From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF82A4908B1 for ; Sat, 25 Jul 2026 10:55:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784976931; cv=none; b=Q8EgslN3udnZLd2eSMO4HkYhxh+NFrfaBqyLvni2qUH67/n5wDPVAYf2c8+Nsq7VkxpiETGs5OwNcplgmSUi152azf4MXcyb9weP9kTfKgKwIjsjLCrUUhf9e8w8wgu4/cEMY6Uh3Y12BiX1iySexnEX6XSKq4MqvpXj0z8gLdg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784976931; c=relaxed/simple; bh=SS8TobXjvFMVJkXagYHE2e5tGwAHWWtGIjrSz2HmSrk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LGPNReNP8oDBvzebethtOcYlziFVkW5WPVyAmUqn6WijlMzekh9Bllv1ihCHPgar/NhBg0SiBbmEzfbeAIpr7CrfHut3KGWyvqLh61MiqxLWHMmiirpEVg1+4bmfKNi5KIGGTtOf+RKl695+TMOTDrK+aYuY3tQuYR9uvr8i08Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OacspPls; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OacspPls" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E6F71F000E9; Sat, 25 Jul 2026 10:55:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784976929; bh=//oh0qIlHkc70zGVKIzVXlxHx66NpHubwDQNWNCAK6k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=OacspPlsojCvaGYg6pRSPWWikmkxjjmZVPhprBmTrGbgCSTS3jwFoB4xHanSoeoQc 3E/Xg6qysp5z7BcrVpCksa+ux85MF08ZtRwDf+djr2REzkXEsGp1+0AYFT6pCi13Kq SIT7TkCOfu94y10XixMU5fr7G/KMBTTJO+hRTT8hVm8RxUaYgFXrMKcU2GDP2N690C 47L8lGfdq/qj9VKI08KzEDvtN0kKGRN5NyH+tJmol6Z2A/ccrpn2JguxrHg9aFp9fZ 4IPzPNdTRc2EgNk+BWNiNb+hrJo2Blw6m/1bHsXVfIzqEu7G7kRqwSvcJ0lzOiSqAL 6qO0cAhFgZR5w== From: Sasha Levin To: stable@vger.kernel.org Cc: Vasiliy Kovalev , Dominique Martinet , Sasha Levin Subject: [PATCH 5.10.y 1/2] net/9p: fix infinite loop in p9_client_rpc on fatal signal Date: Sat, 25 Jul 2026 06:55:26 -0400 Message-ID: <20260725105527.1856073-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026072024-extending-list-343c@gregkh> References: <2026072024-extending-list-343c@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Vasiliy Kovalev [ Upstream commit 6b4f48728faa8bb514368f7eacda05565dea8696 ] When p9_client_rpc() is called with type P9_TFLUSH and the transport has no peer (e.g. fd transport backed by pipes with no 9p server), a fatal signal causes an infinite loop: again: err = io_wait_event_killable(req->wq, ...) /* SIGKILL wakes the task, returns -ERESTARTSYS */ if (err == -ERESTARTSYS && c->status == Connected && type == P9_TFLUSH) { sigpending = 1; clear_thread_flag(TIF_SIGPENDING); goto again; } clear_thread_flag() clears TIF_SIGPENDING before jumping back to io_wait_event_killable(). signal_pending_state() checks TIF_SIGPENDING, finds it zero, and the task goes to sleep again. The task can only wake on the next signal delivery that calls signal_wake_up() and sets TIF_SIGPENDING again. When that happens the loop repeats, clears TIF_SIGPENDING, and sleeps again indefinitely. This is triggered in practice by coredump_wait(): when a thread in a multi-threaded process causes a coredump (e.g. via SIGSYS from Syscall User Dispatch), coredump_wait() sends SIGKILL to all other threads and waits for them to call mm_release(). If one of those threads is blocked in p9_client_rpc() over an fd transport with no peer, it enters the P9_TFLUSH loop and never calls mm_release(), so coredump_wait() stalls forever: INFO: task syz.0.18:676 blocked for more than 143 seconds. Not tainted 6.12.77+ #1 task:syz.0.18 state:D stack:27600 pid:676 tgid:673 ppid:630 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5344 [inline] __schedule+0xcb4/0x5d50 kernel/sched/core.c:6724 __schedule_loop kernel/sched/core.c:6801 [inline] schedule+0xe5/0x350 kernel/sched/core.c:6816 schedule_timeout+0x253/0x290 kernel/time/timer.c:2593 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common+0x409/0x600 kernel/sched/completion.c:116 wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion_state+0x1d/0x40 kernel/sched/completion.c:264 coredump_wait fs/coredump.c:448 [inline] do_coredump+0x854/0x4350 fs/coredump.c:629 get_signal+0x1425/0x2730 kernel/signal.c:2903 arch_do_signal_or_restart+0x81/0x880 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xf9/0x160 kernel/entry/common.c:218 do_syscall_64+0x102/0x220 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix: check fatal_signal_pending() before clearing TIF_SIGPENDING in the P9_TFLUSH retry loop. At that point TIF_SIGPENDING is still set, so fatal_signal_pending() works correctly. If a fatal signal is pending, jump to recalc_sigpending to restore TIF_SIGPENDING and return -ERESTARTSYS to the caller. The same defect is present in stable kernels back to 5.4. On those kernels the infinite loop is broken earlier by a second SIGKILL from the parent process (e.g. kill_and_wait() retrying after a timeout), resulting in a zombie process and a shutdown delay rather than a permanent D-state hang, but the underlying flaw is the same. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 91b8534fa8f5 ("9p: make rpc code common and rework flush code") Closes: https://syzkaller.appspot.com/bug?extid=3ce7863f8fc836a427e7 Cc: stable@vger.kernel.org Signed-off-by: Vasiliy Kovalev Message-ID: <20260415155237.182891-1-kovalev@altlinux.org> Signed-off-by: Dominique Martinet [ adjusted context to match the older parenthesized `if ((err == -ERESTARTSYS) && ...)` condition style ] Signed-off-by: Sasha Levin --- net/9p/client.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/9p/client.c b/net/9p/client.c index f49f5fd98ad820..1bcab7176e5f89 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -771,6 +771,8 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...) if ((err == -ERESTARTSYS) && (c->status == Connected) && (type == P9_TFLUSH)) { + if (fatal_signal_pending(current)) + goto recalc_sigpending; sigpending = 1; clear_thread_flag(TIF_SIGPENDING); goto again; -- 2.53.0