Forwarded: Re: [syzbot] [kernel?] INFO: task hung in restrict_one_thread_callback

[syzbot <syzbot+7ea2f5e9dfd468201817@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [kernel?] INFO: task hung in restrict_one_thread_callback
Author: dingyihan@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 635c467cc14e

--- a/security/landlock/tsync.c
+++ b/security/landlock/tsync.c
@@ -447,6 +447,12 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred,
 	shared_ctx.new_cred = new_cred;
 	shared_ctx.set_no_new_privs = task_no_new_privs(current);
 
+	/*
+	 * Serialize concurrent TSYNC operations to prevent deadlocks
+	 * when multiple threads call landlock_restrict_self() simultaneously.
+	 */
+	down_write(&current->signal->exec_update_lock);
+
 	/*
 	 * We schedule a pseudo-signal task_work for each of the calling task's
 	 * sibling threads.  In the task work, each thread:
@@ -527,14 +533,17 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred,
 					   -ERESTARTNOINTR);
 
 				/*
-				 * Cancel task works for tasks that did not start running yet,
-				 * and decrement all_prepared and num_unfinished accordingly.
+				 * Opportunistic improvement: try to cancel task works
+				 * for tasks that did not start running yet. We do not
+				 * have a guarantee that it cancels any of the enqueued
+				 * task works (because task_work_run() might already have
+				 * dequeued them).
 				 */
 				cancel_tsync_works(&works, &shared_ctx);
 
 				/*
-				 * The remaining task works have started running, so waiting for
-				 * their completion will finish.
+				 * We must wait for the remaining task works to finish to
+				 * prevent a use-after-free of the local shared_ctx.
 				 */
 				wait_for_completion(&shared_ctx.all_prepared);
 			}
@@ -557,5 +566,7 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred,
 
 	tsync_works_release(&works);
 
+	up_write(&current->signal->exec_update_lock);
+
 	return atomic_read(&shared_ctx.preparation_error);
 }


在 2026/2/24 12:08, syzbot 写道:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
>  team0: Port device team_slave_1 added
> [   77.956359][ T5910] batman_adv: batadv0: Adding interface: batadv_slave_0
> [   77.963600][ T5910] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   77.989888][ T5910] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
> [   78.004522][ T5910] batman_adv: batadv0: Adding interface: batadv_slave_1
> [   78.011605][ T5910] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   78.038002][ T5910] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
> [   78.080982][ T5910] hsr_slave_0: entered promiscuous mode
> [   78.087753][ T5910] hsr_slave_1: entered promiscuous mode
> [   78.233618][ T5910] netdevsim netdevsim0 netdevsim0: renamed from eth0
> [   78.246125][ T5910] netdevsim netdevsim0 netdevsim1: renamed from eth1
> [   78.256883][ T5910] netdevsim netdevsim0 netdevsim2: renamed from eth2
> [   78.267118][ T5910] netdevsim netdevsim0 netdevsim3: renamed from eth3
> [   78.297441][ T5910] bridge0: port 2(bridge_slave_1) entered blocking state
> [   78.304646][ T5910] bridge0: port 2(bridge_slave_1) entered forwarding state
> [   78.312595][ T5910] bridge0: port 1(bridge_slave_0) entered blocking state
> [   78.319734][ T5910] bridge0: port 1(bridge_slave_0) entered forwarding state
> [   78.384207][ T5910] 8021q: adding VLAN 0 to HW filter on device bond0
> [   78.404563][ T1004] bridge0: port 1(bridge_slave_0) entered disabled state
> [   78.413314][ T1004] bridge0: port 2(bridge_slave_1) entered disabled state
> [   78.428785][ T5910] 8021q: adding VLAN 0 to HW filter on device team0
> [   78.443104][   T65] bridge0: port 1(bridge_slave_0) entered blocking state
> [   78.450377][   T65] bridge0: port 1(bridge_slave_0) entered forwarding state
> [   78.464952][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
> [   78.472313][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
> [   78.645479][ T5910] 8021q: adding VLAN 0 to HW filter on device batadv0
> [   78.696816][ T5910] veth0_vlan: entered promiscuous mode
> [   78.709183][ T5910] veth1_vlan: entered promiscuous mode
> [   78.745020][ T5910] veth0_macvtap: entered promiscuous mode
> [   78.756102][ T5910] veth1_macvtap: entered promiscuous mode
> [   78.779292][ T5910] batman_adv: batadv0: Interface activated: batadv_slave_0
> [   78.795080][ T5910] batman_adv: batadv0: Interface activated: batadv_slave_1
> [   78.812914][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
> [   78.824397][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
> [   78.840142][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
> [   78.850096][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
> [   78.975137][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> [   79.080924][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> [   79.141701][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> [   79.219381][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> 2026/02/24 04:06:47 executed programs: 0
> [   79.336447][ T5143] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
> [   79.347436][ T5143] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
> [   79.355112][ T5143] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
> [   79.363931][ T5143] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
> [   79.372285][ T5143] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
> [   79.509332][ T5936] chnl_net:caif_netlink_parms(): no params data found
> [   79.580835][ T5936] bridge0: port 1(bridge_slave_0) entered blocking state
> [   79.588539][ T5936] bridge0: port 1(bridge_slave_0) entered disabled state
> [   79.596107][ T5936] bridge_slave_0: entered allmulticast mode
> [   79.603587][ T5936] bridge_slave_0: entered promiscuous mode
> [   79.613548][ T5936] bridge0: port 2(bridge_slave_1) entered blocking state
> [   79.620886][ T5936] bridge0: port 2(bridge_slave_1) entered disabled state
> [   79.628076][ T5936] bridge_slave_1: entered allmulticast mode
> [   79.635811][ T5936] bridge_slave_1: entered promiscuous mode
> [   79.673346][ T5936] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
> [   79.687123][ T5936] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
> [   79.721491][ T5936] team0: Port device team_slave_0 added
> [   79.729676][ T5936] team0: Port device team_slave_1 added
> [   79.759645][ T5936] batman_adv: batadv0: Adding interface: batadv_slave_0
> [   79.766762][ T5936] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   79.793316][ T5936] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
> [   79.806250][ T5936] batman_adv: batadv0: Adding interface: batadv_slave_1
> [   79.816021][ T5936] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   79.842146][ T5936] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
> [   79.891341][ T5936] hsr_slave_0: entered promiscuous mode
> [   79.898314][ T5936] hsr_slave_1: entered promiscuous mode
> [   79.906509][ T5936] debugfs: 'hsr0' already exists in 'hsr'
> [   79.913302][ T5936] Cannot create hsr debugfs directory
> [   81.411273][   T51] Bluetooth: hci0: command tx timeout
> [   81.652909][   T42] cfg80211: failed to load regulatory.db
> [   81.863344][   T13] bridge_slave_1: left allmulticast mode
> [   81.869093][   T13] bridge_slave_1: left promiscuous mode
> [   81.875947][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
> [   81.886804][   T13] bridge_slave_0: left allmulticast mode
> [   81.895320][   T13] bridge_slave_0: left promiscuous mode
> [   81.902418][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
> [   82.056915][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
> [   82.067689][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
> [   82.077661][   T13] bond0 (unregistering): Released all slaves
> [   82.165586][   T13] hsr_slave_0: left promiscuous mode
> [   82.171808][   T13] hsr_slave_1: left promiscuous mode
> [   82.177965][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
> [   82.188972][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
> [   82.201305][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
> [   82.208712][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
> [   82.224168][   T13] veth1_macvtap: left promiscuous mode
> [   82.229800][   T13] veth0_macvtap: left promiscuous mode
> [   82.235949][   T13] veth1_vlan: left promiscuous mode
> [   82.243307][   T13] veth0_vlan: left promiscuous mode
> [   82.524939][   T13] team0 (unregistering): Port device team_slave_1 removed
> [   82.542673][   T13] team0 (unregistering): Port device team_slave_0 removed
> [   82.750272][    C1] list_del corruption, ffff88802a450890->next is NULL
> [   82.757771][    C1] ------------[ cut here ]------------
> [   82.763241][    C1] kernel BUG at lib/list_debug.c:53!
> [   82.768569][    C1] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
> [   82.774843][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
> [   82.783771][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
> [   82.793910][    C1] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190
> [   82.800835][    C1] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 c7 c7 40 c1 29 8c 48 89 de e8 42 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 30 29 65 fc 90 0f 0b 4c 89
> [   82.820420][    C1] RSP: 0018:ffffc90000a08d58 EFLAGS: 00010046
> [   82.826480][    C1] RAX: 0000000000000033 RBX: ffff88802a450890 RCX: e58e7f17a2332a00
> [   82.834525][    C1] RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000
> [   82.842485][    C1] RBP: 0000000000000203 R08: ffffc90000a08ae7 R09: 1ffff9200014115c
> [   82.850447][    C1] R10: dffffc0000000000 R11: fffff5200014115d R12: 1ffff1100548a112
> [   82.858428][    C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
> [   82.866388][    C1] FS:  0000000000000000(0000) GS:ffff888125109000(0000) knlGS:0000000000000000
> [   82.875311][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   82.881921][    C1] CR2: 00007f396a9de368 CR3: 000000000e74c000 CR4: 00000000003526f0
> [   82.889883][    C1] Call Trace:
> [   82.893147][    C1]  <IRQ>
> [   82.896012][    C1]  dst_destroy+0x202/0x5a0
> [   82.900422][    C1]  ? _raw_spin_unlock_irqrestore+0x30/0x80
> [   82.906213][    C1]  ? rcu_core+0x751/0x1070
> [   82.910617][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
> [   82.915891][    C1]  rcu_core+0x7cd/0x1070
> [   82.920126][    C1]  ? __pfx_rcu_core+0x10/0x10
> [   82.924791][    C1]  ? sched_balance_domains+0x13a/0x950
> [   82.930242][    C1]  handle_softirqs+0x22a/0x870
> [   82.935088][    C1]  ? __irq_exit_rcu+0x5f/0x150
> [   82.939842][    C1]  __irq_exit_rcu+0x5f/0x150
> [   82.944421][    C1]  irq_exit_rcu+0x9/0x30
> [   82.948653][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
> [   82.954279][    C1]  </IRQ>
> [   82.957194][    C1]  <TASK>
> [   82.960106][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
> [   82.966079][    C1] RIP: 0010:pv_native_safe_halt+0xf/0x20
> [   82.971695][    C1] Code: ee 73 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 5d 10 00 fb f4 <e9> 7c ea 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
> [   82.991282][    C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000242
> [   82.997334][    C1] RAX: 0000000000045cc1 RBX: ffffffff819ad30d RCX: 0000000080000001
> [   83.005293][    C1] RDX: 0000000000000001 RSI: ffffffff8e013334 RDI: ffffffff8c29be00
> [   83.013439][    C1] RBP: ffffc90000197f10 R08: ffff8880b853395b R09: 1ffff110170a672b
> [   83.021511][    C1] R10: dffffc0000000000 R11: ffffed10170a672c R12: ffffffff9033b6b0
> [   83.029470][    C1] R13: 1ffff11003b5e000 R14: 0000000000000001 R15: 0000000000000001
> [   83.037433][    C1]  ? do_idle+0x1bd/0x500
> [   83.041683][    C1]  default_idle+0x9/0x20
> [   83.045914][    C1]  default_idle_call+0x72/0xb0
> [   83.050753][    C1]  do_idle+0x1bd/0x500
> [   83.054807][    C1]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
> [   83.060598][    C1]  ? __pfx_do_idle+0x10/0x10
> [   83.065174][    C1]  ? _raw_spin_unlock_irqrestore+0x30/0x80
> [   83.071057][    C1]  cpu_startup_entry+0x43/0x60
> [   83.075812][    C1]  start_secondary+0x101/0x110
> [   83.080648][    C1]  common_startup_64+0x13e/0x147
> [   83.085576][    C1]  </TASK>
> [   83.088575][    C1] Modules linked in:
> [   83.092472][    C1] ---[ end trace 0000000000000000 ]---
> [   83.097909][    C1] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190
> [   83.104866][    C1] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 c7 c7 40 c1 29 8c 48 89 de e8 42 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 30 29 65 fc 90 0f 0b 4c 89
> [   83.124458][    C1] RSP: 0018:ffffc90000a08d58 EFLAGS: 00010046
> [   83.130525][    C1] RAX: 0000000000000033 RBX: ffff88802a450890 RCX: e58e7f17a2332a00
> [   83.138482][    C1] RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000
> [   83.146435][    C1] RBP: 0000000000000203 R08: ffffc90000a08ae7 R09: 1ffff9200014115c
> [   83.154477][    C1] R10: dffffc0000000000 R11: fffff5200014115d R12: 1ffff1100548a112
> [   83.162435][    C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
> [   83.170390][    C1] FS:  0000000000000000(0000) GS:ffff888125109000(0000) knlGS:0000000000000000
> [   83.179304][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   83.185872][    C1] CR2: 00007f396a9de368 CR3: 000000000e74c000 CR4: 00000000003526f0
> [   83.193840][    C1] Kernel panic - not syncing: Fatal exception in interrupt
> [   83.201135][    C1] Kernel Offset: disabled
> [   83.205437][    C1] Rebooting in 86400 seconds..
> 
> 
> syzkaller build log:
> go env (err=<nil>)
> AR='ar'
> CC='gcc'
> CGO_CFLAGS='-O2 -g'
> CGO_CPPFLAGS=''
> CGO_CXXFLAGS='-O2 -g'
> CGO_ENABLED='1'
> CGO_FFLAGS='-O2 -g'
> CGO_LDFLAGS='-O2 -g'
> CXX='g++'
> GCCGO='gccgo'
> GO111MODULE='auto'
> GOAMD64='v1'
> GOARCH='amd64'
> GOAUTH='netrc'
> GOBIN=''
> GOCACHE='/syzkaller/.cache/go-build'
> GOCACHEPROG=''
> GODEBUG=''
> GOENV='/syzkaller/.config/go/env'
> GOEXE=''
> GOEXPERIMENT=''
> GOFIPS140='off'
> GOFLAGS=''
> GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3187194119=/tmp/go-build -gno-record-gcc-switches'
> GOHOSTARCH='amd64'
> GOHOSTOS='linux'
> GOINSECURE=''
> GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
> GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
> GONOPROXY=''
> GONOSUMDB=''
> GOOS='linux'
> GOPATH='/syzkaller/jobs-2/linux/gopath'
> GOPRIVATE=''
> GOPROXY='https://proxy.golang.org,direct'
> GOROOT='/usr/local/go'
> GOSUMDB='sum.golang.org'
> GOTELEMETRY='local'
> GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
> GOTMPDIR=''
> GOTOOLCHAIN='auto'
> GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
> GOVCS=''
> GOVERSION='go1.24.4'
> GOWORK=''
> PKG_CONFIG='pkg-config'
> 
> git status (err=<nil>)
> HEAD detached at 1e62d19825
> nothing to commit, working tree clean
> 
> 
> tput: No value for $TERM and no -T specified
> tput: No value for $TERM and no -T specified
> Makefile:31: run command via tools/syz-env for best compatibility, see:
> Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
> go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e62d1982527c3b4e18df04d61f2560fa1f434cc -X github.com/google/syzkaller/prog.gitRevisionDate=20260213-152336"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e62d1982527c3b4e18df04d61f2560fa1f434cc -X github.com/google/syzkaller/prog.gitRevisionDate=20260213-152336"  ./sys/syz-sysgen
> make .descriptions
> tput: No value for $TERM and no -T specified
> tput: No value for $TERM and no -T specified
> Makefile:31: run command via tools/syz-env for best compatibility, see:
> Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
> bin/syz-sysgen
> touch .descriptions
> GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e62d1982527c3b4e18df04d61f2560fa1f434cc -X github.com/google/syzkaller/prog.gitRevisionDate=20260213-152336"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
> mkdir -p ./bin/linux_amd64
> g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
> 	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
> 	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"1e62d1982527c3b4e18df04d61f2560fa1f434cc\"
> /usr/bin/ld: /tmp/ccAQ1hzd.o: in function `Connection::Connect(char const*, char const*)':
> executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
> ./tools/check-syzos.sh 2>/dev/null
> 
> 
> Error text is too large and was truncated, full error text is at:
> https://syzkaller.appspot.com/x/error.txt?x=11c2155a580000
> 
> 
> Tested on:
> 
> commit:         779cae95 Add linux-next specific files for 20260223
> git tree:       linux-next
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ee920513e4deca5f
> dashboard link: https://syzkaller.appspot.com/bug?extid=7ea2f5e9dfd468201817
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=1782455a580000
> 
>