[ 32.489149][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.492187][ T4428] 8021q: adding VLAN 0 to HW filter on device eth3 [ 32.580180][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.650008][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.721726][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.827279][ T13] bridge_slave_1: left allmulticast mode [ 32.827297][ T13] bridge_slave_1: left promiscuous mode [ 32.827377][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.829154][ T13] bridge_slave_0: left allmulticast mode [ 32.829165][ T13] bridge_slave_0: left promiscuous mode [ 32.829224][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.882020][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 32.897703][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 32.937111][ T13] bond0 (unregistering): Released all slaves [ 33.048279][ T4428] 8021q: adding VLAN 0 to HW filter on device eth4 [ 33.160151][ T4428] 8021q: adding VLAN 0 to HW filter on device eth6 [ 33.254652][ T13] hsr_slave_0: left promiscuous mode [ 33.254917][ T13] hsr_slave_1: left promiscuous mode [ 33.255153][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 33.255163][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 33.255436][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 33.255445][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 33.265551][ T13] veth1_macvtap: left promiscuous mode [ 33.265574][ T13] veth0_macvtap: left promiscuous mode [ 33.265630][ T13] veth1_vlan: left promiscuous mode [ 33.265702][ T13] veth0_vlan: left promiscuous mode [ 33.349405][ T13] team0 (unregistering): Port device team_slave_1 removed [ 33.352949][ T13] team0 (unregistering): Port device team_slave_0 removed [ 33.399433][ T4428] 8021q: adding VLAN 0 to HW filter on device eth5 [ 33.531106][ T4428] 8021q: adding VLAN 0 to HW filter on device eth7 Warning: Permanently added '10.128.1.172' (ED25519) to the list of known hosts. [*] Starting reproducer for possible deadlock in device_register... [+] socket NETLINK_KOBJECT_UEVENT successful. [+] bind uevent_fd successful. [+] setsockopt NETLINK_ADD_MEMBERSHIP successful. [+] socket NETLINK_GENERIC successful. [+] Resolved NBD generic netlink family ID: 41 [+] create_tcp_pair sv0 successful. [+] create_tcp_pair sv1 successful. [+] Background server thread started. [+] send NBD_CMD_CONNECT successful. [+] NBD_CMD_CONNECT successful (established &q->elevator_lock -> set->srcu). [+] open /dev/nbd0 successful. [+] pread successful (read 512 bytes, established set->srcu -> &cmd->lock -> &nsock->tx_lock). [+] shutdown(sv0[1]) successful. [+] close(sv0[1]) successful, socket 0 marked dead. [ 37.758628][ T5066] nbd0: detected capacity change from 0 to 2048 [ 37.764664][ T50] block nbd0: Receive control failed (result -32) [+] create_tcp_pair sv_new successful. [+] send NBD_CMD_RECONFIGURE successful. [+] NBD_CMD_RECONFIGURE successful (established &nsock->tx_lock -> cpu_hotplug_lock). [*] Triggering uevents via sysfs... [+] open /sys/block/nbd0/uevent successful. [ 37.915518][ T5066] block nbd0: reconnected socket [ 37.917641][ T5066] [ 37.918072][ T5066] ====================================================== [ 37.919173][ T5066] WARNING: possible circular locking dependency detected [ 37.920391][ T5066] syzkaller #0 Not tainted [ 37.921183][ T5066] ------------------------------------------------------ [ 37.922298][ T5066] syz-executor796/5066 is trying to acquire lock: [ 37.923396][ T5066] ffff800089aea6a0 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x64/0x604 [ 37.925218][ T5066] [ 37.925218][ T5066] but task is already holding lock: [ 37.926548][ T5066] ffff80008ae5fb20 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x24c/0x53c [ 37.928586][ T5066] [ 37.928586][ T5066] which lock already depends on the new lock. [ 37.928586][ T5066] [ 37.930495][ T5066] [ 37.930495][ T5066] the existing dependency chain (in reverse order) is: [ 37.932115][ T5066] [ 37.932115][ T5066] -> #7 (uevent_sock_mutex){+.+.}-{4:4}: [ 37.933657][ T5066] __mutex_lock+0x164/0x1078 [ 37.934711][ T5066] mutex_lock_nested+0x24/0x30 [ 37.935804][ T5066] kobject_uevent_net_broadcast+0x24c/0x53c [ 37.936950][ T5066] kobject_uevent_env+0x518/0x944 [ 37.937938][ T5066] kobject_uevent+0x2c/0x3c [ 37.938896][ T5066] device_add+0x4d0/0x9e0 [ 37.939818][ T5066] device_register+0x28/0x38 [ 37.940839][ T5066] register_cpu+0x28c/0x57c [ 37.941766][ T5066] arch_register_cpu+0x160/0x224 [ 37.942696][ T5066] acpi_processor_add+0x8f0/0x13f0 [ 37.943667][ T5066] acpi_bus_attach+0x398/0x778 [ 37.944573][ T5066] acpi_dev_for_one_check+0xa0/0xb4 [ 37.945614][ T5066] device_for_each_child+0xf4/0x184 [ 37.946647][ T5066] acpi_dev_for_each_child+0x98/0xe4 [ 37.947609][ T5066] acpi_bus_attach+0x540/0x778 [ 37.948578][ T5066] acpi_dev_for_one_check+0xa0/0xb4 [ 37.949658][ T5066] device_for_each_child+0xf4/0x184 [ 37.950720][ T5066] acpi_dev_for_each_child+0x98/0xe4 [ 37.951857][ T5066] acpi_bus_attach+0x540/0x778 [ 37.952784][ T5066] acpi_bus_scan+0x104/0x310 [ 37.953755][ T5066] acpi_scan_init+0x168/0x3cc [ 37.954723][ T5066] acpi_init+0x15c/0x1f4 [ 37.955623][ T5066] do_one_initcall+0x274/0x9f8 [ 37.956696][ T5066] do_initcall_level+0x12c/0x1c4 [ 37.957834][ T5066] do_initcalls+0x70/0xd0 [ 37.958731][ T5066] do_basic_setup+0x7c/0x90 [ 37.959728][ T5066] kernel_init_freeable+0x258/0x398 [ 37.960896][ T5066] kernel_init+0x28/0x1e0 [ 37.961881][ T5066] ret_from_fork+0x10/0x20 [ 37.962793][ T5066] [ 37.962793][ T5066] -> #6 (cpu_hotplug_lock){++++}-{0:0}: [ 37.964381][ T5066] cpus_read_lock+0x54/0x1c8 [ 37.965484][ T5066] static_key_slow_inc+0x1c/0x40 [ 37.966639][ T5066] sk_set_memalloc+0x6c/0xa0 [ 37.967662][ T5066] nbd_genl_reconnect_sock_cb+0x32c/0x72c [ 37.968773][ T5066] nbd_genl_foreach_sock+0x204/0x3c8 [ 37.969872][ T5066] nbd_genl_reconfigure+0x714/0x9e8 [ 37.970915][ T5066] genl_family_rcv_msg_doit+0x1e4/0x2d4 [ 37.972108][ T5066] genl_rcv_msg+0x43c/0x620 [ 37.973142][ T5066] netlink_rcv_skb+0x238/0x414 [ 37.974228][ T5066] genl_rcv+0x38/0x50 [ 37.975118][ T5066] netlink_unicast+0x600/0x7f8 [ 37.976251][ T5066] netlink_sendmsg+0x648/0x948 [ 37.977241][ T5066] __sock_sendmsg+0xc8/0x17c [ 37.978252][ T5066] __sys_sendto+0x250/0x328 [ 37.979250][ T5066] __arm64_sys_sendto+0xec/0x10c [ 37.980398][ T5066] invoke_syscall+0x98/0x244 [ 37.981343][ T5066] el0_svc_common+0xec/0x23c [ 37.982286][ T5066] do_el0_svc+0x4c/0x5c [ 37.983168][ T5066] el0_svc+0x60/0x1d8 [ 37.984066][ T5066] el0t_64_sync_handler+0x44/0x104 [ 37.985071][ T5066] el0t_64_sync+0x198/0x19c [ 37.985966][ T5066] [ 37.985966][ T5066] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 37.987503][ T5066] __mutex_lock+0x164/0x1078 [ 37.988462][ T5066] mutex_lock_nested+0x24/0x30 [ 37.989513][ T5066] nbd_queue_rq+0x1f4/0xbac [ 37.990546][ T5066] blk_mq_dispatch_rq_list+0x3d4/0x13a8 [ 37.991812][ T5066] __blk_mq_sched_dispatch_requests+0xa48/0x10e8 [ 37.993250][ T5066] blk_mq_sched_dispatch_requests+0xa8/0x158 [ 37.994596][ T5066] blk_mq_run_work_fn+0x154/0x2e4 [ 37.995690][ T5066] process_scheduled_works+0x91c/0x1250 [ 37.996823][ T5066] worker_thread+0x798/0xbd0 [ 37.997741][ T5066] kthread+0x304/0x3d4 [ 37.998572][ T5066] ret_from_fork+0x10/0x20 [ 37.999562][ T5066] [ 37.999562][ T5066] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 38.000994][ T5066] __mutex_lock+0x164/0x1078 [ 38.001911][ T5066] mutex_lock_nested+0x24/0x30 [ 38.002911][ T5066] nbd_queue_rq+0xb0/0xbac [ 38.003845][ T5066] blk_mq_dispatch_rq_list+0x3d4/0x13a8 [ 38.005021][ T5066] __blk_mq_sched_dispatch_requests+0xa48/0x10e8 [ 38.006224][ T5066] blk_mq_sched_dispatch_requests+0xa8/0x158 [ 38.007389][ T5066] blk_mq_run_work_fn+0x154/0x2e4 [ 38.008403][ T5066] process_scheduled_works+0x91c/0x1250 [ 38.009626][ T5066] worker_thread+0x798/0xbd0 [ 38.010693][ T5066] kthread+0x304/0x3d4 [ 38.011546][ T5066] ret_from_fork+0x10/0x20 [ 38.012341][ T5066] [ 38.012341][ T5066] -> #3 (set->srcu){.+.+}-{0:0}: [ 38.013655][ T5066] __synchronize_srcu+0xc8/0x268 [ 38.014730][ T5066] synchronize_srcu+0x280/0x2e0 [ 38.015758][ T5066] blk_mq_wait_quiesce_done+0x88/0xac [ 38.016920][ T5066] blk_mq_quiesce_queue+0x70/0x8c [ 38.017984][ T5066] elevator_switch+0x128/0x38c [ 38.018875][ T5066] elevator_change+0x204/0x35c [ 38.019767][ T5066] elevator_set_default+0x190/0x2b0 [ 38.020731][ T5066] blk_register_queue+0x304/0x3dc [ 38.021671][ T5066] __add_disk+0x5c8/0xbdc [ 38.022583][ T5066] add_disk_fwnode+0xd4/0x340 [ 38.023562][ T5066] device_add_disk+0x38/0x4c [ 38.024447][ T5066] nbd_dev_add+0x594/0x884 [ 38.025268][ T5066] nbd_init+0x174/0x19c [ 38.026112][ T5066] do_one_initcall+0x274/0x9f8 [ 38.027056][ T5066] do_initcall_level+0x12c/0x1c4 [ 38.028048][ T5066] do_initcalls+0x70/0xd0 [ 38.028939][ T5066] do_basic_setup+0x7c/0x90 [ 38.029733][ T5066] kernel_init_freeable+0x258/0x398 [ 38.030610][ T5066] kernel_init+0x28/0x1e0 [ 38.031445][ T5066] ret_from_fork+0x10/0x20 [ 38.032361][ T5066] [ 38.032361][ T5066] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 38.033820][ T5066] __mutex_lock+0x164/0x1078 [ 38.034922][ T5066] mutex_lock_nested+0x24/0x30 [ 38.035942][ T5066] elevator_change+0x188/0x35c [ 38.036899][ T5066] elevator_set_none+0xa8/0x13c [ 38.037885][ T5066] blk_mq_update_nr_hw_queues+0x4c4/0x11e0 [ 38.038883][ T5066] nbd_start_device+0x15c/0xa44 [ 38.039728][ T5066] nbd_genl_connect+0xde4/0x12b0 [ 38.040579][ T5066] genl_family_rcv_msg_doit+0x1e4/0x2d4 [ 38.041709][ T5066] genl_rcv_msg+0x43c/0x620 [ 38.042536][ T5066] netlink_rcv_skb+0x238/0x414 [ 38.043490][ T5066] genl_rcv+0x38/0x50 [ 38.044403][ T5066] netlink_unicast+0x600/0x7f8 [ 38.045473][ T5066] netlink_sendmsg+0x648/0x948 [ 38.046450][ T5066] __sock_sendmsg+0xc8/0x17c [ 38.047531][ T5066] __sys_sendto+0x250/0x328 [ 38.048599][ T5066] __arm64_sys_sendto+0xec/0x10c [ 38.049681][ T5066] invoke_syscall+0x98/0x244 [ 38.050643][ T5066] el0_svc_common+0xec/0x23c [ 38.051665][ T5066] do_el0_svc+0x4c/0x5c [ 38.052606][ T5066] el0_svc+0x60/0x1d8 [ 38.053511][ T5066] el0t_64_sync_handler+0x44/0x104 [ 38.054627][ T5066] el0t_64_sync+0x198/0x19c [ 38.055580][ T5066] [ 38.055580][ T5066] -> #1 (&q->q_usage_counter(io)#33){++++}-{0:0}: [ 38.057169][ T5066] blk_alloc_queue+0x488/0x590 [ 38.058243][ T5066] blk_mq_alloc_queue+0x148/0x284 [ 38.059342][ T5066] __blk_mq_alloc_disk+0x38/0x10c [ 38.060431][ T5066] nbd_dev_add+0x3d0/0x884 [ 38.061314][ T5066] nbd_init+0x174/0x19c [ 38.062232][ T5066] do_one_initcall+0x274/0x9f8 [ 38.063093][ T5066] do_initcall_level+0x12c/0x1c4 [ 38.064025][ T5066] do_initcalls+0x70/0xd0 [ 38.064947][ T5066] do_basic_setup+0x7c/0x90 [ 38.065875][ T5066] kernel_init_freeable+0x258/0x398 [ 38.066788][ T5066] kernel_init+0x28/0x1e0 [ 38.067628][ T5066] ret_from_fork+0x10/0x20 [ 38.068463][ T5066] [ 38.068463][ T5066] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 38.069736][ T5066] __lock_acquire+0x1660/0x2b08 [ 38.070616][ T5066] lock_acquire+0x13c/0x320 [ 38.071405][ T5066] fs_reclaim_acquire+0x90/0x110 [ 38.072340][ T5066] kmem_cache_alloc_node_noprof+0x64/0x604 [ 38.073500][ T5066] kmalloc_reserve+0xc4/0x214 [ 38.074473][ T5066] __alloc_skb+0x230/0x610 [ 38.075384][ T5066] alloc_uevent_skb+0x78/0x1ec [ 38.076335][ T5066] kobject_uevent_net_broadcast+0x2d4/0x53c [ 38.077582][ T5066] kobject_uevent_env+0x518/0x944 [ 38.078649][ T5066] kobject_synth_uevent+0x25c/0x730 [ 38.079623][ T5066] uevent_store+0x34/0x84 [ 38.080493][ T5066] dev_attr_store+0x6c/0x90 [ 38.081323][ T5066] sysfs_kf_write+0xe0/0x108 [ 38.082237][ T5066] kernfs_fop_write_iter+0x260/0x3b8 [ 38.083256][ T5066] vfs_write+0x51c/0xa0c [ 38.084063][ T5066] ksys_write+0x12c/0x228 [ 38.084851][ T5066] __arm64_sys_write+0x84/0x98 [ 38.085820][ T5066] invoke_syscall+0x98/0x244 [ 38.086692][ T5066] el0_svc_common+0xec/0x23c [ 38.087546][ T5066] do_el0_svc+0x4c/0x5c [ 38.088366][ T5066] el0_svc+0x60/0x1d8 [ 38.089225][ T5066] el0t_64_sync_handler+0x44/0x104 [ 38.090185][ T5066] el0t_64_sync+0x198/0x19c [ 38.091091][ T5066] [ 38.091091][ T5066] other info that might help us debug this: [ 38.091091][ T5066] [ 38.092911][ T5066] Chain exists of: [ 38.092911][ T5066] fs_reclaim --> cpu_hotplug_lock --> uevent_sock_mutex [ 38.092911][ T5066] [ 38.095267][ T5066] Possible unsafe locking scenario: [ 38.095267][ T5066] [ 38.096680][ T5066] CPU0 CPU1 [ 38.097786][ T5066] ---- ---- [ 38.098868][ T5066] lock(uevent_sock_mutex); [ 38.099788][ T5066] lock(cpu_hotplug_lock); [ 38.101178][ T5066] lock(uevent_sock_mutex); [ 38.102591][ T5066] lock(fs_reclaim); [ 38.103373][ T5066] [ 38.103373][ T5066] *** DEADLOCK *** [ 38.103373][ T5066] [ 38.105088][ T5066] locks held by syz-executor796/5066: 5, last CPU#1: [ 38.106434][ T5066] #0: ffff0000d2c57270 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x100/0x144 [ 38.108035][ T5066] #1: ffff0000d0736460 (sb_writers#6){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c [ 38.109747][ T5066] #2: ffff0000d1ef6c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 [ 38.111735][ T5066] #3: ffff0000c76cd2d8 (kn->active#4){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1f0/0x3b8 [ 38.113591][ T5066] #4: ffff80008ae5fb20 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x24c/0x53c [ 38.115616][ T5066] [ 38.115616][ T5066] stack backtrace: [ 38.116771][ T5066] CPU: 1 UID: 0 PID: 5066 Comm: syz-executor796 Not tainted syzkaller #0 PREEMPT [ 38.118360][ T5066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 38.119964][ T5066] Call trace: [ 38.120527][ T5066] show_stack+0x2c/0x3c (C) [ 38.121281][ T5066] __dump_stack+0x30/0x40 [ 38.122017][ T5066] dump_stack_lvl+0xd8/0x12c [ 38.122753][ T5066] dump_stack+0x1c/0x28 [ 38.123467][ T5066] print_circular_bug+0x328/0x330 [ 38.124385][ T5066] check_noncircular+0x158/0x174 [ 38.125180][ T5066] __lock_acquire+0x1660/0x2b08 [ 38.126002][ T5066] lock_acquire+0x13c/0x320 [ 38.126803][ T5066] fs_reclaim_acquire+0x90/0x110 [ 38.127663][ T5066] kmem_cache_alloc_node_noprof+0x64/0x604 [ 38.128704][ T5066] kmalloc_reserve+0xc4/0x214 [ 38.129553][ T5066] __alloc_skb+0x230/0x610 [ 38.130303][ T5066] alloc_uevent_skb+0x78/0x1ec [ 38.131055][ T5066] kobject_uevent_net_broadcast+0x2d4/0x53c [ 38.132139][ T5066] kobject_uevent_env+0x518/0x944 [ 38.133196][ T5066] kobject_synth_uevent+0x25c/0x730 [ 38.134298][ T5066] uevent_store+0x34/0x84 [ 38.135231][ T5066] dev_attr_store+0x6c/0x90 [ 38.136120][ T5066] sysfs_kf_write+0xe0/0x108 [ 38.137059][ T5066] kernfs_fop_write_iter+0x260/0x3b8 [ 38.138013][ T5066] vfs_write+0x51c/0xa0c [+] Wrote 'add ' to /sys/block/nbd0/uevent (bytes: 4) [+] open /sys/block/nbd0/uevent successful. [+] Wrote 'change ' to /sys/block/nbd0/uevent (bytes: 7) [+] open /sys/class/net/lo/uevent successful. [+] Wrote 'add ' to /sys/class/net/lo/uevent (bytes: 4) [+] close(nbd_fd) successful. [*] Sleeping to allow lockdep report to flush... [ 38.138867][ T5066] ksys_write+0x12c/0x228 [ 38.139703][ T5066] __arm64_sys_write+0x84/0x98 [ 38.140512][ T5066] invoke_syscall+0x98/0x244 [ 38.141375][ T5066] el0_svc_common+0xec/0x23c [ 38.142234][ T5066] do_el0_svc+0x4c/0x5c [ 38.143009][ T5066] el0_svc+0x60/0x1d8 [ 38.143751][ T5066] el0t_64_sync_handler+0x44/0x104 [ 38.144804][ T5066] el0t_64_sync+0x198/0x19c [ 38.147895][ T4591] rxe_eth0 speed is unknown, defaulting to 1000 [+] Reproducer finished.