Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 13 Apr 2023 20:09:01 +0800
From:   Pengfei Xu <pengfei.xu@intel.com>
To:     Frederic Weisbecker <frederic@kernel.org>
CC:     Jens Axboe <axboe@kernel.dk>, <lihuafei1@huawei.com>,
        <rostedt@goodmis.org>, <linux-kernel@vger.kernel.org>,
        <lkp@intel.com>, <quic_neeraju@quicinc.com>, <paulmck@kernel.org>,
        <heng.su@intel.com>
Subject: Re: [Syzkaller & bisect] There is "task hung in synchronize_rcu
 bisect" in v6.3-rc2 kernel
Message-ID: <ZDfw3chR+VVO+ImZ@xpf.sh.intel.com>
References: <ZBG4HOCQIlGFFcIn@xpf.sh.intel.com>
 <ZDdsz+5/QehZ25hg@xpf.sh.intel.com>
 <ZDflLOCujdBNXl3D@lothringen>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <ZDflLOCujdBNXl3D@lothringen>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?hXimANmv42jr0VeHI8TuRQtbTg/8i1hGp0GG55+0TN608TUPgJrR0+XIIOAc?=
 =?us-ascii?Q?sojD6/As6NyVfQHHqjB3nBoA0F6yCq+9YuBRo9niOFAe3d7fSIdslKi4GWsA?=
 =?us-ascii?Q?4+LZfvfHafZhP5nhMv3snUveuvx0ESblbahxsXlxz7hw4LieE6gORujxkbwE?=
 =?us-ascii?Q?gBt84CqREU+K2x/HWZj3lENJsPTNUOVlUpfAKLfAMP6R8/RGa+tnipH4oHUm?=
 =?us-ascii?Q?ZEiSQc4ElWvI5DdpLwJIozLEHu9P2jOsr707F9/T+58pSXukXRu8P/mz+cDx?=
 =?us-ascii?Q?3N8yLnqL3xTGzOsxk9OpPJDitsuLxsCm8j4zUj/LW5C8l1QxfsEbrvDP/YPD?=
 =?us-ascii?Q?5yyXevDIIPuA6Pp3OHwpVhJqnXmL+04uAOb9ciMq45vXPumiMktfsNa08959?=
 =?us-ascii?Q?MBCG0mJc0nRGetQnfhTI0S8diCL+2bqqkGUnJwCaDGvJiyfCsBUTxbnICPuf?=
 =?us-ascii?Q?sE/G2E3lG6vD5Sq8J2HKXYgRTNnbxN7OtPXqRngrV7ISx4wQTamVm5/UpXCq?=
 =?us-ascii?Q?JXCa27mQmWR0DzD/cd55HdLvxw2WE1pzNXoUJwdhTPveqsOBUVrHI+1KOvCQ?=
 =?us-ascii?Q?o+bOFYppmlCAoYi5Xe+wrbrc+GcKi+ZjXikDL0KWLLvTObb0e/eYkvThq1fX?=
 =?us-ascii?Q?QQ6w8dq+lEpuK3vA/bRlXDq7X+BEgiBNVIZPZJOy7p3NsxzXtzfYwIKRIUcs?=
 =?us-ascii?Q?nm3lX84dfB0VRxrRi0bfvct0Nc/+uzvixKyHlrtxQHyVyn7gQ0znWg6A8g+D?=
 =?us-ascii?Q?4JtK2M9GYZcYYhl2MFcClzSLzbydflkkQUF8Mfd8iDXDp06ZUbRbQqVgxGHo?=
 =?us-ascii?Q?teUBtTIeKBSPldrN+Iws8AZaOMKSF1SVHfBDmRBgeD+o9Knh9MlPuJCapN+m?=
 =?us-ascii?Q?2ytrIWIlzDSgmo3FF9fpFN/b88EROfccpq41MxmRhu0RVhqBTm6zbD2buSR0?=
 =?us-ascii?Q?ODXS+Zc4S7IOmwo6C3aqlsNe6d+PRAHYF4p22lr/aP02V8CM47qPL8oSDmHe?=
 =?us-ascii?Q?TOa3ye92WkpBvr+MFQodJ9KzObcQbucLqtRNYqwEZrFqJ+E4GUIsfaUjaM3s?=
 =?us-ascii?Q?1XVo/d77tYb4HCdYtTVBXt7GF6zQY3ZrhlOP2gKZE45LjUoEmdIq5vQP7N6v?=
 =?us-ascii?Q?SiBJp1Ci2a8ZoyZmRYCWE9nw9zA4nhpkO5xH1ViKX53eZOzjiFXcsAKxWk8H?=
 =?us-ascii?Q?XfwNJrgjrYys48TjtB6HcULLccoqg9WwHpxcMPeoj7d8cIMwmA8Dd/PJpS4C?=
 =?us-ascii?Q?LKkmQs5z8NzjLX3tVbtSHojsTTagEgjrXESZo7rHPrqKO9DvVporaXa1R7pq?=
 =?us-ascii?Q?zqXeHKWdbcfw/ELCyNoTEc9oCjSGGINskxfJOMf2hmcTccfXUdogWgJIh1KN?=
 =?us-ascii?Q?1cJMRLAkQ/4xithvdvJA9RDOZj7p7xirErnr7CfYzJlgwWpLf0Y9G2zG4UJM?=
 =?us-ascii?Q?x8h4cg9UTUKb3/9mCtZpYTgHTuWvh7KylbphZzDR4feuJR9Qf+imlpweGfFJ?=
 =?us-ascii?Q?6pc4JuRez5K6NM8K0KkzRy7nZl1n5fJtNf49lwspDGjHLDeJRhS612RvzIcF?=
 =?us-ascii?Q?lIsZ48QMr7/oxL9qiS3uxhtxN2hY5ILmQBQhLs5h?=
X-MS-Exchange-CrossTenant-Network-Message-Id: aacba156-14a3-42ae-f153-08db3c17a56f
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4839.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Apr 2023 12:07:26.2039
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: b7LPhUn1OIoC4OQZb/kwKdB281Y1eehsPdE3Y92iGrKWMf5A3EFU35z1EC+rnN4r0LhjehPoj9hEd6Ax+p8KPw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4534
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        SPF_HELO_NONE,SPF_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2023-04-13 at 13:19:08 +0200, Frederic Weisbecker wrote:
> On Thu, Apr 13, 2023 at 10:45:35AM +0800, Pengfei Xu wrote:
> > Hi Huafei and kernel experts,
> > 
> > It's a soft remind.
> > This issue could be reproduced in v6.3-rc6 kernel.
> > It could be reproduced on Alder lake, Raptor lake and so on x86 platforms.
> > After reverted the commit "0e792b89e6800c:ftrace: Fix use-after-free for
> > dynamic ftrace_ops" on top of v6.3-rc6 kernel, this issue was gone.
> > 
> > New syzkaller reproduced code, repro.report, bisect_info.log and detailed logs
> > are in link:
> > https://github.com/xupengfe/syzkaller_logs/tree/main/230412_031722_synchronize_rcu
> 
> I just tested against v6.3-rc6 and again all I get is this io_ring related
> issue:
> 
  Seems this issue could get different behavior on different platforms.
  I could reproduce the synchronize_rcu issue on Alder lake S(cpu model:151)
  and Raptor lake P(cpu model:186) platforms.

  Thanks!
  BR.

> [  448.290752] INFO: task kworker/u4:0:9 blocked for more than 294 seconds.
> [  448.293868]       Not tainted 6.3.0-rc6-kvm #1
> [  448.296019] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> [  448.299592] task:kworker/u4:0    state:D stack:0     pid:9     ppid:2      flags:0x00004000
> [  448.303397] Workqueue: events_unbound io_ring_exit_work
> [  448.305884] Call Trace:
> [  448.307147]  <TASK>
> [  448.308166]  __schedule+0x422/0xc90
> [  448.309824]  ? wait_for_completion+0x77/0x170
> [  448.311870]  schedule+0x63/0xd0
> [  448.313346]  schedule_timeout+0x2fe/0x4c0
> [  448.315255]  ? __this_cpu_preempt_check+0x1c/0x30
> [  448.317360]  ? _raw_spin_unlock_irq+0x27/0x60
> [  448.319400]  ? lockdep_hardirqs_on+0x88/0x120
> [  448.321395]  ? wait_for_completion+0x77/0x170
> [  448.323462]  wait_for_completion+0x9e/0x170
> [  448.325356]  io_ring_exit_work+0x2b0/0x810
> [  448.327300]  ? __pfx_io_tctx_exit_cb+0x10/0x10
> [  448.329345]  ? _raw_spin_unlock_irq+0x27/0x60
> [  448.331397]  process_one_work+0x34e/0x720
> [  448.333212]  ? __pfx_io_ring_exit_work+0x10/0x10
> [  448.335377]  ? process_one_work+0x34e/0x720
> [  448.337295]  worker_thread+0x4e/0x530
> [  448.339079]  ? __pfx_worker_thread+0x10/0x10
> [  448.341008]  kthread+0x128/0x160
> [  448.342513]  ? __pfx_kthread+0x10/0x10
> [  448.344305]  ret_from_fork+0x2c/0x50
> [  448.346016]  </TASK>
> [  448.347176] 
> [  448.347176] Showing all locks held in the system:
> [  448.349887] 2 locks held by kworker/u4:0/9:
> [  448.351829]  #0: ffff88807eb6dd38 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x2b4/0x720
> [  448.356362]  #1: ffffc9000005fe68 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x2b4/0x720
> [  448.361052] 1 lock held by rcu_tasks_kthre/11:
> [  448.363142]  #0: ffffffff83963450 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0x440
> [  448.367396] 1 lock held by rcu_tasks_rude_/12:
> [  448.369387]  #0: ffffffff839631d0 (rcu_tasks_rude.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0x440
> [  448.373808] 1 lock held by rcu_tasks_trace/13:
> [  448.375852]  #0: ffffffff83962f10 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0x440
> [  448.380434] 1 lock held by khungtaskd/30:
> [  448.382219]  #0: ffffffff83963e60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x17/0x1d0
> [  448.386291] 
> [  448.387159] =============================================
> [  448.387159]