On Wed, Aug 25, 2021 at 10:22:21AM -0700, syzbot wrote:

Hello,

syzbot found the following issue on:

HEAD commit:    6e764bcd1cf7 Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10504885300000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2fd902af77ff1e56
dashboard link: https://syzkaller.appspot.com/bug?extid=4bb1622c9a583bb6f9f2
compiler:       Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14427606300000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=149b3cce300000

The issue was bisected to:

commit 887e975c4172d0d5670c39ead2f18ba1e4ec8133
Author: Mike Christie [off-list ref]
Date:   Tue Aug 13 16:39:51 2019 +0000

    nbd: add missing config put

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=11980ad5300000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=13980ad5300000
console output: https://syzkaller.appspot.com/x/log.txt?x=15980ad5300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4bb1622c9a583bb6f9f2@syzkaller.appspotmail.com
Fixes: 887e975c4172 ("nbd: add missing config put")

XFS is waiting on IO completion to be signalled from the block
device, and the bisect points to commit fixing a problem with a
block device processing IO timeout errors.

IOWs, the above commit is probably exposing a latent bug in the
commit that changes all the error handling in nbd to fix completion
races in IO completion. The commit message for 8f3ea35929a0 ("nbd:
handle unexpected replies better") also makes mention of races with
timeout errors, and the above commit is touching the timeout error
handling.

Josef, this one looks like it is yours...

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com