From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp153-141.sina.com.cn (smtp153-141.sina.com.cn [61.135.153.141]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4993839C015 for ; Tue, 1 Sep 2026 07:34:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=61.135.153.141 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788248056; cv=none; b=Hfir+A8mtM0eIDVmmYSUKqW0FfLxsBw2IMD5FS+XWLqVS1rsWgVLU1W8MVJAsnHlrFByx543JNPLXk4TuXpPoZDQJbsGYKhq+S/KziZEvubKZ5wK47+V+gOUTYJylK4H8UnN8qUE5zDUC4rA9cxbOsxKiokjAN2O2HwpIceoER8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788248056; c=relaxed/simple; bh=AVk2jaYAaxPHdURwWUpd81WgqmUDxFKM81FZdEzAmMY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=P+KaoDYmo0JOddbc70wGhb2nzwA66ejARySWTo6jM3fPa/NlTQ5DelT6sWouaTC7KyOoaAEb7XheP/L+pYnwxqozrBAaxnSJvOIuABUrlHTiY2MW1hZWwI/colHsTMHmGo5KzyacpqHGrjDeIlHdAj8ndz2OddtMHii4c8lTCTU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b=mcFMvOHv; arc=none smtp.client-ip=61.135.153.141 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b="mcFMvOHv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1788248049; bh=idCKI41xL6eW0IArlfOceSxUfotk8ao1yFL3ygF/FOQ=; h=From:Subject:Date:Message-ID; b=mcFMvOHv4rzC/nfvve9Kfw32NpbHrF4SufncMjBEWOstNr/qOAIIWF6v1lMDs8Ipc gzf2bNhbmd8ZDKHv5DCunin1jrrdAEZqqmfPbh3xt7wKTyGJkUoP4ZxTHJnjAuhHiU cHp7omUb65Bfxh45ah/2xQadTKpKatcrcxqrcN2I= X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([114.249.62.194]) by sina.com (10.54.253.31) with ESMTP id 6A967FE100004F60; Tue, 1 Sep 2026 15:33:59 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 5567576815996 X-SMAIL-UIID: ACF6028F0FBE404389B51991927F13F0-20260901-153359-1 From: Hillf Danton To: Sean Christopherson Cc: syzbot , david@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, pbonzini@redhat.com, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [kvm?] INFO: task hung in kvm_gmem_release Date: Tue, 1 Sep 2026 15:33:42 +0800 Message-ID: <20260901073343.2002-1-hdanton@sina.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: kvm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Mon, 31 Aug 2026 08:15:44 -0700 Sean Christopherson wrote: >On Mon, Aug 31, 2026, syzbot wrote: >> Hello, >> >> syzbot found the following issue on: >> >> HEAD commit: 08dbfad3f504 Merge tag 'for-linus' of git://git.kernel.org.. >> git tree: upstream >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12ee0349580000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e >> dashboard link: https://syzkaller.appspot.com/bug?extid=6895ff73d58c59e653ba >> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1153ee25580000 >> >> Downloadable assets: >> disk image: https://storage.googleapis.com/syzbot-assets/ddff5719ec3b/disk-08dbfad3.raw.xz >> vmlinux: https://storage.googleapis.com/syzbot-assets/4b5e39b20fa5/vmlinux-08dbfad3.xz >> kernel image: https://storage.googleapis.com/syzbot-assets/eb1f70eed57f/bzImage-08dbfad3.xz >> >> IMPORTANT: if you fix the issue, please add the following tag to the commit: >> Reported-by: syzbot+6895ff73d58c59e653ba@syzkaller.appspotmail.com >> >> INFO: task syz.0.17:6104 blocked for more than 143 seconds. >> Not tainted syzkaller #0 >> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. >> task:syz.0.17 state:D stack:25544 pid:6104 tgid:6104 ppid:5900 task_flags:0x400040 flags:0x00080003 >> Call Trace: >> >> context_switch kernel/sched/core.c:5520 [inline] >> __schedule+0x17d4/0x5820 kernel/sched/core.c:7270 >> __schedule_loop kernel/sched/core.c:7347 [inline] >> schedule+0x164/0x2b0 kernel/sched/core.c:7362 >> schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7419 >> __mutex_lock+0 >> __mutex_lock_common kernel/locking/mutex.c:726 [inline] >> __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 >> kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 >> __fput+0x418/0xa50 fs/file_table.c:512 >> task_work_run+0x1d9/0x270 kernel/task_work.c:233 >> ptrace_notify+0x27c/0x2b0 kernel/signal.c:2524 >> ptrace_report_syscall include/linux/ptrace.h:416 [inline] >> ptrace_report_syscall_exit+0x2d/0x50 include/linux/ptrace.h:477 >> arch_ptrace_report_syscall_exit include/linux/entry-common.h:233 [inline] >> syscall_exit_work include/linux/entry-common.h:266 [inline] >> syscall_exit_to_user_mode_work include/linux/entry-common.h:297 [inline] >> syscall_exit_to_user_mode include/linux/entry-common.h:334 [inline] >> do_syscall_64+0x4a0/0x520 arch/x86/entry/syscall_64.c:89 >> entry_SYSCALL_64_after_hwframe+0x77/0x7f > >... > >> CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 >> RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:409 >> Code: e8 4e e8 55 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 1f b0 c5 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 5a cc 74 06 cc 44 89 f9 80 e1 07 >> RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 >> RAX: 1ffffffff35a5e00 RBX: 00000000000003fd RCX: 0000000000000000 >> RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 >> RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 >> R10: dffffc0000000000 R11: ffffffff8571cb00 R12: dffffc0000000000 >> R13: 0000000000000000 R14: ffffffff9ad2f0c0 R15: 0000000000000000 >> FS: 0000000000000000(0000) GS:ffff888124ddc000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 0000557adc994a38 CR3: 00000000772ec000 CR4: 00000000003526f0 >> Call Trace: >> >> serial_in drivers/tty/serial/8250/8250.h:128 [inline] >> serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] >> wait_for_lsr+0x184/0x2f0 drivers/tty/serial/8250/8250_port.c:2013 >> serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3270 [inline] >> __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3345 >> serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] >> __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3429 [inline] >> serial8250_console_write+0xaa1/0x1200 drivers/tty/serial/8250/8250_port.c:3493 >> nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 >> nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] >> nbcon_kthread_func+0x679/0x880 kernel/printk/nbcon.c:1271 >> kthread+0x38b/0x480 kernel/kthread.c:436 >> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 >> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 >> > > Marking this invalid, as I'm 99.9% certain guest_memfd is an innocent bystander. > CPU1 is stuck on an IN instruction (the actual port I/O), and there are a handful > of identical failures in random subsystems that pop up a few times a month[*]. > My guess is the host side of the serial port is going out to lunch intermittently. > > [*] https://lore.kernel.org/all/?q=%22io_serial_in%22%20syzkaller > > #syz invalid > The 0.1% uncertainty hints this invalid mark is NOT true or at least earlier than thought, because a) the IN instruction is not kvm specific [11] and b) the i2c hang [11] is i2c specific [12]. [11] Subject: [syzbot] [i2c?] [usb?] INFO: task hung in em28xx_i2c_unregister https://lore.kernel.org/lkml/6a95ef74.764875ec.b345.0003.GAE@google.com/ [12] Subject: [syzbot] [i2c?] [usb?] INFO: task hung in em28xx_i2c_unregister https://lore.kernel.org/lkml/6a9676c7.764875ec.b345.0007.GAE@google.com/ That said, extra evidence is needed to prove that the serial port is going out to lunch on the host side.