sequence precisely explains the observed behavior. The preemption window between `__blk_mq_unfreeze_queue` returning `true` and `blk_unfreeze_release_lock` being called is the key. During this narrow window, the queue must go through a full unfreeze-then-refreeze cycle, with the disk becoming registered in between, and then a separate entity (like a rescan) freezing the queue, thereby setting `q->mq_freeze_disk_dead` to `FALSE`.

Reproducing this is challenging because it requires precise timing: Thread 1 must be delayed, Thread 2 must register the disk, and Thread 3 must freeze the queue again. Since I can't directly control the scheduler from userspace, the strategy is to *spam* these operations concurrently to maximize the chance of hitting this tight race.

My previous attempts to reproduce the bug often triggered a warning related to `blk_mq_free_tag_set`, which occurs during controller teardown. To avoid this, I shifted my focus away from deleting controllers and instead concentrated on toggling namespace enablement and performing rescans. This approach is much cleaner and more likely to isolate the specific race condition I identified.

To further increase the odds, I refined the reproducer program. The core idea is to create a high level of concurrent activity around the queue freezing/unfreezing and disk state changes. This involves:

*   Setting up multiple NVMe controllers (four in this case) connected to the same subsystem. This ensures that when the namespace is enabled, multiple controllers will concurrently try to allocate and register their namespaces, providing the necessary concurrency for threads like my hypothesized Thread 1 and Thread 2.
*   Creating a dedicated thread (`toggle_ns_thread`) to rapidly enable and disable the NVMe namespace. This action itself triggers host-level operations that involve freezing and unfreezing the queue.
*   Using multiple threads (`rescan_thread`) to continuously write to the `rescan_controller` sysfs entry for all connected controllers. This simulates rescanning and triggers `nvme_validate_ns`, which in turn can lead to `nvme_update_ns_info`.
*   Adding another thread (`open_close_thread`) to repeatedly open and close the multipath block device (`/dev/nvmeXn1`). This is significant because opening the block device can trigger `nvme_revalidate_disk`, which directly calls `nvme_update_ns_info` synchronously, providing another avenue for concurrency.

This multi-pronged approach aims to create a highly chaotic environment where the specific sequence of freeze, unfreeze, disk registration, refreeze, and resumption required to hit the race condition is statistically very likely to occur within the 30-second test duration. The elimination of controller deletion avoids extraneous bug reports and keeps the focus squarely on the `io_lockdep_map` acquisition issue.

map[CurrentReproStrategy:An analysis of the previous attempt reveals that deleting controllers concurrently triggered a different bug (`WARNING in blk_mq_free_tag_set`). To avoid this and focus purely on the `bad unlock balance` race condition, we should keep the controllers connected and instead dynamically add and remove the **namespace** from the target side.

### Refined Root Cause & Race Sequence
The race occurs on the multipath disk's queue (`ns->head->disk->queue`) and involves three concurrent operations:
1. **Thread 1 (Controller A)** discovers a new namespace, calls `nvme_alloc_ns` -> `nvme_update_ns_info`, and freezes the queue. Since the multipath disk is not yet registered, `q->mq_freeze_disk_dead` is set to `TRUE`, and it skips acquiring the `io_lockdep_map` lock. It unfreezes the queue but gets preempted just before calling `blk_unfreeze_release_lock`.
2. **Thread 2 (Controller B)** concurrently discovers the same namespace, completes its `nvme_update_ns_info`, and calls `nvme_mpath_add_disk`, which registers the multipath disk.
3. **Thread 3 (Rescan or Open)** calls `nvme_update_ns_info` on the now-registered disk. It freezes the queue, which overwrites `q->mq_freeze_disk_dead` to `FALSE`.
4. **Thread 1** resumes, calls `blk_unfreeze_release_lock`, reads the overwritten `q->mq_freeze_disk_dead == FALSE`, and attempts to release the `io_lockdep_map` lock it never acquired.

### Refined Reproduction Strategy
1. Connect 4 NVMe loopback controllers to the same subsystem.
2. **Toggle Thread:** Continuously enable and disable the namespace on the target side. This causes all 4 controllers to concurrently discover the namespace and call `nvme_alloc_ns` (providing Threads 1 and 2).
3. **Rescan Threads:** Continuously trigger `rescan_controller` via sysfs. This calls `nvme_update_ns_info` via `nvme_validate_ns` (providing Thread 3).
4. **Open Threads:** Continuously `open()` and `close()` the multipath block device (`/dev/nvmeXn1`). This synchronously calls `nvme_update_ns_info` via `nvme_revalidate_disk` (providing more Thread 3 concurrency).

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");

	// Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
	for (int i = 0; i < 4; i++) {
		int fd = open("/dev/nvme-fabrics", O_RDWR);
		if (fd >= 0) {
			write(fd, "nqn=testnqn,transport=loop", 26);
			close(fd);
		}
	}
	
	// Wait a bit for controllers to connect and scan
	sleep(2);
}

void teardown_nvmet()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg)
{
	int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
	if (fd < 0) return NULL;

	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		pwrite(fd, "0", 1, 0);
		usleep(50000); // 50ms to allow host to process removal
		pwrite(fd, "1", 1, 0);
		usleep(50000); // 50ms to allow host to process addition
	}
	close(fd);
	return NULL;
}

void* rescan_thread(void* arg)
{
	int fds[16];
	int num_fds = 0;
	char path[256];

	for (int i = 0; i < 16; i++) {
		snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
		int fd = open(path, O_WRONLY);
		if (fd >= 0) {
			fds[num_fds++] = fd;
		}
	}

	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		for (int i = 0; i < num_fds; i++) {
			pwrite(fds[i], "1", 1, 0);
		}
		usleep(1000);
	}

	for (int i = 0; i < num_fds; i++) {
		close(fds[i]);
	}
	return NULL;
}

void* open_close_thread(void* arg)
{
	char path[256];
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		for (int i = 0; i < 4; i++) {
			snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
			int fd = open(path, O_RDONLY);
			if (fd >= 0) {
				close(fd);
			}
		}
		usleep(1000);
	}
	return NULL;
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t tt;
		pthread_t rt[2];
		pthread_t ot[2];

		__atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

		pthread_create(&tt, NULL, toggle_ns_thread, NULL);
		for (int i = 0; i < 2; i++)
			pthread_create(&rt[i], NULL, rescan_thread, NULL);
		for (int i = 0; i < 2; i++)
			pthread_create(&ot[i], NULL, open_close_thread, NULL);

		sleep(5);
		__atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

		pthread_join(tt, NULL);
		for (int i = 0; i < 2; i++)
			pthread_join(rt[i], NULL);
		for (int i = 0; i < 2; i++)
			pthread_join(ot[i], NULL);
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```]

deep-reasoning

map[IsProbe:false RawCandidateReproC:#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    
    // Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
    for (int i = 0; i < 4; i++) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    
    // Wait a bit for controllers to connect and scan
    sleep(2);
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    // Delete controllers
    for (int i = 0; i < 16; i++) {
        char path[256];
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/delete_controller", i);
        try_write_file(path, "1");
    }
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg) {
    int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
    if (fd < 0) return NULL;

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        if (pwrite(fd, "0\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process removal
        if (pwrite(fd, "1\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process addition
    }
    close(fd);
    return NULL;
}

void* rescan_thread(void* arg) {
    int fds[16];
    int num_fds = 0;
    char path[256];

    for (int i = 0; i < 16; i++) {
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
        int fd = open(path, O_WRONLY);
        if (fd >= 0) {
            fds[num_fds++] = fd;
        }
    }

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < num_fds; i++) {
            if (pwrite(fds[i], "1\n", 2, 0) < 0) {}
        }
        usleep(1000);
    }

    for (int i = 0; i < num_fds; i++) {
        close(fds[i]);
    }
    return NULL;
}

void* open_close_thread(void* arg) {
    char path[256];
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < 4; i++) {
            snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
            int fd = open(path, O_RDONLY);
            if (fd >= 0) {
                close(fd);
            }
        }
        usleep(1000);
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t tt;
        pthread_t rt[2];
        pthread_t ot[2];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        pthread_create(&tt, NULL, toggle_ns_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&ot[i], NULL, open_close_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        pthread_join(tt, NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(ot[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.

To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
   and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
    int res = do_something();
    if (res < 0) {
        printf("[-] Failed to do_something: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
   systems, makefiles, and kernel build/header directories) is NOT available
   on the target test VM guest. Do NOT check for, build, or reference any
   compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
   functions like 'system()', 'popen()', or the 'exec' family such as
   'execve()'). All environment checks, capability probings, and reproduction
   steps must be performed directly using standard Linux system calls (such
   as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
   include a sufficient delay (using sleep or similar) after deleting
   or unregistering the device to allow the kernel's asynchronous
   timeout to trigger before program exit.


=== PHASE 2: BUG REPRODUCTION (GENERATION) ===
You must now generate a full reproducer candidate attempting to trigger the target bug/crash.
Do NOT generate a probe program. Focus directly on triggering the bug/crash described in the description.
You can assume that all necessary kernel capabilities and privileges (e.g., access to /dev/vhci,
ability to load BPF programs, etc.) have already been verified and are available in the environment.

Do not spend too much time analyzing or trying to generate a perfect one-shot reproducer.
Instead, follow an iterative approach: generate a simple candidate, execute it, analyze the results,
and improve it. Keep your reasoning steps short and focused on the next logical experiment.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Strategy: An analysis of the previous attempt reveals that deleting controllers concurrently triggered a different bug (`WARNING in blk_mq_free_tag_set`). To avoid this and focus purely on the `bad unlock balance` race condition, we should keep the controllers connected and instead dynamically add and remove the **namespace** from the target side.

### Refined Root Cause & Race Sequence
The race occurs on the multipath disk's queue (`ns->head->disk->queue`) and involves three concurrent operations:
1. **Thread 1 (Controller A)** discovers a new namespace, calls `nvme_alloc_ns` -> `nvme_update_ns_info`, and freezes the queue. Since the multipath disk is not yet registered, `q->mq_freeze_disk_dead` is set to `TRUE`, and it skips acquiring the `io_lockdep_map` lock. It unfreezes the queue but gets preempted just before calling `blk_unfreeze_release_lock`.
2. **Thread 2 (Controller B)** concurrently discovers the same namespace, completes its `nvme_update_ns_info`, and calls `nvme_mpath_add_disk`, which registers the multipath disk.
3. **Thread 3 (Rescan or Open)** calls `nvme_update_ns_info` on the now-registered disk. It freezes the queue, which overwrites `q->mq_freeze_disk_dead` to `FALSE`.
4. **Thread 1** resumes, calls `blk_unfreeze_release_lock`, reads the overwritten `q->mq_freeze_disk_dead == FALSE`, and attempts to release the `io_lockdep_map` lock it never acquired.

### Refined Reproduction Strategy
1. Connect 4 NVMe loopback controllers to the same subsystem.
2. **Toggle Thread:** Continuously enable and disable the namespace on the target side. This causes all 4 controllers to concurrently discover the namespace and call `nvme_alloc_ns` (providing Threads 1 and 2).
3. **Rescan Threads:** Continuously trigger `rescan_controller` via sysfs. This calls `nvme_update_ns_info` via `nvme_validate_ns` (providing Thread 3).
4. **Open Threads:** Continuously `open()` and `close()` the multipath block device (`/dev/nvmeXn1`). This synchronously calls `nvme_update_ns_info` via `nvme_revalidate_disk` (providing more Thread 3 concurrency).

```c
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

void setup_nvmet()
{
	system("modprobe nvmet >/dev/null 2>&1");
	system("modprobe nvmet-loop >/dev/null 2>&1");
	system("modprobe nvme-loop >/dev/null 2>&1");
	system("modprobe nvme-multipath >/dev/null 2>&1");

	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host");
	system("mkdir -p /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

	system("dd if=/dev/zero of=/tmp/nvme_backing bs=1M count=16 >/dev/null 2>&1");
	system("echo -n /tmp/nvme_backing > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path");
	system("echo 1 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable");

	system("mkdir -p /sys/kernel/config/nvmet/ports/1");
	system("echo loop > /sys/kernel/config/nvmet/ports/1/addr_trtype");
	system("ln -sf /sys/kernel/config/nvmet/subsystems/testnqn /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");

	// Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
	for (int i = 0; i < 4; i++) {
		int fd = open("/dev/nvme-fabrics", O_RDWR);
		if (fd >= 0) {
			write(fd, "nqn=testnqn,transport=loop", 26);
			close(fd);
		}
	}
	
	// Wait a bit for controllers to connect and scan
	sleep(2);
}

void teardown_nvmet()
{
	system("for f in /sys/class/nvme/nvme*/delete_controller; do echo 1 > $f 2>/dev/null; done");
	system("rm -f /sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
	system("rmdir /sys/kernel/config/nvmet/ports/1 >/dev/null 2>&1");
	system("echo 0 > /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1 >/dev/null 2>&1");
	system("rmdir /sys/kernel/config/nvmet/subsystems/testnqn >/dev/null 2>&1");
	system("rm -f /tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg)
{
	int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
	if (fd < 0) return NULL;

	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		pwrite(fd, "0", 1, 0);
		usleep(50000); // 50ms to allow host to process removal
		pwrite(fd, "1", 1, 0);
		usleep(50000); // 50ms to allow host to process addition
	}
	close(fd);
	return NULL;
}

void* rescan_thread(void* arg)
{
	int fds[16];
	int num_fds = 0;
	char path[256];

	for (int i = 0; i < 16; i++) {
		snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
		int fd = open(path, O_WRONLY);
		if (fd >= 0) {
			fds[num_fds++] = fd;
		}
	}

	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		for (int i = 0; i < num_fds; i++) {
			pwrite(fds[i], "1", 1, 0);
		}
		usleep(1000);
	}

	for (int i = 0; i < num_fds; i++) {
		close(fds[i]);
	}
	return NULL;
}

void* open_close_thread(void* arg)
{
	char path[256];
	while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
		for (int i = 0; i < 4; i++) {
			snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
			int fd = open(path, O_RDONLY);
			if (fd >= 0) {
				close(fd);
			}
		}
		usleep(1000);
	}
	return NULL;
}

int main()
{
	SETUP_UNBUFFERED_IO();
	setup_nvmet();

	printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

	TIMER_START(start);
	while (TIMER_NOT_EXPIRED(start, 30.0)) {
		pthread_t tt;
		pthread_t rt[2];
		pthread_t ot[2];

		__atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

		pthread_create(&tt, NULL, toggle_ns_thread, NULL);
		for (int i = 0; i < 2; i++)
			pthread_create(&rt[i], NULL, rescan_thread, NULL);
		for (int i = 0; i < 2; i++)
			pthread_create(&ot[i], NULL, open_close_thread, NULL);

		sleep(5);
		__atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

		pthread_join(tt, NULL);
		for (int i = 0; i < 2; i++)
			pthread_join(rt[i], NULL);
		for (int i = 0; i < 2; i++)
			pthread_join(ot[i], NULL);
	}

	printf("[*] Cleaning up...\n");
	teardown_nvmet();
	return 0;
}
```


Previous Reproducer Attempt:
#include "race_toolkit.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <dirent.h>

#define NUM_CONNECT_THREADS 4
#define NUM_RESCAN_THREADS 4
#define NUM_DISCONNECT_THREADS 2

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* connect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    return NULL;
}

void* rescan_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/rescan_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
    }
    return NULL;
}

void* disconnect_thread(void* arg) {
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        DIR *d = opendir("/sys/class/nvme");
        if (!d) continue;
        struct dirent *dir;
        while ((dir = readdir(d)) != NULL) {
            if (strncmp(dir->d_name, "nvme", 4) == 0) {
                char path[256];
                snprintf(path, sizeof(path), "/sys/class/nvme/%s/delete_controller", dir->d_name);
                try_write_file(path, "1");
            }
        }
        closedir(d);
        usleep(50000); // Disconnect less frequently to allow rescans to hit registered disks
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe multipath connections and rescans...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t ct[NUM_CONNECT_THREADS];
        pthread_t rt[NUM_RESCAN_THREADS];
        pthread_t dt[NUM_DISCONNECT_THREADS];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_create(&ct[i], NULL, connect_thread, NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_create(&dt[i], NULL, disconnect_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        for (int i = 0; i < NUM_CONNECT_THREADS; i++)
            pthread_join(ct[i], NULL);
        for (int i = 0; i < NUM_RESCAN_THREADS; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < NUM_DISCONNECT_THREADS; i++)
            pthread_join(dt[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}




Execution Results & Debugging Feedback:
Collision detected: candidate reproducer triggered a crash with title "WARNING in blk_mq_free_tag_set", which does not match the expected bug.

gemini-3.1-pro-preview

							input: 8512
							output: 2158
							thoughts: 9475
						

**Reproducing the `nvme_update_ns_info` Bad Unlock Balance Race Condition**

My current objective is to reproduce a specific kernel race condition, identified by the warning `WARNING: bad unlock balance in nvme_update_ns_info`. My prior attempt to achieve this resulted in a different warning, `WARNING in blk_mq_free_tag_set`, indicating that the strategy needed refinement.

The analysis of the previous failure highlighted a crucial insight: concurrently deleting NVMe controllers triggered that secondary bug. To isolate and focus solely on the intended `nvme_update_ns_info` race, I need to avoid controller deletion. The updated strategy, therefore, is to keep the controllers connected and instead dynamically add and remove the target namespace from the host's perspective.

The provided code snippet in the strategy section offered a good starting point for this new approach. However, I noticed a critical constraint: I must not use shell commands like `system()` or `popen()`, nor any `exec` family functions. All operations must be performed directly using standard Linux system calls such as `open()`, `socket()`, `ioctl()`, `stat()`, etc. This means I need to rewrite the `setup_nvmet()` function to use POSIX-compliant C library calls instead of `system()`.

Therefore, my immediate task is to refactor `setup_nvmet()` and also implement a corresponding `teardown_nvmet()` function, both adhering strictly to the system call constraint. I've already drafted the necessary C code, replacing `system()` calls with their direct POSIX equivalents for creating directories (`mkdir`), writing to files (`open`, `write`), and managing device paths (`symlink`, `unlink`). I've also ensured proper error handling for these operations.

Looking at the core logic, the strategy involves setting up an NVMe target subsystem with a namespace, then connecting multiple controllers to it. The race condition will be triggered by concurrently toggling the namespace's `enable` attribute on the target side while simultaneously forcing rescans on the host and attempting to open/close the NVMe devices. This combination aims to create a scenario where `nvme_alloc_ns` is called concurrently across multiple controllers, and within that, `nvme_update_ns_info` experiences a race due to conflicting unlock/lock operations.

Specifically, I've implemented the following:

*   **`setup_nvmet()`**: This function now uses `mkdir`, `open`, `write`, `ftruncate`, and `symlink` to configure the NVMe target. It creates the necessary sysfs entries for the subsystem and namespace, sets up a backing file, enables the namespace, and establishes the loopback transport port. Crucially, it connects four controllers to the same subsystem to increase the likelihood of concurrent `nvme_alloc_ns` calls.
*   **`teardown_nvmet()`**: This function will clean up the created sysfs entries, delete the controllers, and remove the backing file.
*   **`toggle_ns_thread()`**: This thread will repeatedly enable and disable the NVMe namespace on the target. It uses `pwrite` to write "0" and "1" to the `enable` file in `configfs`, with short delays to allow the host to process the changes.
*   **`rescan_thread()`**: This thread iterates through available NVMe controllers and writes "1" to their `rescan_controller` sysfs entry. This forces the host to rescan for devices and namespaces.
*   **`open_close_thread()`**: This thread attempts to repeatedly open and close the `/dev/nvmeXn1` device nodes. This action can also trigger namespace discovery and potentially interact with the underlying NVMe drivers.

The `main` function orchestrates these threads within a timed loop. It starts the `toggle_ns_thread`, two `rescan_thread` instances, and two `open_close_thread` instances concurrently. After a few seconds, it signals them to stop, then joins them before the loop repeats. This repeated concurrent activity, especially the toggling of the namespace combined with rescans and device opens, is designed to create the specific race condition in `nvme_update_ns_info` that I am trying to reproduce.

I've made minor adjustments like adding `\n` to writes to sysfs files, as this is often expected by kernel interfaces, and ensuring `usleep` calls are appropriately placed to allow for asynchronous operations. I believe this revised approach directly addresses the issues encountered in the previous attempt and aligns perfectly with the goal of isolating the `bad unlock balance` race.

map[IsProbe:false RawCandidateReproC:#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    
    // Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
    for (int i = 0; i < 4; i++) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    
    // Wait a bit for controllers to connect and scan
    sleep(2);
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    // Delete controllers
    for (int i = 0; i < 16; i++) {
        char path[256];
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/delete_controller", i);
        try_write_file(path, "1");
    }
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg) {
    int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
    if (fd < 0) return NULL;

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        if (pwrite(fd, "0\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process removal
        if (pwrite(fd, "1\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process addition
    }
    close(fd);
    return NULL;
}

void* rescan_thread(void* arg) {
    int fds[16];
    int num_fds = 0;
    char path[256];

    for (int i = 0; i < 16; i++) {
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
        int fd = open(path, O_WRONLY);
        if (fd >= 0) {
            fds[num_fds++] = fd;
        }
    }

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < num_fds; i++) {
            if (pwrite(fds[i], "1\n", 2, 0) < 0) {}
        }
        usleep(1000);
    }

    for (int i = 0; i < num_fds; i++) {
        close(fds[i]);
    }
    return NULL;
}

void* open_close_thread(void* arg) {
    char path[256];
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < 4; i++) {
            snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
            int fd = open(path, O_RDONLY);
            if (fd >= 0) {
                close(fd);
            }
        }
        usleep(1000);
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t tt;
        pthread_t rt[2];
        pthread_t ot[2];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        pthread_create(&tt, NULL, toggle_ns_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&ot[i], NULL, open_close_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        pthread_join(tt, NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(ot[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[IsProbe:false RawCandidateReproC:#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    
    // Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
    for (int i = 0; i < 4; i++) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    
    // Wait a bit for controllers to connect and scan
    sleep(2);
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    // Delete controllers
    for (int i = 0; i < 16; i++) {
        char path[256];
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/delete_controller", i);
        try_write_file(path, "1");
    }
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg) {
    int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
    if (fd < 0) return NULL;

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        if (pwrite(fd, "0\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process removal
        if (pwrite(fd, "1\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process addition
    }
    close(fd);
    return NULL;
}

void* rescan_thread(void* arg) {
    int fds[16];
    int num_fds = 0;
    char path[256];

    for (int i = 0; i < 16; i++) {
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
        int fd = open(path, O_WRONLY);
        if (fd >= 0) {
            fds[num_fds++] = fd;
        }
    }

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < num_fds; i++) {
            if (pwrite(fds[i], "1\n", 2, 0) < 0) {}
        }
        usleep(1000);
    }

    for (int i = 0; i < num_fds; i++) {
        close(fds[i]);
    }
    return NULL;
}

void* open_close_thread(void* arg) {
    char path[256];
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < 4; i++) {
            snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
            int fd = open(path, O_RDONLY);
            if (fd >= 0) {
                close(fd);
            }
        }
        usleep(1000);
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t tt;
        pthread_t rt[2];
        pthread_t ot[2];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        pthread_create(&tt, NULL, toggle_ns_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&ot[i], NULL, open_close_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        pthread_join(tt, NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(ot[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[CurrentCandidateReproC:#include "race_toolkit.h"
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    
    // Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
    for (int i = 0; i < 4; i++) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    
    // Wait a bit for controllers to connect and scan
    sleep(2);
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    // Delete controllers
    for (int i = 0; i < 16; i++) {
        char path[256];
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/delete_controller", i);
        try_write_file(path, "1");
    }
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg) {
    int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
    if (fd < 0) return NULL;

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        if (pwrite(fd, "0\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process removal
        if (pwrite(fd, "1\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process addition
    }
    close(fd);
    return NULL;
}

void* rescan_thread(void* arg) {
    int fds[16];
    int num_fds = 0;
    char path[256];

    for (int i = 0; i < 16; i++) {
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
        int fd = open(path, O_WRONLY);
        if (fd >= 0) {
            fds[num_fds++] = fd;
        }
    }

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < num_fds; i++) {
            if (pwrite(fds[i], "1\n", 2, 0) < 0) {}
        }
        usleep(1000);
    }

    for (int i = 0; i < num_fds; i++) {
        close(fds[i]);
    }
    return NULL;
}

void* open_close_thread(void* arg) {
    char path[256];
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < 4; i++) {
            snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
            int fd = open(path, O_RDONLY);
            if (fd >= 0) {
                close(fd);
            }
        }
        usleep(1000);
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t tt;
        pthread_t rt[2];
        pthread_t ot[2];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        pthread_create(&tt, NULL, toggle_ns_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&ot[i], NULL, open_close_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        pthread_join(tt, NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(ot[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[CompilerError: FormattedReproC:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }

#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    
    // Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
    for (int i = 0; i < 4; i++) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    
    // Wait a bit for controllers to connect and scan
    sleep(2);
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    // Delete controllers
    for (int i = 0; i < 16; i++) {
        char path[256];
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/delete_controller", i);
        try_write_file(path, "1");
    }
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg) {
    int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
    if (fd < 0) return NULL;

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        if (pwrite(fd, "0\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process removal
        if (pwrite(fd, "1\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process addition
    }
    close(fd);
    return NULL;
}

void* rescan_thread(void* arg) {
    int fds[16];
    int num_fds = 0;
    char path[256];

    for (int i = 0; i < 16; i++) {
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
        int fd = open(path, O_WRONLY);
        if (fd >= 0) {
            fds[num_fds++] = fd;
        }
    }

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < num_fds; i++) {
            if (pwrite(fds[i], "1\n", 2, 0) < 0) {}
        }
        usleep(1000);
    }

    for (int i = 0; i < num_fds; i++) {
        close(fds[i]);
    }
    return NULL;
}

void* open_close_thread(void* arg) {
    char path[256];
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < 4; i++) {
            snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
            int fd = open(path, O_RDONLY);
            if (fd >= 0) {
                close(fd);
            }
        }
        usleep(1000);
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t tt;
        pthread_t rt[2];
        pthread_t ot[2];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        pthread_create(&tt, NULL, toggle_ns_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&ot[i], NULL, open_close_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        pthread_join(tt, NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(ot[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
]

map[CompilerError:]

map[CandidateBugTitle:WARNING: bad unlock balance in nvme_update_ns_info CandidateCrashReport:=====================================
WARNING: bad unlock balance detected!
syzkaller #1 Not tainted
-------------------------------------
kworker/u10:5/1108 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff8664416f>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff8664416f>] nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u10:5/1108: 2, last CPU#1:
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 1108 Comm: kworker/u10:5 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme0: rescanning namespaces.
 CandidateReproduced:true ConsoleOutput:[   65.728600][   T34] kauditd_printk_skb: 10 callbacks suppressed
[   65.728615][   T34] audit: type=1400 audit(1790188851.753:201): avc:  denied  { transition } for  pid=5834 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.728641][   T34] audit: type=1400 audit(1790188851.753:202): avc:  denied  { noatsecure } for  pid=5834 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.729190][   T34] audit: type=1400 audit(1790188851.753:203): avc:  denied  { rlimitinh } for  pid=5834 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   65.729217][   T34] audit: type=1400 audit(1790188851.753:204): avc:  denied  { siginh } for  pid=5834 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   67.707286][   T34] audit: type=1400 audit(1790188853.733:205): avc:  denied  { write } for  pid=5840 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   67.751523][   T34] audit: type=1400 audit(1790188853.773:206): avc:  denied  { write } for  pid=5843 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:9503' (ED25519) to the list of known hosts.
[   68.370226][   T34] audit: type=1400 audit(1790188854.393:207): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.370275][   T34] audit: type=1400 audit(1790188854.393:208): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="nvmet" dev="configfs" ino=3497 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.370408][   T34] audit: type=1400 audit(1790188854.393:209): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="subsystems" dev="configfs" ino=3498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.371496][   T34] audit: type=1400 audit(1790188854.393:210): avc:  denied  { write search } for  pid=5853 comm="syz-executor217" name="subsystems" dev="configfs" ino=3498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   68.390623][ T5853] nvmet: adding nsid 1 to subsystem testnqn
[   68.450358][ T1108] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0d892168-d1c9-4f3a-a6ea-9b74f5caa5a5.
[   68.463763][ T5853] nvme nvme0: creating 2 I/O queues.
[   68.468071][ T5853] nvme nvme0: new ctrl: "testnqn"
[   68.525729][ T1112] nvmet: Created nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0d892168-d1c9-4f3a-a6ea-9b74f5caa5a5.
[   68.526807][ T5853] nvme nvme1: creating 2 I/O queues.
[   68.530108][ T5853] nvme nvme1: new ctrl: "testnqn"
[   68.570372][  T432] nvmet: Created nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0d892168-d1c9-4f3a-a6ea-9b74f5caa5a5.
[   68.580770][ T5853] nvme nvme2: creating 2 I/O queues.
[   68.593732][ T5853] nvme nvme2: new ctrl: "testnqn"
[   68.652187][ T1108] nvmet: Created nvm controller 4 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:0d892168-d1c9-4f3a-a6ea-9b74f5caa5a5.
[   68.653031][ T5853] nvme nvme3: creating 2 I/O queues.
[   68.655871][ T5853] nvme nvme3: new ctrl: "testnqn"
[+] setup_nvmet successful.
[*] Starting concurrent NVMe namespace toggling, rescans, and opens...
[   70.742611][   T27] nvme nvme0: rescanning namespaces.
[   70.742715][   T95] nvme nvme2: rescanning namespaces.
[   70.758610][   T27] nvme nvme2: rescanning namespaces.
[   70.762934][  T432] nvme nvme0: rescanning namespaces.
[   70.774997][   T55] nvme nvme3: rescanning namespaces.
[   70.869700][   T29] nvme nvme1: rescanning namespaces.
[   70.875927][  T432] nvme nvme0: rescanning namespaces.
[   70.880202][   T66] nvme nvme1: rescanning namespaces.
[   70.906312][   T27] nvme nvme2: rescanning namespaces.
[   70.906810][   T55] nvme nvme3: rescanning namespaces.
[   70.946707][   T34] kauditd_printk_skb: 63 callbacks suppressed
[   70.946751][   T34] audit: type=1400 audit(1790188856.973:274): avc:  denied  { write } for  pid=5903 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   70.973191][ T5856] block nvme0n2: no usable path - requeuing I/O
[   70.988856][   T11] nvme0c1n2: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   70.988913][   T11] I/O error, dev nvme0c1n2, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   70.989900][   T66] nvme nvme1: rescanning namespaces.
[   71.004597][   T26] block nvme0n2: no usable path - requeuing I/O
[   71.009503][   T55] nvme nvme3: rescanning namespaces.
[   71.009521][  T432] nvme nvme0: rescanning namespaces.
[   71.020005][   T27] nvme nvme2: rescanning namespaces.
[   71.021615][  T182] nvme nvme3: rescanning namespaces.
[   71.024757][  T432] nvme nvme0: rescanning namespaces.
[   71.040908][   T34] audit: type=1400 audit(1790188857.063:275): avc:  denied  { read } for  pid=5853 comm="syz-executor217" name="nvme0n1" dev="devtmpfs" ino=2812 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[   71.040941][   T34] audit: type=1400 audit(1790188857.063:276): avc:  denied  { open } for  pid=5853 comm="syz-executor217" path="/dev/nvme0n1" dev="devtmpfs" ino=2812 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[   71.085234][ T5855] nvme0c2n1: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   71.085267][ T5855] I/O error, dev nvme0c2n1, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   71.189466][   T27] nvme nvme2: rescanning namespaces.
[   71.200321][   T26] block nvme0n2: no available path - failing I/O
[   71.200368][   T26] Buffer I/O error on dev nvme0n2, logical block 4080, async page read
[   71.218279][  T432] nvme nvme0: rescanning namespaces.
[   71.235754][   T27] nvme nvme2: rescanning namespaces.
[   71.240809][   T34] audit: type=1400 audit(1790188857.263:277): avc:  denied  { write } for  pid=5910 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.250132][ T5856] udevd[5856]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   71.269954][   T66] nvme nvme1: rescanning namespaces.
[   71.279254][ T5894] block device autoloading is deprecated and will be removed.
[   71.279851][  T182] nvme nvme3: rescanning namespaces.
[   71.281546][ T5895] block device autoloading is deprecated and will be removed.
[   71.288491][ T1108] nvme nvme1: rescanning namespaces.
[   71.351573][   T37] nvme nvme3: rescanning namespaces.
[   71.355392][   T27] nvme nvme2: rescanning namespaces.
[   71.430151][  T432] nvme nvme0: rescanning namespaces.
[   71.476001][   T27] nvme nvme2: rescanning namespaces.
[   71.479455][ T1113] nvme nvme1: rescanning namespaces.
[   71.494344][   T37] nvme nvme3: rescanning namespaces.
[   71.494837][ T1108] nvme nvme0: rescanning namespaces.
[   71.531694][ T5858] nvme0c1n2: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   71.531718][ T5858] I/O error, dev nvme0c1n2, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   71.645938][ T1108] nvme nvme0: rescanning namespaces.
[   71.648604][   T27] nvme nvme2: rescanning namespaces.
[   71.658168][   T37] nvme nvme3: rescanning namespaces.
[   71.687033][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   71.687080][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   71.688203][ T5858] nvme0c1n2: I/O Cmd(0x2) @ LBA 4095, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   71.688221][ T5858] I/O error, dev nvme0c1n2, sector 32760 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   71.702524][ T1113] nvme nvme1: rescanning namespaces.
[   71.814237][ T1108] nvme nvme0: rescanning namespaces.
[   71.825141][   T37] nvme nvme3: rescanning namespaces.
[   71.829789][ T5858] nvme0c3n2: I/O Cmd(0x2) @ LBA 4088, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   71.829810][ T5858] I/O error, dev nvme0c3n2, sector 32704 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   71.857432][ T1113] nvme nvme1: rescanning namespaces.
[   71.889213][ T1113] nvme nvme1: rescanning namespaces.
[   71.895573][   T27] nvme nvme2: rescanning namespaces.
[   71.907990][ T1108] nvme nvme0: rescanning namespaces.
[   71.952345][ T5858] nvme0c0n2: I/O Cmd(0x2) @ LBA 4022, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   71.952368][ T5858] I/O error, dev nvme0c0n2, sector 32176 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   71.954919][   T37] nvme nvme3: rescanning namespaces.
[   71.985664][ T1112] nvme nvme3: rescanning namespaces.
[   72.001111][ T1121] nvme nvme1: rescanning namespaces.
[   72.022294][ T1108] nvme nvme0: rescanning namespaces.
[   72.036378][ T1113] nvme nvme1: rescanning namespaces.
[   72.037348][  T432] nvme nvme3: rescanning namespaces.
[   72.053681][   T27] nvme nvme2: rescanning namespaces.
[   72.068395][ T1108] nvme nvme0: rescanning namespaces.
[   72.113587][ T5858] block nvme0n2: no usable path - requeuing I/O
[   72.117179][   T26] nvme0c1n2: I/O Cmd(0x2) @ LBA 4004, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   72.117200][   T26] I/O error, dev nvme0c1n2, sector 32032 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   72.118692][ T1113] nvme nvme1: rescanning namespaces.
[   72.164245][ T5858] block nvme0n2: no usable path - requeuing I/O
[   72.177763][ T1108] nvme nvme0: rescanning namespaces.
[   72.180944][   T27] nvme nvme2: rescanning namespaces.
[   72.226728][   T27] nvme nvme2: rescanning namespaces.
[   72.227077][ T1108] nvme nvme0: rescanning namespaces.
[   72.236366][  T432] nvme nvme3: rescanning namespaces.
[   72.236774][ T1113] nvme nvme1: rescanning namespaces.
[   72.288627][   T66] nvme nvme1: rescanning namespaces.
[   72.288711][   T29] nvme nvme3: rescanning namespaces.
[   72.314395][ T1108] nvme nvme0: rescanning namespaces.
[   72.376334][   T27] nvme nvme2: rescanning namespaces.
[   72.383843][ T1108] nvme nvme0: rescanning namespaces.
[   72.429962][   T66] nvme nvme1: rescanning namespaces.
[   72.433151][   T26] block nvme0n1: no usable path - requeuing I/O
[   72.439221][ T1128] nvme nvme2: rescanning namespaces.
[   72.468878][ T5895] block device autoloading is deprecated and will be removed.
[   72.486185][   T29] nvme nvme3: rescanning namespaces.
[   72.518639][ T5894] block device autoloading is deprecated and will be removed.
[   72.529277][ T1128] nvme nvme2: rescanning namespaces.
[   72.529288][ T1108] nvme nvme0: rescanning namespaces.
[   72.529328][   T29] nvme nvme3: rescanning namespaces.
[   72.543757][   T11] block nvme0n1: no available path - failing I/O
[   72.543773][   T11] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.545994][ T1121] block nvme0n1: no available path - failing I/O
[   72.546006][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546027][ T1121] block nvme0n1: no available path - failing I/O
[   72.546033][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546046][ T1121] block nvme0n1: no available path - failing I/O
[   72.546052][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546065][ T1121] block nvme0n1: no available path - failing I/O
[   72.546071][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546093][ T1121] block nvme0n1: no available path - failing I/O
[   72.546099][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546119][ T1121] block nvme0n1: no available path - failing I/O
[   72.546124][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546137][ T1121] block nvme0n1: no available path - failing I/O
[   72.546142][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546149][ T1121] ldm_validate_partition_table(): Disk read failed.
[   72.546161][ T1121] block nvme0n1: no available path - failing I/O
[   72.546167][ T1121] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   72.546194][ T1121] Dev nvme0n1: unable to read RDB block 0
[   72.546276][ T1121]  nvme0n1: unable to read partition table
[   72.573780][   T34] audit: type=1400 audit(1790188858.603:278): avc:  denied  { write } for  pid=5923 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   72.586042][ T5904] nvme nvme2: rescanning namespaces.
[   72.586139][ T5905] nvme nvme3: rescanning namespaces.
[   72.586454][ T5900] nvme nvme0: rescanning namespaces.
[   72.654552][   T66] nvme nvme1: rescanning namespaces.
[   72.694564][ T1121] nvme nvme1: rescanning namespaces.
[   72.703174][ T5904] nvme nvme2: rescanning namespaces.
[   72.707029][ T5900] nvme nvme0: rescanning namespaces.
[   72.707611][ T5905] nvme nvme3: rescanning namespaces.
[   72.759136][ T5855] block nvme0n2: no usable path - requeuing I/O
[   72.787571][   T11] nvme0c2n2: I/O Cmd(0x2) @ LBA 4095, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   72.787593][   T11] I/O error, dev nvme0c2n2, sector 32760 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   72.821174][ T5904] nvme nvme2: rescanning namespaces.
[   72.828362][   T34] audit: type=1400 audit(1790188858.853:279): avc:  denied  { write } for  pid=5932 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   72.831926][ T5900] nvme nvme0: rescanning namespaces.
[   72.835260][ T5905] nvme nvme3: rescanning namespaces.
[   72.851104][ T1121] nvme nvme1: rescanning namespaces.
[   72.915389][ T5855] nvme0c1n2: I/O Cmd(0x2) @ LBA 15, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   72.915436][ T5855] I/O error, dev nvme0c1n2, sector 120 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   72.943151][ T5904] nvme nvme2: rescanning namespaces.
[   72.959935][ T5900] nvme nvme0: rescanning namespaces.
[   72.966389][ T5905] nvme nvme3: rescanning namespaces.
[   72.972648][ T1121] nvme nvme1: rescanning namespaces.
[   72.980639][ T5904] nvme nvme2: rescanning namespaces.
[   73.043895][ T5905] nvme nvme3: rescanning namespaces.
[   73.052700][ T5904] nvme nvme2: rescanning namespaces.
[   73.085456][ T5900] nvme nvme0: rescanning namespaces.
[   73.089020][ T5905] nvme nvme3: rescanning namespaces.
[   73.102433][ T1121] nvme nvme1: rescanning namespaces.
[   73.111995][ T5904] nvme nvme2: rescanning namespaces.
[   73.145739][ T5905] nvme nvme3: rescanning namespaces.
[   73.176204][ T5900] nvme nvme0: rescanning namespaces.
[   73.198119][ T5905] nvme nvme3: rescanning namespaces.
[   73.213534][ T1121] nvme nvme1: rescanning namespaces.
[   73.221191][ T5900] nvme nvme0: rescanning namespaces.
[   73.224478][ T5904] nvme nvme2: rescanning namespaces.
[   73.279468][ T5905] nvme nvme3: rescanning namespaces.
[   73.329969][ T1121] nvme nvme1: rescanning namespaces.
[   73.337221][ T5900] nvme nvme0: rescanning namespaces.
[   73.338960][ T5905] nvme nvme3: rescanning namespaces.
[   73.372670][ T5904] nvme nvme2: rescanning namespaces.
[   73.401310][ T5905] nvme nvme3: rescanning namespaces.
[   73.402642][ T1121] nvme nvme1: rescanning namespaces.
[   73.435549][ T5900] nvme nvme0: rescanning namespaces.
[   73.448482][ T5904] nvme nvme2: rescanning namespaces.
[   73.457794][ T5905] nvme nvme3: rescanning namespaces.
[   73.464631][ T1121] nvme nvme1: rescanning namespaces.
[   73.511215][ T5904] nvme nvme2: rescanning namespaces.
[   73.518612][ T5905] nvme nvme3: rescanning namespaces.
[   73.534690][ T1121] nvme nvme1: rescanning namespaces.
[   73.583915][ T5900] nvme nvme0: rescanning namespaces.
[   73.609708][ T1121] nvme nvme1: rescanning namespaces.
[   73.609794][ T5904] nvme nvme2: rescanning namespaces.
[   73.619713][ T5905] nvme nvme3: rescanning namespaces.
[   73.634696][ T5900] nvme nvme0: rescanning namespaces.
[   73.634951][ T1113] nvme nvme3: rescanning namespaces.
[   73.635349][   T37] nvme nvme1: rescanning namespaces.
[   73.635760][  T432] nvme nvme2: rescanning namespaces.
[   73.689435][ T1112] nvme nvme3: rescanning namespaces.
[   73.689530][   T37] nvme nvme2: rescanning namespaces.
[   73.755797][ T1128] nvme nvme1: rescanning namespaces.
[   73.800841][ T5894] block device autoloading is deprecated and will be removed.
[   73.809845][ T5900] nvme nvme0: rescanning namespaces.
[   73.842457][   T37] nvme nvme2: rescanning namespaces.
[   73.846191][   T26] block nvme0n1: no usable path - requeuing I/O
[   73.862077][ T5905] nvme nvme0: rescanning namespaces.
[   73.902238][ T1128] nvme nvme1: rescanning namespaces.
[   73.902397][ T1112] nvme nvme3: rescanning namespaces.
[   73.905412][ T1121] ldm_validate_partition_table(): Disk read failed.
[   73.905450][ T1121] Dev nvme0n1: unable to read RDB block 0
[   73.905532][ T1121]  nvme0n1: unable to read partition table
[   73.955927][ T1112] nvme nvme3: rescanning namespaces.
[   73.975657][ T5855] udevd[5855]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   73.990917][   T37] nvme nvme2: rescanning namespaces.
[   74.002046][ T5905] nvme nvme0: rescanning namespaces.
[   74.030018][ T1128] nvme nvme1: rescanning namespaces.
[   74.054042][ T5858] nvme0c0n2: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   74.054064][ T5858] I/O error, dev nvme0c0n2, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   74.070487][ T1112] nvme nvme3: rescanning namespaces.
[   74.084280][ T1113] nvme nvme3: rescanning namespaces.
[   74.122561][ T5905] nvme nvme0: rescanning namespaces.
[   74.136796][ T5900] nvme nvme3: rescanning namespaces.
[   74.155248][   T37] nvme nvme2: rescanning namespaces.
[   74.156304][ T1128] nvme nvme1: rescanning namespaces.
[   74.215674][ T1128] nvme nvme1: rescanning namespaces.
[   74.223120][ T5905] nvme nvme0: rescanning namespaces.
[   74.264223][ T5900] nvme nvme3: rescanning namespaces.
[   74.265777][   T37] nvme nvme2: rescanning namespaces.
[   74.272627][ T1128] nvme nvme1: rescanning namespaces.
[   74.274937][ T5905] nvme nvme0: rescanning namespaces.
[   74.335795][ T1128] nvme nvme1: rescanning namespaces.
[   74.345200][ T5905] nvme nvme0: rescanning namespaces.
[   74.379412][   T37] nvme nvme2: rescanning namespaces.
[   74.385478][ T5941] block nvme0n2: no usable path - requeuing I/O
[   74.404730][ T5900] nvme nvme3: rescanning namespaces.
[   74.407895][ T5905] nvme nvme0: rescanning namespaces.
[   74.408069][ T1128] nvme nvme1: rescanning namespaces.
[   74.524480][ T1128] nvme nvme1: rescanning namespaces.
[   74.529853][ T5905] nvme nvme0: rescanning namespaces.
[   74.545225][ T5900] nvme nvme3: rescanning namespaces.
[   74.547685][ T5941] block nvme0n1: no usable path - requeuing I/O
[   74.596978][ T1121] ldm_validate_partition_table(): Disk read failed.
[   74.597043][ T1121] Dev nvme0n1: unable to read RDB block 0
[   74.597163][ T1121]  nvme0n1: unable to read partition table
[   74.604401][   T37] nvme nvme2: rescanning namespaces.
[   74.625699][ T1128] nvme nvme1: rescanning namespaces.
[   74.630279][ T5905] nvme nvme0: rescanning namespaces.
[   74.653021][ T5896] nvme nvme0: rescanning namespaces.
[   74.653083][ T5905] nvme nvme1: rescanning namespaces.
[   74.653316][ T5900] nvme nvme3: rescanning namespaces.
[   74.711816][ T5929] nvme nvme3: rescanning namespaces.
[   74.713383][ T5905] nvme nvme0: rescanning namespaces.
[   74.716392][ T5900] nvme nvme1: rescanning namespaces.
[   74.768515][   T37] nvme nvme2: rescanning namespaces.
[   74.793002][ T5929] nvme nvme3: rescanning namespaces.
[   74.795836][ T5941] block nvme0n2: no usable path - requeuing I/O
[   74.857521][ T5855] udevd[5855]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   74.893434][ T5900] nvme nvme1: rescanning namespaces.
[   74.906755][   T37] nvme nvme2: rescanning namespaces.
[   74.910885][ T5905] nvme nvme0: rescanning namespaces.
[   74.922525][ T5899] nvme nvme2: rescanning namespaces.
[   74.923038][ T5929] nvme nvme3: rescanning namespaces.
[   74.971728][ T5900] nvme nvme1: rescanning namespaces.
[   75.057907][ T5899] nvme nvme2: rescanning namespaces.
[   75.059360][ T5900] nvme nvme1: rescanning namespaces.
[   75.066738][ T5929] nvme nvme3: rescanning namespaces.
[   75.069467][ T5895] block device autoloading is deprecated and will be removed.
[   75.070185][ T1113] ldm_validate_partition_table(): Disk read failed.
[   75.070223][ T1113] Dev nvme0n2: unable to read RDB block 0
[   75.070332][ T1113]  nvme0n2: unable to read partition table
[   75.088700][ T5894] block device autoloading is deprecated and will be removed.
[   75.124006][ T5899] nvme nvme2: rescanning namespaces.
[   75.126674][ T5905] nvme nvme0: rescanning namespaces.
[   75.130833][ T5900] nvme nvme1: rescanning namespaces.
[   75.134481][ T5929] nvme nvme3: rescanning namespaces.
[   75.166939][   T35] nvme nvme1: rescanning namespaces.
[   75.167116][   T37] nvme nvme0: rescanning namespaces.
[   75.223293][ T5899] nvme nvme2: rescanning namespaces.
[   75.232977][ T5899] nvme nvme2: rescanning namespaces.
[   75.239086][ T5944] udevd[5944]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   75.294002][ T5900] nvme nvme2: rescanning namespaces.
[   75.294638][ T5929] nvme nvme3: rescanning namespaces.
[   75.310584][   T37] nvme nvme0: rescanning namespaces.
[   75.310745][   T35] nvme nvme1: rescanning namespaces.
[   75.404005][   T37] nvme nvme0: rescanning namespaces.
[   75.449145][ T5929] nvme nvme3: rescanning namespaces.
[   75.470026][ T5900] nvme nvme2: rescanning namespaces.
[   75.470083][   T35] nvme nvme1: rescanning namespaces.
[   75.504638][   T37] nvme nvme0: rescanning namespaces.
[   75.508093][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   75.577918][ T1108] nvme nvme0: rescanning namespaces.
[   75.597579][ T5894] block device autoloading is deprecated and will be removed.
[   75.626595][ T5900] nvme nvme2: rescanning namespaces.
[   75.638380][   T35] nvme nvme1: rescanning namespaces.
[   75.658272][ T5929] nvme nvme3: rescanning namespaces.
[   75.674636][ T5895] block device autoloading is deprecated and will be removed.
[   75.676860][   T34] audit: type=1400 audit(1790188861.703:280): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   75.676928][   T34] audit: type=1400 audit(1790188861.703:281): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="nvmet" dev="configfs" ino=3497 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   75.677004][   T34] audit: type=1400 audit(1790188861.703:282): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="subsystems" dev="configfs" ino=3498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   75.677082][   T34] audit: type=1400 audit(1790188861.703:283): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="testnqn" dev="configfs" ino=8403 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   75.712246][   T35] nvme nvme1: rescanning namespaces.
[   75.715491][ T5900] nvme nvme2: rescanning namespaces.
[   75.756303][ T5929] nvme nvme3: rescanning namespaces.
[   75.758005][ T5929] nvme nvme3: rescanning namespaces.
[   75.760131][ T1113] nvme nvme0: rescanning namespaces.
[   75.768904][ T5900] nvme nvme2: rescanning namespaces.
[   75.775720][   T35] nvme nvme1: rescanning namespaces.
[   75.869871][ T5929] nvme nvme3: rescanning namespaces.
[   75.888167][   T35] nvme nvme1: rescanning namespaces.
[   75.888569][ T5900] nvme nvme2: rescanning namespaces.
[   75.898001][ T1113] nvme nvme0: rescanning namespaces.
[   75.905822][ T5929] nvme nvme3: rescanning namespaces.
[   76.002861][   T35] nvme nvme1: rescanning namespaces.
[   76.027346][ T5900] nvme nvme2: rescanning namespaces.
[   76.044045][ T5900] nvme nvme1: rescanning namespaces.
[   76.047884][ T5896] nvme nvme2: rescanning namespaces.
[   76.061947][ T5929] nvme nvme3: rescanning namespaces.
[   76.112755][ T1113] nvme nvme0: rescanning namespaces.
[   76.160546][ T1113] nvme nvme0: rescanning namespaces.
[   76.171758][ T5896] nvme nvme2: rescanning namespaces.
[   76.191352][   T66] nvme nvme0: rescanning namespaces.
[   76.200403][  T182] nvme nvme1: rescanning namespaces.
[   76.210025][ T5896] nvme nvme2: rescanning namespaces.
[   76.215675][ T5929] nvme nvme3: rescanning namespaces.
[   76.242793][ T5858] nvme_log_error: 8 callbacks suppressed
[   76.242807][ T5858] nvme0c3n1: I/O Cmd(0x2) @ LBA 3974, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   76.242819][ T5858] blk_print_req_error: 8 callbacks suppressed
[   76.242825][ T5858] I/O error, dev nvme0c3n1, sector 31792 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   76.281439][   T66] nvme nvme0: rescanning namespaces.
[   76.315273][ T5896] nvme nvme2: rescanning namespaces.
[   76.323613][ T5929] nvme nvme3: rescanning namespaces.
[   76.331639][   T66] nvme nvme0: rescanning namespaces.
[   76.342614][  T182] nvme nvme1: rescanning namespaces.
[   76.343876][ T5896] nvme nvme2: rescanning namespaces.
[   76.401549][   T66] nvme nvme0: rescanning namespaces.
[   76.403531][ T5858] nvme0c3n1: I/O Cmd(0x2) @ LBA 3972, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   76.403548][ T5858] I/O error, dev nvme0c3n1, sector 31776 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   76.405148][ T5929] nvme nvme3: rescanning namespaces.
[   76.454728][  T182] nvme nvme1: rescanning namespaces.
[   76.467119][   T66] nvme nvme0: rescanning namespaces.
[   76.478152][ T5929] nvme nvme3: rescanning namespaces.
[   76.481744][ T5896] nvme nvme2: rescanning namespaces.
[   76.487871][ T1113] nvme nvme1: Identify Descriptors failed (nsid=1, status=0x2300)
[   76.528717][   T66] nvme nvme0: rescanning namespaces.
[   76.553333][ T5896] nvme nvme2: rescanning namespaces.
[   76.555279][  T182] nvme nvme1: rescanning namespaces.
[   76.558529][   T66] nvme nvme0: rescanning namespaces.
[   76.565572][ T5929] nvme nvme3: rescanning namespaces.
[   76.623832][ T5896] nvme nvme2: rescanning namespaces.
[   76.624292][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 1024, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   76.624310][ T5858] I/O error, dev nvme0c2n1, sector 8192 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   76.667456][  T182] nvme nvme1: rescanning namespaces.
[   76.677181][ T5929] nvme nvme3: rescanning namespaces.
[   76.692213][   T66] nvme nvme0: rescanning namespaces.
[   76.698550][ T5896] nvme nvme2: rescanning namespaces.
[   76.749717][   T66] nvme nvme0: rescanning namespaces.
[   76.763451][ T5929] nvme nvme3: rescanning namespaces.
[   76.778327][ T5896] nvme nvme2: rescanning namespaces.
[   76.785962][ T1113] nvme nvme0: rescanning namespaces.
[   76.786032][  T182] nvme nvme1: rescanning namespaces.
[   76.800612][ T5929] nvme nvme3: rescanning namespaces.
[   76.823176][   T10] cfg80211: failed to load regulatory.db
[   76.824777][ T5896] nvme nvme2: rescanning namespaces.
[   76.864506][  T182] nvme nvme1: rescanning namespaces.
[   76.896338][ T5896] nvme nvme2: rescanning namespaces.
[   76.900446][ T1113] nvme nvme0: rescanning namespaces.
[   76.910983][ T5929] nvme nvme3: rescanning namespaces.
[   76.916829][   T37] nvme nvme3: rescanning namespaces.
[   76.916913][ T1121] nvme nvme0: rescanning namespaces.
[   76.923305][  T432] nvme nvme1: rescanning namespaces.
[   77.040304][ T5896] nvme nvme2: rescanning namespaces.
[   77.051365][  T432] nvme nvme1: rescanning namespaces.
[   77.062405][ T1121] nvme nvme0: rescanning namespaces.
[   77.064102][ T1108] nvme nvme2: rescanning namespaces.
[   77.065146][   T37] nvme nvme3: rescanning namespaces.
[   77.124587][ T1121] nvme nvme0: rescanning namespaces.
[   77.131413][ T5858] nvme0c3n2: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   77.131431][ T5858] I/O error, dev nvme0c3n2, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   77.254976][  T193] nvme_ns_head_submit_bio: 4 callbacks suppressed
[   77.254996][  T193] block nvme0n2: no usable path - requeuing I/O
[   77.266842][ T5905] nvme nvme0: rescanning namespaces.
[   77.285686][ T1108] nvme nvme2: rescanning namespaces.
[   77.304968][ T5896] nvme nvme2: rescanning namespaces.
[   77.317419][ T5905] nvme nvme0: rescanning namespaces.
[   77.331481][  T432] nvme nvme1: rescanning namespaces.
[   77.335261][  T193] nvme_ns_head_submit_bio: 60 callbacks suppressed
[   77.335274][  T193] block nvme0n2: no available path - failing I/O
[   77.335284][  T193] buffer_io_error: 59 callbacks suppressed
[   77.335289][  T193] Buffer I/O error on dev nvme0n2, logical block 4080, async page read
[   77.377572][ T5905] nvme nvme0: rescanning namespaces.
[   77.388227][  T432] nvme nvme1: rescanning namespaces.
[   77.393958][   T37] nvme nvme3: rescanning namespaces.
[   77.432219][ T1113] nvme nvme3: rescanning namespaces.
[   77.433702][ T5896] nvme nvme2: rescanning namespaces.
[   77.445356][ T5905] nvme nvme0: rescanning namespaces.
[   77.489353][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   77.489378][ T5858] I/O error, dev nvme0c2n1, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   77.509776][ T5964] block device autoloading is deprecated and will be removed.
[   77.519829][ T5905] nvme nvme0: rescanning namespaces.
[   77.545924][ T5965] block device autoloading is deprecated and will be removed.
[   77.548429][  T432] nvme nvme1: rescanning namespaces.
[   77.554597][ T1114] nvme nvme1: rescanning namespaces.
[   77.563798][ T5896] nvme nvme2: rescanning namespaces.
[   77.575245][ T5905] nvme nvme0: rescanning namespaces.
[   77.590791][ T1113] nvme nvme3: rescanning namespaces.
[   77.612607][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   77.612632][ T5858] I/O error, dev nvme0c2n1, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   77.646708][ T1113] nvme nvme3: rescanning namespaces.
[   77.689061][ T5929] nvme nvme1: rescanning namespaces.
[   77.689215][ T5896] nvme nvme2: rescanning namespaces.
[   77.698237][ T5905] nvme nvme0: rescanning namespaces.
[   77.739246][ T1113] nvme nvme3: rescanning namespaces.
[   77.765528][ T5858] nvme0c0n1: I/O Cmd(0x2) @ LBA 4022, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   77.765550][ T5858] I/O error, dev nvme0c0n1, sector 32176 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   77.767760][   T55] nvme nvme3: rescanning namespaces.
[   77.789387][ T5929] nvme nvme1: rescanning namespaces.
[   77.798214][ T5896] nvme nvme2: rescanning namespaces.
[   77.802780][ T5905] nvme nvme0: rescanning namespaces.
[   77.805937][  T193] block nvme0n1: no usable path - requeuing I/O
[   77.819865][ T1112] nvme nvme3: rescanning namespaces.
[   77.852817][ T5905] nvme nvme0: rescanning namespaces.
[   77.854491][ T5929] nvme nvme1: rescanning namespaces.
[   77.870915][   T11] block nvme0n1: no available path - failing I/O
[   77.870930][   T11] Buffer I/O error on dev nvme0n1, logical block 4022, async page read
[   77.899774][ T5944] block nvme0n2: no usable path - requeuing I/O
[   77.914851][   T11] nvme0c1n2: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   77.914874][   T11] I/O error, dev nvme0c1n2, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   77.918762][ T5929] nvme nvme1: rescanning namespaces.
[   77.937162][ T5896] nvme nvme2: rescanning namespaces.
[   77.949184][ T5900] nvme nvme2: rescanning namespaces.
[   77.961543][ T5905] nvme nvme0: rescanning namespaces.
[   77.984291][ T1112] nvme nvme3: rescanning namespaces.
[   78.013514][ T5944] nvme0c0n2: I/O Cmd(0x2) @ LBA 4004, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   78.013536][ T5944] I/O error, dev nvme0c0n2, sector 32032 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   78.042887][ T5905] nvme nvme0: rescanning namespaces.
[   78.075605][ T5929] nvme nvme1: rescanning namespaces.
[   78.076498][ T5944] block nvme0n2: no usable path - requeuing I/O
[   78.093563][ T5900] nvme nvme2: rescanning namespaces.
[   78.097697][ T1112] nvme nvme3: rescanning namespaces.
[   78.132552][   T11] nvme0c2n2: I/O Cmd(0x2) @ LBA 3982, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   78.132576][   T11] I/O error, dev nvme0c2n2, sector 31856 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   78.143225][ T5900] nvme nvme2: rescanning namespaces.
[   78.145702][ T5905] nvme nvme0: rescanning namespaces.
[   78.160534][ T5929] nvme nvme1: rescanning namespaces.
[   78.197122][ T1112] nvme nvme3: rescanning namespaces.
[   78.206523][ T5929] nvme nvme0: rescanning namespaces.
[   78.209799][ T5944] block nvme0n2: no usable path - requeuing I/O
[   78.226676][ T5900] nvme nvme2: rescanning namespaces.
[   78.233460][   T11] block nvme0n2: no usable path - requeuing I/O
[   78.264645][ T1112] nvme nvme3: rescanning namespaces.
[   78.266768][ T5896] nvme nvme1: rescanning namespaces.
[   78.274506][   T66] nvme nvme3: rescanning namespaces.
[   78.287835][ T5900] nvme nvme2: rescanning namespaces.
[   78.303239][ T5929] nvme nvme0: rescanning namespaces.
[   78.311452][ T5944] block nvme0n2: no available path - failing I/O
[   78.311469][ T5944] Buffer I/O error on dev nvme0n2, logical block 8, async page read
[   78.334789][ T5896] nvme nvme1: rescanning namespaces.
[   78.350223][ T5900] nvme nvme2: rescanning namespaces.
[   78.380272][ T5899] nvme nvme3: rescanning namespaces.
[   78.395172][ T1112] block nvme0n1: no usable path - requeuing I/O
[   78.435784][ T5900] nvme nvme2: rescanning namespaces.
[   78.453134][ T5896] nvme nvme1: rescanning namespaces.
[   78.455413][  T193] block nvme0n1: no available path - failing I/O
[   78.455427][  T193] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   78.456848][ T1112] block nvme0n1: no available path - failing I/O
[   78.456858][ T1112] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   78.456873][ T1112] block nvme0n1: no available path - failing I/O
[   78.456879][ T1112] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   78.456892][ T1112] block nvme0n1: no available path - failing I/O
[   78.456897][ T1112] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   78.456910][ T1112] block nvme0n1: no available path - failing I/O
[   78.456915][ T1112] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   78.456942][ T1112] block nvme0n1: no available path - failing I/O
[   78.456947][ T1112] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   78.456967][ T1112] block nvme0n1: no available path - failing I/O
[   78.456973][ T1112] Buffer I/O error on dev nvme0n1, logical block 0, async page read
[   78.456987][ T1112] ldm_validate_partition_table(): Disk read failed.
[   78.457020][ T1112] Dev nvme0n1: unable to read RDB block 0
[   78.457140][ T1112]  nvme0n1: unable to read partition table
[   78.478644][ T5929] nvme nvme0: rescanning namespaces.
[   78.510861][ T5965] block device autoloading is deprecated and will be removed.
[   78.515676][ T5900] nvme nvme2: rescanning namespaces.
[   78.545145][ T5904] nvme nvme2: rescanning namespaces.
[   78.562927][ T5964] block device autoloading is deprecated and will be removed.
[   78.563365][ T5899] nvme nvme3: rescanning namespaces.
[   78.624712][ T5896] nvme nvme1: rescanning namespaces.
[   78.636768][ T1112] nvme nvme3: rescanning namespaces.
[   78.639683][ T5929] nvme nvme0: rescanning namespaces.
[   78.670626][ T5858] block nvme0n2: no usable path - requeuing I/O
[   78.681150][ T1108] nvme nvme2: rescanning namespaces.
[   78.683525][   T11] block nvme0n2: no usable path - requeuing I/O
[   78.732414][ T5896] nvme nvme1: rescanning namespaces.
[   78.753611][ T1108] nvme nvme2: rescanning namespaces.
[   78.753691][ T5929] nvme nvme0: rescanning namespaces.
[   78.758494][ T1112] nvme nvme3: rescanning namespaces.
[   78.814274][ T1112] nvme nvme3: rescanning namespaces.
[   78.862755][ T5899] nvme nvme3: rescanning namespaces.
[   78.862830][ T1108] nvme nvme2: rescanning namespaces.
[   78.900092][ T5929] nvme nvme0: rescanning namespaces.
[   78.903887][ T5896] nvme nvme1: rescanning namespaces.
[   78.968092][ T5899] nvme nvme3: rescanning namespaces.
[   78.992733][ T1108] nvme nvme2: rescanning namespaces.
[   79.003865][ T5929] nvme nvme0: rescanning namespaces.
[   79.015061][ T1114] nvme nvme3: rescanning namespaces.
[   79.044522][ T5896] nvme nvme1: rescanning namespaces.
[   79.064256][ T1108] nvme nvme2: rescanning namespaces.
[   79.065304][ T5929] nvme nvme0: rescanning namespaces.
[   79.066553][ T1112] nvme nvme2: Identify Descriptors failed (nsid=1, status=0x2300)
[   79.111945][ T5896] nvme nvme1: rescanning namespaces.
[   79.113034][ T1112] nvme nvme0: rescanning namespaces.
[   79.118560][ T1113] nvme nvme2: rescanning namespaces.
[   79.154861][   T37] nvme nvme2: rescanning namespaces.
[   79.156186][ T5904] nvme nvme0: rescanning namespaces.
[   79.176277][ T1114] nvme nvme3: rescanning namespaces.
[   79.216059][ T5896] nvme nvme1: rescanning namespaces.
[   79.243439][ T1112] nvme nvme1: rescanning namespaces.
[   79.250744][ T5964] block device autoloading is deprecated and will be removed.
[   79.275504][ T1114] nvme nvme3: rescanning namespaces.
[   79.290080][   T37] nvme nvme2: rescanning namespaces.
[   79.293912][   T37] nvme nvme1: rescanning namespaces.
[   79.295678][  T182] nvme nvme2: rescanning namespaces.
[   79.304730][ T5904] nvme nvme0: rescanning namespaces.
[   79.315030][ T1114] nvme nvme3: rescanning namespaces.
[   79.388065][   T37] nvme nvme1: rescanning namespaces.
[   79.394645][  T182] nvme nvme2: rescanning namespaces.
[   79.413564][ T5904] nvme nvme0: rescanning namespaces.
[   79.426543][ T1114] nvme nvme3: rescanning namespaces.
[   79.438885][  T182] nvme nvme2: rescanning namespaces.
[   79.438923][   T37] nvme nvme1: rescanning namespaces.
[   79.567008][   T37] nvme nvme1: rescanning namespaces.
[   79.571136][ T5904] nvme nvme0: rescanning namespaces.
[   79.574361][ T1114] nvme nvme3: rescanning namespaces.
[   79.594631][ T1113] nvme nvme0: rescanning namespaces.
[   79.613615][  T193] block nvme0n1: no usable path - requeuing I/O
[   79.631630][ T1114] nvme nvme3: rescanning namespaces.
[   79.641447][   T37] nvme nvme1: rescanning namespaces.
[   79.715104][ T1114] nvme nvme3: rescanning namespaces.
[   79.724280][  T182] nvme nvme2: rescanning namespaces.
[   79.732829][   T37] nvme nvme1: rescanning namespaces.
[   79.769689][ T1113] nvme nvme0: rescanning namespaces.
[   79.803790][   T66] nvme nvme0: rescanning namespaces.
[   79.838497][  T182] nvme nvme2: rescanning namespaces.
[   79.841451][   T37] nvme nvme1: rescanning namespaces.
[   79.883215][ T1113] nvme nvme2: rescanning namespaces.
[   79.883606][  T182] nvme nvme0: rescanning namespaces.
[   79.888447][ T1114] nvme nvme3: rescanning namespaces.
[   79.936415][   T37] nvme nvme1: rescanning namespaces.
[   79.986421][   T37] nvme nvme1: rescanning namespaces.
[   80.003589][ T1114] nvme nvme3: rescanning namespaces.
[   80.021138][  T182] nvme nvme0: rescanning namespaces.
[   80.035612][  T182] nvme nvme1: rescanning namespaces.
[   80.037578][ T5896] nvme nvme0: rescanning namespaces.
[   80.042749][ T1113] nvme nvme2: rescanning namespaces.
[   80.078902][ T1114] nvme nvme3: rescanning namespaces.
[   80.156382][ T5904] nvme nvme1: rescanning namespaces.
[   80.157998][ T1113] nvme nvme2: rescanning namespaces.
[   80.159448][ T1114] nvme nvme3: rescanning namespaces.
[   80.170262][ T5896] nvme nvme0: rescanning namespaces.
[   80.187538][   T66] nvme nvme2: rescanning namespaces.
[   80.187840][ T5899] nvme nvme1: rescanning namespaces.
[   80.218892][ T1114] nvme nvme3: rescanning namespaces.
[   80.235325][ T5896] nvme nvme0: rescanning namespaces.
[   80.256184][   T66] nvme nvme2: rescanning namespaces.
[   80.270787][ T1114] nvme nvme3: rescanning namespaces.
[   80.298382][ T5899] nvme nvme1: rescanning namespaces.
[   80.304970][ T5904] nvme nvme2: rescanning namespaces.
[   80.339779][ T1114] nvme nvme3: rescanning namespaces.
[   80.359030][ T5899] nvme nvme1: rescanning namespaces.
[   80.359095][ T5896] nvme nvme0: rescanning namespaces.
[   80.377562][ T1113] nvme nvme1: rescanning namespaces.
[   80.390106][ T5904] nvme nvme2: rescanning namespaces.
[   80.397565][ T1114] nvme nvme3: rescanning namespaces.
[   80.448184][ T5896] nvme nvme0: rescanning namespaces.
[   80.458125][ T5904] nvme nvme2: rescanning namespaces.
[   80.485816][ T1114] nvme nvme3: rescanning namespaces.
[   80.543583][ T1108] nvme nvme3: rescanning namespaces.
[   80.582851][ T5896] nvme nvme0: rescanning namespaces.
[   80.583216][ T1113] nvme nvme1: rescanning namespaces.
[   80.585365][ T5904] nvme nvme2: rescanning namespaces.
[   80.624387][ T1108] nvme nvme3: rescanning namespaces.
[   80.674475][ T5904] nvme nvme2: rescanning namespaces.
[   80.677905][ T1108] nvme nvme3: rescanning namespaces.
[   80.713666][ T1113] nvme nvme1: rescanning namespaces.
[   80.724989][   T34] kauditd_printk_skb: 2 callbacks suppressed
[   80.725001][   T34] audit: type=1400 audit(1790188866.753:286): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   80.725027][   T34] audit: type=1400 audit(1790188866.753:287): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="nvmet" dev="configfs" ino=3497 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   80.725130][   T34] audit: type=1400 audit(1790188866.753:288): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="subsystems" dev="configfs" ino=3498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   80.725224][   T34] audit: type=1400 audit(1790188866.753:289): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="testnqn" dev="configfs" ino=8403 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   80.725331][   T34] audit: type=1400 audit(1790188866.753:290): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="namespaces" dev="configfs" ino=8404 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   80.725351][   T34] audit: type=1400 audit(1790188866.753:291): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="1" dev="configfs" ino=8407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   80.812481][ T5896] nvme nvme0: rescanning namespaces.
[   80.845475][ T5904] nvme nvme2: rescanning namespaces.
[   80.858270][ T1108] nvme nvme3: rescanning namespaces.
[   80.882889][ T1113] nvme nvme1: rescanning namespaces.
[   80.893493][ T5896] nvme nvme0: rescanning namespaces.
[   80.910144][ T1113] nvme nvme1: rescanning namespaces.
[   80.912620][ T1108] nvme nvme3: rescanning namespaces.
[   80.935100][  T182] nvme nvme3: rescanning namespaces.
[   80.935161][ T1112] nvme nvme0: rescanning namespaces.
[   80.935275][ T1108] nvme nvme1: rescanning namespaces.
[   80.971120][ T5904] nvme nvme2: rescanning namespaces.
[   81.066930][  T182] nvme nvme3: rescanning namespaces.
[   81.068075][ T1108] nvme nvme1: rescanning namespaces.
[   81.076393][ T1112] nvme nvme0: rescanning namespaces.
[   81.083931][ T5904] nvme nvme2: rescanning namespaces.
[   81.106172][ T5905] nvme nvme1: rescanning namespaces.
[   81.107497][ T5929] nvme nvme3: rescanning namespaces.
[   81.140515][ T1112] nvme nvme0: rescanning namespaces.
[   81.156922][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   81.171199][ T5904] nvme nvme2: rescanning namespaces.
[   81.213914][ T5904] nvme nvme2: rescanning namespaces.
[   81.244322][ T5929] nvme nvme3: rescanning namespaces.
[   81.261803][ T5896] nvme nvme2: rescanning namespaces.
[   81.281791][ T1112] nvme nvme0: rescanning namespaces.
[   81.288689][ T5995] block device autoloading is deprecated and will be removed.
[   81.309124][ T5905] nvme nvme1: rescanning namespaces.
[   81.330646][   T35] ldm_validate_partition_table(): Disk read failed.
[   81.330690][   T35] Dev nvme0n1: unable to read RDB block 0
[   81.330935][   T35]  nvme0n1: unable to read partition table
[   81.356015][ T1112] nvme nvme0: rescanning namespaces.
[   81.384253][ T5896] nvme nvme2: rescanning namespaces.
[   81.405571][ T5929] nvme nvme3: rescanning namespaces.
[   81.438900][ T1112] nvme nvme0: rescanning namespaces.
[   81.447499][ T5896] nvme nvme2: rescanning namespaces.
[   81.450899][ T5905] nvme nvme1: rescanning namespaces.
[   81.466390][  T432] nvme nvme0: rescanning namespaces.
[   81.485798][ T5856] nvme_log_error: 10 callbacks suppressed
[   81.485813][ T5856] nvme0c1n2: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   81.485851][ T5856] blk_print_req_error: 10 callbacks suppressed
[   81.485856][ T5856] I/O error, dev nvme0c1n2, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   81.512412][ T5905] nvme nvme1: rescanning namespaces.
[   81.518700][ T1108] nvme nvme0: rescanning namespaces.
[   81.556720][ T5896] nvme nvme2: rescanning namespaces.
[   81.565441][ T5905] nvme nvme1: rescanning namespaces.
[   81.568569][ T5929] nvme nvme3: rescanning namespaces.
[   81.587394][ T5856] nvme0c2n2: I/O Cmd(0x2) @ LBA 4064, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   81.587416][ T5856] I/O error, dev nvme0c2n2, sector 32512 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   81.630414][ T1108] nvme nvme0: rescanning namespaces.
[   81.630506][ T5929] nvme nvme3: rescanning namespaces.
[   81.644234][ T1113] nvme nvme1: rescanning namespaces.
[   81.644367][ T5929] nvme nvme3: rescanning namespaces.
[   81.664676][ T5896] nvme nvme2: rescanning namespaces.
[   81.723945][ T5856] nvme0c2n2: I/O Cmd(0x2) @ LBA 4046, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   81.723969][ T5856] I/O error, dev nvme0c2n2, sector 32368 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   81.755996][ T1113] nvme nvme1: rescanning namespaces.
[   81.766830][  T182] nvme nvme0: rescanning namespaces.
[   81.803032][ T1113] nvme nvme1: rescanning namespaces.
[   81.810589][ T5929] nvme nvme3: rescanning namespaces.
[   81.817306][ T5896] nvme nvme2: rescanning namespaces.
[   81.820388][ T5856] nvme0c2n2: I/O Cmd(0x2) @ LBA 4022, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   81.820407][ T5856] I/O error, dev nvme0c2n2, sector 32176 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   81.886465][ T1113] nvme nvme1: rescanning namespaces.
[   81.889991][ T5929] nvme nvme3: rescanning namespaces.
[   81.924992][ T5929] nvme nvme3: rescanning namespaces.
[   81.926967][  T182] nvme nvme0: rescanning namespaces.
[   81.934940][ T1113] nvme nvme1: rescanning namespaces.
[   81.947879][ T5896] nvme nvme2: rescanning namespaces.
[   81.975451][ T5856] nvme0c3n2: I/O Cmd(0x2) @ LBA 3710, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   81.975475][ T5856] I/O error, dev nvme0c3n2, sector 29680 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   82.014004][ T1113] nvme nvme1: rescanning namespaces.
[   82.019933][  T182] nvme nvme0: rescanning namespaces.
[   82.037189][ T5896] nvme nvme2: rescanning namespaces.
[   82.067086][  T182] nvme nvme0: rescanning namespaces.
[   82.069231][ T5929] nvme nvme3: rescanning namespaces.
[   82.080197][ T1113] nvme nvme1: rescanning namespaces.
[   82.087656][ T5896] nvme nvme2: rescanning namespaces.
[   82.104264][ T5856] nvme0c3n2: I/O Cmd(0x2) @ LBA 8, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   82.104287][ T5856] I/O error, dev nvme0c3n2, sector 64 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   82.222263][ T5929] nvme nvme3: rescanning namespaces.
[   82.243333][ T1113] nvme nvme1: rescanning namespaces.
[   82.252905][ T5896] nvme nvme2: rescanning namespaces.
[   82.256293][  T182] nvme nvme0: rescanning namespaces.
[   82.292057][ T5929] nvme nvme3: rescanning namespaces.
[   82.326155][  T432] nvme nvme3: rescanning namespaces.
[   82.372526][ T5856] nvme0c0n2: I/O Cmd(0x2) @ LBA 15, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   82.372549][ T5856] I/O error, dev nvme0c0n2, sector 120 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   82.376036][  T432] nvme nvme3: rescanning namespaces.
[   82.385242][ T5896] nvme nvme2: rescanning namespaces.
[   82.401490][ T1113] nvme nvme1: rescanning namespaces.
[   82.404795][  T182] nvme nvme0: rescanning namespaces.
[   82.472890][  T182] nvme nvme0: rescanning namespaces.
[   82.482882][ T5896] nvme nvme2: rescanning namespaces.
[   82.502437][ T5856] nvme_ns_head_submit_bio: 11 callbacks suppressed
[   82.502455][ T5856] block nvme0n2: no usable path - requeuing I/O
[   82.520551][  T432] nvme nvme3: rescanning namespaces.
[   82.530244][  T182] nvme nvme0: rescanning namespaces.
[   82.541884][ T1113] nvme nvme1: rescanning namespaces.
[   82.603889][ T1113] nvme nvme1: rescanning namespaces.
[   82.610097][  T182] nvme nvme0: rescanning namespaces.
[   82.618332][ T5896] nvme nvme2: rescanning namespaces.
[   82.655125][  T432] nvme nvme3: rescanning namespaces.
[   82.660700][ T1113] nvme nvme1: rescanning namespaces.
[   82.667085][  T182] nvme nvme0: rescanning namespaces.
[   82.711235][ T5858] nvme0c3n1: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   82.711256][ T5858] I/O error, dev nvme0c3n1, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   82.712488][ T5896] nvme nvme2: rescanning namespaces.
[   82.778909][   T66] nvme nvme2: rescanning namespaces.
[   82.824851][   T66] nvme nvme2: rescanning namespaces.
[   82.847167][ T5996] block device autoloading is deprecated and will be removed.
[   82.863672][ T1113] nvme nvme1: rescanning namespaces.
[   82.883695][ T5858] nvme0c1n1: I/O Cmd(0x2) @ LBA 3710, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   82.883715][ T5858] I/O error, dev nvme0c1n1, sector 29680 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   82.892171][ T5995] block device autoloading is deprecated and will be removed.
[   82.900154][  T182] nvme nvme0: rescanning namespaces.
[   82.900504][  T432] nvme nvme3: rescanning namespaces.
[   82.900634][   T66] nvme nvme2: rescanning namespaces.
[   82.933829][ T5929] nvme nvme0: rescanning namespaces.
[   82.935519][ T1121] nvme nvme3: rescanning namespaces.
[   82.982579][   T66] nvme nvme2: rescanning namespaces.
[   82.996381][   T66] nvme nvme2: rescanning namespaces.
[   83.006375][ T5929] nvme nvme0: rescanning namespaces.
[   83.022217][ T1113] nvme nvme1: rescanning namespaces.
[   83.053372][  T182] nvme nvme2: rescanning namespaces.
[   83.070897][ T1121] nvme nvme3: rescanning namespaces.
[   83.099074][ T5929] nvme nvme0: rescanning namespaces.
[   83.101429][ T1113] nvme nvme1: rescanning namespaces.
[   83.134279][   T66] nvme nvme1: rescanning namespaces.
[   83.134295][  T182] nvme nvme2: rescanning namespaces.
[   83.180671][ T5929] nvme nvme0: rescanning namespaces.
[   83.181855][ T1121] nvme nvme3: rescanning namespaces.
[   83.185219][  T432] nvme nvme1: rescanning namespaces.
[   83.186352][  T182] nvme nvme2: rescanning namespaces.
[   83.246998][ T5929] nvme nvme0: rescanning namespaces.
[   83.268679][ T1121] nvme nvme3: rescanning namespaces.
[   83.270669][  T182] nvme nvme2: rescanning namespaces.
[   83.277026][  T432] nvme nvme1: rescanning namespaces.
[   83.311627][ T1112] nvme nvme0: rescanning namespaces.
[   83.337498][  T182] nvme nvme2: rescanning namespaces.
[   83.365347][  T432] nvme nvme1: rescanning namespaces.
[   83.393870][   T35] nvme nvme1: rescanning namespaces.
[   83.406546][ T1113] nvme nvme3: rescanning namespaces.
[   83.444726][ T5896] nvme nvme1: rescanning namespaces.
[   83.494050][  T182] nvme nvme2: rescanning namespaces.
[   83.528572][ T1113] nvme nvme3: rescanning namespaces.
[   83.529119][ T1112] nvme nvme0: rescanning namespaces.
[   83.531992][  T182] nvme nvme2: rescanning namespaces.
[   83.566424][   T66] nvme nvme3: rescanning namespaces.
[   83.567373][   T29] nvme nvme2: rescanning namespaces.
[   83.569066][ T5899] nvme nvme0: rescanning namespaces.
[   83.579310][ T5896] nvme nvme1: rescanning namespaces.
[   83.635940][ T5899] nvme nvme0: rescanning namespaces.
[   83.686081][   T66] nvme nvme3: rescanning namespaces.
[   83.686933][ T5899] nvme nvme0: rescanning namespaces.
[   83.713850][   T29] nvme nvme2: rescanning namespaces.
[   83.746604][ T5896] nvme nvme1: rescanning namespaces.
[   83.806981][   T29] nvme nvme2: rescanning namespaces.
[   83.811055][ T5896] nvme nvme1: rescanning namespaces.
[   83.818333][   T66] nvme nvme3: rescanning namespaces.
[   83.824500][ T5899] nvme nvme0: rescanning namespaces.
[   83.874764][ T5896] nvme nvme1: rescanning namespaces.
[   83.888553][   T66] nvme nvme3: rescanning namespaces.
[   83.913007][   T29] nvme nvme2: rescanning namespaces.
[   83.920121][ T5896] nvme nvme1: rescanning namespaces.
[   83.933198][ T5899] nvme nvme0: rescanning namespaces.
[   83.937832][   T66] nvme nvme3: rescanning namespaces.
[   83.976944][ T5896] nvme nvme1: rescanning namespaces.
[   84.027442][ T5896] nvme nvme1: rescanning namespaces.
[   84.027447][   T29] nvme nvme2: rescanning namespaces.
[   84.037742][ T5899] nvme nvme0: rescanning namespaces.
[   84.073665][   T66] nvme nvme3: rescanning namespaces.
[   84.129268][   T66] nvme nvme3: rescanning namespaces.
[   84.138711][   T29] nvme nvme2: rescanning namespaces.
[   84.144457][ T5899] nvme nvme0: rescanning namespaces.
[   84.163309][ T5896] nvme nvme1: rescanning namespaces.
[   84.169446][ T1112] nvme nvme2: rescanning namespaces.
[   84.175072][   T35] nvme nvme0: rescanning namespaces.
[   84.192500][   T66] nvme nvme3: rescanning namespaces.
[   84.237013][ T5896] nvme nvme1: rescanning namespaces.
[   84.258552][ T1112] nvme nvme2: rescanning namespaces.
[   84.273768][   T35] nvme nvme0: rescanning namespaces.
[   84.274882][   T66] nvme nvme3: rescanning namespaces.
[   84.285119][ T1113] nvme nvme1: rescanning namespaces.
[   84.285978][  T182] nvme nvme3: rescanning namespaces.
[   84.308452][ T1112] nvme nvme2: rescanning namespaces.
[   84.360442][   T35] nvme nvme0: rescanning namespaces.
[   84.366807][  T182] nvme nvme3: rescanning namespaces.
[   84.386056][ T1113] nvme nvme1: rescanning namespaces.
[   84.413753][ T5899] nvme nvme3: rescanning namespaces.
[   84.413837][   T95] nvme nvme0: rescanning namespaces.
[   84.436420][ T1112] nvme nvme2: rescanning namespaces.
[   84.439082][ T1113] nvme nvme1: rescanning namespaces.
[   84.497041][   T95] nvme nvme0: rescanning namespaces.
[   84.501572][ T5899] nvme nvme3: rescanning namespaces.
[   84.515104][ T1113] nvme nvme1: rescanning namespaces.
[   84.532747][ T1112] nvme nvme2: rescanning namespaces.
[   84.543808][   T95] nvme nvme0: rescanning namespaces.
[   84.564798][ T1113] nvme nvme1: rescanning namespaces.
[   84.564797][ T5899] nvme nvme3: rescanning namespaces.
[   84.577925][ T1112] nvme nvme2: rescanning namespaces.
[   84.627929][ T1113] nvme nvme1: rescanning namespaces.
[   84.640359][   T95] nvme nvme0: rescanning namespaces.
[   84.664128][ T5899] nvme nvme3: rescanning namespaces.
[   84.667176][ T1108] nvme nvme0: rescanning namespaces.
[   84.679070][ T1112] nvme nvme2: rescanning namespaces.
[   84.690128][ T1113] nvme nvme1: rescanning namespaces.
[   84.690650][ T5899] nvme nvme3: rescanning namespaces.
[   84.767293][ T1112] nvme nvme2: rescanning namespaces.
[   84.779244][ T5899] nvme nvme3: rescanning namespaces.
[   84.793005][ T1113] nvme nvme1: rescanning namespaces.
[   84.811111][ T5899] nvme nvme3: rescanning namespaces.
[   84.825504][ T1108] nvme nvme0: rescanning namespaces.
[   84.847748][ T1113] nvme nvme1: rescanning namespaces.
[   84.850241][ T1112] nvme nvme2: rescanning namespaces.
[   84.882012][ T1113] nvme nvme1: rescanning namespaces.
[   84.900083][ T1112] nvme nvme2: rescanning namespaces.
[   84.933630][ T1108] nvme nvme0: rescanning namespaces.
[   84.940759][ T1113] nvme nvme1: rescanning namespaces.
[   84.949052][ T5899] nvme nvme3: rescanning namespaces.
[   84.966116][ T1112] nvme nvme2: rescanning namespaces.
[   84.983918][ T1108] nvme nvme0: rescanning namespaces.
[   84.984051][ T5899] nvme nvme3: rescanning namespaces.
[   85.000239][ T1113] nvme nvme1: rescanning namespaces.
[   85.035326][ T5896] nvme nvme3: rescanning namespaces.
[   85.036466][ T1113] nvme nvme1: rescanning namespaces.
[   85.046654][ T1108] nvme nvme0: rescanning namespaces.
[   85.059880][ T1112] nvme nvme2: rescanning namespaces.
[   85.114764][ T5896] nvme nvme3: rescanning namespaces.
[   85.115295][ T1108] nvme nvme0: rescanning namespaces.
[   85.133372][ T1113] nvme nvme1: rescanning namespaces.
[   85.142445][ T1112] nvme nvme2: rescanning namespaces.
[   85.169711][ T1108] nvme nvme0: rescanning namespaces.
[   85.169782][ T1113] nvme nvme1: rescanning namespaces.
[   85.185068][ T5896] nvme nvme3: rescanning namespaces.
[   85.284292][ T1112] nvme nvme2: rescanning namespaces.
[   85.287038][ T1108] nvme nvme0: rescanning namespaces.
[   85.302476][ T5896] nvme nvme3: rescanning namespaces.
[   85.321043][ T5995] block device autoloading is deprecated and will be removed.
[   85.359229][ T5858] nvme0c0n1: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   85.359263][ T5858] I/O error, dev nvme0c0n1, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   85.468172][ T1113] nvme nvme1: rescanning namespaces.
[   85.480134][ T1112] nvme nvme2: rescanning namespaces.
[   85.487415][ T1108] nvme nvme0: rescanning namespaces.
[   85.520484][ T5896] nvme nvme3: rescanning namespaces.
[   85.524510][ T5900] nvme nvme3: rescanning namespaces.
[   85.524796][ T1112] nvme nvme2: rescanning namespaces.
[   85.576531][   T29] nvme nvme3: rescanning namespaces.
[   85.616313][ T1108] nvme nvme0: rescanning namespaces.
[   85.627767][ T1112] nvme nvme2: rescanning namespaces.
[   85.638797][ T1113] nvme nvme1: rescanning namespaces.
[   85.663270][ T5929] nvme nvme1: rescanning namespaces.
[   85.663399][ T5899] nvme nvme2: rescanning namespaces.
[   85.664754][ T1108] nvme nvme0: rescanning namespaces.
[   85.669464][   T11] block nvme0n1: no usable path - requeuing I/O
[   85.706994][   T29] nvme nvme3: rescanning namespaces.
[   85.714342][ T1113] nvme nvme1: rescanning namespaces.
[   85.714611][   T66] nvme nvme2: rescanning namespaces.
[   85.715896][   T11] nvme_ns_head_submit_bio: 28 callbacks suppressed
[   85.715907][   T11] block nvme0n1: no available path - failing I/O
[   85.715917][   T11] buffer_io_error: 27 callbacks suppressed
[   85.715921][   T11] Buffer I/O error on dev nvme0n1, logical block 64, async page read
[   85.723722][   T35] nvme nvme3: rescanning namespaces.
[   85.760427][ T1108] nvme nvme0: rescanning namespaces.
[   85.838643][   T34] audit: type=1400 audit(1790188871.863:292): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.838675][   T34] audit: type=1400 audit(1790188871.863:293): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="nvmet" dev="configfs" ino=3497 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.838739][   T34] audit: type=1400 audit(1790188871.863:294): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="subsystems" dev="configfs" ino=3498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.838830][   T34] audit: type=1400 audit(1790188871.863:295): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="testnqn" dev="configfs" ino=8403 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.838893][   T34] audit: type=1400 audit(1790188871.863:296): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="namespaces" dev="configfs" ino=8404 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.838973][   T34] audit: type=1400 audit(1790188871.863:297): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="1" dev="configfs" ino=8407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   85.840016][ T1128] nvme nvme0: Identify Descriptors failed (nsid=1, status=0x2300)
[   85.888301][   T66] nvme nvme2: rescanning namespaces.
[   85.888373][ T1113] nvme nvme1: rescanning namespaces.
[   85.933232][   T35] nvme nvme3: rescanning namespaces.
[   85.953976][ T5858] block nvme0n2: no available path - failing I/O
[   85.954014][ T5858] block nvme0n2: no available path - failing I/O
[   85.954021][ T5858] Buffer I/O error on dev nvme0n2, logical block 4080, async page read
[   86.016981][   T66] nvme nvme2: rescanning namespaces.
[   86.036636][ T5899] nvme nvme0: rescanning namespaces.
[   86.041033][ T1113] nvme nvme1: rescanning namespaces.
[   86.057703][ T1113] nvme nvme0: rescanning namespaces.
[   86.058023][ T1112] nvme nvme2: rescanning namespaces.
[   86.058079][ T1128] nvme nvme1: rescanning namespaces.
[   86.064283][   T35] nvme nvme3: rescanning namespaces.
[   86.196387][ T1112] nvme nvme2: rescanning namespaces.
[   86.196657][ T1128] nvme nvme1: rescanning namespaces.
[   86.205424][   T35] nvme nvme3: rescanning namespaces.
[   86.214405][ T6024] block device autoloading is deprecated and will be removed.
[   86.227470][ T6023] block device autoloading is deprecated and will be removed.
[   86.230740][ T1113] nvme nvme0: rescanning namespaces.
[   86.277904][   T35] nvme nvme3: rescanning namespaces.
[   86.293044][ T1128] nvme nvme1: rescanning namespaces.
[   86.293936][ T1112] nvme nvme2: rescanning namespaces.
[   86.356230][ T1113] nvme nvme0: rescanning namespaces.
[   86.385597][   T35] nvme nvme3: rescanning namespaces.
[   86.429945][   T55] nvme nvme2: rescanning namespaces.
[   86.442821][ T1113] nvme nvme0: rescanning namespaces.
[   86.458962][   T35] nvme nvme3: rescanning namespaces.
[   86.512364][   T66] nvme nvme1: rescanning namespaces.
[   86.515590][   T55] nvme nvme2: rescanning namespaces.
[   86.546326][ T1113] nvme nvme0: rescanning namespaces.
[   86.567241][ T5858] nvme_log_error: 5 callbacks suppressed
[   86.567255][ T5858] nvme0c3n1: I/O Cmd(0x2) @ LBA 16, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   86.567267][ T5858] blk_print_req_error: 5 callbacks suppressed
[   86.567272][ T5858] I/O error, dev nvme0c3n1, sector 128 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   86.567880][   T35] nvme nvme3: rescanning namespaces.
[   86.612325][   T11] block nvme0n1: no usable path - requeuing I/O
[   86.662409][ T1113] nvme nvme0: rescanning namespaces.
[   86.699033][   T35] nvme nvme3: rescanning namespaces.
[   86.701420][ T5858] block nvme0n1: no usable path - requeuing I/O
[   86.714774][   T66] nvme nvme1: rescanning namespaces.
[   86.714844][   T55] nvme nvme2: rescanning namespaces.
[   86.734651][ T1108] 
[   86.735550][ T1108] =====================================
[   86.737311][ T1108] WARNING: bad unlock balance detected!
[   86.739097][ T1108] syzkaller #1 Not tainted
[   86.740579][ T1108] -------------------------------------
[   86.742341][ T1108] kworker/u10:5/1108 is trying to release lock (&q->q_usage_counter(io)) at:
[   86.745149][ T1108] [<ffffffff8664416f>] nvme_update_ns_info+0x9ff/0x1200
[   86.747387][ T1108] but there are no more locks to release!
[   86.749237][ T1108] 
[   86.749237][ T1108] other info that might help us debug this:
[   86.751842][ T1108] locks held by kworker/u10:5/1108: 2, last CPU#1:
[   86.753932][ T1108]  #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[   86.757394][ T1108]  #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[   86.761093][ T1108] 
[   86.761093][ T1108] stack backtrace:
[   86.763053][ T1108] CPU: 1 UID: 0 PID: 1108 Comm: kworker/u10:5 Not tainted syzkaller #1 PREEMPT(full) 
[   86.766034][ T1108] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   86.769204][ T1108] Workqueue: async async_run_entry_fn
[   86.770992][ T1108] Call Trace:
[   86.772079][ T1108]  <TASK>
[   86.773075][ T1108]  dump_stack_lvl+0xe8/0x150
[   86.774605][ T1108]  ? nvme_update_ns_info+0x9ff/0x1200
[   86.776290][ T1108]  print_unlock_imbalance_bug+0xdc/0xf0
[   86.778074][ T1108]  lock_release+0x252/0x3c0
[   86.779577][ T1108]  ? nvme_update_ns_info+0x9ff/0x1200
[   86.781315][ T1108]  nvme_update_ns_info+0x9ff/0x1200
[   86.783046][ T1108]  ? __pfx_nvme_update_ns_info+0x10/0x10
[   86.784855][ T1108]  ? __pfx_number+0x10/0x10
[   86.786333][ T1108]  ? vsnprintf+0xe42/0xef0
[   86.787800][ T1108]  ? __cancel_work+0x17f/0x230
[   86.789351][ T1108]  ? lockdep_hardirqs_on+0x7b/0x110
[   86.791061][ T1108]  ? __cancel_work+0x1dd/0x230
[   86.792609][ T1108]  nvme_scan_ns+0x34c1/0x46c0
[   86.794163][ T1108]  ? ret_from_fork_asm+0x1a/0x30
[   86.795763][ T1108]  ? __pfx_nvme_scan_ns+0x10/0x10
[   86.797358][ T1108]  ? arch_stack_walk+0x11b/0x150
[   86.798973][ T1108]  ? ret_from_fork_asm+0x1a/0x30
[   86.800600][ T1108]  ? stack_trace_save+0xa9/0x100
[   86.802205][ T1108]  ? __pfx_stack_trace_save+0x10/0x10
[   86.803960][ T1108]  ? kfree+0x1c5/0x650
[   86.805293][ T1108]  ? stack_depot_save_flags+0x33/0x7f0
[   86.807060][ T1108]  ? __lock_acquire+0x680/0x2de0
[   86.808693][ T1108]  ? __lock_acquire+0x747/0x2de0
[   86.810299][ T1108]  ? register_lock_class+0x31/0x2e0
[   86.812025][ T1108]  ? __lock_acquire+0x747/0x2de0
[   86.813642][ T1108]  ? seqcount_lockdep_reader_access+0xa9/0x100
[   86.815584][ T1108]  ? lockdep_hardirqs_on+0x7b/0x110
[   86.817238][ T1108]  ? __pfx_nvme_scan_ns_async+0x10/0x10
[   86.819008][ T1108]  ? __pfx_nvme_scan_ns_async+0x10/0x10
[   86.820814][ T1108]  async_run_entry_fn+0x9d/0x430
[   86.822437][ T1108]  ? process_scheduled_works+0x97a/0x1630
[   86.824256][ T1108]  process_scheduled_works+0xc3d/0x1630
[   86.826047][ T1108]  ? __pfx_process_scheduled_works+0x10/0x10
[   86.827992][ T1108]  ? do_raw_spin_lock+0x12b/0x2f0
[   86.829680][ T1108]  worker_thread+0x92d/0xe10
[   86.831212][ T1108]  kthread+0x38b/0x480
[   86.832597][ T1108]  ? __pfx_worker_thread+0x10/0x10
[   86.834224][ T1108]  ? __pfx_kthread+0x10/0x10
[   86.835724][ T1108]  ret_from_fork+0x514/0xb70
[   86.837201][ T1108]  ? __pfx_ret_from_fork+0x10/0x10
[   86.838811][ T1108]  ? __switch_to+0xc89/0x1420
[   86.840333][ T1108]  ? __pfx_kthread+0x10/0x10
[   86.841830][ T1108]  ret_from_fork_asm+0x1a/0x30
[   86.843360][ T1108]  </TASK>
[   86.850099][   T11] block nvme0n1: no available path - failing I/O
[   86.850194][ T5858] block nvme0n1: no available path - failing I/O
[   86.850201][ T5858] Buffer I/O error on dev nvme0n1, logical block 33, async page read
[   86.869517][ T5899] block nvme0n2: no usable path - requeuing I/O
[   86.869546][ T5941] block nvme0n2: no usable path - requeuing I/O
[   86.894442][ T1113] nvme nvme0: rescanning namespaces.
[   86.915131][   T55] nvme nvme2: rescanning namespaces.
[   86.922439][   T66] nvme nvme1: rescanning namespaces.
[   86.957978][   T35] nvme nvme3: rescanning namespaces.
[   86.984126][ T5856] block nvme0n2: no usable path - requeuing I/O
[   87.001499][   T55] nvme nvme2: rescanning namespaces.
[   87.003773][ T1128] nvme nvme2: rescanning namespaces.
[   87.007391][   T66] nvme nvme1: rescanning namespaces.
[   87.014402][   T11] nvme0c0n2: I/O Cmd(0x2) @ LBA 4022, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   87.014420][   T11] I/O error, dev nvme0c0n2, sector 32176 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   87.054250][   T29] nvme nvme0: rescanning namespaces.
[   87.054267][   T28] nvme nvme2: rescanning namespaces.
[   87.055355][ T1128] nvme nvme1: rescanning namespaces.
[   87.064162][   T35] nvme nvme3: rescanning namespaces.
[   87.114844][   T28] nvme nvme2: rescanning namespaces.
[   87.117870][ T5856] block nvme0n2: no usable path - requeuing I/O
[   87.131349][   T35] nvme nvme3: rescanning namespaces.
[   87.131655][   T11] nvme0c1n2: I/O Cmd(0x2) @ LBA 3977, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   87.131669][   T11] I/O error, dev nvme0c1n2, sector 31816 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   87.154008][ T1128] nvme nvme1: rescanning namespaces.
[   87.154079][   T29] nvme nvme0: rescanning namespaces.
[   87.164883][ T1121] nvme nvme0: rescanning namespaces.
[   87.164928][ T1114] nvme nvme3: rescanning namespaces.
[   87.166264][   T28] nvme nvme2: rescanning namespaces.
[   87.206010][ T1128] nvme nvme1: rescanning namespaces.
[   87.223397][ T5856] block nvme0n2: no usable path - requeuing I/O
[   87.225800][ T5941] nvme0c0n2: I/O Cmd(0x2) @ LBA 16, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   87.225819][ T5941] I/O error, dev nvme0c0n2, sector 128 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   87.249894][ T1128] nvme nvme1: rescanning namespaces.
[   87.252184][   T11] block nvme0n2: no usable path - requeuing I/O
[   87.274399][ T1114] nvme nvme3: rescanning namespaces.
[   87.276067][   T28] nvme nvme2: rescanning namespaces.
[   87.276476][ T1121] nvme nvme0: rescanning namespaces.
[   87.284148][   T28] nvme nvme2: rescanning namespaces.
[   87.284391][ T1112] nvme nvme0: rescanning namespaces.
[   87.286209][ T1121] nvme nvme3: rescanning namespaces.
[   87.289859][ T5941] block nvme0n2: no available path - failing I/O
[   87.289872][ T5941] Buffer I/O error on dev nvme0n2, logical block 16, async page read
[   87.324310][ T1128] nvme nvme1: rescanning namespaces.
[   87.343698][ T5856] nvme0c2n1: I/O Cmd(0x2) @ LBA 8, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   87.343717][ T5856] I/O error, dev nvme0c2n1, sector 64 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   87.349942][ T6024] block device autoloading is deprecated and will be removed.
[   87.361139][ T1128] nvme nvme1: rescanning namespaces.
[   87.394762][ T1112] nvme nvme0: rescanning namespaces.
[   87.408549][ T1128] nvme nvme1: rescanning namespaces.
[   87.413702][   T28] nvme nvme2: rescanning namespaces.
[   87.444483][ T1121] nvme nvme3: rescanning namespaces.
[   87.457720][ T1128] nvme nvme1: rescanning namespaces.
[   87.493266][ T1121] nvme nvme3: rescanning namespaces.
[   87.493644][ T1112] nvme nvme0: rescanning namespaces.
[   87.495424][ T5856] nvme0c0n1: I/O Cmd(0x2) @ LBA 16, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   87.495440][ T5856] I/O error, dev nvme0c0n1, sector 128 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   87.509667][ T1128] nvme nvme1: rescanning namespaces.
[   87.514599][   T28] nvme nvme2: rescanning namespaces.
[   87.552843][ T1121] nvme nvme3: rescanning namespaces.
[   87.556513][ T5941] block nvme0n1: no available path - failing I/O
[   87.556567][ T5856] block nvme0n1: no available path - failing I/O
[   87.556574][ T5856] Buffer I/O error on dev nvme0n1, logical block 32, async page read
[   87.570496][ T5856] udevd[5856]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   87.574138][ T1128] nvme nvme1: rescanning namespaces.
[   87.574290][  T432] nvme nvme3: rescanning namespaces.
[   87.605357][ T5944] nvme0c2n2: I/O Cmd(0x2) @ LBA 4094, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   87.605379][ T5944] I/O error, dev nvme0c2n2, sector 32752 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   87.605674][   T28] nvme nvme2: rescanning namespaces.
[   87.609300][ T1112] nvme nvme0: rescanning namespaces.
[   87.623958][  T432] nvme nvme3: rescanning namespaces.
[   87.624160][ T1112] nvme nvme0: rescanning namespaces.
[   87.628663][ T1128] nvme nvme1: rescanning namespaces.
[   87.653952][   T11] nvme_ns_head_submit_bio: 1 callbacks suppressed
[   87.653970][   T11] block nvme0n2: no usable path - requeuing I/O
[   87.653993][   T11] block nvme0n2: no usable path - requeuing I/O
[   87.660211][   T28] nvme nvme2: rescanning namespaces.
[   87.689301][ T1112] nvme nvme0: rescanning namespaces.
[   87.734761][  T432] nvme nvme3: rescanning namespaces.
[   87.739806][ T1112] nvme nvme0: rescanning namespaces.
[   87.779334][  T432] nvme nvme3: rescanning namespaces.
[   87.779931][ T1128] nvme nvme1: rescanning namespaces.
[   87.800656][ T1112] nvme nvme0: rescanning namespaces.
[   87.801165][   T28] nvme nvme2: rescanning namespaces.
[   87.850484][ T1128] nvme nvme1: rescanning namespaces.
[   87.857099][   T28] nvme nvme2: rescanning namespaces.
[   87.862751][  T432] nvme nvme3: rescanning namespaces.
[   87.889337][ T5899] nvme nvme0: rescanning namespaces.
[   87.902544][ T5944] nvme0c1n2: I/O Cmd(0x2) @ LBA 3972, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   87.902566][ T5944] I/O error, dev nvme0c1n2, sector 31776 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   87.943868][ T5899] nvme nvme0: rescanning namespaces.
[   87.965163][  T432] nvme nvme3: rescanning namespaces.
[   87.984104][ T1112] nvme nvme0: rescanning namespaces.
[   88.026753][ T1128] nvme nvme1: rescanning namespaces.
[   88.030943][  T432] nvme nvme3: rescanning namespaces.
[   88.032754][   T28] nvme nvme2: rescanning namespaces.
[   88.044707][ T5944] nvme0c1n2: I/O Cmd(0x2) @ LBA 3977, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   88.044730][ T5944] I/O error, dev nvme0c1n2, sector 31816 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   88.049234][ T1112] nvme nvme0: rescanning namespaces.
[   88.086230][ T1128] nvme nvme1: rescanning namespaces.
[   88.101131][ T1112] nvme nvme0: rescanning namespaces.
[   88.105318][ T1128] nvme nvme1: rescanning namespaces.
[   88.105357][  T432] nvme nvme3: rescanning namespaces.
[   88.112446][   T28] nvme nvme2: rescanning namespaces.
[   88.185036][   T28] nvme nvme2: rescanning namespaces.
[   88.185502][  T432] nvme nvme3: rescanning namespaces.
[   88.187278][ T5944] nvme0c2n2: I/O Cmd(0x2) @ LBA 3710, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   88.187293][ T5944] I/O error, dev nvme0c2n2, sector 29680 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   88.190724][ T5919] block nvme0n2: no usable path - requeuing I/O
[   88.202869][ T1112] nvme nvme0: rescanning namespaces.
[   88.202977][ T1128] nvme nvme1: rescanning namespaces.
[   88.207654][  T193] block nvme0n2: no usable path - requeuing I/O
[   88.233838][  T432] nvme nvme3: rescanning namespaces.
[   88.234164][ T1108] nvme nvme0: rescanning namespaces.
[   88.248058][ T5919] block nvme0n2: no available path - failing I/O
[   88.248072][ T5919] Buffer I/O error on dev nvme0n2, logical block 3710, async page read
[   88.269892][   T28] nvme nvme2: rescanning namespaces.
[   88.281253][ T1128] nvme nvme1: rescanning namespaces.
[   88.298200][ T6024] block device autoloading is deprecated and will be removed.
[   88.304746][ T1128] nvme nvme1: rescanning namespaces.
[   88.310408][ T6023] block device autoloading is deprecated and will be removed.
[   88.323989][   T28] nvme nvme2: rescanning namespaces.
[   88.328101][  T432] nvme nvme3: rescanning namespaces.
[   88.342748][ T1108] nvme nvme0: rescanning namespaces.
[   88.354270][  T432] nvme nvme1: rescanning namespaces.
[   88.354595][  T182] nvme nvme3: rescanning namespaces.
[   88.357975][   T28] nvme nvme2: rescanning namespaces.
[   88.400906][ T1108] nvme nvme0: rescanning namespaces.
[   88.448803][ T1128] nvme nvme1: rescanning namespaces.
[   88.469084][ T1108] nvme nvme0: rescanning namespaces.
[   88.469120][   T28] nvme nvme2: rescanning namespaces.
[   88.495167][  T182] nvme nvme3: rescanning namespaces.
[   88.495688][ T5904] nvme nvme1: rescanning namespaces.
[   88.495744][ T5896] nvme nvme2: rescanning namespaces.
[   88.517674][ T1108] nvme nvme0: rescanning namespaces.
[   88.593891][  T182] nvme nvme3: rescanning namespaces.
[   88.596382][ T1108] nvme nvme0: rescanning namespaces.
[   88.612499][ T5896] nvme nvme2: rescanning namespaces.
[   88.615149][ T1114] nvme nvme0: rescanning namespaces.
[   88.620543][  T182] nvme nvme3: rescanning namespaces.
[   88.629688][ T5904] nvme nvme1: rescanning namespaces.
[   88.630252][ T5896] nvme nvme2: rescanning namespaces.
[   88.714392][ T5904] nvme nvme1: rescanning namespaces.
[   88.719916][ T5896] nvme nvme2: rescanning namespaces.
[   88.743295][ T1108] nvme nvme2: rescanning namespaces.
[   88.752769][ T1114] nvme nvme0: rescanning namespaces.
[   88.762386][ T5904] nvme nvme1: rescanning namespaces.
[   88.764077][  T182] nvme nvme3: rescanning namespaces.
[   88.814339][ T1108] nvme nvme2: rescanning namespaces.
[   88.842345][ T1114] nvme nvme0: rescanning namespaces.
[   88.857519][ T5904] nvme nvme1: rescanning namespaces.
[   88.859179][ T1108] nvme nvme1: rescanning namespaces.
[   88.859237][   T37] nvme nvme2: rescanning namespaces.
[   88.863573][  T182] nvme nvme3: rescanning namespaces.
[   88.866414][ T1114] nvme nvme0: rescanning namespaces.
[   88.909837][ T6043] nvme nvme2: Identify Descriptors failed (nsid=1, status=0x2300)
[   88.953905][ T1108] nvme nvme1: rescanning namespaces.
[   88.959916][   T37] nvme nvme2: rescanning namespaces.
[   88.967019][ T1114] nvme nvme0: rescanning namespaces.
[   88.982342][  T182] nvme nvme3: rescanning namespaces.
[   89.002208][  T193] block nvme0n1: no usable path - requeuing I/O
[   89.003117][   T55] nvme nvme2: rescanning namespaces.
[   89.008058][ T5929] nvme nvme0: rescanning namespaces.
[   89.009660][ T1108] nvme nvme1: rescanning namespaces.
[   89.039292][ T5919] block nvme0n1: no available path - failing I/O
[   89.039343][ T5919] Buffer I/O error on dev nvme0n1, logical block 3974, async page read
[   89.056508][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   89.056967][  T182] nvme nvme3: rescanning namespaces.
[   89.068583][ T5899] nvme nvme3: rescanning namespaces.
[   89.068694][   T55] nvme nvme2: rescanning namespaces.
[   89.080224][ T5929] nvme nvme0: rescanning namespaces.
[   89.102996][ T1108] nvme nvme1: rescanning namespaces.
[   89.107074][  T193] block nvme0n2: no usable path - requeuing I/O
[   89.121809][   T55] nvme nvme0: rescanning namespaces.
[   89.137016][  T193] Buffer I/O error on dev nvme0n2, logical block 4063, async page read
[   89.145854][   T29] nvme nvme3: rescanning namespaces.
[   89.162495][ T5856] udevd[5856]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   89.163679][ T5929] nvme nvme2: rescanning namespaces.
[   89.174079][ T1108] nvme nvme1: rescanning namespaces.
[   89.193376][ T6024] block device autoloading is deprecated and will be removed.
[   89.208217][ T5899] nvme nvme1: rescanning namespaces.
[   89.223280][ T5929] nvme nvme2: rescanning namespaces.
[   89.226309][   T29] nvme nvme3: rescanning namespaces.
[   89.228698][  T193] block nvme0n1: no usable path - requeuing I/O
[   89.237062][   T55] nvme nvme0: rescanning namespaces.
[   89.257959][   T66] nvme nvme1: rescanning namespaces.
[   89.258005][   T55] nvme nvme0: rescanning namespaces.
[   89.285176][ T5929] nvme nvme2: rescanning namespaces.
[   89.287552][ T5919] Buffer I/O error on dev nvme0n1, logical block 4080, async page read
[   89.314680][   T29] nvme nvme3: rescanning namespaces.
[   89.317665][   T66] nvme nvme1: rescanning namespaces.
[   89.317716][   T29] nvme nvme3: rescanning namespaces.
[   89.327227][ T5929] nvme nvme2: rescanning namespaces.
[   89.352638][   T55] nvme nvme0: rescanning namespaces.
[   89.354850][  T193] block nvme0n2: no usable path - requeuing I/O
[   89.367976][ T1114] nvme nvme3: rescanning namespaces.
[   89.373079][ T5929] nvme nvme2: rescanning namespaces.
[   89.377517][   T66] nvme nvme1: rescanning namespaces.
[   89.384187][ T5919] Buffer I/O error on dev nvme0n2, logical block 4080, async page read
[   89.404755][   T55] nvme nvme0: rescanning namespaces.
[   89.405815][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   89.433759][ T5929] nvme nvme2: rescanning namespaces.
[   89.440839][ T6023] block device autoloading is deprecated and will be removed.
[   89.448350][   T55] nvme nvme0: rescanning namespaces.
[   89.456061][ T1114] nvme nvme3: rescanning namespaces.
[   89.483401][ T5900] nvme nvme2: rescanning namespaces.
[   89.483527][ T5929] nvme nvme0: rescanning namespaces.
[   89.529751][ T1114] nvme nvme3: rescanning namespaces.
[   89.532408][   T66] nvme nvme1: rescanning namespaces.
[   89.568631][ T5900] nvme nvme2: rescanning namespaces.
[   89.574256][ T5929] nvme nvme0: rescanning namespaces.
[   89.610063][ T1114] nvme nvme3: rescanning namespaces.
[   89.617689][ T5929] nvme nvme0: rescanning namespaces.
[   89.624089][   T66] nvme nvme1: rescanning namespaces.
[   89.638706][   T95] nvme nvme2: rescanning namespaces.
[   89.709905][ T5929] nvme nvme0: rescanning namespaces.
[   89.742799][   T66] nvme nvme1: rescanning namespaces.
[   89.742820][   T95] nvme nvme2: rescanning namespaces.
[   89.742960][ T1114] nvme nvme3: rescanning namespaces.
[   89.763319][ T5929] nvme nvme0: rescanning namespaces.
[   89.798120][ T1114] nvme nvme3: rescanning namespaces.
[   89.798889][   T66] nvme nvme1: rescanning namespaces.
[   89.814842][  T193] block nvme0n1: no usable path - requeuing I/O
[   89.842792][  T193] block nvme0n1: no usable path - requeuing I/O
[   89.851168][ T1114] nvme nvme3: rescanning namespaces.
[   89.867757][   T95] nvme nvme2: rescanning namespaces.
[   89.893916][   T66] nvme nvme1: rescanning namespaces.
[   89.894037][   T28] nvme nvme2: rescanning namespaces.
[   89.894669][ T5929] nvme nvme0: rescanning namespaces.
[   89.916973][ T1114] nvme nvme3: rescanning namespaces.
[   89.962986][   T66] nvme nvme1: rescanning namespaces.
[   90.003789][ T5929] nvme nvme0: rescanning namespaces.
[   90.009742][   T28] nvme nvme2: rescanning namespaces.
[   90.016222][   T28] nvme nvme2: rescanning namespaces.
[   90.021042][   T66] nvme nvme1: rescanning namespaces.
[   90.024992][ T1114] nvme nvme3: rescanning namespaces.
[   90.049092][ T5929] nvme nvme0: rescanning namespaces.
[   90.087879][ T1114] nvme nvme3: rescanning namespaces.
[   90.096070][   T66] nvme nvme1: rescanning namespaces.
[   90.113646][ T5929] nvme nvme0: rescanning namespaces.
[   90.133756][ T5899] nvme nvme1: rescanning namespaces.
[   90.137596][   T28] nvme nvme2: rescanning namespaces.
[   90.144653][ T5929] nvme nvme0: rescanning namespaces.
[   90.144756][ T1114] nvme nvme3: rescanning namespaces.
[   90.204367][ T5899] nvme nvme1: rescanning namespaces.
[   90.243062][ T5929] nvme nvme0: rescanning namespaces.
[   90.254561][ T1114] nvme nvme3: rescanning namespaces.
[   90.254837][ T1121] nvme nvme1: rescanning namespaces.
[   90.287685][ T5929] nvme nvme0: rescanning namespaces.
[   90.293720][   T28] nvme nvme2: rescanning namespaces.
[   90.336963][ T1114] nvme nvme3: rescanning namespaces.
[   90.339697][ T1121] nvme nvme1: rescanning namespaces.
[   90.373315][ T5899] nvme nvme3: rescanning namespaces.
[   90.389264][ T1121] nvme nvme1: rescanning namespaces.
[   90.396506][ T5929] nvme nvme0: rescanning namespaces.
[   90.412927][   T28] nvme nvme2: rescanning namespaces.
[   90.442719][   T28] nvme nvme2: rescanning namespaces.
[   90.442771][ T5929] nvme nvme0: rescanning namespaces.
[   90.455832][ T5899] nvme nvme3: rescanning namespaces.
[   90.499698][ T1121] nvme nvme1: rescanning namespaces.
[   90.516904][ T5929] nvme nvme0: rescanning namespaces.
[   90.527176][   T28] nvme nvme2: rescanning namespaces.
[   90.531110][   T29] nvme nvme3: rescanning namespaces.
[   90.611842][ T1121] nvme nvme1: rescanning namespaces.
[   90.613493][   T29] nvme nvme3: rescanning namespaces.
[   90.617389][ T5929] nvme nvme0: rescanning namespaces.
[   90.617560][ T1128] nvme nvme1: rescanning namespaces.
[   90.625761][   T28] nvme nvme2: rescanning namespaces.
[   90.660806][   T29] nvme nvme3: rescanning namespaces.
[   90.707985][ T5929] nvme nvme0: rescanning namespaces.
[   90.743227][ T1128] nvme nvme1: rescanning namespaces.
[   90.752470][   T28] nvme nvme2: rescanning namespaces.
[   90.755458][   T35] nvme nvme0: rescanning namespaces.
[   90.800475][ T1128] nvme nvme1: rescanning namespaces.
[   90.801257][   T29] nvme nvme3: rescanning namespaces.
[   90.809278][   T28] nvme nvme2: rescanning namespaces.
[   90.852586][   T95] nvme nvme2: rescanning namespaces.
[   90.858800][   T35] nvme nvme0: rescanning namespaces.
[   90.870528][ T1128] nvme nvme1: rescanning namespaces.
[   90.895548][ T1121] nvme nvme2: rescanning namespaces.
[   90.904420][   T29] nvme nvme3: rescanning namespaces.
[   90.907789][   T35] nvme nvme0: rescanning namespaces.
[   90.918158][ T1128] nvme nvme1: rescanning namespaces.
[   90.946239][   T34] audit: type=1400 audit(1790188876.973:298): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   90.946281][   T34] audit: type=1400 audit(1790188876.973:299): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="nvmet" dev="configfs" ino=3497 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   90.946335][   T34] audit: type=1400 audit(1790188876.973:300): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="subsystems" dev="configfs" ino=3498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   90.946389][   T34] audit: type=1400 audit(1790188876.973:301): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="testnqn" dev="configfs" ino=8403 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   90.946444][   T34] audit: type=1400 audit(1790188876.973:302): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="namespaces" dev="configfs" ino=8404 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   90.946543][   T34] audit: type=1400 audit(1790188876.973:303): avc:  denied  { search } for  pid=5853 comm="syz-executor217" name="1" dev="configfs" ino=8407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[   90.999552][   T35] nvme nvme0: rescanning namespaces.
[   91.002827][   T29] nvme nvme3: rescanning namespaces.
[   91.005118][   T66] nvme nvme2: rescanning namespaces.
[   91.033804][   T55] nvme nvme2: rescanning namespaces.
[   91.034658][ T1128] nvme nvme1: rescanning namespaces.
[   91.111201][   T35] nvme nvme0: rescanning namespaces.
[   91.111283][   T29] nvme nvme3: rescanning namespaces.
[   91.117784][   T55] nvme nvme2: rescanning namespaces.
[   91.160127][   T66] nvme nvme0: rescanning namespaces.
[   91.160206][   T29] nvme nvme3: rescanning namespaces.
[   91.160247][ T5929] nvme nvme2: rescanning namespaces.
[   91.187908][ T5941] nvme_ns_head_submit_bio: 3 callbacks suppressed
[   91.187924][ T5941] block nvme0n1: no available path - failing I/O
[   91.187933][ T5941] Buffer I/O error on dev nvme0n1, logical block 18, async page read
[   91.225922][ T1128] nvme nvme1: rescanning namespaces.
[   91.236735][   T29] nvme nvme3: rescanning namespaces.
[   91.237387][ T5904] nvme nvme1: rescanning namespaces.
[   91.247435][   T66] nvme nvme0: rescanning namespaces.
[   91.274049][ T5929] nvme nvme2: rescanning namespaces.
[   91.286936][   T66] nvme nvme0: rescanning namespaces.
[   91.287363][   T29] nvme nvme1: rescanning namespaces.
[   91.287745][ T6013] nvme nvme3: rescanning namespaces.
[   91.336352][ T5941] block nvme0n2: no available path - failing I/O
[   91.336369][ T5941] Buffer I/O error on dev nvme0n2, logical block 4094, async page read
[   91.346461][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   91.354284][   T66] nvme nvme0: rescanning namespaces.
[   91.354498][ T6063] block device autoloading is deprecated and will be removed.
[   91.354900][ T5929] nvme nvme2: rescanning namespaces.
[   91.372392][ T6062] block device autoloading is deprecated and will be removed.
[   91.404675][ T5899] nvme nvme2: rescanning namespaces.
[   91.425732][   T29] nvme nvme1: rescanning namespaces.
[   91.425812][ T6013] nvme nvme3: rescanning namespaces.
[   91.432691][   T66] nvme nvme0: rescanning namespaces.
[   91.506789][   T66] nvme nvme0: rescanning namespaces.
[   91.509797][ T5899] nvme nvme2: rescanning namespaces.
[   91.512351][   T29] nvme nvme1: rescanning namespaces.
[   91.562566][ T6013] nvme nvme3: rescanning namespaces.
[   91.565761][   T55] nvme nvme2: rescanning namespaces.
[   91.566449][   T66] nvme nvme0: rescanning namespaces.
[   91.566486][   T29] nvme nvme1: rescanning namespaces.
[   91.586856][ T6013] nvme nvme3: rescanning namespaces.
[   91.663616][   T29] nvme nvme1: rescanning namespaces.
[   91.668592][   T55] nvme nvme2: rescanning namespaces.
[   91.673615][ T5856] nvme_log_error: 24 callbacks suppressed
[   91.673625][ T5856] nvme0c0n1: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   91.673636][ T5856] blk_print_req_error: 24 callbacks suppressed
[   91.673641][ T5856] I/O error, dev nvme0c0n1, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   91.703774][ T6064] nvme nvme2: rescanning namespaces.
[   91.707020][ T6013] nvme nvme3: rescanning namespaces.
[   91.716350][   T66] nvme nvme0: rescanning namespaces.
[   91.773942][ T6064] nvme nvme2: rescanning namespaces.
[   91.774038][   T66] nvme nvme0: rescanning namespaces.
[   91.782428][   T29] nvme nvme1: rescanning namespaces.
[   91.818593][ T5899] nvme nvme1: rescanning namespaces.
[   91.823586][ T6013] nvme nvme3: rescanning namespaces.
[   91.830273][ T6064] nvme nvme2: rescanning namespaces.
[   91.836831][   T66] nvme nvme0: rescanning namespaces.
[   91.887392][ T5899] nvme nvme1: rescanning namespaces.
[   91.888648][ T6064] nvme nvme2: rescanning namespaces.
[   91.901441][ T6013] nvme nvme3: rescanning namespaces.
[   91.916576][  T193] nvme0c0n1: I/O Cmd(0x2) @ LBA 4095, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   91.916597][  T193] I/O error, dev nvme0c0n1, sector 32760 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   91.934781][   T55] nvme nvme1: rescanning namespaces.
[   91.935523][ T6013] nvme nvme3: rescanning namespaces.
[   91.939859][   T66] nvme nvme0: rescanning namespaces.
[   91.940545][ T6064] nvme nvme2: rescanning namespaces.
[   91.984524][   T95] nvme nvme1: Identify Descriptors failed (nsid=1, status=0x2300)
[   92.026764][   T55] nvme nvme1: rescanning namespaces.
[   92.042360][ T5856] nvme0c0n1: I/O Cmd(0x2) @ LBA 4064, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   92.042381][ T5856] I/O error, dev nvme0c0n1, sector 32512 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   92.054088][   T66] nvme nvme0: rescanning namespaces.
[   92.064507][ T6013] nvme nvme3: rescanning namespaces.
[   92.086941][ T5929] nvme nvme3: rescanning namespaces.
[   92.086992][ T5899] nvme nvme1: rescanning namespaces.
[   92.087146][ T6064] nvme nvme2: rescanning namespaces.
[   92.096442][   T66] nvme nvme0: rescanning namespaces.
[   92.174947][ T5899] nvme nvme1: rescanning namespaces.
[   92.179660][ T5929] nvme nvme3: rescanning namespaces.
[   92.215820][  T182] nvme nvme3: rescanning namespaces.
[   92.221038][ T5899] nvme nvme1: rescanning namespaces.
[   92.224363][   T66] nvme nvme0: rescanning namespaces.
[   92.233700][ T6064] nvme nvme2: rescanning namespaces.
[   92.294189][ T6064] nvme nvme2: rescanning namespaces.
[   92.299932][  T182] nvme nvme3: rescanning namespaces.
[   92.352952][ T6064] nvme nvme2: rescanning namespaces.
[   92.358010][ T5899] nvme nvme1: rescanning namespaces.
[   92.383029][   T66] nvme nvme0: rescanning namespaces.
[   92.407587][   T35] nvme nvme3: rescanning namespaces.
[   92.432756][ T5899] nvme nvme1: rescanning namespaces.
[   92.432905][   T66] nvme nvme0: rescanning namespaces.
[   92.444922][ T6064] nvme nvme2: rescanning namespaces.
[   92.447207][   T35] nvme nvme3: rescanning namespaces.
[   92.463743][   T55] nvme nvme3: rescanning namespaces.
[   92.488640][   T66] nvme nvme0: rescanning namespaces.
[   92.495841][ T5899] nvme nvme1: rescanning namespaces.
[   92.523915][ T6064] nvme nvme2: rescanning namespaces.
[   92.563581][ T1114] nvme nvme2: rescanning namespaces.
[   92.583489][   T55] nvme nvme3: rescanning namespaces.
[   92.584471][ T5856] nvme0c3n2: I/O Cmd(0x2) @ LBA 4094, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   92.584487][ T5856] I/O error, dev nvme0c3n2, sector 32752 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   92.612656][   T66] nvme nvme0: rescanning namespaces.
[   92.615783][   T95] nvme nvme2: rescanning namespaces.
[   92.620303][ T5899] nvme nvme1: rescanning namespaces.
[   92.620974][ T5929] nvme nvme0: rescanning namespaces.
[   92.644550][   T55] nvme nvme3: rescanning namespaces.
[   92.676796][   T95] nvme nvme2: rescanning namespaces.
[   92.685198][ T5929] nvme nvme0: rescanning namespaces.
[   92.692908][ T5899] nvme nvme1: rescanning namespaces.
[   92.731006][   T95] nvme nvme2: rescanning namespaces.
[   92.734430][ T5929] nvme nvme0: rescanning namespaces.
[   92.734645][ T5899] nvme nvme1: rescanning namespaces.
[   92.738887][   T55] nvme nvme3: rescanning namespaces.
[   92.819953][ T5929] nvme nvme0: rescanning namespaces.
[   92.823082][   T55] nvme nvme3: rescanning namespaces.
[   92.830952][ T5899] nvme nvme1: rescanning namespaces.
[   92.844344][   T95] nvme nvme2: rescanning namespaces.
[   92.853374][   T35] nvme nvme1: rescanning namespaces.
[   92.853629][ T1114] nvme nvme0: rescanning namespaces.
[   92.854012][   T55] nvme nvme3: rescanning namespaces.
[   92.904943][ T5858] nvme0c3n1: I/O Cmd(0x2) @ LBA 4080, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   92.904965][ T5858] I/O error, dev nvme0c3n1, sector 32640 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   92.906076][ T6062] block device autoloading is deprecated and will be removed.
[   92.916324][   T95] nvme nvme2: rescanning namespaces.
[   92.937196][ T6063] block device autoloading is deprecated and will be removed.
[   92.946649][   T95] nvme nvme2: rescanning namespaces.
[   92.972718][ T1114] nvme nvme0: rescanning namespaces.
[   92.985158][   T55] nvme nvme3: rescanning namespaces.
[   92.994088][ T5919] nvme_ns_head_submit_bio: 10 callbacks suppressed
[   92.994101][ T5919] block nvme0n1: no usable path - requeuing I/O
[   92.994478][   T28] nvme nvme2: rescanning namespaces.
[   92.994664][   T35] nvme nvme1: rescanning namespaces.
[   93.045857][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.054097][ T1114] nvme nvme0: rescanning namespaces.
[   93.054322][   T55] nvme nvme3: rescanning namespaces.
[   93.063546][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.063564][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.072211][   T55] nvme nvme3: rescanning namespaces.
[   93.072373][ T6064] nvme nvme0: rescanning namespaces.
[   93.122242][   T28] nvme nvme2: rescanning namespaces.
[   93.125136][   T35] nvme nvme1: rescanning namespaces.
[   93.125744][ T5899] nvme nvme3: rescanning namespaces.
[   93.125803][   T55] nvme nvme0: rescanning namespaces.
[   93.222828][   T35] nvme nvme1: rescanning namespaces.
[   93.241748][   T55] nvme nvme0: rescanning namespaces.
[   93.244693][ T5899] nvme nvme3: rescanning namespaces.
[   93.255699][   T35] nvme nvme1: rescanning namespaces.
[   93.266362][   T28] nvme nvme2: rescanning namespaces.
[   93.277849][ T5899] nvme nvme3: rescanning namespaces.
[   93.291544][  T432] nvme nvme0: rescanning namespaces.
[   93.334215][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.334266][ T5858] I/O error, dev nvme0c2n1, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.334709][   T28] nvme nvme2: rescanning namespaces.
[   93.387588][   T28] nvme nvme2: rescanning namespaces.
[   93.396116][   T35] nvme nvme1: rescanning namespaces.
[   93.408557][ T5899] nvme nvme3: rescanning namespaces.
[   93.442523][  T432] nvme nvme0: rescanning namespaces.
[   93.451836][   T28] nvme nvme2: rescanning namespaces.
[   93.483514][ T5858] nvme0c1n1: I/O Cmd(0x2) @ LBA 4046, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.483536][ T5858] I/O error, dev nvme0c1n1, sector 32368 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.485602][   T35] nvme nvme1: rescanning namespaces.
[   93.489810][  T432] nvme nvme0: rescanning namespaces.
[   93.494438][   T28] nvme nvme0: rescanning namespaces.
[   93.494732][ T1121] nvme nvme2: rescanning namespaces.
[   93.523352][ T5899] nvme nvme3: rescanning namespaces.
[   93.530233][   T35] nvme nvme1: rescanning namespaces.
[   93.554571][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4022, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.554605][ T5858] I/O error, dev nvme0c2n1, sector 32176 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.577982][ T5919] block nvme0n1: no usable path - requeuing I/O
[   93.588790][ T1121] nvme nvme2: rescanning namespaces.
[   93.603270][ T5899] nvme nvme3: rescanning namespaces.
[   93.607054][  T182] nvme nvme0: rescanning namespaces.
[   93.607508][ T5919] block nvme0n1: no available path - failing I/O
[   93.607518][ T5919] Buffer I/O error on dev nvme0n1, logical block 4022, async page read
[   93.627331][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   93.633273][ T1112] nvme nvme0: rescanning namespaces.
[   93.634343][  T432] nvme nvme2: rescanning namespaces.
[   93.636470][ T1114] nvme nvme3: rescanning namespaces.
[   93.654618][   T35] nvme nvme1: rescanning namespaces.
[   93.693606][ T5858] nvme0c2n2: I/O Cmd(0x2) @ LBA 4095, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.693631][ T5858] I/O error, dev nvme0c2n2, sector 32760 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.713503][ T1128] nvme nvme0: rescanning namespaces.
[   93.713549][ T1114] nvme nvme3: rescanning namespaces.
[   93.748222][   T35] nvme nvme1: rescanning namespaces.
[   93.750404][  T432] nvme nvme2: rescanning namespaces.
[   93.755462][  T432] nvme nvme2: rescanning namespaces.
[   93.776962][ T1128] nvme nvme0: rescanning namespaces.
[   93.777098][ T1114] nvme nvme3: rescanning namespaces.
[   93.817831][ T5858] block nvme0n2: no usable path - requeuing I/O
[   93.823108][ T5941] nvme0c3n2: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.823129][ T5941] I/O error, dev nvme0c3n2, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.824478][ T1114] nvme nvme3: rescanning namespaces.
[   93.865520][ T1128] nvme nvme0: rescanning namespaces.
[   93.867692][ T5919] block nvme0n2: no usable path - requeuing I/O
[   93.883039][   T35] nvme nvme1: rescanning namespaces.
[   93.886940][  T432] nvme nvme2: rescanning namespaces.
[   93.892808][ T1114] nvme nvme3: rescanning namespaces.
[   93.893869][ T5941] block nvme0n2: no available path - failing I/O
[   93.893887][ T5941] Buffer I/O error on dev nvme0n2, logical block 4063, async page read
[   93.922443][ T1128] nvme nvme0: rescanning namespaces.
[   93.960733][ T6062] block device autoloading is deprecated and will be removed.
[   93.978204][ T1114] nvme nvme3: rescanning namespaces.
[   93.978229][  T432] nvme nvme2: rescanning namespaces.
[   94.002367][   T35] nvme nvme1: rescanning namespaces.
[   94.014656][ T5919] block nvme0n1: no usable path - requeuing I/O
[   94.014689][ T5919] block nvme0n1: no usable path - requeuing I/O
[   94.021831][ T1108] nvme nvme3: rescanning namespaces.
[   94.022006][   T37] nvme nvme2: rescanning namespaces.
[   94.031508][   T35] nvme nvme1: rescanning namespaces.
[   94.035833][ T1128] nvme nvme0: rescanning namespaces.
[   94.108256][ T1108] nvme nvme3: rescanning namespaces.
[   94.109406][   T37] nvme nvme2: rescanning namespaces.
[   94.157535][   T35] nvme nvme1: rescanning namespaces.
[   94.165806][ T1128] nvme nvme0: rescanning namespaces.
[   94.170553][   T37] nvme nvme2: rescanning namespaces.
[   94.215771][   T66] nvme nvme3: rescanning namespaces.
[   94.262790][ T1128] nvme nvme0: rescanning namespaces.
[   94.270902][   T66] nvme nvme3: rescanning namespaces.
[   94.282387][   T35] nvme nvme1: rescanning namespaces.
[   94.292990][ T1108] nvme nvme3: rescanning namespaces.
[   94.317287][ T1128] nvme nvme0: rescanning namespaces.
[   94.322353][ T5941] block nvme0n1: no usable path - requeuing I/O
[   94.328738][   T37] nvme nvme2: rescanning namespaces.
[   94.330981][   T35] nvme nvme1: rescanning namespaces.
[   94.368760][ T1128] nvme nvme0: rescanning namespaces.
[   94.413090][ T1108] nvme nvme3: rescanning namespaces.
[   94.416031][   T37] nvme nvme2: rescanning namespaces.
[   94.426376][ T1128] nvme nvme0: rescanning namespaces.
[   94.428249][   T35] nvme nvme1: rescanning namespaces.
[   94.439497][ T1108] nvme nvme3: rescanning namespaces.
[   94.499766][ T1108] nvme nvme3: rescanning namespaces.
[   94.506050][   T37] nvme nvme2: rescanning namespaces.
[   94.516124][   T35] nvme nvme1: rescanning namespaces.
[   94.544425][ T5899] nvme nvme2: rescanning namespaces.
[   94.552567][ T1128] nvme nvme0: rescanning namespaces.
[   94.568586][ T6013] nvme nvme3: rescanning namespaces.
[   94.568717][   T35] nvme nvme1: rescanning namespaces.
[   94.612598][ T6013] nvme nvme3: rescanning namespaces.
[   94.612653][ T5899] nvme nvme2: rescanning namespaces.
[   94.613996][ T1128] nvme nvme0: rescanning namespaces.
[   94.622288][   T35] nvme nvme1: rescanning namespaces.
[   94.625672][ T5941] block nvme0n1: no available path - failing I/O
[   94.625685][ T5941] Buffer I/O error on dev nvme0n1, logical block 4095, async page read
[   94.663335][ T5899] nvme nvme2: rescanning namespaces.
[   94.663439][ T1128] nvme nvme0: rescanning namespaces.
[   94.663545][ T6013] nvme nvme3: rescanning namespaces.
[   94.716447][   T35] nvme nvme1: rescanning namespaces.
[   94.725417][   T35] nvme nvme1: rescanning namespaces.
[   94.753957][ T6013] nvme nvme3: rescanning namespaces.
[   94.761772][ T1128] nvme nvme0: rescanning namespaces.
[   94.762559][ T5899] nvme nvme2: rescanning namespaces.
[   94.793369][   T95] nvme nvme1: rescanning namespaces.
[   94.842332][ T5899] nvme nvme2: rescanning namespaces.
[   94.850133][ T6013] nvme nvme3: rescanning namespaces.
[   94.855055][ T6013] nvme nvme3: rescanning namespaces.
[   94.855216][ T1128] nvme nvme0: rescanning namespaces.
[   94.868103][ T5899] nvme nvme2: rescanning namespaces.
[   94.886011][   T95] nvme nvme1: rescanning namespaces.
[   94.898883][   T11] block nvme0n2: no available path - failing I/O
[   94.898897][   T11] Buffer I/O error on dev nvme0n2, logical block 7, async page read
[   94.922776][ T5899] nvme nvme2: rescanning namespaces.
[   94.925469][ T5944] udevd[5944]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   94.938276][  T182] nvme nvme3: rescanning namespaces.
[   94.939859][ T1114] nvme nvme0: rescanning namespaces.
[   94.949689][   T37] nvme nvme1: rescanning namespaces.
[   94.968835][ T6063] block device autoloading is deprecated and will be removed.
[   94.977257][ T1114] nvme nvme0: rescanning namespaces.
[   94.984489][ T6062] block device autoloading is deprecated and will be removed.
[   94.993848][  T182] nvme nvme3: rescanning namespaces.
[   95.032454][ T5899] nvme nvme2: rescanning namespaces.
[   95.037785][  T182] nvme nvme3: rescanning namespaces.
[   95.037979][ T1114] nvme nvme0: rescanning namespaces.
[   95.075460][   T37] nvme nvme1: rescanning namespaces.
[   95.109587][  T182] nvme nvme3: rescanning namespaces.
[   95.153316][   T37] nvme nvme1: rescanning namespaces.
[   95.167932][  T182] nvme nvme3: rescanning namespaces.
[   95.208241][ T1114] nvme nvme0: rescanning namespaces.
[   95.224820][ T5899] nvme nvme2: rescanning namespaces.
[   95.228566][ T1114] nvme nvme0: rescanning namespaces.
[   95.277048][ T1114] nvme nvme0: rescanning namespaces.
[   95.278308][ T5899] nvme nvme2: rescanning namespaces.
[   95.281765][  T182] nvme nvme3: rescanning namespaces.
[   95.285636][   T37] nvme nvme1: rescanning namespaces.
[   95.367812][ T1114] nvme nvme0: rescanning namespaces.
[   95.376330][ T5899] nvme nvme2: rescanning namespaces.
[   95.382389][   T37] nvme nvme1: rescanning namespaces.
[   95.383193][  T182] nvme nvme3: rescanning namespaces.
[   95.432845][ T6013] nvme nvme0: rescanning namespaces.
[   95.432918][   T95] nvme nvme2: rescanning namespaces.
[   95.432953][ T6064] nvme nvme1: rescanning namespaces.
[   95.457573][  T182] nvme nvme3: rescanning namespaces.
[   95.505854][   T95] nvme nvme2: rescanning namespaces.
[   95.521417][ T6064] nvme nvme1: rescanning namespaces.
[   95.573402][ T1108] nvme nvme1: rescanning namespaces.
[   95.573505][ T6013] nvme nvme0: rescanning namespaces.
[   95.576659][  T182] nvme nvme3: rescanning namespaces.
[   95.619502][ T1114] nvme nvme2: rescanning namespaces.
[   95.683715][ T6013] nvme nvme0: rescanning namespaces.
[   95.684747][ T1114] nvme nvme2: rescanning namespaces.
[   95.699195][  T182] nvme nvme3: rescanning namespaces.
[   95.734994][   T28] nvme nvme3: rescanning namespaces.
[   95.735928][ T1108] nvme nvme1: rescanning namespaces.
[   95.748076][ T6013] nvme nvme0: rescanning namespaces.
[   95.749045][ T1114] nvme nvme2: rescanning namespaces.
[   95.827640][   T28] nvme nvme3: rescanning namespaces.
[   95.833126][ T1108] nvme nvme1: rescanning namespaces.
[   95.842709][ T1114] nvme nvme2: rescanning namespaces.
[   95.847230][ T6013] nvme nvme0: rescanning namespaces.
[   95.887069][   T28] nvme nvme3: rescanning namespaces.
[   95.888463][ T1108] nvme nvme1: rescanning namespaces.
[   95.913992][ T1114] nvme nvme2: rescanning namespaces.
[   95.914402][   T11] block nvme0n1: no available path - failing I/O
[   95.914475][ T5858] block nvme0n1: no available path - failing I/O
[   95.914485][ T5858] Buffer I/O error on dev nvme0n1, logical block 3840, async page read
[   95.936690][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   95.946646][ T1108] nvme nvme1: rescanning namespaces.
[   95.948177][ T6013] nvme nvme0: rescanning namespaces.
[   95.979570][ T1114] nvme nvme2: rescanning namespaces.
[   95.993687][ T1108] nvme nvme0: rescanning namespaces.
[   95.994057][ T1121] nvme nvme1: rescanning namespaces.
[   96.012968][   T28] nvme nvme3: rescanning namespaces.
[   96.026611][ T1114] nvme nvme2: rescanning namespaces.
[*] Cleaning up...
[   96.045582][ T5853] nvme nvme0: Removing ctrl: NQN "testnqn"
[   96.293216][ T5853] nvme nvme1: Removing ctrl: NQN "testnqn"
[   96.533400][ T5853] nvme nvme2: Removing ctrl: NQN "testnqn"
 OtherCrashReports:<nil> StraceOutput: TestError:]

map[TruncatedConsoleOutput:[   92.985158][   T55] nvme nvme3: rescanning namespaces.
[   92.994088][ T5919] nvme_ns_head_submit_bio: 10 callbacks suppressed
[   92.994101][ T5919] block nvme0n1: no usable path - requeuing I/O
[   92.994478][   T28] nvme nvme2: rescanning namespaces.
[   92.994664][   T35] nvme nvme1: rescanning namespaces.
[   93.045857][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.054097][ T1114] nvme nvme0: rescanning namespaces.
[   93.054322][   T55] nvme nvme3: rescanning namespaces.
[   93.063546][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.063564][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.072211][   T55] nvme nvme3: rescanning namespaces.
[   93.072373][ T6064] nvme nvme0: rescanning namespaces.
[   93.122242][   T28] nvme nvme2: rescanning namespaces.
[   93.125136][   T35] nvme nvme1: rescanning namespaces.
[   93.125744][ T5899] nvme nvme3: rescanning namespaces.
[   93.125803][   T55] nvme nvme0: rescanning namespaces.
[   93.222828][   T35] nvme nvme1: rescanning namespaces.
[   93.241748][   T55] nvme nvme0: rescanning namespaces.
[   93.244693][ T5899] nvme nvme3: rescanning namespaces.
[   93.255699][   T35] nvme nvme1: rescanning namespaces.
[   93.266362][   T28] nvme nvme2: rescanning namespaces.
[   93.277849][ T5899] nvme nvme3: rescanning namespaces.
[   93.291544][  T432] nvme nvme0: rescanning namespaces.
[   93.334215][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.334266][ T5858] I/O error, dev nvme0c2n1, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.334709][   T28] nvme nvme2: rescanning namespaces.
[   93.387588][   T28] nvme nvme2: rescanning namespaces.
[   93.396116][   T35] nvme nvme1: rescanning namespaces.
[   93.408557][ T5899] nvme nvme3: rescanning namespaces.
[   93.442523][  T432] nvme nvme0: rescanning namespaces.
[   93.451836][   T28] nvme nvme2: rescanning namespaces.
[   93.483514][ T5858] nvme0c1n1: I/O Cmd(0x2) @ LBA 4046, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.483536][ T5858] I/O error, dev nvme0c1n1, sector 32368 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.485602][   T35] nvme nvme1: rescanning namespaces.
[   93.489810][  T432] nvme nvme0: rescanning namespaces.
[   93.494438][   T28] nvme nvme0: rescanning namespaces.
[   93.494732][ T1121] nvme nvme2: rescanning namespaces.
[   93.523352][ T5899] nvme nvme3: rescanning namespaces.
[   93.530233][   T35] nvme nvme1: rescanning namespaces.
[   93.554571][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4022, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.554605][ T5858] I/O error, dev nvme0c2n1, sector 32176 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.577982][ T5919] block nvme0n1: no usable path - requeuing I/O
[   93.588790][ T1121] nvme nvme2: rescanning namespaces.
[   93.603270][ T5899] nvme nvme3: rescanning namespaces.
[   93.607054][  T182] nvme nvme0: rescanning namespaces.
[   93.607508][ T5919] block nvme0n1: no available path - failing I/O
[   93.607518][ T5919] Buffer I/O error on dev nvme0n1, logical block 4022, async page read
[   93.627331][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   93.633273][ T1112] nvme nvme0: rescanning namespaces.
[   93.634343][  T432] nvme nvme2: rescanning namespaces.
[   93.636470][ T1114] nvme nvme3: rescanning namespaces.
[   93.654618][   T35] nvme nvme1: rescanning namespaces.
[   93.693606][ T5858] nvme0c2n2: I/O Cmd(0x2) @ LBA 4095, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.693631][ T5858] I/O error, dev nvme0c2n2, sector 32760 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.713503][ T1128] nvme nvme0: rescanning namespaces.
[   93.713549][ T1114] nvme nvme3: rescanning namespaces.
[   93.748222][   T35] nvme nvme1: rescanning namespaces.
[   93.750404][  T432] nvme nvme2: rescanning namespaces.
[   93.755462][  T432] nvme nvme2: rescanning namespaces.
[   93.776962][ T1128] nvme nvme0: rescanning namespaces.
[   93.777098][ T1114] nvme nvme3: rescanning namespaces.
[   93.817831][ T5858] block nvme0n2: no usable path - requeuing I/O
[   93.823108][ T5941] nvme0c3n2: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.823129][ T5941] I/O error, dev nvme0c3n2, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.824478][ T1114] nvme nvme3: rescanning namespaces.
[   93.865520][ T1128] nvme nvme0: rescanning namespaces.
[   93.867692][ T5919] block nvme0n2: no usable path - requeuing I/O
[   93.883039][   T35] nvme nvme1: rescanning namespaces.
[   93.886940][  T432] nvme nvme2: rescanning namespaces.
[   93.892808][ T1114] nvme nvme3: rescanning namespaces.
[   93.893869][ T5941] block nvme0n2: no available path - failing I/O
[   93.893887][ T5941] Buffer I/O error on dev nvme0n2, logical block 4063, async page read
[   93.922443][ T1128] nvme nvme0: rescanning namespaces.
[   93.960733][ T6062] block device autoloading is deprecated and will be removed.
[   93.978204][ T1114] nvme nvme3: rescanning namespaces.
[   93.978229][  T432] nvme nvme2: rescanning namespaces.
[   94.002367][   T35] nvme nvme1: rescanning namespaces.
[   94.014656][ T5919] block nvme0n1: no usable path - requeuing I/O
[   94.014689][ T5919] block nvme0n1: no usable path - requeuing I/O
[   94.021831][ T1108] nvme nvme3: rescanning namespaces.
[   94.022006][   T37] nvme nvme2: rescanning namespaces.
[   94.031508][   T35] nvme nvme1: rescanning namespaces.
[   94.035833][ T1128] nvme nvme0: rescanning namespaces.
[   94.108256][ T1108] nvme nvme3: rescanning namespaces.
[   94.109406][   T37] nvme nvme2: rescanning namespaces.
[   94.157535][   T35] nvme nvme1: rescanning namespaces.
[   94.165806][ T1128] nvme nvme0: rescanning namespaces.
[   94.170553][   T37] nvme nvme2: rescanning namespaces.
[   94.215771][   T66] nvme nvme3: rescanning namespaces.
[   94.262790][ T1128] nvme nvme0: rescanning namespaces.
[   94.270902][   T66] nvme nvme3: rescanning namespaces.
[   94.282387][   T35] nvme nvme1: rescanning namespaces.
[   94.292990][ T1108] nvme nvme3: rescanning namespaces.
[   94.317287][ T1128] nvme nvme0: rescanning namespaces.
[   94.322353][ T5941] block nvme0n1: no usable path - requeuing I/O
[   94.328738][   T37] nvme nvme2: rescanning namespaces.
[   94.330981][   T35] nvme nvme1: rescanning namespaces.
[   94.368760][ T1128] nvme nvme0: rescanning namespaces.
[   94.413090][ T1108] nvme nvme3: rescanning namespaces.
[   94.416031][   T37] nvme nvme2: rescanning namespaces.
[   94.426376][ T1128] nvme nvme0: rescanning namespaces.
[   94.428249][   T35] nvme nvme1: rescanning namespaces.
[   94.439497][ T1108] nvme nvme3: rescanning namespaces.
[   94.499766][ T1108] nvme nvme3: rescanning namespaces.
[   94.506050][   T37] nvme nvme2: rescanning namespaces.
[   94.516124][   T35] nvme nvme1: rescanning namespaces.
[   94.544425][ T5899] nvme nvme2: rescanning namespaces.
[   94.552567][ T1128] nvme nvme0: rescanning namespaces.
[   94.568586][ T6013] nvme nvme3: rescanning namespaces.
[   94.568717][   T35] nvme nvme1: rescanning namespaces.
[   94.612598][ T6013] nvme nvme3: rescanning namespaces.
[   94.612653][ T5899] nvme nvme2: rescanning namespaces.
[   94.613996][ T1128] nvme nvme0: rescanning namespaces.
[   94.622288][   T35] nvme nvme1: rescanning namespaces.
[   94.625672][ T5941] block nvme0n1: no available path - failing I/O
[   94.625685][ T5941] Buffer I/O error on dev nvme0n1, logical block 4095, async page read
[   94.663335][ T5899] nvme nvme2: rescanning namespaces.
[   94.663439][ T1128] nvme nvme0: rescanning namespaces.
[   94.663545][ T6013] nvme nvme3: rescanning namespaces.
[   94.716447][   T35] nvme nvme1: rescanning namespaces.
[   94.725417][   T35] nvme nvme1: rescanning namespaces.
[   94.753957][ T6013] nvme nvme3: rescanning namespaces.
[   94.761772][ T1128] nvme nvme0: rescanning namespaces.
[   94.762559][ T5899] nvme nvme2: rescanning namespaces.
[   94.793369][   T95] nvme nvme1: rescanning namespaces.
[   94.842332][ T5899] nvme nvme2: rescanning namespaces.
[   94.850133][ T6013] nvme nvme3: rescanning namespaces.
[   94.855055][ T6013] nvme nvme3: rescanning namespaces.
[   94.855216][ T1128] nvme nvme0: rescanning namespaces.
[   94.868103][ T5899] nvme nvme2: rescanning namespaces.
[   94.886011][   T95] nvme nvme1: rescanning namespaces.
[   94.898883][   T11] block nvme0n2: no available path - failing I/O
[   94.898897][   T11] Buffer I/O error on dev nvme0n2, logical block 7, async page read
[   94.922776][ T5899] nvme nvme2: rescanning namespaces.
[   94.925469][ T5944] udevd[5944]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   94.938276][  T182] nvme nvme3: rescanning namespaces.
[   94.939859][ T1114] nvme nvme0: rescanning namespaces.
[   94.949689][   T37] nvme nvme1: rescanning namespaces.
[   94.968835][ T6063] block device autoloading is deprecated and will be removed.
[   94.977257][ T1114] nvme nvme0: rescanning namespaces.
[   94.984489][ T6062] block device autoloading is deprecated and will be removed.
[   94.993848][  T182] nvme nvme3: rescanning namespaces.
[   95.032454][ T5899] nvme nvme2: rescanning namespaces.
[   95.037785][  T182] nvme nvme3: rescanning namespaces.
[   95.037979][ T1114] nvme nvme0: rescanning namespaces.
[   95.075460][   T37] nvme nvme1: rescanning namespaces.
[   95.109587][  T182] nvme nvme3: rescanning namespaces.
[   95.153316][   T37] nvme nvme1: rescanning namespaces.
[   95.167932][  T182] nvme nvme3: rescanning namespaces.
[   95.208241][ T1114] nvme nvme0: rescanning namespaces.
[   95.224820][ T5899] nvme nvme2: rescanning namespaces.
[   95.228566][ T1114] nvme nvme0: rescanning namespaces.
[   95.277048][ T1114] nvme nvme0: rescanning namespaces.
[   95.278308][ T5899] nvme nvme2: rescanning namespaces.
[   95.281765][  T182] nvme nvme3: rescanning namespaces.
[   95.285636][   T37] nvme nvme1: rescanning namespaces.
[   95.367812][ T1114] nvme nvme0: rescanning namespaces.
[   95.376330][ T5899] nvme nvme2: rescanning namespaces.
[   95.382389][   T37] nvme nvme1: rescanning namespaces.
[   95.383193][  T182] nvme nvme3: rescanning namespaces.
[   95.432845][ T6013] nvme nvme0: rescanning namespaces.
[   95.432918][   T95] nvme nvme2: rescanning namespaces.
[   95.432953][ T6064] nvme nvme1: rescanning namespaces.
[   95.457573][  T182] nvme nvme3: rescanning namespaces.
[   95.505854][   T95] nvme nvme2: rescanning namespaces.
[   95.521417][ T6064] nvme nvme1: rescanning namespaces.
[   95.573402][ T1108] nvme nvme1: rescanning namespaces.
[   95.573505][ T6013] nvme nvme0: rescanning namespaces.
[   95.576659][  T182] nvme nvme3: rescanning namespaces.
[   95.619502][ T1114] nvme nvme2: rescanning namespaces.
[   95.683715][ T6013] nvme nvme0: rescanning namespaces.
[   95.684747][ T1114] nvme nvme2: rescanning namespaces.
[   95.699195][  T182] nvme nvme3: rescanning namespaces.
[   95.734994][   T28] nvme nvme3: rescanning namespaces.
[   95.735928][ T1108] nvme nvme1: rescanning namespaces.
[   95.748076][ T6013] nvme nvme0: rescanning namespaces.
[   95.749045][ T1114] nvme nvme2: rescanning namespaces.
[   95.827640][   T28] nvme nvme3: rescanning namespaces.
[   95.833126][ T1108] nvme nvme1: rescanning namespaces.
[   95.842709][ T1114] nvme nvme2: rescanning namespaces.
[   95.847230][ T6013] nvme nvme0: rescanning namespaces.
[   95.887069][   T28] nvme nvme3: rescanning namespaces.
[   95.888463][ T1108] nvme nvme1: rescanning namespaces.
[   95.913992][ T1114] nvme nvme2: rescanning namespaces.
[   95.914402][   T11] block nvme0n1: no available path - failing I/O
[   95.914475][ T5858] block nvme0n1: no available path - failing I/O
[   95.914485][ T5858] Buffer I/O error on dev nvme0n1, logical block 3840, async page read
[   95.936690][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   95.946646][ T1108] nvme nvme1: rescanning namespaces.
[   95.948177][ T6013] nvme nvme0: rescanning namespaces.
[   95.979570][ T1114] nvme nvme2: rescanning namespaces.
[   95.993687][ T1108] nvme nvme0: rescanning namespaces.
[   95.994057][ T1121] nvme nvme1: rescanning namespaces.
[   96.012968][   T28] nvme nvme3: rescanning namespaces.
[   96.026611][ T1114] nvme nvme2: rescanning namespaces.
[*] Cleaning up...
[   96.045582][ T5853] nvme nvme0: Removing ctrl: NQN "testnqn"
[   96.293216][ T5853] nvme nvme1: Removing ctrl: NQN "testnqn"
[   96.533400][ T5853] nvme nvme2: Removing ctrl: NQN "testnqn"
 TruncatedCrashReport:=====================================
WARNING: bad unlock balance detected!
syzkaller #1 Not tainted
-------------------------------------
kworker/u10:5/1108 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff8664416f>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff8664416f>] nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u10:5/1108: 2, last CPU#1:
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 1108 Comm: kworker/u10:5 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme0: rescanning namespaces.
 TruncatedStraceOutput:]

deep-reasoning

map[Feedback:The execution successfully triggered a crash that matches the expected bug. The crash report shows a `WARNING: bad unlock balance detected!` in `nvme_update_ns_info` at `blk_mq_unfreeze_queue`, which is exactly the same signature as the original bug description. The reproducer is working correctly and successfully triggers the target vulnerability. ProbePassed:false TerminalError: TitleMatches:true]

You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.

=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
   that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
   meaning the codebase version is mismatched and the target code is absent.

=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
  or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.


=== PHASE 2: BUG REPRODUCTION (EVALUATION) ===
The executed program was a full reproducer candidate attempting to trigger the target bug/crash.
Use this to guide your classification and feedback:
1. If a crash was triggered (Reproduced is true):
   - Determine if the triggered crash matches the expected bug.
   - If you conclude they represent the same underlying bug (the same root cause)
     despite different titles, crash signatures, or call traces, set TitleMatches
     to true and provide a detailed, technical, and verbose explanation of the
     equivalence in the 'Feedback' field.
   - If they do not represent the same bug (a completely unrelated crash/collision),
     set TitleMatches to false and explain the collision in 'Feedback'.
   - If they match exactly, set TitleMatches to true and provide a brief confirmation in 'Feedback'.
2. If the execution was successful (exit 0) WITHOUT a crash (Reproduced is false):
   - The reproduction attempt failed to trigger the bug. Analyze the console/strace output
     to understand why the bug did not trigger (e.g., timing, input arguments, environment setup)
     and provide feedback on how to improve the reproducer logic to trigger the crash.

Critical Diagnostic Rule for Reproduction Failures:
If the reproduction attempt fails (e.g., a system call returns an error, or a
warning/error message appears in the console log), you MUST:
1. Identify the failing system call from the execution trace or strace output.
2. Identify any corresponding warning or error messages in the console log.
3. Provide a clear technical diagnosis in the feedback identifying the failing call,
   return code (errno), and error messages so the strategy-refiner can analyze the root cause.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: WARNING: bad unlock balance in nvme_update_ns_info

=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

IsProbe: false
Reproduced: true
Console Output: [   92.985158][   T55] nvme nvme3: rescanning namespaces.
[   92.994088][ T5919] nvme_ns_head_submit_bio: 10 callbacks suppressed
[   92.994101][ T5919] block nvme0n1: no usable path - requeuing I/O
[   92.994478][   T28] nvme nvme2: rescanning namespaces.
[   92.994664][   T35] nvme nvme1: rescanning namespaces.
[   93.045857][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.054097][ T1114] nvme nvme0: rescanning namespaces.
[   93.054322][   T55] nvme nvme3: rescanning namespaces.
[   93.063546][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.063564][  T193] block nvme0n1: no usable path - requeuing I/O
[   93.072211][   T55] nvme nvme3: rescanning namespaces.
[   93.072373][ T6064] nvme nvme0: rescanning namespaces.
[   93.122242][   T28] nvme nvme2: rescanning namespaces.
[   93.125136][   T35] nvme nvme1: rescanning namespaces.
[   93.125744][ T5899] nvme nvme3: rescanning namespaces.
[   93.125803][   T55] nvme nvme0: rescanning namespaces.
[   93.222828][   T35] nvme nvme1: rescanning namespaces.
[   93.241748][   T55] nvme nvme0: rescanning namespaces.
[   93.244693][ T5899] nvme nvme3: rescanning namespaces.
[   93.255699][   T35] nvme nvme1: rescanning namespaces.
[   93.266362][   T28] nvme nvme2: rescanning namespaces.
[   93.277849][ T5899] nvme nvme3: rescanning namespaces.
[   93.291544][  T432] nvme nvme0: rescanning namespaces.
[   93.334215][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.334266][ T5858] I/O error, dev nvme0c2n1, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.334709][   T28] nvme nvme2: rescanning namespaces.
[   93.387588][   T28] nvme nvme2: rescanning namespaces.
[   93.396116][   T35] nvme nvme1: rescanning namespaces.
[   93.408557][ T5899] nvme nvme3: rescanning namespaces.
[   93.442523][  T432] nvme nvme0: rescanning namespaces.
[   93.451836][   T28] nvme nvme2: rescanning namespaces.
[   93.483514][ T5858] nvme0c1n1: I/O Cmd(0x2) @ LBA 4046, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.483536][ T5858] I/O error, dev nvme0c1n1, sector 32368 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.485602][   T35] nvme nvme1: rescanning namespaces.
[   93.489810][  T432] nvme nvme0: rescanning namespaces.
[   93.494438][   T28] nvme nvme0: rescanning namespaces.
[   93.494732][ T1121] nvme nvme2: rescanning namespaces.
[   93.523352][ T5899] nvme nvme3: rescanning namespaces.
[   93.530233][   T35] nvme nvme1: rescanning namespaces.
[   93.554571][ T5858] nvme0c2n1: I/O Cmd(0x2) @ LBA 4022, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.554605][ T5858] I/O error, dev nvme0c2n1, sector 32176 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.577982][ T5919] block nvme0n1: no usable path - requeuing I/O
[   93.588790][ T1121] nvme nvme2: rescanning namespaces.
[   93.603270][ T5899] nvme nvme3: rescanning namespaces.
[   93.607054][  T182] nvme nvme0: rescanning namespaces.
[   93.607508][ T5919] block nvme0n1: no available path - failing I/O
[   93.607518][ T5919] Buffer I/O error on dev nvme0n1, logical block 4022, async page read
[   93.627331][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   93.633273][ T1112] nvme nvme0: rescanning namespaces.
[   93.634343][  T432] nvme nvme2: rescanning namespaces.
[   93.636470][ T1114] nvme nvme3: rescanning namespaces.
[   93.654618][   T35] nvme nvme1: rescanning namespaces.
[   93.693606][ T5858] nvme0c2n2: I/O Cmd(0x2) @ LBA 4095, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.693631][ T5858] I/O error, dev nvme0c2n2, sector 32760 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.713503][ T1128] nvme nvme0: rescanning namespaces.
[   93.713549][ T1114] nvme nvme3: rescanning namespaces.
[   93.748222][   T35] nvme nvme1: rescanning namespaces.
[   93.750404][  T432] nvme nvme2: rescanning namespaces.
[   93.755462][  T432] nvme nvme2: rescanning namespaces.
[   93.776962][ T1128] nvme nvme0: rescanning namespaces.
[   93.777098][ T1114] nvme nvme3: rescanning namespaces.
[   93.817831][ T5858] block nvme0n2: no usable path - requeuing I/O
[   93.823108][ T5941] nvme0c3n2: I/O Cmd(0x2) @ LBA 4063, 1 blocks, I/O Error (sct 0x3 / sc 0x0) MORE 
[   93.823129][ T5941] I/O error, dev nvme0c3n2, sector 32504 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2
[   93.824478][ T1114] nvme nvme3: rescanning namespaces.
[   93.865520][ T1128] nvme nvme0: rescanning namespaces.
[   93.867692][ T5919] block nvme0n2: no usable path - requeuing I/O
[   93.883039][   T35] nvme nvme1: rescanning namespaces.
[   93.886940][  T432] nvme nvme2: rescanning namespaces.
[   93.892808][ T1114] nvme nvme3: rescanning namespaces.
[   93.893869][ T5941] block nvme0n2: no available path - failing I/O
[   93.893887][ T5941] Buffer I/O error on dev nvme0n2, logical block 4063, async page read
[   93.922443][ T1128] nvme nvme0: rescanning namespaces.
[   93.960733][ T6062] block device autoloading is deprecated and will be removed.
[   93.978204][ T1114] nvme nvme3: rescanning namespaces.
[   93.978229][  T432] nvme nvme2: rescanning namespaces.
[   94.002367][   T35] nvme nvme1: rescanning namespaces.
[   94.014656][ T5919] block nvme0n1: no usable path - requeuing I/O
[   94.014689][ T5919] block nvme0n1: no usable path - requeuing I/O
[   94.021831][ T1108] nvme nvme3: rescanning namespaces.
[   94.022006][   T37] nvme nvme2: rescanning namespaces.
[   94.031508][   T35] nvme nvme1: rescanning namespaces.
[   94.035833][ T1128] nvme nvme0: rescanning namespaces.
[   94.108256][ T1108] nvme nvme3: rescanning namespaces.
[   94.109406][   T37] nvme nvme2: rescanning namespaces.
[   94.157535][   T35] nvme nvme1: rescanning namespaces.
[   94.165806][ T1128] nvme nvme0: rescanning namespaces.
[   94.170553][   T37] nvme nvme2: rescanning namespaces.
[   94.215771][   T66] nvme nvme3: rescanning namespaces.
[   94.262790][ T1128] nvme nvme0: rescanning namespaces.
[   94.270902][   T66] nvme nvme3: rescanning namespaces.
[   94.282387][   T35] nvme nvme1: rescanning namespaces.
[   94.292990][ T1108] nvme nvme3: rescanning namespaces.
[   94.317287][ T1128] nvme nvme0: rescanning namespaces.
[   94.322353][ T5941] block nvme0n1: no usable path - requeuing I/O
[   94.328738][   T37] nvme nvme2: rescanning namespaces.
[   94.330981][   T35] nvme nvme1: rescanning namespaces.
[   94.368760][ T1128] nvme nvme0: rescanning namespaces.
[   94.413090][ T1108] nvme nvme3: rescanning namespaces.
[   94.416031][   T37] nvme nvme2: rescanning namespaces.
[   94.426376][ T1128] nvme nvme0: rescanning namespaces.
[   94.428249][   T35] nvme nvme1: rescanning namespaces.
[   94.439497][ T1108] nvme nvme3: rescanning namespaces.
[   94.499766][ T1108] nvme nvme3: rescanning namespaces.
[   94.506050][   T37] nvme nvme2: rescanning namespaces.
[   94.516124][   T35] nvme nvme1: rescanning namespaces.
[   94.544425][ T5899] nvme nvme2: rescanning namespaces.
[   94.552567][ T1128] nvme nvme0: rescanning namespaces.
[   94.568586][ T6013] nvme nvme3: rescanning namespaces.
[   94.568717][   T35] nvme nvme1: rescanning namespaces.
[   94.612598][ T6013] nvme nvme3: rescanning namespaces.
[   94.612653][ T5899] nvme nvme2: rescanning namespaces.
[   94.613996][ T1128] nvme nvme0: rescanning namespaces.
[   94.622288][   T35] nvme nvme1: rescanning namespaces.
[   94.625672][ T5941] block nvme0n1: no available path - failing I/O
[   94.625685][ T5941] Buffer I/O error on dev nvme0n1, logical block 4095, async page read
[   94.663335][ T5899] nvme nvme2: rescanning namespaces.
[   94.663439][ T1128] nvme nvme0: rescanning namespaces.
[   94.663545][ T6013] nvme nvme3: rescanning namespaces.
[   94.716447][   T35] nvme nvme1: rescanning namespaces.
[   94.725417][   T35] nvme nvme1: rescanning namespaces.
[   94.753957][ T6013] nvme nvme3: rescanning namespaces.
[   94.761772][ T1128] nvme nvme0: rescanning namespaces.
[   94.762559][ T5899] nvme nvme2: rescanning namespaces.
[   94.793369][   T95] nvme nvme1: rescanning namespaces.
[   94.842332][ T5899] nvme nvme2: rescanning namespaces.
[   94.850133][ T6013] nvme nvme3: rescanning namespaces.
[   94.855055][ T6013] nvme nvme3: rescanning namespaces.
[   94.855216][ T1128] nvme nvme0: rescanning namespaces.
[   94.868103][ T5899] nvme nvme2: rescanning namespaces.
[   94.886011][   T95] nvme nvme1: rescanning namespaces.
[   94.898883][   T11] block nvme0n2: no available path - failing I/O
[   94.898897][   T11] Buffer I/O error on dev nvme0n2, logical block 7, async page read
[   94.922776][ T5899] nvme nvme2: rescanning namespaces.
[   94.925469][ T5944] udevd[5944]: inotify_add_watch(7, /dev/nvme0n2, 10) failed: No such file or directory
[   94.938276][  T182] nvme nvme3: rescanning namespaces.
[   94.939859][ T1114] nvme nvme0: rescanning namespaces.
[   94.949689][   T37] nvme nvme1: rescanning namespaces.
[   94.968835][ T6063] block device autoloading is deprecated and will be removed.
[   94.977257][ T1114] nvme nvme0: rescanning namespaces.
[   94.984489][ T6062] block device autoloading is deprecated and will be removed.
[   94.993848][  T182] nvme nvme3: rescanning namespaces.
[   95.032454][ T5899] nvme nvme2: rescanning namespaces.
[   95.037785][  T182] nvme nvme3: rescanning namespaces.
[   95.037979][ T1114] nvme nvme0: rescanning namespaces.
[   95.075460][   T37] nvme nvme1: rescanning namespaces.
[   95.109587][  T182] nvme nvme3: rescanning namespaces.
[   95.153316][   T37] nvme nvme1: rescanning namespaces.
[   95.167932][  T182] nvme nvme3: rescanning namespaces.
[   95.208241][ T1114] nvme nvme0: rescanning namespaces.
[   95.224820][ T5899] nvme nvme2: rescanning namespaces.
[   95.228566][ T1114] nvme nvme0: rescanning namespaces.
[   95.277048][ T1114] nvme nvme0: rescanning namespaces.
[   95.278308][ T5899] nvme nvme2: rescanning namespaces.
[   95.281765][  T182] nvme nvme3: rescanning namespaces.
[   95.285636][   T37] nvme nvme1: rescanning namespaces.
[   95.367812][ T1114] nvme nvme0: rescanning namespaces.
[   95.376330][ T5899] nvme nvme2: rescanning namespaces.
[   95.382389][   T37] nvme nvme1: rescanning namespaces.
[   95.383193][  T182] nvme nvme3: rescanning namespaces.
[   95.432845][ T6013] nvme nvme0: rescanning namespaces.
[   95.432918][   T95] nvme nvme2: rescanning namespaces.
[   95.432953][ T6064] nvme nvme1: rescanning namespaces.
[   95.457573][  T182] nvme nvme3: rescanning namespaces.
[   95.505854][   T95] nvme nvme2: rescanning namespaces.
[   95.521417][ T6064] nvme nvme1: rescanning namespaces.
[   95.573402][ T1108] nvme nvme1: rescanning namespaces.
[   95.573505][ T6013] nvme nvme0: rescanning namespaces.
[   95.576659][  T182] nvme nvme3: rescanning namespaces.
[   95.619502][ T1114] nvme nvme2: rescanning namespaces.
[   95.683715][ T6013] nvme nvme0: rescanning namespaces.
[   95.684747][ T1114] nvme nvme2: rescanning namespaces.
[   95.699195][  T182] nvme nvme3: rescanning namespaces.
[   95.734994][   T28] nvme nvme3: rescanning namespaces.
[   95.735928][ T1108] nvme nvme1: rescanning namespaces.
[   95.748076][ T6013] nvme nvme0: rescanning namespaces.
[   95.749045][ T1114] nvme nvme2: rescanning namespaces.
[   95.827640][   T28] nvme nvme3: rescanning namespaces.
[   95.833126][ T1108] nvme nvme1: rescanning namespaces.
[   95.842709][ T1114] nvme nvme2: rescanning namespaces.
[   95.847230][ T6013] nvme nvme0: rescanning namespaces.
[   95.887069][   T28] nvme nvme3: rescanning namespaces.
[   95.888463][ T1108] nvme nvme1: rescanning namespaces.
[   95.913992][ T1114] nvme nvme2: rescanning namespaces.
[   95.914402][   T11] block nvme0n1: no available path - failing I/O
[   95.914475][ T5858] block nvme0n1: no available path - failing I/O
[   95.914485][ T5858] Buffer I/O error on dev nvme0n1, logical block 3840, async page read
[   95.936690][ T5858] udevd[5858]: inotify_add_watch(7, /dev/nvme0n1, 10) failed: No such file or directory
[   95.946646][ T1108] nvme nvme1: rescanning namespaces.
[   95.948177][ T6013] nvme nvme0: rescanning namespaces.
[   95.979570][ T1114] nvme nvme2: rescanning namespaces.
[   95.993687][ T1108] nvme nvme0: rescanning namespaces.
[   95.994057][ T1121] nvme nvme1: rescanning namespaces.
[   96.012968][   T28] nvme nvme3: rescanning namespaces.
[   96.026611][ T1114] nvme nvme2: rescanning namespaces.
[*] Cleaning up...
[   96.045582][ T5853] nvme nvme0: Removing ctrl: NQN "testnqn"
[   96.293216][ T5853] nvme nvme1: Removing ctrl: NQN "testnqn"
[   96.533400][ T5853] nvme nvme2: Removing ctrl: NQN "testnqn"

Strace Output: 
Crash Report: =====================================
WARNING: bad unlock balance detected!
syzkaller #1 Not tainted
-------------------------------------
kworker/u10:5/1108 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff8664416f>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff8664416f>] nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u10:5/1108: 2, last CPU#1:
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 1108 Comm: kworker/u10:5 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme0: rescanning namespaces.

gemini-3.1-pro-preview

							input: 9982
							output: 103
							thoughts: 406
						

**Analysis of Kernel Bug Reproducer Execution**

My current task is to meticulously analyze the results from running a C program that was specifically designed to reproduce a known kernel bug. This bug is characterized by a `WARNING: bad unlock balance in nvme_update_ns_info`.

Upon executing the generated program, I observed a crash report that precisely mirrors the described bug. The output clearly states:

```
WARNING: bad unlock balance detected!
syzkaller #1 Not tainted
-------------------------------------
kworker/u10:5/1108 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff8664416f>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff8664416f>] nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!
```

This report directly confirms the presence of a `WARNING: bad unlock balance detected!` originating from within the `nvme_update_ns_info` function, specifically at the `blk_mq_unfreeze_queue` call site. This aligns perfectly with the initial bug description, leaving no doubt that the intended bug has been triggered.

Given this direct correlation, I can confidently ascertain that:
*   The program was not intended as a probe (`IsProbe: false`).
*   The bug was indeed reproduced (`Reproduced: true`).
*   The outcome warrants detailed feedback confirming the successful reproduction.
*   The `ProbePassed` status should be set to `false`, as this was not a probe execution.
*   There was no overarching terminal error in the process beyond the expected bug manifestation, so `TerminalError` will be empty.
*   The observed crash signature definitively matches the `TitleMatches` the expected bug description.

Therefore, I will formulate my feedback to clearly state: "The execution successfully triggered a crash that matches the expected bug. The crash report shows a `WARNING: bad unlock balance detected!` in `nvme_update_ns_info` at `blk_mq_unfreeze_queue`, which is exactly the same signature as the original bug description. The reproducer is working correctly."

map[Feedback:The execution successfully triggered a crash that matches the expected bug. The crash report shows a `WARNING: bad unlock balance detected!` in `nvme_update_ns_info` at `blk_mq_unfreeze_queue`, which is exactly the same signature as the original bug description. The reproducer is working correctly and successfully triggers the target vulnerability. ProbePassed:false TerminalError: TitleMatches:true]

map[Feedback:The execution successfully triggered a crash that matches the expected bug. The crash report shows a `WARNING: bad unlock balance detected!` in `nvme_update_ns_info` at `blk_mq_unfreeze_queue`, which is exactly the same signature as the original bug description. The reproducer is working correctly and successfully triggers the target vulnerability. ProbePassed:false TerminalError: TitleMatches:true]

map[CapabilitiesVerified:true ContinueSignal: EquivalenceAnalysis:The execution successfully triggered a crash that matches the expected bug. The crash report shows a `WARNING: bad unlock balance detected!` in `nvme_update_ns_info` at `blk_mq_unfreeze_queue`, which is exactly the same signature as the original bug description. The reproducer is working correctly and successfully triggers the target vulnerability. OracleFeedback:The execution successfully triggered a crash that matches the expected bug. The crash report shows a `WARNING: bad unlock balance detected!` in `nvme_update_ns_info` at `blk_mq_unfreeze_queue`, which is exactly the same signature as the original bug description. The reproducer is working correctly and successfully triggers the target vulnerability. ReproC:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }

#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>

void check_mkdir(const char *path) {
    if (mkdir(path, 0755) < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir %s: %s\n", path, strerror(errno));
        exit(1);
    }
}

void check_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, data, strlen(data)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
}

void try_write_file(const char *path, const char *data) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, data, strlen(data)) < 0) {
            // ignore
        }
        close(fd);
    }
}

void setup_nvmet() {
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/attr_allow_any_host", "1");
    check_mkdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");

    int fd = open("/tmp/nvme_backing", O_RDWR | O_CREAT, 0644);
    if (fd < 0) {
        printf("[-] Failed to open /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    if (ftruncate(fd, 16 * 1024 * 1024) < 0) {
        printf("[-] Failed to ftruncate /tmp/nvme_backing: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);

    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/device_path", "/tmp/nvme_backing");
    check_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "1");

    check_mkdir("/sys/kernel/config/nvmet/ports/1");
    check_write_file("/sys/kernel/config/nvmet/ports/1/addr_trtype", "loop");
    
    if (symlink("/sys/kernel/config/nvmet/subsystems/testnqn", "/sys/kernel/config/nvmet/ports/1/subsystems/testnqn") < 0 && errno != EEXIST) {
        printf("[-] Failed to symlink: %s\n", strerror(errno));
        exit(1);
    }
    
    // Connect 4 controllers to the same subsystem to maximize concurrent nvme_alloc_ns
    for (int i = 0; i < 4; i++) {
        int fd = open("/dev/nvme-fabrics", O_RDWR);
        if (fd >= 0) {
            if (write(fd, "nqn=testnqn,transport=loop", 26) < 0) {
                // ignore
            }
            close(fd);
        }
    }
    
    // Wait a bit for controllers to connect and scan
    sleep(2);
    printf("[+] setup_nvmet successful.\n");
}

void teardown_nvmet() {
    // Delete controllers
    for (int i = 0; i < 16; i++) {
        char path[256];
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/delete_controller", i);
        try_write_file(path, "1");
    }
    unlink("/sys/kernel/config/nvmet/ports/1/subsystems/testnqn");
    rmdir("/sys/kernel/config/nvmet/ports/1");
    try_write_file("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", "0");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1");
    rmdir("/sys/kernel/config/nvmet/subsystems/testnqn");
    unlink("/tmp/nvme_backing");
}

volatile int stop = 0;

void* toggle_ns_thread(void* arg) {
    int fd = open("/sys/kernel/config/nvmet/subsystems/testnqn/namespaces/1/enable", O_WRONLY);
    if (fd < 0) return NULL;

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        if (pwrite(fd, "0\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process removal
        if (pwrite(fd, "1\n", 2, 0) < 0) {}
        usleep(50000); // 50ms to allow host to process addition
    }
    close(fd);
    return NULL;
}

void* rescan_thread(void* arg) {
    int fds[16];
    int num_fds = 0;
    char path[256];

    for (int i = 0; i < 16; i++) {
        snprintf(path, sizeof(path), "/sys/class/nvme/nvme%d/rescan_controller", i);
        int fd = open(path, O_WRONLY);
        if (fd >= 0) {
            fds[num_fds++] = fd;
        }
    }

    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < num_fds; i++) {
            if (pwrite(fds[i], "1\n", 2, 0) < 0) {}
        }
        usleep(1000);
    }

    for (int i = 0; i < num_fds; i++) {
        close(fds[i]);
    }
    return NULL;
}

void* open_close_thread(void* arg) {
    char path[256];
    while (!__atomic_load_n(&stop, __ATOMIC_RELAXED)) {
        for (int i = 0; i < 4; i++) {
            snprintf(path, sizeof(path), "/dev/nvme%dn1", i);
            int fd = open(path, O_RDONLY);
            if (fd >= 0) {
                close(fd);
            }
        }
        usleep(1000);
    }
    return NULL;
}

int main() {
    SETUP_UNBUFFERED_IO();
    setup_nvmet();

    printf("[*] Starting concurrent NVMe namespace toggling, rescans, and opens...\n");

    TIMER_START(start);
    while (TIMER_NOT_EXPIRED(start, 25.0)) {
        pthread_t tt;
        pthread_t rt[2];
        pthread_t ot[2];

        __atomic_store_n(&stop, 0, __ATOMIC_RELAXED);

        pthread_create(&tt, NULL, toggle_ns_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&rt[i], NULL, rescan_thread, NULL);
        for (int i = 0; i < 2; i++)
            pthread_create(&ot[i], NULL, open_close_thread, NULL);

        sleep(5);
        __atomic_store_n(&stop, 1, __ATOMIC_RELAXED);

        pthread_join(tt, NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(rt[i], NULL);
        for (int i = 0; i < 2; i++)
            pthread_join(ot[i], NULL);
    }

    printf("[*] Cleaning up...\n");
    teardown_nvmet();
    sleep(2);
    return 0;
}
 Reproduced:true ReproducedBugTitle:WARNING: bad unlock balance in nvme_update_ns_info ReproducedCrashReport:=====================================
WARNING: bad unlock balance detected!
syzkaller #1 Not tainted
-------------------------------------
kworker/u10:5/1108 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff8664416f>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff8664416f>] nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u10:5/1108: 2, last CPU#1:
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff8881012f7940 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc90006b4fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 1108 Comm: kworker/u10:5 Not tainted syzkaller #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0x9ff/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme0: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme2: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme3: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme1: rescanning namespaces.
nvme nvme0: rescanning namespaces.
]

map[]