Dear developers and maintainers,
We encountered a bug in net core. It is tested on linux kernel
6.8.0-rc7. Kernel config and C repro are attached to this email. Bug
report is listed below.
```
INFO: task syz-executor301:8111 blocked for more than 143 seconds.
Not tainted 6.7.0-rc7 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor301 state:D stack:27968 pid:8111 tgid:8111
ppid:8110 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5376 [inline]
__schedule+0xcea/0x59e0 kernel/sched/core.c:6688
__schedule_loop kernel/sched/core.c:6763 [inline]
schedule+0xe9/0x270 kernel/sched/core.c:6778
__lock_sock+0x141/0x260 net/core/sock.c:2944
lock_sock_nested+0xda/0xf0 net/core/sock.c:3524
lock_sock include/net/sock.h:1720 [inline]
l2cap_sock_shutdown+0xc6/0x1060 net/bluetooth/l2cap_sock.c:1306
nbd_mark_nsock_dead+0xae/0x5c0 drivers/block/nbd.c:303
sock_shutdown+0x17c/0x280 drivers/block/nbd.c:377
nbd_start_device_ioctl drivers/block/nbd.c:1446 [inline]
__nbd_ioctl drivers/block/nbd.c:1511 [inline]
nbd_ioctl+0xc08/0xd70 drivers/block/nbd.c:1551
blkdev_ioctl+0x2f2/0x750 block/ioctl.c:633
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f7335e2c18d
RSP: 002b:00007ffd088318f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffd08831b58 RCX: 00007f7335e2c18d
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 00007f7335ea94f0 R15: 0000000000000001
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/32:
#0: ffffffff8cfa9a60 (rcu_read_lock){....}-{1:2}, at:
rcu_lock_acquire include/linux/rcupdate.h:301 [inline]
#0: ffffffff8cfa9a60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock
include/linux/rcupdate.h:747 [inline]
#0: ffffffff8cfa9a60 (rcu_read_lock){....}-{1:2}, at:
debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6614
3 locks held by kworker/u9:0/54:
#0: ffff8881053de538 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at:
process_one_work+0x77b/0x15c0 kernel/workqueue.c:2602
#1: ffffc90000defd88 ((work_completion)(&args->work)){+.+.}-{0:0},
at: process_one_work+0x7dd/0x15c0 kernel/workqueue.c:2603
#2: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: lock_sock
include/net/sock.h:1720 [inline]
#2: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at:
bt_sock_recvmsg+0xcb/0x750 net/bluetooth/af_bluetooth.c:312
1 lock held by in:imklog/7716:
#0: ffff88801babb888 (&f->f_pos_lock){+.+.}-{3:3}, at:
__fdget_pos+0xdb/0x160 fs/file.c:1177
2 locks held by syz-executor301/8111:
#0: ffff88810cddeb70 (&nsock->tx_lock){+.+.}-{3:3}, at:
sock_shutdown+0x16f/0x280 drivers/block/nbd.c:376
#1: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: lock_sock
include/net/sock.h:1720 [inline]
#1: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at:
l2cap_sock_shutdown+0xc6/0x1060 net/bluetooth/l2cap_sock.c:1306
```
NMI backtrace seems not relevant to this bug, but will be attached to
this email.
If you have any questions, please contact us.
Reported by: Yue Sun <[email protected]>
Reported by: xingwei lee <[email protected]>
Best Regards,
Yue