linux-kernel - [Bug] INFO: task hung in lock_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 5 Mar 2024 19:52:49 +0800
From: Sam Sun <samsun1006219@...il.com>
To: linux-kernel@...r.kernel.org
Cc: netdev@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>, davem@...emloft.net, 
	kuba@...nel.org, pabeni@...hat.com, kuniyu@...zon.com, 
	wuyun.abel@...edance.com, leitao@...ian.org, alexander@...alicyn.com, 
	dhowells@...hat.com, syzkaller@...glegroups.com, xrivendell7@...il.com
Subject: [Bug] INFO: task hung in lock_sock_nested

Dear developers and maintainers,

We encountered a bug in net core. It is tested on linux kernel
6.8.0-rc7. Kernel config and C repro are attached to this email. Bug
report is listed below.

```
INFO: task syz-executor301:8111 blocked for more than 143 seconds.
      Not tainted 6.7.0-rc7 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor301 state:D stack:27968 pid:8111  tgid:8111
ppid:8110   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5376 [inline]
 __schedule+0xcea/0x59e0 kernel/sched/core.c:6688
 __schedule_loop kernel/sched/core.c:6763 [inline]
 schedule+0xe9/0x270 kernel/sched/core.c:6778
 __lock_sock+0x141/0x260 net/core/sock.c:2944
 lock_sock_nested+0xda/0xf0 net/core/sock.c:3524
 lock_sock include/net/sock.h:1720 [inline]
 l2cap_sock_shutdown+0xc6/0x1060 net/bluetooth/l2cap_sock.c:1306
 nbd_mark_nsock_dead+0xae/0x5c0 drivers/block/nbd.c:303
 sock_shutdown+0x17c/0x280 drivers/block/nbd.c:377
 nbd_start_device_ioctl drivers/block/nbd.c:1446 [inline]
 __nbd_ioctl drivers/block/nbd.c:1511 [inline]
 nbd_ioctl+0xc08/0xd70 drivers/block/nbd.c:1551
 blkdev_ioctl+0x2f2/0x750 block/ioctl.c:633
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f7335e2c18d
RSP: 002b:00007ffd088318f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffd08831b58 RCX: 00007f7335e2c18d
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 00007f7335ea94f0 R15: 0000000000000001
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/32:
 #0: ffffffff8cfa9a60 (rcu_read_lock){....}-{1:2}, at:
rcu_lock_acquire include/linux/rcupdate.h:301 [inline]
 #0: ffffffff8cfa9a60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock
include/linux/rcupdate.h:747 [inline]
 #0: ffffffff8cfa9a60 (rcu_read_lock){....}-{1:2}, at:
debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6614
3 locks held by kworker/u9:0/54:
 #0: ffff8881053de538 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at:
process_one_work+0x77b/0x15c0 kernel/workqueue.c:2602
 #1: ffffc90000defd88 ((work_completion)(&args->work)){+.+.}-{0:0},
at: process_one_work+0x7dd/0x15c0 kernel/workqueue.c:2603
 #2: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: lock_sock
include/net/sock.h:1720 [inline]
 #2: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at:
bt_sock_recvmsg+0xcb/0x750 net/bluetooth/af_bluetooth.c:312
1 lock held by in:imklog/7716:
 #0: ffff88801babb888 (&f->f_pos_lock){+.+.}-{3:3}, at:
__fdget_pos+0xdb/0x160 fs/file.c:1177
2 locks held by syz-executor301/8111:
 #0: ffff88810cddeb70 (&nsock->tx_lock){+.+.}-{3:3}, at:
sock_shutdown+0x16f/0x280 drivers/block/nbd.c:376
 #1: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: lock_sock
include/net/sock.h:1720 [inline]
 #1: ffff88801c94e130
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at:
l2cap_sock_shutdown+0xc6/0x1060 net/bluetooth/l2cap_sock.c:1306
```

NMI backtrace seems not relevant to this bug, but will be attached to
this email.

If you have any questions, please contact us.
Reported by: Yue Sun <samsun1006219@...il.com>
Reported by: xingwei lee <xrivendell7@...il.com>

Best Regards,
Yue

Download attachment "config" of type "application/octet-stream" (246595 bytes)

View attachment "lock_sock_nested.c" of type "text/x-csrc" (4775 bytes)

View attachment "lock_sock_nmi.log" of type "text/x-log" (4339 bytes)