INFO: task hung in nbd_start_device_ioctl

[Wei Chen]

Dear Linux Developer,

Recently when using our tool to fuzz kernel, the following crash was triggered.

HEAD commit: 094226ad94f4 Linux v6.1-rc5
git tree: upstream
compiler: clang 12.0.1
console output:
https://drive.google.com/file/d/15f5Of5MfU2zv-Kk71lgn5gMprC0hhE75/view?usp=share_link
syz reproducer:
https://drive.google.com/file/d/128ClGPSxby6Rc2IiL5dVkWUTbI8xXQjV/view?usp=share_link
C reproducer: https://drive.google.com/file/d/1965s5haTl1NQm6ShugukIVbyOih3pG0L/view?usp=share_link
kernel config: https://drive.google.com/file/d/1TdPsg_5Zon8S2hEFpLBWjb8Tnd2KA5WJ/view?usp=share_link

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: Wei Chen <harperchen1110@xxxxxxxxx>

INFO: task syz-executor.0:10784 blocked for more than 143 seconds.
      Not tainted 6.1.0-rc5 #40
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:20792 pid:10784 ppid:6618   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5191 [inline]
 __schedule+0xbbd/0x1130 kernel/sched/core.c:6503
 schedule+0xcb/0x190 kernel/sched/core.c:6579
 schedule_timeout+0x98/0x2f0 kernel/time/timer.c:1911
 do_wait_for_common+0x3ea/0x560 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x46/0x60 kernel/sched/completion.c:138
 __flush_workqueue+0x75a/0x16a0 kernel/workqueue.c:2861
 nbd_start_device_ioctl+0x41f/0x600 drivers/block/nbd.c:1419
 __nbd_ioctl drivers/block/nbd.c:1481 [inline]
 nbd_ioctl+0x28c/0x5b0 drivers/block/nbd.c:1521
 blkdev_ioctl+0x3a6/0x770 block/ioctl.c:614
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f389c28bded
RSP: 002b:00007f389d3a2c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f389c3abf80 RCX: 00007f389c28bded
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004
RBP: 00007f389c2f8ce0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f389c3abf80
R13: 00007ffd6fa63d3f R14: 00007ffd6fa63ee0 R15: 00007f389d3a2dc0
 </TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8cd20d30 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at:
rcu_tasks_one_gp+0x30/0xbd0 kernel/rcu/tasks.h:507
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8cd21530 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3},
at: rcu_tasks_one_gp+0x30/0xbd0 kernel/rcu/tasks.h:507
1 lock held by khungtaskd/22:
 #0: ffffffff8cd20b60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
1 lock held by in:imklog/6512:
 #0: ffff888018cd2fe8 (&f->f_pos_lock){+.+.}-{3:3}, at:
__fdget_pos+0x23a/0x2d0 fs/file.c:1037
2 locks held by kworker/u3:2/6623:
 #0: ffff88801a58f938 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at:
process_one_work+0x7bc/0x11a0
 #1: ffffc9000b42fd20 ((work_completion)(&args->work)){+.+.}-{0:0},
at: process_one_work+0x7fb/0x11a0 kernel/workqueue.c:2264

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 22 Comm: khungtaskd Not tainted 6.1.0-rc5 #40
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
 nmi_cpu_backtrace+0x467/0x4f0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x19c/0x3e0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xcf5/0xd40 kernel/hung_task.c:377
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Best,
Wei