For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] BUG: sleeping function called from invalid context in null_insert_page
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Reported-by: syzbot+95fdab36405e5ffdb680@syzkaller.appspotmail.com

diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 6beb1f5b7..e22e79b02 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1861,8 +1861,15 @@ static int null_init_global_tag_set(void)
 		tag_set.flags |= BLK_MQ_F_NO_SCHED_BY_DEFAULT;
 	if (g_shared_tag_bitmap)
 		tag_set.flags |= BLK_MQ_F_TAG_HCTX_SHARED;
-	if (g_blocking)
-		tag_set.flags |= BLK_MQ_F_BLOCKING;
+	/*
+	 * Shared tag sets can be used by memory-backed devices, which may
+	 * sleep in ->queue_rq() while allocating a page.  The flag cannot be
+	 * changed after the tag set is allocated, so always mark shared tag
+	 * sets as blocking.  blk-mq will then use an SRCU read lock instead
+	 * of an RCU read lock around dispatch and the allocation is allowed
+	 * to sleep.
+	 */
+	tag_set.flags |= BLK_MQ_F_BLOCKING;
 
 	error = null_init_tag_set(&tag_set, g_poll_queues);
 	if (error)