linux-kernel - Re: [syzbot] [netfs?] INFO: task hung in vfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250919021852.7157-1-hdanton@sina.com>
Date: Fri, 19 Sep 2025 10:18:50 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+3815dce0acab6c55984e@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [netfs?] INFO: task hung in vfs_utimes (3)

> Date: Thu, 18 Sep 2025 17:47:03 -0700	[thread overview]
> syzbot has bisected this issue to:
> 
> commit aaec5a95d59615523db03dd53c2052f0a87beea7
> Author: Oleg Nesterov <oleg@...hat.com>
> Date:   Thu Jan 2 14:07:15 2025 +0000
> 
>     pipe_read: don't wake up the writer if the pipe is still full
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=175fa534580000
> start commit:   46a51f4f5eda Merge tag 'for-v6.17-rc' of git://git.kernel...
> git tree:       upstream
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=14dfa534580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10dfa534580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=8f01d8629880e620
> dashboard link: https://syzkaller.appspot.com/bug?extid=3815dce0acab6c55984e
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17692f62580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1361f47c580000

Test Oleg's fix.

#syz test upstream  master

--- x/net/9p/trans_fd.c
+++ y/net/9p/trans_fd.c
@@ -666,7 +666,6 @@ static void p9_poll_mux(struct p9_conn *
 
 static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
 {
-	__poll_t n;
 	int err;
 	struct p9_trans_fd *ts = client->trans;
 	struct p9_conn *m = &ts->conn;
@@ -686,14 +685,7 @@ static int p9_fd_request(struct p9_clien
 	list_add_tail(&req->req_list, &m->unsent_req_list);
 	spin_unlock(&m->req_lock);
 
-	if (test_and_clear_bit(Wpending, &m->wsched))
-		n = EPOLLOUT;
-	else
-		n = p9_fd_poll(m->client, NULL, NULL);
-
-	if (n & EPOLLOUT && !test_and_set_bit(Wworksched, &m->wsched))
-		schedule_work(&m->wq);
-
+	p9_poll_mux(m);
 	return 0;
 }
 
--