Warning: Permanently added '10.128.0.204' (ED25519) to the list of known hosts. [*] Starting reproducer for circular locking dependency in nfsd_file_cache_shutdown... [+] NETLINK_GENERIC socket created successfully (fd=3). [+] NETLINK_GENERIC socket bound successfully. [+] Resolved generic netlink family 'nbd' -> ID 45. [+] Resolved generic netlink family 'nfsd' -> ID 41. [+] Resolved generic netlink family 'MAC80211_HWSIM' -> ID 49. [+] Resolved generic netlink family 'nl80211' -> ID 38. [+] HWSIM_CMD_NEW_RADIO returned: 6 [+] Found wireless interface 'wlan0' (index 8) [+] Brought down interface wlan0 [ 109.968676][ T6004] NFSD: Failed to start, no listeners configured. [+] NFSD_CMD_THREADS_SET completed (established cpu_hotplug_lock -> slab_mutex via nfsd_file_cache_shutdown, ret=-5). [+] /dev/nbd0 exists. [+] TCP server listening on port 40961. [+] Established TCP connection 1a (cli1a=5, acc1a=6). [+] Established TCP connection 1b (cli1b=7, acc1b=8). [+] Started background NBD server worker threads 1a and 1b. [+] NBD_CMD_CONNECT with 2 sockets successful (established q_usage_counter -> elevator_lock -> set->srcu). [ 110.412730][ T6004] nbd0: detected capacity change from 0 to 2048 [+] Closed TCP connections 1a and 1b to trigger nsock->dead cleanly. [ 110.468631][ T53] block nbd0: Receive control failed (result -32) [ 110.480429][ T4955] block nbd0: Receive control failed (result -32) [ 110.485984][ T6005] block nbd0: Dead connection, failed to find a fallback [ 110.486010][ T6005] block nbd0: shutting down sockets [ 110.486098][ T6005] I/O error, dev nbd0, sector 32 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 110.486968][ T1986] I/O error, dev nbd0, sector 32 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.487140][ T1986] Buffer I/O error on dev nbd0, logical block 4, async page read [+] Read from dead /dev/nbd0 returned -1 (errno=Input/output error) [ 110.635764][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.635799][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.635938][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.635959][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.636053][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.636073][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.636164][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.636186][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.636288][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.636307][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.636413][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [+] Dead I/O dispatched (established set->srcu -> cmd->lock -> nsock->tx_lock). [+] Established TCP connection 2a (cli2a=5, acc2a=6). [ 110.636434][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.636542][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.636564][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.636654][ T2691] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.636678][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [+] Established TCP connection 2b (cli2b=7, acc2b=8). [+] Started background NBD server worker threads 2a and 2b. [+] NBD_CMD_RECONFIGURE successful (established nsock->tx_lock -> cpu_hotplug_lock). [*] Sending NL80211_CMD_SET_INTERFACE to switch wlan0 to MESH_POINT... [ 110.636705][ T6004] ldm_validate_partition_table(): Disk read failed. [ 110.636794][ T2691] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.637116][ T6004] Dev nbd0: unable to read RDB block 0 [ 110.637615][ T6004] nbd0: unable to read partition table [ 110.813624][ T6004] block nbd0: reconnected socket [ 110.813723][ T6004] block nbd0: reconnected socket [ 110.818601][ T6004] [ 110.831387][ T6004] ====================================================== [ 110.838417][ T6004] WARNING: possible circular locking dependency detected [ 110.845737][ T6004] syzkaller #0 Not tainted [ 110.850260][ T6004] ------------------------------------------------------ [ 110.857635][ T6004] syz-executor411/6004 is trying to acquire lock: [ 110.864410][ T6004] ffffffff90094cc0 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_noprof+0x5f/0x600 [ 110.874030][ T6004] [ 110.874030][ T6004] but task is already holding lock: [ 110.881656][ T6004] ffffffff900771b8 (slab_mutex){+.+.}-{4:4}, at: __kmem_cache_create_args+0x59/0x470 [ 110.891240][ T6004] [ 110.891240][ T6004] which lock already depends on the new lock. [ 110.891240][ T6004] [ 110.901928][ T6004] [ 110.901928][ T6004] the existing dependency chain (in reverse order) is: [ 110.910998][ T6004] [ 110.910998][ T6004] -> #7 (slab_mutex){+.+.}-{4:4}: [ 110.918477][ T6004] __mutex_lock+0x197/0x15a0 [ 110.923956][ T6004] kmem_cache_destroy+0x73/0x180 [ 110.929615][ T6004] wg_ratelimiter_uninit+0x94/0xb0 [ 110.935362][ T6004] wg_destruct+0x223/0x310 [ 110.940410][ T6004] netdev_run_todo+0xeb2/0x1090 [ 110.946152][ T6004] default_device_exit_batch+0x6d4/0x760 [ 110.952567][ T6004] ops_undo_list+0x4d7/0x8f0 [ 110.957779][ T6004] cleanup_net+0x572/0x810 [ 110.962725][ T6004] process_scheduled_works+0xc3d/0x1630 [ 110.968882][ T6004] worker_thread+0xa47/0xfb0 [ 110.973994][ T6004] kthread+0x38b/0x480 [ 110.978756][ T6004] ret_from_fork+0x514/0xb70 [ 110.983886][ T6004] ret_from_fork_asm+0x1a/0x30 [ 110.989601][ T6004] [ 110.989601][ T6004] -> #6 (cpu_hotplug_lock){++++}-{0:0}: [ 110.998019][ T6004] cpus_read_lock+0x3d/0x160 [ 111.003134][ T6004] static_key_slow_inc+0x12/0x30 [ 111.009028][ T6004] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 111.015346][ T6004] nbd_genl_foreach_sock+0x265/0x450 [ 111.022019][ T6004] nbd_genl_reconfigure+0xbbb/0x1040 [ 111.028363][ T6004] genl_family_rcv_msg_doit+0x233/0x340 [ 111.034601][ T6004] genl_rcv_msg+0x614/0x7a0 [ 111.040063][ T6004] netlink_rcv_skb+0x226/0x4a0 [ 111.045799][ T6004] genl_rcv+0x28/0x40 [ 111.050306][ T6004] netlink_unicast+0x8ef/0xa80 [ 111.055732][ T6004] netlink_sendmsg+0x7f0/0xb20 [ 111.061070][ T6004] sock_sendmsg_nosec+0x14e/0x190 [ 111.066733][ T6004] __sys_sendto+0x408/0x5a0 [ 111.071883][ T6004] __x64_sys_sendto+0xde/0x100 [ 111.077380][ T6004] do_syscall_64+0x166/0x520 [ 111.082734][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.089869][ T6004] [ 111.089869][ T6004] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 111.097651][ T6004] __mutex_lock+0x197/0x15a0 [ 111.103025][ T6004] nbd_queue_rq+0x373/0xff0 [ 111.108242][ T6004] blk_mq_dispatch_rq_list+0x499/0x1990 [ 111.114421][ T6004] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 111.121821][ T6004] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 111.128715][ T6004] blk_mq_run_work_fn+0x167/0x2f0 [ 111.134438][ T6004] process_scheduled_works+0xc3d/0x1630 [ 111.140690][ T6004] worker_thread+0xa47/0xfb0 [ 111.145899][ T6004] kthread+0x38b/0x480 [ 111.150481][ T6004] ret_from_fork+0x514/0xb70 [ 111.155759][ T6004] ret_from_fork_asm+0x1a/0x30 [ 111.161236][ T6004] [ 111.161236][ T6004] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 111.169045][ T6004] __mutex_lock+0x197/0x15a0 [ 111.174148][ T6004] nbd_queue_rq+0xc1/0xff0 [ 111.179084][ T6004] blk_mq_dispatch_rq_list+0x499/0x1990 [ 111.185258][ T6004] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 111.192901][ T6004] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 111.199860][ T6004] blk_mq_run_work_fn+0x167/0x2f0 [ 111.205690][ T6004] process_scheduled_works+0xc3d/0x1630 [ 111.211757][ T6004] worker_thread+0xa47/0xfb0 [ 111.217131][ T6004] kthread+0x38b/0x480 [ 111.221904][ T6004] ret_from_fork+0x514/0xb70 [ 111.227105][ T6004] ret_from_fork_asm+0x1a/0x30 [ 111.232655][ T6004] [ 111.232655][ T6004] -> #3 (set->srcu){.+.+}-{0:0}: [ 111.239951][ T6004] __synchronize_srcu+0xca/0x2f0 [ 111.245406][ T6004] elevator_switch+0x1e8/0x7b0 [ 111.250701][ T6004] elevator_change+0x2fa/0x480 [ 111.256354][ T6004] elevator_set_default+0x375/0x440 [ 111.262273][ T6004] blk_register_queue+0x404/0x4f0 [ 111.267917][ T6004] __add_disk+0x6b8/0xdb0 [ 111.272764][ T6004] add_disk_fwnode+0x100/0x3a0 [ 111.278132][ T6004] nbd_dev_add+0x733/0xb60 [ 111.283063][ T6004] nbd_init+0x168/0x1f0 [ 111.288084][ T6004] do_one_initcall+0x250/0x870 [ 111.293359][ T6004] do_initcall_level+0x10a/0x1a0 [ 111.298904][ T6004] do_initcalls+0x59/0xa0 [ 111.303749][ T6004] kernel_init_freeable+0x29d/0x3e0 [ 111.309637][ T6004] kernel_init+0x22/0x1d0 [ 111.314670][ T6004] ret_from_fork+0x514/0xb70 [ 111.320050][ T6004] ret_from_fork_asm+0x1a/0x30 [ 111.325560][ T6004] [ 111.325560][ T6004] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 111.333489][ T6004] __mutex_lock+0x197/0x15a0 [ 111.339047][ T6004] elevator_change+0x1af/0x480 [ 111.344425][ T6004] elevator_set_none+0xb5/0x140 [ 111.349966][ T6004] blk_mq_update_nr_hw_queues+0x5ef/0x19e0 [ 111.356388][ T6004] nbd_start_device+0x189/0xb30 [ 111.361883][ T6004] nbd_genl_connect+0x167d/0x1cd0 [ 111.367452][ T6004] genl_family_rcv_msg_doit+0x233/0x340 [ 111.373539][ T6004] genl_rcv_msg+0x614/0x7a0 [ 111.378748][ T6004] netlink_rcv_skb+0x226/0x4a0 [ 111.384229][ T6004] genl_rcv+0x28/0x40 [ 111.388942][ T6004] netlink_unicast+0x8ef/0xa80 [ 111.394226][ T6004] netlink_sendmsg+0x7f0/0xb20 [ 111.399611][ T6004] sock_sendmsg_nosec+0x14e/0x190 [ 111.405160][ T6004] __sys_sendto+0x408/0x5a0 [ 111.410180][ T6004] __x64_sys_sendto+0xde/0x100 [ 111.415466][ T6004] do_syscall_64+0x166/0x520 [ 111.420680][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.427362][ T6004] [ 111.427362][ T6004] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 111.436055][ T6004] blk_alloc_queue+0x544/0x690 [ 111.441528][ T6004] __blk_mq_alloc_disk+0x194/0x390 [ 111.447624][ T6004] nbd_dev_add+0x494/0xb60 [ 111.452653][ T6004] nbd_init+0x168/0x1f0 [ 111.457327][ T6004] do_one_initcall+0x250/0x870 [ 111.462709][ T6004] do_initcall_level+0x10a/0x1a0 [ 111.468519][ T6004] do_initcalls+0x59/0xa0 [ 111.473453][ T6004] kernel_init_freeable+0x29d/0x3e0 [ 111.479346][ T6004] kernel_init+0x22/0x1d0 [ 111.484374][ T6004] ret_from_fork+0x514/0xb70 [ 111.489477][ T6004] ret_from_fork_asm+0x1a/0x30 [ 111.494925][ T6004] [ 111.494925][ T6004] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 111.502782][ T6004] __lock_acquire+0x164c/0x2de0 [ 111.508251][ T6004] lock_acquire+0x115/0x350 [ 111.513541][ T6004] fs_reclaim_acquire+0x71/0x100 [ 111.519006][ T6004] kmem_cache_alloc_noprof+0x5f/0x600 [ 111.525421][ T6004] __kmem_cache_create_args+0x30c/0x470 [ 111.531487][ T6004] ieee80211_mesh_init_sdata+0x371/0x620 [ 111.537647][ T6004] ieee80211_setup_sdata+0x858/0xc10 [ 111.543711][ T6004] ieee80211_if_change_type+0x141/0x940 [ 111.549947][ T6004] ieee80211_change_iface+0xdc/0x4b0 [ 111.555847][ T6004] cfg80211_change_iface+0x40f/0x9c0 [ 111.561652][ T6004] nl80211_set_interface+0x78e/0xaa0 [ 111.567625][ T6004] genl_family_rcv_msg_doit+0x233/0x340 [ 111.573687][ T6004] genl_rcv_msg+0x614/0x7a0 [ 111.578802][ T6004] netlink_rcv_skb+0x226/0x4a0 [ 111.584268][ T6004] genl_rcv+0x28/0x40 [ 111.588763][ T6004] netlink_unicast+0x8ef/0xa80 [ 111.594231][ T6004] netlink_sendmsg+0x7f0/0xb20 [ 111.599684][ T6004] sock_sendmsg_nosec+0x14e/0x190 [ 111.605427][ T6004] __sys_sendto+0x408/0x5a0 [ 111.610622][ T6004] __x64_sys_sendto+0xde/0x100 [ 111.615922][ T6004] do_syscall_64+0x166/0x520 [ 111.621116][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.627865][ T6004] [ 111.627865][ T6004] other info that might help us debug this: [ 111.627865][ T6004] [ 111.638344][ T6004] Chain exists of: [ 111.638344][ T6004] fs_reclaim --> cpu_hotplug_lock --> slab_mutex [ 111.638344][ T6004] [ 111.650683][ T6004] Possible unsafe locking scenario: [ 111.650683][ T6004] [ 111.658395][ T6004] CPU0 CPU1 [ 111.663837][ T6004] ---- ---- [ 111.669366][ T6004] lock(slab_mutex); [ 111.673599][ T6004] lock(cpu_hotplug_lock); [ 111.680613][ T6004] lock(slab_mutex); [ 111.687194][ T6004] lock(fs_reclaim); [ 111.691170][ T6004] [ 111.691170][ T6004] *** DEADLOCK *** [ 111.691170][ T6004] [ 111.699304][ T6004] locks held by syz-executor411/6004: 4, last CPU#1: [ 111.706407][ T6004] #0: ffffffff914f07a8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 111.714769][ T6004] #1: ffffffff9148c420 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0x117/0xfa0 [ 111.724253][ T6004] #2: ffff888146e80800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: nl80211_pre_doit+0x6b2/0xfa0 [ 111.734316][ T6004] #3: ffffffff900771b8 (slab_mutex){+.+.}-{4:4}, at: __kmem_cache_create_args+0x59/0x470 [ 111.744674][ T6004] [ 111.744674][ T6004] stack backtrace: [ 111.750590][ T6004] CPU: 1 UID: 0 PID: 6004 Comm: syz-executor411 Not tainted syzkaller #0 PREEMPT(full) [ 111.760738][ T6004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 111.771062][ T6004] Call Trace: [ 111.774335][ T6004] [ 111.777440][ T6004] dump_stack_lvl+0xe8/0x150 [ 111.782035][ T6004] print_circular_bug+0x2e2/0x300 [ 111.787243][ T6004] check_noncircular+0x12f/0x150 [ 111.792439][ T6004] __lock_acquire+0x164c/0x2de0 [ 111.797289][ T6004] ? __pfx___mutex_trylock_common+0x10/0x10 [ 111.803178][ T6004] ? rcu_is_watching+0x16/0xb0 [ 111.807944][ T6004] ? trace_contention_end+0x3d/0x140 [ 111.813404][ T6004] lock_acquire+0x115/0x350 [ 111.818081][ T6004] ? kmem_cache_alloc_noprof+0x5f/0x600 [ 111.823798][ T6004] ? __kmem_cache_create_args+0x59/0x470 [ 111.829615][ T6004] ? __kmem_cache_create_args+0x30c/0x470 [ 111.835505][ T6004] fs_reclaim_acquire+0x71/0x100 [ 111.840692][ T6004] ? kmem_cache_alloc_noprof+0x5f/0x600 [ 111.846502][ T6004] kmem_cache_alloc_noprof+0x5f/0x600 [ 111.852463][ T6004] ? __kmem_cache_create_args+0x30c/0x470 [ 111.858776][ T6004] __kmem_cache_create_args+0x30c/0x470 [ 111.864404][ T6004] ieee80211_mesh_init_sdata+0x371/0x620 [ 111.870039][ T6004] ? __pfx_ieee80211_mesh_init_sdata+0x10/0x10 [ 111.876281][ T6004] ? __raw_spin_lock_init+0x45/0x100 [ 111.881642][ T6004] ieee80211_setup_sdata+0x858/0xc10 [ 111.887018][ T6004] ieee80211_if_change_type+0x141/0x940 [ 111.893090][ T6004] ieee80211_change_iface+0xdc/0x4b0 [ 111.898395][ T6004] cfg80211_change_iface+0x40f/0x9c0 [ 111.903884][ T6004] nl80211_set_interface+0x78e/0xaa0 [ 111.909438][ T6004] ? __pfx_nl80211_set_interface+0x10/0x10 [ 111.915336][ T6004] genl_family_rcv_msg_doit+0x233/0x340 [ 111.920882][ T6004] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 111.927387][ T6004] ? bpf_lsm_capable+0x9/0x20 [ 111.932150][ T6004] ? security_capable+0x7e/0x2c0 [ 111.937115][ T6004] genl_rcv_msg+0x614/0x7a0 [ 111.941617][ T6004] ? __pfx_genl_rcv_msg+0x10/0x10 [ 111.946719][ T6004] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 111.952086][ T6004] ? __pfx_nl80211_set_interface+0x10/0x10 [ 111.958325][ T6004] ? __pfx_nl80211_post_doit+0x10/0x10 [ 111.963966][ T6004] netlink_rcv_skb+0x226/0x4a0 [ 111.968735][ T6004] ? __pfx_genl_rcv_msg+0x10/0x10 [ 111.973841][ T6004] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 111.979217][ T6004] ? down_read+0x2b9/0x320 [ 111.983630][ T6004] genl_rcv+0x28/0x40 [ 111.987864][ T6004] netlink_unicast+0x8ef/0xa80 [ 111.992818][ T6004] netlink_sendmsg+0x7f0/0xb20 [ 111.997758][ T6004] ? __pfx_netlink_sendmsg+0x10/0x10 [ 112.003127][ T6004] ? aa_sock_msg_perm+0x144/0x210 [ 112.008233][ T6004] ? apparmor_socket_sendmsg+0x98/0x360 [ 112.013866][ T6004] ? __pfx_netlink_sendmsg+0x10/0x10 [ 112.019549][ T6004] sock_sendmsg_nosec+0x14e/0x190 [ 112.024587][ T6004] __sys_sendto+0x408/0x5a0 [ 112.029183][ T6004] ? __pfx___sys_sendto+0x10/0x10 [ 112.034221][ T6004] ? fdget+0x1ac/0x250 [ 112.038398][ T6004] ? __pfx_ksys_write+0x10/0x10 [ 112.043455][ T6004] __x64_sys_sendto+0xde/0x100 [ 112.048830][ T6004] do_syscall_64+0x166/0x520 [ 112.053513][ T6004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.060193][ T6004] ? clear_bhb_loop+0x70/0xc0 [ 112.065057][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.071046][ T6004] RIP: 0033:0x7fcb7fbe801e [ 112.075644][ T6004] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 [ 112.095516][ T6004] RSP: 002b:00007fff7765df98 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 112.104295][ T6004] RAX: ffffffffffffffda RBX: 0000555567b69400 RCX: 00007fcb7fbe801e [ 112.112357][ T6004] RDX: 0000000000000024 RSI: 00007fff7765ea00 RDI: 0000000000000003 [ 112.120630][ T6004] RBP: 00007fff776600e0 R08: 0000000000000000 R09: 0000000000000000 [ 112.129121][ T6004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 112.137524][ T6004] R13: 000000000000002c R14: 00007fff7765ea00 R15: 0000000000000004 [*] NL80211_CMD_SET_INTERFACE returned: 0 [ 112.145503][ T6004] [+] Reproducer execution completed successfully.