syzbot


INFO: task hung in tls_sw_cancel_work_tx (2)

Status: upstream: reported on 2025/01/03 01:13
Reported-by: syzbot+ee45759a86f5ec5e7ef0@syzkaller.appspotmail.com
First crash: 33d, last: 33d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in tls_sw_cancel_work_tx net C done error 74 342d 1824d 0/28 closed as dup on 2020/12/29 19:08
linux-6.1 INFO: task hung in tls_sw_cancel_work_tx 3 448d 472d 0/3 auto-obsoleted due to no activity on 2024/02/22 04:34
linux-5.15 INFO: task hung in tls_sw_cancel_work_tx 1 468d 468d 0/3 auto-obsoleted due to no activity on 2024/02/02 07:08

Sample crash report:
INFO: task syz.1.2966:12930 blocked for more than 143 seconds.
      Not tainted 6.1.123-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.2966      state:D stack:0     pid:12930 ppid:4295   flags:0x00000001
Call trace:
 __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0xef4/0x1d44 kernel/sched/core.c:6558
 schedule+0xc4/0x170 kernel/sched/core.c:6634
 schedule_timeout+0xb8/0x344 kernel/time/timer.c:1941
 do_wait_for_common+0x30c/0x468 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 __flush_work+0x12c/0x1c0 kernel/workqueue.c:3076
 __cancel_work_timer+0x3ec/0x548 kernel/workqueue.c:3163
 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304
 tls_sw_cancel_work_tx+0x80/0xd0 net/tls/tls_sw.c:2443
 tls_sk_proto_close+0xf8/0xbc4 net/tls/tls_main.c:331
 inet_release+0x160/0x1d0 net/ipv4/af_inet.c:430
 inet6_release+0x5c/0x78 net/ipv6/af_inet6.c:491
 __sock_release net/socket.c:654 [inline]
 sock_close+0xb8/0x1fc net/socket.c:1400
 __fput+0x1c8/0x7c8 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x240/0x2f0 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x2080/0x2cb8 arch/arm64/kernel/signal.c:1132
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Showing all locks held in the system:
3 locks held by kworker/0:0/7:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265
 #1: ffff80001d1c7c20 ((work_completion)(&(&sw_ctx_tx->tx_work.work)->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
 #2: ffff0000f27848d8 (&ctx->tx_lock){+.+.}-{3:3}, at: tx_work_handler+0xf4/0x284 net/tls/tls_sw.c:2553
1 lock held by rcu_tasks_kthre/12:
 #0: ffff800015c65530 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffff800015c65d30 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
 #0: ffff800015c65360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
2 locks held by kworker/u4:4/293:
 #0: ffff0000c0029138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265
 #1: ffff800020ed7c20 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
2 locks held by getty/4056:
 #0: ffff0000d8850098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
 #1: ffff80001d8302f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1214 drivers/tty/n_tty.c:2198
1 lock held by syz.1.2966/12930:
 #0: ffff0000e17db810 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #0: ffff0000e17db810 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline]
 #0: ffff0000e17db810 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x80/0x1fc net/socket.c:1400
1 lock held by syz.5.3650/15148:
1 lock held by syz.2.3655/15163:

=============================================


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/03 01:12 linux-6.1.y 7dc732d24ff7 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 INFO: task hung in tls_sw_cancel_work_tx
* Struck through repros no longer work on HEAD.