* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2024-05-29 22:08 [syzbot] [kvm?] [net?] [virt?] " syzbot
@ 2025-08-31 2:21 ` syzbot
2025-08-31 5:53 ` Hillf Danton
` (4 more replies)
0 siblings, 5 replies; 12+ messages in thread
From: syzbot @ 2025-08-31 2:21 UTC (permalink / raw)
To: anna-maria, brauner, ebiederm, eperezma, frederic, jasowang, kvm,
linux-kernel, michael.christie, mst, netdev, oleg, seanjc,
sgarzare, stefanha, syzkaller-bugs, tglx, virtualization
syzbot has found a reproducer for the following issue on:
HEAD commit: 11e7861d680c Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17c5c242580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1671ba62580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1685aa62580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/aa8c34462d5d/disk-11e7861d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f90079573556/vmlinux-11e7861d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8571495e4fea/bzImage-11e7861d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7f3bbe59e8dd2328a990@syzkaller.appspotmail.com
INFO: task syz.0.17:6038 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:27224 pid:6038 tgid:6038 ppid:5979 task_flags:0x400040 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7058
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
__vhost_worker_flush+0x1a8/0x1d0 drivers/vhost/vhost.c:296
vhost_worker_flush drivers/vhost/vhost.c:303 [inline]
vhost_dev_flush+0xac/0x110 drivers/vhost/vhost.c:313
vhost_vsock_flush drivers/vhost/vsock.c:698 [inline]
vhost_vsock_dev_release+0x19f/0x400 drivers/vhost/vsock.c:750
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1fdc78ebe9
RSP: 002b:00007ffcf43dcf28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f1fdc9c7da0 RCX: 00007f1fdc78ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f1fdc9c7da0 R08: 0000000000000000 R09: 00000008f43dd21f
R10: 00007f1fdc9c7cb0 R11: 0000000000000246 R12: 00000000000248b9
R13: 00007ffcf43dd020 R14: ffffffffffffffff R15: 00007ffcf43dd040
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
3 locks held by kworker/u9:1/5174:
#0: ffff8880605ef148 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3211
#1: ffffc9000f89fd10 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3212
#2: ffff8880256d4dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331
2 locks held by getty/5615:
#0: ffff88814d35e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf0e/0x1260 kernel/hung_task.c:491
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 0c 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 12 16 00 fb f4 <e9> 4c 09 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197df8 EFLAGS: 000002c2
RAX: 000000000015fae9 RBX: 0000000000000001 RCX: ffffffff8b93fc29
RDX: 0000000000000000 RSI: ffffffff8de50a38 RDI: ffffffff8c162980
RBP: ffffed1003c5d488 R08: 0000000000000001 R09: ffffed10170a6655
R10: ffff8880b85332ab R11: 0000000000000000 R12: 0000000000000001
R13: ffff88801e2ea440 R14: ffffffff90ab5290 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881247b8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555d26767660 CR3: 000000000e380000 CR4: 00000000003526f0
Call Trace:
<TASK>
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:757
default_idle_call+0x6d/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:190 [inline]
do_idle+0x391/0x510 kernel/sched/idle.c:330
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:428
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:315
common_startup_64+0x13e/0x148
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 2:21 ` [syzbot] [net] [virt] " syzbot
@ 2025-08-31 5:53 ` Hillf Danton
2025-08-31 6:29 ` syzbot
2025-08-31 7:34 ` Hillf Danton
` (3 subsequent siblings)
4 siblings, 1 reply; 12+ messages in thread
From: Hillf Danton @ 2025-08-31 5:53 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Sat, 30 Aug 2025 19:21:32 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 11e7861d680c Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17c5c242580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
> dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1671ba62580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1685aa62580000
#syz test
--- x/kernel/vhost_task.c
+++ y/kernel/vhost_task.c
@@ -34,8 +34,10 @@ static int vhost_task_fn(void *data)
if (signal_pending(current)) {
struct ksignal ksig;
- if (get_signal(&ksig))
+ if (get_signal(&ksig)) {
+ vtsk->fn(vtsk->data);
break;
+ }
}
/* mb paired w/ vhost_task_stop */
--
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 5:53 ` Hillf Danton
@ 2025-08-31 6:29 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-08-31 6:29 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in __vhost_worker_flush
INFO: task syz.0.17:6534 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:26264 pid:6534 tgid:6534 ppid:6428 task_flags:0x400040 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7058
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
__vhost_worker_flush+0x1a8/0x1d0 drivers/vhost/vhost.c:296
vhost_worker_flush drivers/vhost/vhost.c:303 [inline]
vhost_dev_flush+0xac/0x110 drivers/vhost/vhost.c:313
vhost_vsock_flush drivers/vhost/vsock.c:698 [inline]
vhost_vsock_dev_release+0x19f/0x400 drivers/vhost/vsock.c:750
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f15c9b8ebe9
RSP: 002b:00007fffe67e3fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f15c9dc7da0 RCX: 00007f15c9b8ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f15c9dc7da0 R08: 0000000000000000 R09: 00000008e67e42df
R10: 00007f15c9dc7cb0 R11: 0000000000000246 R12: 000000000001d5b5
R13: 00007fffe67e40e0 R14: ffffffffffffffff R15: 00007fffe67e4100
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
5 locks held by kworker/u8:4/59:
3 locks held by kworker/u8:6/2981:
#0: ffff8880b853a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:636
#1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:220 [inline]
#1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 kernel/sched/core.c:6955
#2: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#2: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#2: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
#2: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: batadv_nc_worker+0x159/0x1030 net/batman-adv/network-coding.c:719
2 locks held by getty/5607:
#0: ffff88803612d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000362c2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf0e/0x1260 kernel/hung_task.c:491
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 0c 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 12 16 00 fb f4 <e9> 4c 09 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff8e207e08 EFLAGS: 000002c2
RAX: 000000000018d07d RBX: 0000000000000000 RCX: ffffffff8b93fc29
RDX: 0000000000000000 RSI: ffffffff8de50a38 RDI: ffffffff8c162980
RBP: fffffbfff1c52ef8 R08: 0000000000000001 R09: ffffed1017086655
R10: ffff8880b84332ab R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e2977c0 R14: ffffffff90ab5290 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881246b8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055dea603fc80 CR3: 000000000e380000 CR4: 00000000003526f0
Call Trace:
<TASK>
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:757
default_idle_call+0x6d/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:190 [inline]
do_idle+0x391/0x510 kernel/sched/idle.c:330
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:428
rest_init+0x16b/0x2b0 init/main.c:744
start_kernel+0x3ee/0x4d0 init/main.c:1097
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:307
x86_64_start_kernel+0x130/0x190 arch/x86/kernel/head64.c:288
common_startup_64+0x13e/0x148
</TASK>
Tested on:
commit: c8bc81a5 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14882242580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=121b41f0580000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 2:21 ` [syzbot] [net] [virt] " syzbot
2025-08-31 5:53 ` Hillf Danton
@ 2025-08-31 7:34 ` Hillf Danton
2025-08-31 8:17 ` syzbot
2025-08-31 8:41 ` Hillf Danton
` (2 subsequent siblings)
4 siblings, 1 reply; 12+ messages in thread
From: Hillf Danton @ 2025-08-31 7:34 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Sat, 30 Aug 2025 19:21:32 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 11e7861d680c Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17c5c242580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
> dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1671ba62580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1685aa62580000
#syz test
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -440,7 +440,9 @@ static bool vhost_run_work_list(void *da
struct vhost_worker *worker = data;
struct vhost_work *work, *work_next;
struct llist_node *node;
+ bool did = false;
+again:
node = llist_del_all(&worker->work_list);
if (node) {
__set_current_state(TASK_RUNNING);
@@ -455,9 +457,11 @@ static bool vhost_run_work_list(void *da
kcov_remote_stop();
cond_resched();
}
+ did = true;
+ goto again;
}
- return !!node;
+ return did;
}
static void vhost_worker_killed(void *data)
--
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 7:34 ` Hillf Danton
@ 2025-08-31 8:17 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-08-31 8:17 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in __vhost_worker_flush
INFO: task syz.0.17:6483 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:27928 pid:6483 tgid:6483 ppid:6379 task_flags:0x400040 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7058
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
__vhost_worker_flush+0x1a8/0x1d0 drivers/vhost/vhost.c:296
vhost_worker_flush drivers/vhost/vhost.c:303 [inline]
vhost_dev_flush+0xac/0x110 drivers/vhost/vhost.c:313
vhost_vsock_flush drivers/vhost/vsock.c:698 [inline]
vhost_vsock_dev_release+0x19f/0x400 drivers/vhost/vsock.c:750
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbbf8f8ebe9
RSP: 002b:00007ffc4fda04f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fbbf91c7da0 RCX: 00007fbbf8f8ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fbbf91c7da0 R08: 0000000000000000 R09: 000000084fda07ef
R10: 00007fbbf91c7cb0 R11: 0000000000000246 R12: 000000000001e441
R13: 00007ffc4fda05f0 R14: ffffffffffffffff R15: 00007ffc4fda0610
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
5 locks held by kworker/u8:2/35:
3 locks held by kworker/u9:1/5173:
#0: ffff88807d124148 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3211
#1: ffffc9000f90fd10 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3212
#2: ffff8880773d8dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331
2 locks held by getty/5611:
#0: ffff88814de1b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900036bb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf0e/0x1260 kernel/hung_task.c:491
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 1167 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:mark_lock+0xad/0x610 kernel/locking/lockdep.c:4722
Code: 54 24 68 65 48 2b 15 ba e6 3e 12 0f 85 e8 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc f6 46 22 03 74 8d <41> bd 00 02 00 00 bb 09 00 00 00 eb 8e 44 8b 1d ff 56 4e 19 45 85
RSP: 0000:ffffc90003e0f480 EFLAGS: 00000002
RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffffff95e3eb08
RDX: 0000000000000008 RSI: ffff888028468b90 RDI: ffff888028468000
RBP: ffffc90003e0f520 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000000a0 R11: 0000000000000001 R12: ffff888028468b90
R13: ffff888028468000 R14: 0000000000000004 R15: ffff888028468000
FS: 0000000000000000(0000) GS:ffff8881247b8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564fc0756be0 CR3: 000000000e380000 CR4: 00000000003526f0
Call Trace:
<TASK>
mark_usage kernel/locking/lockdep.c:4674 [inline]
__lock_acquire+0x3f8/0x1ce0 kernel/locking/lockdep.c:5191
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x60/0x70 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kfree+0x2b4/0x4d0 mm/slub.c:4879
skb_kfree_head net/core/skbuff.c:1047 [inline]
skb_free_head+0x114/0x210 net/core/skbuff.c:1059
skb_release_data+0x795/0x9e0 net/core/skbuff.c:1086
skb_release_all net/core/skbuff.c:1151 [inline]
__kfree_skb net/core/skbuff.c:1165 [inline]
consume_skb net/core/skbuff.c:1397 [inline]
consume_skb+0xbf/0x100 net/core/skbuff.c:1391
nsim_dev_trap_report drivers/net/netdevsim/dev.c:836 [inline]
nsim_dev_trap_report_work+0x8bd/0xcf0 drivers/net/netdevsim/dev.c:866
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: c8bc81a5 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=143cce34580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11c4ce34580000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 2:21 ` [syzbot] [net] [virt] " syzbot
2025-08-31 5:53 ` Hillf Danton
2025-08-31 7:34 ` Hillf Danton
@ 2025-08-31 8:41 ` Hillf Danton
2025-08-31 9:14 ` syzbot
2025-09-01 1:37 ` Hillf Danton
2025-09-01 6:57 ` Hillf Danton
4 siblings, 1 reply; 12+ messages in thread
From: Hillf Danton @ 2025-08-31 8:41 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Sat, 30 Aug 2025 19:21:32 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 11e7861d680c Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17c5c242580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
> dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1671ba62580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1685aa62580000
#syz test
--- a/kernel/vhost_task.c
+++ b/kernel/vhost_task.c
@@ -59,9 +59,9 @@ static int vhost_task_fn(void *data)
*/
if (!test_bit(VHOST_TASK_FLAGS_STOP, &vtsk->flags)) {
set_bit(VHOST_TASK_FLAGS_KILLED, &vtsk->flags);
- vtsk->handle_sigkill(vtsk->data);
}
mutex_unlock(&vtsk->exit_mutex);
+ vtsk->handle_sigkill(vtsk->data);
complete(&vtsk->exited);
do_exit(0);
--
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 8:41 ` Hillf Danton
@ 2025-08-31 9:14 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-08-31 9:14 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in __vhost_worker_flush
INFO: task syz.0.17:6497 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:27928 pid:6497 tgid:6497 ppid:6385 task_flags:0x400040 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7058
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
__vhost_worker_flush+0x1a8/0x1d0 drivers/vhost/vhost.c:296
vhost_worker_flush drivers/vhost/vhost.c:303 [inline]
vhost_dev_flush+0xac/0x110 drivers/vhost/vhost.c:313
vhost_vsock_flush drivers/vhost/vsock.c:698 [inline]
vhost_vsock_dev_release+0x19f/0x400 drivers/vhost/vsock.c:750
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f970df8ebe9
RSP: 002b:00007ffdf6784698 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f970e1c7da0 RCX: 00007f970df8ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f970e1c7da0 R08: 0000000000000000 R09: 00000008f678498f
R10: 00007f970e1c7cb0 R11: 0000000000000246 R12: 000000000001e9d9
R13: 00007ffdf6784790 R14: ffffffffffffffff R15: 00007ffdf67847b0
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
1 lock held by klogd/5210:
#0: ffff8880b843a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:636
2 locks held by getty/5611:
#0: ffff8880361060a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf0e/0x1260 kernel/hung_task.c:491
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 0c 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 12 16 00 fb f4 <e9> 4c 09 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197df8 EFLAGS: 000002c2
RAX: 000000000016ae1b RBX: 0000000000000001 RCX: ffffffff8b93fc29
RDX: 0000000000000000 RSI: ffffffff8de50a38 RDI: ffffffff8c162980
RBP: ffffed1003c5d488 R08: 0000000000000001 R09: ffffed10170a6655
R10: ffff8880b85332ab R11: 0000000000000000 R12: 0000000000000001
R13: ffff88801e2ea440 R14: ffffffff90ab5290 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881247b8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cc5af69be0 CR3: 000000000e380000 CR4: 00000000003526f0
Call Trace:
<TASK>
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:757
default_idle_call+0x6d/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:190 [inline]
do_idle+0x391/0x510 kernel/sched/idle.c:330
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:428
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:315
common_startup_64+0x13e/0x148
</TASK>
Tested on:
commit: c8bc81a5 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=102a7a62580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=124cc1f0580000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
[not found] <20250831080725-mutt-send-email-mst@kernel.org>
@ 2025-08-31 12:45 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-08-31 12:45 UTC (permalink / raw)
To: linux-kernel, mst, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in __vhost_worker_flush
INFO: task syz.0.17:6636 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:27880 pid:6636 tgid:6636 ppid:6529 task_flags:0x400040 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5397 [inline]
__schedule+0x116a/0x5de0 kernel/sched/core.c:6786
__schedule_loop kernel/sched/core.c:6864 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6879
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x2ff/0x4e0 kernel/sched/completion.c:116
__vhost_worker_flush+0x1cd/0x210 drivers/vhost/vhost.c:288
vhost_worker_flush drivers/vhost/vhost.c:295 [inline]
vhost_dev_flush+0xac/0x110 drivers/vhost/vhost.c:305
vhost_vsock_flush drivers/vhost/vsock.c:697 [inline]
vhost_vsock_dev_release+0x19f/0x400 drivers/vhost/vsock.c:749
__fput+0x402/0xb70 fs/file_table.c:465
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f978f78ebe9
RSP: 002b:00007ffc3ab7e268 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f978f9c7da0 RCX: 00007f978f78ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f978f9c7da0 R08: 0000000000000000 R09: 000000083ab7e55f
R10: 00007f978f9c7cb0 R11: 0000000000000246 R12: 000000000001d01b
R13: 00007ffc3ab7e360 R14: ffffffffffffffff R15: 00007ffc3ab7e380
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e5c2a40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5c2a40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e5c2a40 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6770
5 locks held by kworker/u8:2/36:
2 locks held by udevd/5203:
#0: ffff8880b843a2d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:606
#1: ffff8880b8424088 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x2c1/0x8e0 kernel/sched/psi.c:987
2 locks held by getty/5594:
#0: ffff88814dcd80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:307 [inline]
watchdog+0xf70/0x12c0 kernel/hung_task.c:470
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5154 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: hci9 hci_cmd_timeout
RIP: 0010:unwind_get_return_address+0x4e/0xa0 arch/x86/kernel/unwind_orc.c:369
Code: 7e 59 8b 03 85 c0 75 09 31 c0 5b 5d e9 0b 32 1a 0a 48 b8 00 00 00 00 00 fc ff df 48 8d 6b 48 48 89 ea 48 c1 ea 03 80 3c 02 00 <75> 36 48 8b 7b 48 e8 57 9c 19 00 85 c0 74 cf 48 b8 00 00 00 00 00
RSP: 0018:ffffc90000a08828 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffc90000a08840 RCX: ffffc90000a08794
RDX: 1ffff92000141111 RSI: ffffffff8de01fb5 RDI: ffffc90000a08840
RBP: ffffc90000a08888 R08: ffffffff913e3972 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000007c23 R12: ffffffff81a6bcc0
R13: ffffc90000a08900 R14: 0000000000000000 R15: ffff88803756c880
FS: 0000000000000000(0000) GS:ffff888124841000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffeff55cff8 CR3: 0000000028574000 CR4: 00000000003526f0
Call Trace:
<IRQ>
arch_stack_walk+0xa6/0x100 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:548
insert_work+0x36/0x230 kernel/workqueue.c:2183
__queue_work+0x97e/0x10f0 kernel/workqueue.c:2341
call_timer_fn+0x197/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1793 [inline]
__run_timers+0x569/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2061 [inline]
RIP: 0010:vprintk_emit+0x567/0x6d0 kernel/printk/printk.c:2449
Code: 00 4d 85 ed 0f 85 19 01 00 00 e8 64 59 20 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 c2 54 20 00 48 85 ed 0f 85 25 01 00 00 <e8> 44 59 20 00 45 31 c9 41 b8 01 00 00 00 31 c9 48 8d 05 00 00 00
RSP: 0018:ffffc900105c79c8 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000023 RCX: ffffffff819ac02c
RDX: ffff88803756c880 RSI: ffffffff819ac036 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff920020b8f3b
R13: 0000000000000200 R14: ffff8880212b8000 R15: ffffc900105c7a90
_printk+0xc7/0x100 kernel/printk/printk.c:2475
bt_err+0xe4/0x120 net/bluetooth/lib.c:296
hci_cmd_timeout+0x1ff/0x260 net/bluetooth/hci_core.c:1475
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: d9ea58b5 vdpa: Fix IDR memory leak in VDUSE module exit
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11068662580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4931b9b3bcbb1c4c
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 2:21 ` [syzbot] [net] [virt] " syzbot
` (2 preceding siblings ...)
2025-08-31 8:41 ` Hillf Danton
@ 2025-09-01 1:37 ` Hillf Danton
2025-09-01 2:46 ` syzbot
2025-09-01 6:57 ` Hillf Danton
4 siblings, 1 reply; 12+ messages in thread
From: Hillf Danton @ 2025-09-01 1:37 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Sat, 30 Aug 2025 19:21:32 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 11e7861d680c Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17c5c242580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
> dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1671ba62580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1685aa62580000
#syz test
--- x/drivers/vhost/vhost.c
+++ y/drivers/vhost/vhost.c
@@ -407,16 +407,14 @@ static int vhost_run_work_kthread_list(v
kthread_use_mm(dev->mm);
for (;;) {
- /* mb paired w/ kthread_stop */
- set_current_state(TASK_INTERRUPTIBLE);
-
- if (kthread_should_stop()) {
- __set_current_state(TASK_RUNNING);
- break;
- }
node = llist_del_all(&worker->work_list);
- if (!node)
+ if (!node) {
+ if (kthread_should_stop())
+ break;
+ __set_current_state(TASK_INTERRUPTIBLE);
schedule();
+ continue;
+ }
node = llist_reverse_order(node);
/* make sure flag is seen after deletion */
--
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-09-01 1:37 ` Hillf Danton
@ 2025-09-01 2:46 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-09-01 2:46 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in __vhost_worker_flush
INFO: task syz.0.17:6484 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:27928 pid:6484 tgid:6484 ppid:6375 task_flags:0x400040 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7058
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
__vhost_worker_flush+0x1a8/0x1d0 drivers/vhost/vhost.c:296
vhost_worker_flush drivers/vhost/vhost.c:303 [inline]
vhost_dev_flush+0xac/0x110 drivers/vhost/vhost.c:313
vhost_vsock_flush drivers/vhost/vsock.c:698 [inline]
vhost_vsock_dev_release+0x19f/0x400 drivers/vhost/vsock.c:750
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4ae478ebe9
RSP: 002b:00007ffe922fd5f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f4ae49c7da0 RCX: 00007f4ae478ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f4ae49c7da0 R08: 0000000000000000 R09: 00000008922fd8ef
R10: 00007f4ae49c7cb0 R11: 0000000000000246 R12: 000000000001e366
R13: 00007ffe922fd6f0 R14: ffffffffffffffff R15: 00007ffe922fd710
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e5c1260 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5c1260 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e5c1260 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
2 locks held by kworker/u8:2/36:
1 lock held by klogd/5209:
#0: ffff8880b853a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:636
2 locks held by getty/5608:
#0: ffff88814df690a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900036bb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf0e/0x1260 kernel/hung_task.c:491
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5911 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: 0x0 (wg-crypt-wg0)
RIP: 0010:schedule_debug kernel/sched/core.c:5917 [inline]
RIP: 0010:__schedule+0x1b2/0x5de0 kernel/sched/core.c:6838
Code: 80 3c 02 00 0f 85 1f 53 00 00 48 8b 85 10 ff ff ff 4c 8b 68 20 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 <0f> 85 ec 52 00 00 49 81 7d 00 9d 6e ac 57 0f 85 24 53 00 00 48 8b
RSP: 0018:ffffc900041efbc8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8b94c176
RDX: 1ffff9200083d000 RSI: ffffffff8c162980 RDI: ffff88802740c8a0
RBP: ffffc900041efd80 R08: 0000000000000000 R09: fffffbfff2156a52
R10: ffffffff90ab5297 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc900041e8000 R14: ffff8880b843a300 R15: ffff888033d59840
FS: 0000000000000000(0000) GS:ffff8881246b8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555588e15c8 CR3: 000000000e380000 CR4: 00000000003526f0
Call Trace:
<TASK>
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7058
worker_thread+0x2e5/0xf10 kernel/workqueue.c:3415
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: b320789d Linux 6.17-rc4
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16446242580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=127a4662580000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-08-31 2:21 ` [syzbot] [net] [virt] " syzbot
` (3 preceding siblings ...)
2025-09-01 1:37 ` Hillf Danton
@ 2025-09-01 6:57 ` Hillf Danton
2025-09-01 8:55 ` syzbot
4 siblings, 1 reply; 12+ messages in thread
From: Hillf Danton @ 2025-09-01 6:57 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Sat, 30 Aug 2025 19:21:32 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 11e7861d680c Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17c5c242580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
> dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1671ba62580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1685aa62580000
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3652117f8548
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush
2025-09-01 6:57 ` Hillf Danton
@ 2025-09-01 8:55 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-09-01 8:55 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in vhost_worker_flush
INFO: task syz.0.17:7125 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:26880 pid:7125 tgid:7125 ppid:7031 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5376 [inline]
__schedule+0x1049/0x5e50 kernel/sched/core.c:6688
__schedule_loop kernel/sched/core.c:6763 [inline]
schedule+0xe9/0x2f0 kernel/sched/core.c:6778
schedule_timeout+0x25b/0x2a0 kernel/time/timer.c:2143
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x3e4/0x600 kernel/sched/completion.c:116
vhost_worker_flush+0xc5/0x100 drivers/vhost/vhost.c:293
vhost_dev_flush+0xaa/0x190 drivers/vhost/vhost.c:307
vhost_vsock_flush drivers/vhost/vsock.c:693 [inline]
vhost_vsock_dev_release+0x1a5/0x400 drivers/vhost/vsock.c:745
__fput+0x270/0xb80 fs/file_table.c:394
task_work_run+0x14f/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x217/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x1e/0x60 kernel/entry/common.c:296
do_syscall_64+0x53/0x120 arch/x86/entry/common.c:88
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9fadd8ebe9
RSP: 002b:00007ffc203f0568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f9fadfc7da0 RCX: 00007f9fadd8ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f9fadfc7da0 R08: 0000000000000000 R09: 00000008203f085f
R10: 00007f9fadfc7cb0 R11: 0000000000000246 R12: 0000000000023e71
R13: 00007ffc203f0660 R14: ffffffffffffffff R15: 00007ffc203f0680
</TASK>
Showing all locks held in the system:
2 locks held by kworker/u4:0/11:
1 lock held by khungtaskd/28:
#0: ffffffff8d9b4320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline]
#0: ffffffff8d9b4320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
#0: ffffffff8d9b4320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6613
2 locks held by kworker/u4:11/2965:
2 locks held by getty/5543:
#0: ffff888030e8a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000325e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xfb3/0x1460 drivers/tty/n_tty.c:2201
1 lock held by syz.0.17/7125:
#0: ffff888028c3c470 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
1 lock held by syz.1.18/7168:
#0: ffff888066b28b70 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
1 lock held by syz.2.19/7204:
#0: ffff888073648070 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
2 locks held by kworker/0:5/7217:
#0: ffff88801a476938 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x788/0x15e0 kernel/workqueue.c:2605
#1: ffffc90003717d80 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7ea/0x15e0 kernel/workqueue.c:2606
1 lock held by syz.3.20/7235:
#0: ffff888028fcbf70 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
1 lock held by syz.4.21/7271:
#0: ffff888030fdb670 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
1 lock held by syz.5.22/7308:
#0: ffff88806680fc70 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
1 lock held by syz.6.23/7350:
#0: ffff888030a54070 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
1 lock held by syz.7.24/7386:
#0: ffff888073602a70 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
1 lock held by syz.8.25/7422:
#0: ffff88801ff7d570 (&worker->mutex){+.+.}-{4:4}, at: vhost_dev_flush+0xeb/0x190 drivers/vhost/vhost.c:302
2 locks held by syz-executor/7426:
#0: ffffffff8f562fe8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
#0: ffffffff8f562fe8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x372/0xe10 net/core/rtnetlink.c:6555
#1: ffffffff8d9bfd78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:293 [inline]
#1: ffffffff8d9bfd78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x6b5/0x800 kernel/rcu/tree_exp.h:996
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf95/0x1220 kernel/hung_task.c:379
kthread+0x2c6/0x3b0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5135 Comm: klogd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:get_current arch/x86/include/asm/current.h:41 [inline]
RIP: 0010:write_comp_data+0x9/0x90 kernel/kcov.c:235
Code: 8b 80 f0 15 00 00 c3 cc cc cc cc 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 49 89 d2 49 89 f8 49 89 f1 <65> 48 8b 14 25 40 bc 03 00 65 8b 05 2f 3f 77 7e a9 00 01 ff 00 74
RSP: 0018:ffffc900032074b8 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffffc90003207540 RCX: ffffffff813cdcda
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000002 R11: ffff88807de2a400 R12: ffffffff905d514c
R13: ffffffff905d5151 R14: 0000000000000002 R15: ffffc90003207575
FS: 00007f1b8d59bc80(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fca41409e9c CR3: 0000000033162000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
unwind_next_frame+0x5ea/0x2390 arch/x86/kernel/unwind_orc.c:505
arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x90/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc_node_track_caller+0x5a/0x90 mm/slab_common.c:1027
kmalloc_reserve+0xef/0x260 net/core/skbuff.c:582
__alloc_skb+0x12b/0x330 net/core/skbuff.c:651
alloc_skb include/linux/skbuff.h:1286 [inline]
alloc_skb_with_frags+0xdb/0x700 net/core/skbuff.c:6331
sock_alloc_send_pskb+0x7f4/0x980 net/core/sock.c:2780
unix_dgram_sendmsg+0x455/0x1c40 net/unix/af_unix.c:1976
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x4b0/0x510 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x43/0x120 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f1b8d6eb407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcc76a21e0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f1b8d59bc80 RCX: 00007f1b8d6eb407
RDX: 0000000000000039 RSI: 00007ffcc76a2320 RDI: 0000000000000003
RBP: 00007ffcc76a2750 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffcc76a2768
R13: 00007ffcc76a2320 R14: 000000000000001e R15: 00007ffcc76a2320
</TASK>
Tested on:
commit: 3652117f eventfd: simplify eventfd_signal()
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17e36242580000
kernel config: https://syzkaller.appspot.com/x/.config?x=72e26fe183bbe37e
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3bbe59e8dd2328a990
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2025-09-01 8:55 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20250831080725-mutt-send-email-mst@kernel.org>
2025-08-31 12:45 ` [syzbot] [net] [virt] INFO: task hung in __vhost_worker_flush syzbot
2024-05-29 22:08 [syzbot] [kvm?] [net?] [virt?] " syzbot
2025-08-31 2:21 ` [syzbot] [net] [virt] " syzbot
2025-08-31 5:53 ` Hillf Danton
2025-08-31 6:29 ` syzbot
2025-08-31 7:34 ` Hillf Danton
2025-08-31 8:17 ` syzbot
2025-08-31 8:41 ` Hillf Danton
2025-08-31 9:14 ` syzbot
2025-09-01 1:37 ` Hillf Danton
2025-09-01 2:46 ` syzbot
2025-09-01 6:57 ` Hillf Danton
2025-09-01 8:55 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).