[syzbot] [block?] WARNING: lock held when returning to user space in elevator_change

[syzbot] [block?] WARNING: lock held when returning to user space in elevator_change

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    151a134a4e6e Add linux-next specific files for 20261027
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=113ab295580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f530fbb08d65d27a
dashboard link: https://syzkaller.appspot.com/bug?extid=48ca80a8587c1d97c433
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1422b721580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c1d27f58c2b6/disk-151a134a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c2670074ce19/vmlinux-151a134a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1588f5d40496/bzImage-151a134a.xz

AI-generated root cause summary:
A race condition exists between concurrent DM_TABLE_LOAD and DM_DEV_REMOVE
operations on a device-mapper mapped device. In __dm_destroy(),
blk_mark_disk_dead() is invoked to mark the queue dying and start queue draining
before waiting for mapped_device holders to drain, allowing
blk_freeze_set_owner() to overwrite q->mq_freeze_queue_dying on the request
queue after another thread in table_load() freezes the queue via
elevator_change(). Consequently, blk_unfreeze_release_lock() observes
q->mq_freeze_queue_dying as true and skips releasing the lockdep map for
&q->q_usage_counter, triggering a lockdep warning upon returning to userspace.

full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=48ca80a8587c1d97c433

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+48ca80a8587c1d97c433@syzkaller.appspotmail.com

device-mapper: ioctl: device has been removed from the dev hash table.
================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
syz.1.593/7980 is leaving the kernel with locks still held!
locks held by syz.1.593/7980: 1, last CPU#1:
 #0: ffff888030823878 (&q->q_usage_counter(queue)#53){+.+.}-{0:0}, at: blk_mq_freeze_queue include/linux/blk-mq.h:953 [inline]
 #0: ffff888030823878 (&q->q_usage_counter(queue)#53){+.+.}-{0:0}, at: elevator_change+0x194/0x480 block/elevator.c:668


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup