Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <0000000000001416bb06004ebf53@google.com>
References: <0000000000001416bb06004ebf53@google.com>
To:     syzbot <syzbot+f527b971b4bdc8e79f9e@syzkaller.appspotmail.com>
Cc:     dhowells@redhat.com, bpf@vger.kernel.org, brauner@kernel.org,
        davem@davemloft.net, dsahern@kernel.org, edumazet@google.com,
        kuba@kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        pabeni@redhat.com, syzkaller-bugs@googlegroups.com,
        viro@zeniv.linux.org.uk
Subject: Re: [syzbot] [fs?] INFO: task hung in pipe_release (4)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <145369.1690204627.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Mon, 24 Jul 2023 14:17:07 +0100
Message-ID: <145370.1690204627@warthog.procyon.org.uk>
Precedence: bulk

Note that the test program is dodgy:

    pipe(&(0x7f0000000100)=3D{<r0=3D>0xffffffffffffffff, <r1=3D>0xffffffff=
ffffffff})
    r2 =3D socket$inet_udp(0x2, 0x2, 0x0)

r2 is closed here:

    close(r2)
    r3 =3D socket$inet_udp(0x2, 0x2, 0x0)
    setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000140)=3D0x32, 0x4)
    bind$inet(r3, &(0x7f0000000000)=3D{0x2, 0x0, @dev=3D{0xac, 0x14, 0x14,=
 0x15}}, 0x10)
    connect$inet(r3, &(0x7f0000000200)=3D{0x2, 0x0, @broadcast}, 0x10)
    sendmmsg(r3, &(0x7f0000000180)=3D[{{0x0, 0x0, 0x0}}, {{0x0, 0xffffffff=
fffffed3, &(0x7f0000000940)=3D[{&(0x7f00000006c0)=3D'O', 0x57e}], 0x1}}], =
0x4000000000003bd, 0x8800)
    write$binfmt_misc(r1, &(0x7f0000000440)=3DANY=3D[], 0x8)

but then used here:

    splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0)

As it happens, r3 will probably end up referring to the same fd as r2 did,=
 but
that's not guaranteed.

David