Received-SPF: pass (google.com: domain of linux-kernel+bounces-197745-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+54594368fbd5a4f1754a@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] INFO: rcu detected stall in kcompactd (2)
Date: Sat,  1 Jun 2024 15:01:17 +0800
Message-Id: <20240601070117.3481-1-hdanton@sina.com>
In-Reply-To: <0000000000002304860619cb8aa1@google.com>
References: 
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Fri, 31 May 2024 20:17:26 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    2bfcfd584ff5 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17314572980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master

--- x/net/mac80211/ieee80211_i.h
+++ y/net/mac80211/ieee80211_i.h
@@ -1437,6 +1437,7 @@ struct ieee80211_local {
 	 * queues increases over the limit. */
 #define IEEE80211_IRQSAFE_QUEUE_LIMIT 128
 	struct tasklet_struct tasklet;
+	struct work_struct tlw;
 	struct sk_buff_head skb_queue;
 	struct sk_buff_head skb_queue_unreliable;
 
--- x/net/mac80211/main.c
+++ y/net/mac80211/main.c
@@ -423,9 +423,9 @@ u64 ieee80211_reset_erp_info(struct ieee
 	       BSS_CHANGED_ERP_SLOT;
 }
 
-static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+static void ieee80211_tlw_fn(struct work_struct *w)
 {
-	struct ieee80211_local *local = from_tasklet(local, t, tasklet);
+	struct ieee80211_local *local = container_of(w, struct ieee80211_local, tlw);
 	struct sk_buff *skb;
 
 	while ((skb = skb_dequeue(&local->skb_queue)) ||
@@ -450,6 +450,13 @@ static void ieee80211_tasklet_handler(st
 	}
 }
 
+static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+{
+	struct ieee80211_local *local = from_tasklet(local, t, tasklet);
+
+	schedule_work(&local->tlw);
+}
+
 static void ieee80211_restart_work(struct work_struct *work)
 {
 	struct ieee80211_local *local =
@@ -989,6 +996,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
 	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
 	tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
 	tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);
+	INIT_WORK(&local->tlw, ieee80211_tlw_fn);
 
 	skb_queue_head_init(&local->skb_queue);
 	skb_queue_head_init(&local->skb_queue_unreliable);
@@ -1634,6 +1642,7 @@ void ieee80211_unregister_hw(struct ieee
 
 	tasklet_kill(&local->tx_pending_tasklet);
 	tasklet_kill(&local->tasklet);
+	flush_work(&local->tlw);
 
 #ifdef CONFIG_INET
 	unregister_inetaddr_notifier(&local->ifa_notifier);
--