Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <CAJfpegsNzxc3c=ojjYHgdiKiHXXutOkKCUAO131cifwKyLhqOg@mail.gmail.com>
References: <000000000000c25cca0579982a05@google.com> <CACT4Y+YLFp4OXRyroL8coE5Mw6yMdbajKPeu8kzkHunVGypx0Q@mail.gmail.com>
 <CAJfpegsNzxc3c=ojjYHgdiKiHXXutOkKCUAO131cifwKyLhqOg@mail.gmail.com>
From:   Miklos Szeredi <miklos@szeredi.hu>
Date:   Mon, 5 Nov 2018 13:03:24 +0100
Message-ID: <CAJfpegtGz2Z4c4mGE+LMC9ZoEQd9wJtL=segqrFo72-g4MdAig@mail.gmail.com>
Subject: Re: INFO: task hung in fuse_sb_destroy
To:     Dmitry Vyukov <dvyukov@google.com>
Cc:     syzbot <syzbot+6339eda9cb4ebbc4c37b@syzkaller.appspotmail.com>,
        linux-fsdevel <linux-fsdevel@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        syzkaller-bugs@googlegroups.com
Content-Type: multipart/mixed; boundary="0000000000002d2cee0579e9ac92"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

--0000000000002d2cee0579e9ac92
Content-Type: text/plain; charset="UTF-8"

On Mon, Nov 5, 2018 at 11:40 AM, Miklos Szeredi <miklos@szeredi.hu> wrote:
> On Thu, Nov 1, 2018 at 12:05 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
>> On Thu, Nov 1, 2018 at 11:49 AM, syzbot
>> <syzbot+6339eda9cb4ebbc4c37b@syzkaller.appspotmail.com> wrote:
>>> Hello,
>>>
>>> syzbot found the following crash on:
>>>
>>> HEAD commit:    59fc453b21f7 Merge branch 'akpm' (patches from Andrew)
>>> git tree:       upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=15fb2447400000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ea045471e4c756e8
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=6339eda9cb4ebbc4c37b
>>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178a105d400000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16651133400000
>>
>>
>> I can easily reproduce this.
>
> I can't reproduce on my meager dual core notebook.
>
>>
>> The repro gives me a task hanged at:
>>
>> # cat /proc/7563/task/*/stack
>> [<0>] fuse_wait_aborted+0x20b/0x320
>> [<0>] fuse_sb_destroy+0xe2/0x1d0
>> [<0>] fuse_kill_sb_anon+0x15/0x20
>> [<0>] deactivate_locked_super+0x97/0x100
>> [<0>] deactivate_super+0x2bb/0x320
>> [<0>] cleanup_mnt+0xbf/0x160
>> [<0>] __cleanup_mnt+0x16/0x20
>> [<0>] task_work_run+0x1e8/0x2a0
>> [<0>] exit_to_usermode_loop+0x318/0x380
>> [<0>] do_syscall_64+0x6be/0x820
>> [<0>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>> [<0>] 0xffffffffffffffff
>>
>> I double checked that writing to /sys/fs/fuse/connections/44/abort did
>> not help (the only entry in fuse/connections). Wrote multiple times,
>> and tried to kill the task, nothing helps.
>
> What's the output of
>
> cat /sys/fs/fuse/connections/NN/waiting
>
> ?

I think I found the culprit.  Does the attached patch fix it?

Thanks,
Miklos

--0000000000002d2cee0579e9ac92
Content-Type: text/x-patch; charset="US-ASCII"; name="fuse-fix-leaked-notify-reply.patch"
Content-Disposition: attachment; 
	filename="fuse-fix-leaked-notify-reply.patch"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_jo49ao720

LS0tCiBmcy9mdXNlL2Rldi5jIHwgICAgNCArKystCiAxIGZpbGUgY2hhbmdlZCwgMyBpbnNlcnRp
b25zKCspLCAxIGRlbGV0aW9uKC0pCgotLS0gYS9mcy9mdXNlL2Rldi5jCisrKyBiL2ZzL2Z1c2Uv
ZGV2LmMKQEAgLTE3MTUsOCArMTcxNSwxMCBAQCBzdGF0aWMgaW50IGZ1c2VfcmV0cmlldmUoc3Ry
dWN0IGZ1c2VfY29uCiAJcmVxLT5pbi5hcmdzWzFdLnNpemUgPSB0b3RhbF9sZW47CiAKIAllcnIg
PSBmdXNlX3JlcXVlc3Rfc2VuZF9ub3RpZnlfcmVwbHkoZmMsIHJlcSwgb3V0YXJnLT5ub3RpZnlf
dW5pcXVlKTsKLQlpZiAoZXJyKQorCWlmIChlcnIpIHsKIAkJZnVzZV9yZXRyaWV2ZV9lbmQoZmMs
IHJlcSk7CisJCWZ1c2VfcHV0X3JlcXVlc3QoZmMsIHJlcSk7CisJfQogCiAJcmV0dXJuIGVycjsK
IH0K
--0000000000002d2cee0579e9ac92--