Skip to content

nbd: fix circular lock dependency between tx_lock and sk_lock#1018

Open
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1117816=>linus-master
Open

nbd: fix circular lock dependency between tx_lock and sk_lock#1018
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1117816=>linus-master

Conversation

@blktests-ci

@blktests-ci blktests-ci Bot commented Jun 29, 2026

Copy link
Copy Markdown

Pull request for series with
subject: nbd: fix circular lock dependency between tx_lock and sk_lock
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1117816

@blktests-ci

blktests-ci Bot commented Jun 29, 2026

Copy link
Copy Markdown
Author

Upstream branch: 4edcdef
series: https://patchwork.kernel.org/project/linux-block/list/?series=1117816
version: 1

@blktests-ci

blktests-ci Bot commented Jun 29, 2026

Copy link
Copy Markdown
Author

Upstream branch: dc59e4f
series: https://patchwork.kernel.org/project/linux-block/list/?series=1117816
version: 1

Move kernel_sock_shutdown() out of the tx_lock critical section to break
the circular lock dependency: tx_lock -> sk_lock (via inet_shutdown) vs
the reverse order in the block I/O submission path.

The lockdep splat shows:
  sk_lock-AF_INET6 --> &cmd->lock --> &nsock->tx_lock

When recv_work() detects a connection failure, it calls
nbd_mark_nsock_dead() under tx_lock, which calls kernel_sock_shutdown()
-> inet_shutdown() -> lock_sock(), creating the tx_lock -> sk_lock
dependency that conflicts with the reverse order in the I/O path.

Fix this by introducing a deferred shutdown mechanism:
nbd_mark_nsock_dead() records the socket needing shutdown in
nsock->shutdown_sock (with an extra file reference to prevent
use-after-free from the reconnect path), and the actual
kernel_sock_shutdown() is performed by nbd_nsock_deferred_shutdown()
after tx_lock is released at each call site. The helper uses xchg()
to guarantee the shutdown is executed exactly once even when multiple
paths race to consume it.

Fixes: f373324 ("nbd: handle single path failures gracefully")
Reported-by: syzbot+576095eed5658cbd9b63@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=576095eed5658cbd9b63
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
@blktests-ci blktests-ci Bot force-pushed the series/1117816=>linus-master branch from 1e4c4be to 575931b Compare June 29, 2026 17:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant