From nobody Sat Jul 25 21:20:43 2026 Received: from mail-pj2-f4.google.com (mail-pj2-f4.google.com [74.125.227.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 56A313FE645 for ; Mon, 13 Jul 2026 12:04:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.132 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944241; cv=none; b=kbkSHzw71l232yJ3gAiQmMumIdsya5uq6R+m0MPFWkOAyQBKql2id8JVczEbP8YqyjB3e40OCvxfI0FB3TiD5lrumx6lKXhXaJf3F5hq6KN92Q1hqZXDbZHmK/ZpAoMYRk4ZgeE4X7anfI3plJli85T3yfeDphOXfNoTf+2awsE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944241; c=relaxed/simple; bh=ZYPlUQQ8NxbRmIt812/pyp1086j6CiJO2t2sgFOKsSE=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=QoDli3pOIRj09gb1UvcRlaRmopJAEGJbz7GFxCF+UXHAJ2NXKMFmDhBsrikq6G9EqyborW86JWcNryEGuZ5cDWiDgbak6097JmaMZ9uDJfLCGOE6QnRdOmaCQTN3gs/DLsik2hn+wuC2B/x2vKWmkRoD6vrD8OWqbCmQwGfebi4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HjqPVD2T; arc=none smtp.client-ip=74.125.227.132 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HjqPVD2T" Received: by mail-pj2-f4.google.com with SMTP id d9443c01a7336-2cc6207127aso16014285ad.1 for ; Mon, 13 Jul 2026 05:04:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944240; x=1784549040; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=vdrPerGbmq5NMDa7g7PMgXL4m2wISq1Mdu9LzzqhMGo=; b=HjqPVD2TDoITQepsUFBIz7TpaTgvFVqECKRbZrFK3TUGhfCvLyoumpnZaRfLzJl7xK vz3mti5j3NtApZHvxcbl9TsJKfEu/NTW9l48sNmZ+9hpTNG+CeMtsbzZLwH1BO61Aalh ilPUokikmveH53mVtKN2OWDNhZGx01BoAOupJwtI6y9OqOiowcxycKNyagMHQGPdNS3j /x7J2OQDFJ9PxeeV0VqhJMHruzcdpZeb7ErqSuSRZtBA/tPJOomdL9D7YvzOvCeTrlBI k3berGHi5JnHn00t8BSMFY/cn705cUDXrDPMp2yJddQgysi3VSopu26NmCuL1d/lPNSK fI7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944240; x=1784549040; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vdrPerGbmq5NMDa7g7PMgXL4m2wISq1Mdu9LzzqhMGo=; b=Wvq0L04uv36CxsyjwkUFIcjNltVN15DRcXPcBz/QuFpNlLaRWsev04Tm0mT7ZbrIEN jT7ApGVqVMrLjwi7ZfLJBqjUO4B/MNi5NEAS+IbrNe5LDAainZTMIt8Ch0tm3cfPh3cl ZounQZcrNKgE+TKFyws/1s6CYcvWbI9427CifasQbLocPAnjNdoxSR5JUYRpbHSuNH28 nPgavmP1D0DPTp/9Slj8TipvKdGzsYMqirsj7V/nQIVmYPf0h5q9ryVKMrE9qv93ABf0 OBKx9WL+DVwstOdlYhiOCV8is51sAVVGN4BQHUb/BIA/U2tC/+9Kv3nBH32r7BySMVQb N5mQ== X-Forwarded-Encrypted: i=1; AHgh+RpHRs2y2RB2Yl9rQKH6KUa+Qtw9widOqICh9VdaMJuAuWRXgx6H9pm6nFUQ/0yrL8VITJ4dMf0DdgrL2/0=@vger.kernel.org X-Gm-Message-State: AOJu0YwLWACTaPmCGdhQfsWknteG0zYMQcv0psIwERl+KFbd919UXKNT KWNVtekOhE2ug4JcG8CXK8B1RlR+XWNPWcjDLzXkNWKmnuh5Cgr+FqitqWoTtA09t2bgprvL X-Gm-Gg: AfdE7cnFARAmF97KKJ+t+HSm6FBllc9sQNq8nlBQd66q+D+nl45Imx0nMRrUs+kZ4Ps z2tD/7DGaJhHZuTPcxwYXm06ybquh0olNy6U54TCuARBES6CFf3Ac6aA46yQR7gsQHtNiHweZwU spg5kGoFwen0A8DYm6FPRM1xgswEuxRW+8DP91nn1uorPj8r5fdQtpfBuGAM2BftSq1aIcVvu9U AgP2ASWimJSwRPI8WniGxUpqqO7Nytmfi411vBVp1rAoFdnM+s7ME0cRpwr166IYaraptZJsJGr thLBaAWTeNEaN202/OCnXe2CxnN4XKLktfzyZ5VKzRQv+CafQEUxk7IzWxOUqAuLLgraNVG2xKX Z0ybVa/oYAeOYbgGFJMM/WGEtLc9EGguSfR6b5+C8UO12vjaqQRKP6yQvYaLXOVWwMM/HgQ4ZGK DEQR2un5gvDZGKkzk2GfHr X-Received: by 2002:a17:903:350c:b0:2c9:aae1:a61a with SMTP id d9443c01a7336-2ce9eac6af3mr84428895ad.14.1783944239683; Mon, 13 Jul 2026 05:03:59 -0700 (PDT) Received: from amax.cluster.local ([115.233.223.43]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9c100adsm97053395ad.32.2026.07.13.05.03.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:03:59 -0700 (PDT) From: l1za0.sec@gmail.com To: josef@toxicpanda.com Cc: axboe@kernel.dk, linux-block@vger.kernel.org, nbd@other.debian.org, linux-kernel@vger.kernel.org, Haocheng Yu Subject: [PATCH] nbd: do not reclassify userspace sockets Date: Mon, 13 Jul 2026 20:02:42 +0800 Message-Id: <20260713120242.1284559-1-l1za0.sec@gmail.com> X-Mailer: git-send-email 2.30.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Haocheng Yu A Syzkaller-based tool we developed reported a pvqspinlock warning when one thread passes a TCP socket to NBD_SET_SOCK while another thread concurrently calls setsockopt() on the same socket: pvqspinlock: lock ... has corrupted value 0x0 sockopt_lock_sock() do_ip_setsockopt() __sys_setsockopt() NBD gets the socket with sockfd_lookup(), so the socket remains a normal userspace-visible file descriptor. Under CONFIG_DEBUG_LOCK_ALLOC, nbd_add_socket() calls nbd_reclassify_socket(), which in turn calls sock_lock_init_class_and_name(). This function resets sk_lock.owned, reinitializes sk_lock.wq, and calls spin_lock_init() on sk_lock.slock. The sock_allow_reclassification() check only samples the current socket lock state. It does not prevent a concurrent syscall from acquiring or using the socket lock immediately after the check. Reinitializing the socket lock while setsockopt() is using it can therefore clear the queued spinlock state and make the later unlock trigger the corrupted-lock warning. Only reclassify sockets that are private to the kernel before they are published. NBD accepts sockets supplied by userspace and cannot make that guarantee, so remove the NBD-specific reclassification. Signed-off-by: Haocheng Yu --- drivers/block/nbd.c | 37 ------------------------------------- 1 file changed, 37 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 8f10762e90ef..e2fe9e3308fc 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1238,42 +1238,6 @@ static struct socket *nbd_get_socket(struct nbd_devi= ce *nbd, unsigned long fd, return sock; } =20 -#ifdef CONFIG_DEBUG_LOCK_ALLOC -static struct lock_class_key nbd_key[3]; -static struct lock_class_key nbd_slock_key[3]; - -static void nbd_reclassify_socket(struct socket *sock) -{ - struct sock *sk =3D sock->sk; - - if (!sock_allow_reclassification(sk)) - return; - - switch (sk->sk_family) { - case AF_INET: - sock_lock_init_class_and_name(sk, "slock-AF_INET-NBD", - &nbd_slock_key[0], - "sk_lock-AF_INET-NBD", - &nbd_key[0]); - break; - case AF_INET6: - sock_lock_init_class_and_name(sk, "slock-AF_INET6-NBD", - &nbd_slock_key[1], - "sk_lock-AF_INET6-NBD", - &nbd_key[1]); - break; - case AF_UNIX: - sock_lock_init_class_and_name(sk, "slock-AF_UNIX-NBD", - &nbd_slock_key[2], - "sk_lock-AF_UNIX-NBD", - &nbd_key[2]); - break; - } -} -#else -static inline void nbd_reclassify_socket(struct socket *sock) {} -#endif - static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, bool netlink) { @@ -1290,7 +1254,6 @@ static int nbd_add_socket(struct nbd_device *nbd, uns= igned long arg, sock =3D nbd_get_socket(nbd, arg, &err); if (!sock) return err; - nbd_reclassify_socket(sock); =20 /* * We need to make sure we don't get any errant requests while we're base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa --=20 2.51.0