syzbot


INFO: task hung in io_uring_del_tctx_node (2)

Status: upstream: reported on 2025/07/24 10:20
Reported-by: syzbot+915c6107499bce8b0de3@syzkaller.appspotmail.com
First crash: 9d00h, last: 9d00h
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in io_uring_del_tctx_node 1 2 829d 832d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:02
upstream INFO: task hung in io_uring_del_tctx_node (3) io-uring 1 1 394d 394d 0/29 auto-obsoleted due to no activity on 2024/10/02 07:14
upstream INFO: task hung in io_uring_del_tctx_node (4) io-uring 1 C done 8 65d 61d 0/29 closed as invalid on 2025/06/02 13:41
upstream INFO: task hung in io_uring_del_tctx_node io-uring fs 1 C unreliable 37 1244d 1408d 20/29 fixed on 2022/03/08 16:11
upstream INFO: task hung in io_uring_del_tctx_node (2) io-uring 1 C error error 20 873d 1235d 0/29 auto-obsoleted due to no activity on 2023/07/30 22:24

Sample crash report:
INFO: task syz.1.950:7134 blocked for more than 143 seconds.
      Not tainted 5.15.189-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.950       state:D stack:    0 pid: 7134 ppid:  4038 flags:0x00000008
Call trace:
 __switch_to+0x2f4/0x558 arch/arm64/kernel/process.c:521
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0xe00/0x1c0c kernel/sched/core.c:6376
 schedule+0x11c/0x1c8 kernel/sched/core.c:6459
 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6518
 __mutex_lock_common+0xa9c/0x1edc kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0xac/0x11c kernel/locking/mutex.c:743
 io_uring_del_tctx_node+0xdc/0x25c io_uring/io_uring.c:9825
 io_uring_clean_tctx io_uring/io_uring.c:9841 [inline]
 io_uring_cancel_generic+0x498/0x714 io_uring/io_uring.c:9921
 __io_uring_cancel+0x24/0x34 io_uring/io_uring.c:9935
 io_uring_files_cancel include/linux/io_uring.h:16 [inline]
 do_exit+0x1f8/0x1f58 kernel/exit.c:829
 do_group_exit+0x100/0x268 kernel/exit.c:997
 get_signal+0x73c/0x1340 kernel/signal.c:2900
 do_signal arch/arm64/kernel/signal.c:893 [inline]
 do_notify_resume+0x35c/0x3128 arch/arm64/kernel/signal.c:946
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609
 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Showing all locks held in the system:
2 locks held by kworker/u4:0/9:
 #0: ffff0001a10d8958 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:475 [inline]
 #0: ffff0001a10d8958 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
 #0: ffff0001a10d8958 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1621 [inline]
 #0: ffff0001a10d8958 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x310/0x1c0c kernel/sched/core.c:6290
 #1: ffff0000c9388918 (&p->pi_lock){-.-.}-{2:2}, at: process_one_work+0x6b8/0x1140 kernel/workqueue.c:2285
1 lock held by khungtaskd/27:
 #0: ffff800014341360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:311
2 locks held by getty/3806:
 #0: ffff0000d3754098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x40/0x50 drivers/tty/tty_ldsem.c:340
 #1: ffff80001b7a32e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x2f0/0xf6c drivers/tty/n_tty.c:2158
1 lock held by syz.1.950/7133:
1 lock held by syz.1.950/7134:
 #0: ffff0000dbf2e0a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_uring_del_tctx_node+0xdc/0x25c io_uring/io_uring.c:9825
1 lock held by syz.6.2043/10155:
1 lock held by syz.2.2045/10146:
1 lock held by syz.0.2046/10148:
1 lock held by syz.5.2048/10149:
 #0: ffff0000d5b42958 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
 #0: ffff0000d5b42958 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x138/0x284 mm/util.c:549
2 locks held by syz.5.2048/10153:
1 lock held by syz.5.2048/10154:
 #0: ffff0000d5b42958 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 #0: ffff0000d5b42958 (&mm->mmap_lock){++++}-{3:3}, at: exit_mm+0xc0/0x684 kernel/exit.c:499

=============================================


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/24 10:19 linux-5.15.y c79648372d02 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in io_uring_del_tctx_node
* Struck through repros no longer work on HEAD.