Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Zhang, Qiang1" <qiang1.zhang@intel.com>
To:     Frederic Weisbecker <frederic@kernel.org>,
        "Xu, Pengfei" <pengfei.xu@intel.com>, Jens Axboe <axboe@kernel.dk>
CC:     "lihuafei1@huawei.com" <lihuafei1@huawei.com>,
        "rostedt@goodmis.org" <rostedt@goodmis.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        lkp <lkp@intel.com>,
        "quic_neeraju@quicinc.com" <quic_neeraju@quicinc.com>,
        "paulmck@kernel.org" <paulmck@kernel.org>,
        "Su, Heng" <heng.su@intel.com>
Subject: RE: [Syzkaller & bisect] There is "task hung in synchronize_rcu
 bisect" in v6.3-rc2 kernel
Thread-Topic: [Syzkaller & bisect] There is "task hung in synchronize_rcu
 bisect" in v6.3-rc2 kernel
Thread-Index: AQHZVziOTn8pP4Zt5kGJFo0XB8eC968otZqAgACPfACAAAd0sA==
Date:   Thu, 13 Apr 2023 11:51:28 +0000
Message-ID: <PH0PR11MB588010215E1ACBDD1F9EF6B3DA989@PH0PR11MB5880.namprd11.prod.outlook.com>
References: <ZBG4HOCQIlGFFcIn@xpf.sh.intel.com>
 <ZDdsz+5/QehZ25hg@xpf.sh.intel.com> <ZDflLOCujdBNXl3D@lothringen>
In-Reply-To: <ZDflLOCujdBNXl3D@lothringen>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?g0hCkTTJLX6ttEFn4w8vIdysvGyvtZgq/PMs3iTrvx0MTL9TBU/vdWvDBkmh?=
 =?us-ascii?Q?uv4NUciYTNE2rfnU+HCUKQBut7TyBIlm8NOoombyNULfRzeJs45dA655lJwp?=
 =?us-ascii?Q?bjtu+0P23ZiTBsGq46gGL1+cLn6ZWz3DihNyhNqrVVioP0u+zSpLYoziSe/I?=
 =?us-ascii?Q?POEK+UVmLx8XUuzCr1cN5i2zAtHDmwkRnFM7gABv9OmPs5lIxanc2k+jy2jx?=
 =?us-ascii?Q?JYBLj0zIObQqp6b45b8zQj4xAEPntKtx7mScFIAi/hLydFLf5JNMqm6Xq8c8?=
 =?us-ascii?Q?YhGEIK8aD7OvmKYlLyrkr389Vvx0FuvntqQl28dZZJ75MabGwr+3Z5pwU4n2?=
 =?us-ascii?Q?v+HSUxL2sNScPLpxAFiZiiPyfc4CfNl5/LXIdIK5eC87S1SKl8cL8wRzpWzb?=
 =?us-ascii?Q?24QUiQFktG1OhgnADT9bT4gNjwhocdGgQHjFAV6T3EbQXixgzqIKokCnwyr+?=
 =?us-ascii?Q?/IW4gu0/0AepLJkyytDELZ20QyeRlsRkr8/WB5+XSn7D6gO5VPOduldydTp1?=
 =?us-ascii?Q?SoTynF/nqF91d/ivrz7g89jDByPyyNAi/wXML7TJOqoKkJ0kUSVQ6XWsC66G?=
 =?us-ascii?Q?v/3ELdRIoTDjodq3QEr+80+yaLlC0r5Gf07tV/eY2gr19g9ggYJawxPPxaQm?=
 =?us-ascii?Q?o1Oj5ZfjlPNlyFpmSfhbWcEdK64BKrPtJElVXmwRrL6/l5TDNWMP3KkJxy7K?=
 =?us-ascii?Q?UI0eY2M1NSriNzLaQv5JwNIVEwnGTnIbSyF7pFT+S/8O5Kz2W1xK4UsURwQ0?=
 =?us-ascii?Q?qWbc0vXSMHFas2/x/I9zUCQ9qY9O+aXDHxhGal36D+iDU3hJuiNRMP+Gr46w?=
 =?us-ascii?Q?gNLo4CEV6DkvyY2ze5Q5ajnvfnmZFHM0M0Psqk8Yk7rEChFfty1kTv5avSnm?=
 =?us-ascii?Q?Ed0pLCNCs9HzzEWOm3RUHjWOS1pV20u4oDVf7jHs1WKHu4n7NbcNrJRtZuwW?=
 =?us-ascii?Q?zMm0qjfLWc1WoBS2JsktUO3MOhV26wpBcCFoCxhvKfjsLxrRuQkQpt7DkYXd?=
 =?us-ascii?Q?9OQFSx35iCLpmp9NqjmvN89NLHiVMeI6Zl535BeEf9gdiauhtIGqYjDERlPY?=
 =?us-ascii?Q?XfkeFJFgeLMCIn6v8i18UarDTAiuO0UjAxk9CLC0idkERggdC1t2399Bg7oG?=
 =?us-ascii?Q?pmIHzgZR3JOkXup8iBuu9ZTVqOHscqZzD3mUAr/uzcEICRqZv04qUuLXAPMo?=
 =?us-ascii?Q?IF80GsSkXq69qv0h7wnUMFVmDkRecTj/q+mbb8KlRDt8v7HxWqnzKoh8RtEr?=
 =?us-ascii?Q?OA+kCsiTeTPoOrn5cL7gF3YRhdWgqbs9HUOhzGRdWh0vgZjQ0/6WwGK/gaRs?=
 =?us-ascii?Q?L9AIPdvPZSy8/eMTfU6lRQB328jbwe/IVd4CsLwwsjjIkcvk1DI0xMEPxTWZ?=
 =?us-ascii?Q?4VO7WLswPmC/SqFP8jmtpB2SjfpMtpyZ1fdJWKqqbxmMZPetc4gi6kaju9z7?=
 =?us-ascii?Q?vmmH1b0itsgy+FXS1FsDWXpverM4WHQptkrFCE10ihOacALhgEpDPG4mcC8N?=
 =?us-ascii?Q?ut3lRTNJ+ITmEgATypElNCdaF0J7sMgUuNAv/klb7pXN5O+i3qb2WzHbuWBg?=
 =?us-ascii?Q?WPo6Mp1cKtRP3K1jeT0iWAWX20LmAQDrwxQVNDIz?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB5880.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cd64b786-109b-4e73-eb6d-08db3c156a76
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Apr 2023 11:51:28.1015
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Z4/yqeWQkrvxD3zttbKaRliROQM5v0xlAcOO18PxDTxWaPI+y5SAL0rdilXXjFZWPfhr+12d+KEnIxWqI/SoxA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR11MB7432
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

> Hi Huafei and kernel experts,
>=20
> It's a soft remind.
> This issue could be reproduced in v6.3-rc6 kernel.
> It could be reproduced on Alder lake, Raptor lake and so on x86 platforms=
.
> After reverted the commit "0e792b89e6800c:ftrace: Fix use-after-free for
> dynamic ftrace_ops" on top of v6.3-rc6 kernel, this issue was gone.
>=20
> New syzkaller reproduced code, repro.report, bisect_info.log and detailed=
 logs
> are in link:
> https://github.com/xupengfe/syzkaller_logs/tree/main/230412_031722_synchr=
onize_rcu
>
>I just tested against v6.3-rc6 and again all I get is this io_ring related
>issue:
>

I also did not reproduce this synchronize_rcu_tasks() hung problem, but fro=
m this link:
https://github.com/xupengfe/syzkaller_logs/blob/main/230412_031722_synchron=
ize_rcu/02bf43c7b7f7a19aa59a75f5244f0a3408bace1a_dmesg.log

I find rcu-task stall

INFO: rcu_tasks detected stalls on tasks:
[ 1243.720952] 000000008aaceb95: .. nvcsw: 1/1 holdout: 1 idle_cpu: -1/0
[ 1243.721915] task:repro           state:R  running task     stack:0     p=
id:592   ppid:585    flags:0x00004004
[ 1243.723486] Call Trace:
[ 1243.723996]  <TASK>
[ 1243.725204]  __schedule+0x385/0xb00
[ 1243.726212]  ? __cond_resched+0x25/0x30
[ 1243.727108]  preempt_schedule_common+0x11/0x90
[ 1243.727964]  __cond_resched+0x25/0x30
[ 1243.729076]  mousedev_write+0xd2/0x3d0
[ 1243.730168]  vfs_write+0x1b6/0x780
[ 1243.730873]  ? mousedev_fasync+0x40/0x40
[ 1243.731864]  ? vfs_write+0x9/0x780
[ 1243.732874]  ? write_comp_data+0x2f/0x90
[ 1243.733926]  ksys_write+0x153/0x170
[ 1243.734929]  __x64_sys_write+0x27/0x30
[ 1243.735718]  do_syscall_64+0x3b/0x90
[ 1243.736760]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 1243.737586] RIP: 0033:0x7f374119759d

Thanks
Zqiang


>
>[  448.290752] INFO: task kworker/u4:0:9 blocked for more than 294 seconds=
.
>[  448.293868]       Not tainted 6.3.0-rc6-kvm #1
>[  448.296019] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables=
 this message.
>[  448.299592] task:kworker/u4:0    state:D stack:0     pid:9     ppid:2  =
    flags:0x00004000
>[  448.303397] Workqueue: events_unbound io_ring_exit_work
>[  448.305884] Call Trace:
>[  448.307147]  <TASK>
>[  448.308166]  __schedule+0x422/0xc90
>[  448.309824]  ? wait_for_completion+0x77/0x170
>[  448.311870]  schedule+0x63/0xd0
>[  448.313346]  schedule_timeout+0x2fe/0x4c0
>[  448.315255]  ? __this_cpu_preempt_check+0x1c/0x30
>[  448.317360]  ? _raw_spin_unlock_irq+0x27/0x60
>[  448.319400]  ? lockdep_hardirqs_on+0x88/0x120
>[  448.321395]  ? wait_for_completion+0x77/0x170
>[  448.323462]  wait_for_completion+0x9e/0x170
>[  448.325356]  io_ring_exit_work+0x2b0/0x810
>[  448.327300]  ? __pfx_io_tctx_exit_cb+0x10/0x10
>[  448.329345]  ? _raw_spin_unlock_irq+0x27/0x60
>[  448.331397]  process_one_work+0x34e/0x720
>[  448.333212]  ? __pfx_io_ring_exit_work+0x10/0x10
>[  448.335377]  ? process_one_work+0x34e/0x720
>[  448.337295]  worker_thread+0x4e/0x530
>[  448.339079]  ? __pfx_worker_thread+0x10/0x10
>[  448.341008]  kthread+0x128/0x160
>[  448.342513]  ? __pfx_kthread+0x10/0x10
>[  448.344305]  ret_from_fork+0x2c/0x50
>[  448.346016]  </TASK>
>[  448.347176]=20
>[  448.347176] Showing all locks held in the system:
>[  448.349887] 2 locks held by kworker/u4:0/9:
>[  448.351829]  #0: ffff88807eb6dd38 ((wq_completion)events_unbound){+.+.}=
-{0:0}, at: process_one_work+0x2b4/0x720
>[  448.356362]  #1: ffffc9000005fe68 ((work_completion)(&ctx->exit_work)){=
+.+.}-{0:0}, at: process_one_work+0x2b4/0x720
>[  448.361052] 1 lock held by rcu_tasks_kthre/11:
>[  448.363142]  #0: ffffffff83963450 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3=
}, at: rcu_tasks_one_gp+0x31/0x440
>[  448.367396] 1 lock held by rcu_tasks_rude_/12:
>[  448.369387]  #0: ffffffff839631d0 (rcu_tasks_rude.tasks_gp_mutex){+.+.}=
-{3:3}, at: rcu_tasks_one_gp+0x31/0x440
>[  448.373808] 1 lock held by rcu_tasks_trace/13:
>[  448.375852]  #0: ffffffff83962f10 (rcu_tasks_trace.tasks_gp_mutex){+.+.=
}-{3:3}, at: rcu_tasks_one_gp+0x31/0x440
>[  448.380434] 1 lock held by khungtaskd/30:
>[  448.382219]  #0: ffffffff83963e60 (rcu_read_lock){....}-{1:2}, at: debu=
g_show_all_locks+0x17/0x1d0
>[  448.386291]=20
>[  448.387159] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
>[  448.387159]=20