linux-kernel - [BUG] KVM: hung task during vCPU destruction in kvm_clear_async_pf_completion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <69615ae2.050a0220.47ba6.c4aa@mx.google.com>
Date: Sat, 10 Jan 2026 03:45:36 +0800
From: JiaHong Su <s11242586@...il.com>
To: Paolo Bonzini <pbonzini@...hat.com>,
	Sean Christopherson <seanjc@...gle.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [BUG] KVM: hung task during vCPU destruction in
 kvm_clear_async_pf_completion_queue()


Hello,

I found the following issue using Syzkaller on:

HEAD commit:    9ace475 Linux 6.19-rc4
Kernel config:  https://gist.github.com/AxelHowe/7fb5b3917d2f4a18c1d8cefbfd5846ef

A hung task warning is reported during KVM vCPU destruction.

INFO: task repro:9778 blocked for more than 143 seconds.
      Not tainted 6.19.0-rc4 #8
      Blocked by coredump.
Call Trace:
  __schedule
  schedule
  schedule_timeout
  __wait_for_common
  __flush_work
  cancel_work_sync
  kvm_clear_async_pf_completion_queue
  kvm_arch_vcpu_destroy
  kvm_destroy_vcpus
  kvm_arch_destroy_vm
  kvm_put_kvm
  kvm_vcpu_release
  __fput
  task_work_run
  do_exit
  do_group_exit
  get_signal
  arch_do_signal_or_restart
  entry_SYSCALL_64_after_hwframe

The teardown path blocks in cancel_work_sync() while clearing the async
page fault completion queue. The wait exceeds the hung task timeout and
does not appear to make forward progress in this exit/coredump context.

C reproducer, full dmesg output are available at:
https://gist.github.com/AxelHowe/f09bce07178d13a2ee095f30eef8327e

Thanks,
JiaHong Su