Skip to content

nbd: fix circular lock dependency in nbd_disconnect_and_put#1022

Open
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1118610=>linus-master
Open

nbd: fix circular lock dependency in nbd_disconnect_and_put#1022
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1118610=>linus-master

Conversation

@blktests-ci

@blktests-ci blktests-ci Bot commented Jun 30, 2026

Copy link
Copy Markdown

Pull request for series with
subject: nbd: fix circular lock dependency in nbd_disconnect_and_put
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1118610

Move flush_workqueue() out of the config_lock critical section in
nbd_disconnect_and_put() to break a circular lock dependency.

The lockdep splat shows:

  config_lock -> (wq_completion)nbd0-recv
    from nbd_disconnect_and_put() holding config_lock then calling
    flush_workqueue() which waits for recv_work to complete.

  (work_completion)(&args->work) -> config_lock
    from recv_work() -> nbd_config_put() -> refcount_dec_and_mutex_lock()
    which may acquire config_lock when the last reference is dropped.

Fix by splitting the config_lock region: first hold config_lock to
perform nbd_disconnect(), sock_shutdown(), and clear NBD_RT_BOUND (to
prevent nbd_genl_reconfigure from queueing new recv_work during the
window), then release config_lock before flush_workqueue(), and
re-acquire it for nbd_clear_que(). This is safe because:

- sock_shutdown() ensures recv_work will observe errors and exit
- NBD_RT_BOUND cleared prevents concurrent reconfigure from reconnecting
- flush_workqueue() guarantees all recv_work has completed before
  the second config_lock section clears the queue

Fixes: e2daec4 ("nbd: Fix hungtask when nbd_config_put")
Reported-by: syzbot+3add0454d5a2619b8e80@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3add0454d5a2619b8e80
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
@blktests-ci

blktests-ci Bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Upstream branch: dc59e4f
series: https://patchwork.kernel.org/project/linux-block/list/?series=1118610
version: 1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant