possible deadlock in throtl_pending_timer_fn (3)

Status: upstream: reported on 2026/09/17 06:14
Reported-by: syzbot+57d4f59c9de7e9f54572@syzkaller.appspotmail.com
First crash: 37d, last: 22h13m
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in throtl_pending_timer_fn cgroups block 4 syz, C done 12 1481d 1669d 0/29 auto-obsoleted due to no activity on 2023/04/20 01:03
linux-6.1 possible deadlock in throtl_pending_timer_fn (2) 4 1 657d 657d 0/3 auto-obsoleted due to no activity on 2025/04/14 14:43
linux-6.1 possible deadlock in throtl_pending_timer_fn 4 syz, C done 266 1323d 1324d 3/3 fixed on 2023/04/11 15:30
linux-5.15 possible deadlock in throtl_pending_timer_fn 4 1 13d 13d 0/3 upstream: reported on 2026/10/11 03:54

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.8.626/6462 is trying to acquire lock:
ffff888028cab710 (&q->queue_lock){..-.}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
ffff888028cab710 (&q->queue_lock){..-.}-{2:2}, at: throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200

but task is already holding lock:
ffffc90000007bc0 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 ((&sq->pending_timer)){+.-.}-{0:0}:
       __timer_delete_sync+0xe1/0x2e0 kernel/time/timer.c:1556
       del_timer_sync include/linux/timer.h:200 [inline]
       throtl_pd_free+0x15/0x40 block/blk-throttle.c:493
       blkcg_deactivate_policy+0x35c/0x5c0 block/blk-cgroup.c:1530
       blk_throtl_exit+0xa6/0x140 block/blk-throttle.c:2415
       blkcg_init_disk+0x37b/0x3f0 block/blk-cgroup.c:1307
       __alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
       __blk_alloc_disk+0x2c/0x80 block/genhd.c:1471
       alloc_dev drivers/md/dm.c:2055 [inline]
       dm_create+0x46b/0xf90 drivers/md/dm.c:2259
       dev_create+0x12e/0x2c0 drivers/md/dm-ioctl.c:875
       ctl_ioctl drivers/md/dm-ioctl.c:2055 [inline]
       dm_ctl_ioctl+0xa9c/0xec0 drivers/md/dm-ioctl.c:2077
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:870 [inline]
       __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
       do_syscall_x64 arch/x86/entry/common.c:46 [inline]
       do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
       entry_SYSCALL_64_after_hwframe+0x68/0xd2

-> #1 (&blkcg->lock){....}-{2:2}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       blkg_create+0xbe9/0x1390 block/blk-cgroup.c:322
       blkcg_init_disk+0x28c/0x3f0 block/blk-cgroup.c:1283
       __alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
       __blk_alloc_disk+0x2c/0x80 block/genhd.c:1471
       brd_alloc+0x377/0x760 drivers/block/brd.c:424
       brd_init+0x125/0x1a5 drivers/block/brd.c:529
       do_one_initcall+0x257/0x800 init/main.c:1271
       do_initcall_level+0x13d/0x1ed init/main.c:1344
       do_initcalls+0x4b/0x8a init/main.c:1360
       kernel_init_freeable+0x401/0x5ab init/main.c:1599
       kernel_init+0x19/0x1b0 init/main.c:1487
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #0 (&q->queue_lock){..-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3162 [inline]
       check_prevs_add kernel/locking/lockdep.c:3281 [inline]
       validate_chain kernel/locking/lockdep.c:3897 [inline]
       __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171
       lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
       __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
       _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
       spin_lock_irq include/linux/spinlock.h:376 [inline]
       throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
       call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
       expire_timers kernel/time/timer.c:1752 [inline]
       __run_timers+0x56c/0x810 kernel/time/timer.c:2023
       run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
       handle_softirqs+0x291/0x910 kernel/softirq.c:596
       __do_softirq kernel/softirq.c:630 [inline]
       invoke_softirq kernel/softirq.c:470 [inline]
       __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
       irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
       sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
       asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
       native_irq_enable arch/x86/include/asm/irqflags.h:45 [inline]
       arch_local_irq_enable arch/x86/include/asm/irqflags.h:80 [inline]
       raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline]
       finish_lock_switch kernel/sched/core.c:5005 [inline]
       finish_task_switch+0x267/0x8e0 kernel/sched/core.c:5123
       context_switch kernel/sched/core.c:5249 [inline]
       __schedule+0x1087/0x4030 kernel/sched/core.c:6563
       preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:6732
       preempt_schedule+0xbc/0xd0 kernel/sched/core.c:6756
       preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
       __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
       _raw_spin_unlock_irqrestore+0x10d/0x120 kernel/locking/spinlock.c:194
       spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
       __wake_up_common_lock kernel/sched/wait.c:140 [inline]
       __wake_up_sync_key+0x128/0x190 kernel/sched/wait.c:208
       __unix_dgram_recvmsg+0x4b7/0xda0 net/unix/af_unix.c:2490
       ____sys_recvmsg+0x2c8/0x5b0 net/socket.c:-1
       ___sys_recvmsg+0x210/0x590 net/socket.c:2780
       do_recvmmsg+0x370/0x810 net/socket.c:2874
       __sys_recvmmsg net/socket.c:2953 [inline]
       __do_sys_recvmmsg net/socket.c:2976 [inline]
       __se_sys_recvmmsg net/socket.c:2969 [inline]
       __x64_sys_recvmmsg+0x195/0x250 net/socket.c:2969
       do_syscall_x64 arch/x86/entry/common.c:46 [inline]
       do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
       entry_SYSCALL_64_after_hwframe+0x68/0xd2

other info that might help us debug this:

Chain exists of:
  &q->queue_lock --> &blkcg->lock --> (&sq->pending_timer)

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock((&sq->pending_timer));
                               lock(&blkcg->lock);
                               lock((&sq->pending_timer));
  lock(&q->queue_lock);

 *** DEADLOCK ***

2 locks held by syz.8.626/6462:
 #0: ffff88807b4b1d98 (&u->iolock){+.+.}-{3:3}, at: __unix_dgram_recvmsg+0x1f9/0xda0 net/unix/af_unix.c:2460
 #1: ffffc90000007bc0 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698

stack backtrace:
CPU: 0 PID: 6462 Comm: syz.8.626 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2215
 check_prev_add kernel/locking/lockdep.c:3162 [inline]
 check_prevs_add kernel/locking/lockdep.c:3281 [inline]
 validate_chain kernel/locking/lockdep.c:3897 [inline]
 __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171
 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
 spin_lock_irq include/linux/spinlock.h:376 [inline]
 throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:finish_task_switch+0x267/0x8e0 kernel/sched/core.c:5125
Code: e1 08 85 c0 0f 84 38 01 00 00 48 85 db 0f 85 57 01 00 00 0f 1f 44 00 00 4c 89 e7 e8 63 89 eb 08 e8 be 2b 2f 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc900048272c0 EFLAGS: 00000282
RAX: e6f9bd1b3f66bb00 RBX: 0000000000000000 RCX: e6f9bd1b3f66bb00
RDX: dffffc0000000000 RSI: ffffffff8aac19a0 RDI: ffffffff8aff71e0
RBP: ffffc90004827310 R08: ffffffff91b702ef R09: 1ffffffff236e05d
R10: dffffc0000000000 R11: fffffbfff236e05e R12: ffff888021343c00
R13: 1ffff110171876f2 R14: dffffc0000000000 R15: ffff8880b8c3b790
 context_switch kernel/sched/core.c:5249 [inline]
 __schedule+0x1087/0x4030 kernel/sched/core.c:6563
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:6732
 preempt_schedule+0xbc/0xd0 kernel/sched/core.c:6756
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x10d/0x120 kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:140 [inline]
 __wake_up_sync_key+0x128/0x190 kernel/sched/wait.c:208
 __unix_dgram_recvmsg+0x4b7/0xda0 net/unix/af_unix.c:2490
 ____sys_recvmsg+0x2c8/0x5b0 net/socket.c:-1
 ___sys_recvmsg+0x210/0x590 net/socket.c:2780
 do_recvmmsg+0x370/0x810 net/socket.c:2874
 __sys_recvmmsg net/socket.c:2953 [inline]
 __do_sys_recvmmsg net/socket.c:2976 [inline]
 __se_sys_recvmmsg net/socket.c:2969 [inline]
 __x64_sys_recvmmsg+0x195/0x250 net/socket.c:2969
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f040319f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04040aa028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f0403426090 RCX: 00007f040319f559
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000004
RBP: 00007f0403236b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0403426128 R14: 00007f0403426090 R15: 00007ffed4082018
 </TASK>
----------------
Code disassembly (best guess):
   0:	e1 08                	loope  0xa
   2:	85 c0                	test   %eax,%eax
   4:	0f 84 38 01 00 00    	je     0x142
   a:	48 85 db             	test   %rbx,%rbx
   d:	0f 85 57 01 00 00    	jne    0x16a
  13:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  18:	4c 89 e7             	mov    %r12,%rdi
  1b:	e8 63 89 eb 08       	call   0x8eb8983
  20:	e8 be 2b 2f 00       	call   0x2f2be3
  25:	fb                   	sti
  26:	4c 8b 65 b8          	mov    -0x48(%rbp),%r12
* 2a:	49 8d bc 24 f8 15 00 	lea    0x15f8(%r12),%rdi <-- trapping instruction
  31:	00
  32:	48 89 f8             	mov    %rdi,%rax
  35:	48 c1 e8 03          	shr    $0x3,%rax
  39:	42 0f b6 04 30       	movzbl (%rax,%r14,1),%eax
  3e:	84 c0                	test   %al,%al

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/23 13:48 linux-6.1.y 79807e970724 d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/10/21 03:00 linux-6.1.y 79807e970724 df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/10/03 18:10 linux-6.1.y a500ba24937a 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/27 04:46 linux-6.1.y 1a8763b93150 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/22 10:17 linux-6.1.y 1a8763b93150 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/21 17:35 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/20 00:59 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/20 00:59 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/18 13:25 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/18 13:25 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/09/17 06:13 linux-6.1.y 1a8763b93150 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in throtl_pending_timer_fn
2026/10/21 11:51 linux-6.1.y 79807e970724 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/10/09 02:37 linux-6.1.y a500ba24937a b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/10/07 17:06 linux-6.1.y a500ba24937a 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/10/06 20:13 linux-6.1.y a500ba24937a f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/10/05 18:36 linux-6.1.y a500ba24937a af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/10/04 08:12 linux-6.1.y a500ba24937a 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/09/24 13:05 linux-6.1.y 1a8763b93150 0281b448 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/09/24 12:33 linux-6.1.y 1a8763b93150 0281b448 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/09/23 23:43 linux-6.1.y 1a8763b93150 abce1216 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
2026/09/23 07:22 linux-6.1.y 1a8763b93150 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in throtl_pending_timer_fn
* Struck through repros no longer work on HEAD.