linux-kernel - [BUG] soft lockup in seq_read while reading io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID:
	<PS1PPF7E1D7501FE5631002D242DD89403FAB9BA@PS1PPF7E1D7501F.apcprd02.prod.outlook.com>
Date: Tue, 3 Feb 2026 09:39:32 +0000
From: 是参差 <shicenci@...il.com>
To: io-uring <io-uring@...r.kernel.org>
CC: "axboe@...nel.dk" <axboe@...nel.dk>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: [BUG] soft lockup in seq_read while reading io_uring fdinfo

Hi,

I’m reporting a reproducible soft lockup observed in the seq_file read path when reading io_uring fdinfo via procfs.

The lockup is triggered by a syzkaller C reproducer that:

creates an io_uring instance with a large number of entries, and then

reads /proc/thread-self/fdinfo/<uring_fd>.

The watchdog reports a soft lockup with CPU stuck in __sanitizer_cov_trace_pc() while the task is executing seq_read() -> io_uring_show_fdinfo().

Another CPU concurrently shows an NMI backtrace stuck in KFENCE’s toggle_allocation_gate() path, going through jump_label_update() and smp_text_poke_sync_each_cpu(). This suggests a potential interaction between heavy fdinfo seq_printf output under KCOV instrumentation and KFENCE’s jump_label/text_poke synchronization.

Reproducer:

C reproducer: https://pastebin.com/raw/MxksimZh

console output: https://pastebin.com/raw/ZgwRNeTc

kernel config: https://pastebin.com/raw/qBYGyUzD

Kernel:

HEAD commit: 63804fed149a6750ffd28610c5c1c98cce6bd377

 git tree: torvalds/linux  

kernel version: 6.19.0-rc7 #2 PREEMPT(voluntary) (QEMU Ubuntu 24.10)


watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz.3.17:1226]
Modules linked in:
CPU: 1 UID: 0 PID: 1226 Comm: syz.3.17 Not tainted 6.19.0-rc7 #2 PREEMPT(voluntary)
Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x8/0x20 kernel/kcov.c:300
Code: 00 00 f3 0f 1e fa 48 8b 0c 24 48 89 f2 48 89 fe bf 06 00 00 00 e9 18 ff ff ff 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 8b 0c 24 <40> 0f b6 d6 40 0f b6 f7 bf 01 00 00 00 e9 f6 fe ff ff 66 0f 1f 44
RSP: 0018:ffffc900043bf760 EFLAGS: 00000246
RAX: 000000003a736500 RBX: ffffffff850afe21 RCX: ffffffff84cd69b0
RDX: ffff88800c9a3bc0 RSI: 0000000000000073 RDI: 0000000000000025
RBP: ffffc900043bf810 R08: 000000003a736500 R09: ffffffff84cd69a3
R10: 0000000000000001 R11: ffffc90048c4d037 R12: ffffc900043bf8a0
R13: ffffffff850afe1b R14: dffffc0000000000 R15: 0000000000000073
FS: 00007f24f90fe500(0000) GS:ffff8880e5b52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005593e173d130 CR3: 000000000f716000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 format_decode+0x190/0xc80 lib/vsprintf.c:2692
 vsnprintf+0x186/0x1160 lib/vsprintf.c:2889
 seq_vprintf+0xe6/0x1a0 fs/seq_file.c:391
 seq_printf+0xbe/0xf0 fs/seq_file.c:406
 __io_uring_show_fdinfo io_uring/fdinfo.c:158 [inline]
 io_uring_show_fdinfo+0x9a7/0x1920 io_uring/fdinfo.c:261
 seq_show+0x469/0x730 fs/proc/fd.c:68
 seq_read_iter+0x4cc/0x11d0 fs/seq_file.c:230
 seq_read+0x391/0x570 fs/seq_file.c:162
 vfs_read fs/read_write.c:570 [inline]
 vfs_read+0x1f9/0xc90 fs/read_write.c:552
 ksys_read+0x121/0x240 fs/read_write.c:715
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xac/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f24f838ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48