Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Sender: Tejun Heo <htejun@gmail.com>
Date:   Tue, 11 Jul 2023 11:29:16 -1000
From:   Tejun Heo <tj@kernel.org>
To:     Z qiang <qiang.zhang1211@gmail.com>
Cc:     syzbot <syzbot+087b7effddeec0697c66@syzkaller.appspotmail.com>,
        linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in kthread_bind_mask
Message-ID: <ZK3JrFCT3EsS2mxG@slm.duckdns.org>
References: <0000000000005ca92705d877448c@google.com>
 <ZKx8+B3gI9/1g5A3@google.com>
 <CALm+0cUurycz1=pt85sChA2dpzhk3KNLmTo5vfSb_uObOxQPRQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CALm+0cUurycz1=pt85sChA2dpzhk3KNLmTo5vfSb_uObOxQPRQ@mail.gmail.com>
Precedence: bulk

Hello,

On Tue, Jul 11, 2023 at 12:01:48PM +0800, Z qiang wrote:
> Full email path here:
> https://lore.kernel.org/all/0000000000005ca92705d877448c@google.com/T/
> https://syzkaller.appspot.com/bug?extid=087b7effddeec0697c66
> 
> 
> static void __kthread_bind_mask(struct task_struct *p, const struct
> cpumask *mask, unsigned int state)
> {
>         unsigned long flags;
> 
>         if (!wait_task_inactive(p, state)) {
>                 WARN_ON(1);      <--------------------------trigger warning
>                 return;
>         }
> ....
> }
> 
> Inconsistent task state trigger WARN_ON().

The usage looks correct to me. The rescuer kthread was just created
successfully and did complete(done) in kthread() and then should be either
about to sleep or already sleeping in the subsequent
schedule_preempt_disabled(). Either there's something buggy in
wait_task_inactive() or task state transition itself, or there's something
else which somehow ends up waking up the newly created task? My hunch is the
latter but it's impossible to tell from the available information.

It'd be really great if syzbot can find a repro.

Thanks.

-- 
tejun