lkml.org 
[lkml]   [2018]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
SubjectRe: INFO: task hung in fuse_sb_destroy
On Mon, Nov 5, 2018 at 11:40 AM, Miklos Szeredi <miklos@szeredi.hu> wrote:
> On Thu, Nov 1, 2018 at 12:05 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
>> On Thu, Nov 1, 2018 at 11:49 AM, syzbot
>> <syzbot+6339eda9cb4ebbc4c37b@syzkaller.appspotmail.com> wrote:
>>> Hello,
>>>
>>> syzbot found the following crash on:
>>>
>>> HEAD commit: 59fc453b21f7 Merge branch 'akpm' (patches from Andrew)
>>> git tree: upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=15fb2447400000
>>> kernel config: https://syzkaller.appspot.com/x/.config?x=ea045471e4c756e8
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=6339eda9cb4ebbc4c37b
>>> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=178a105d400000
>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16651133400000
>>
>>
>> I can easily reproduce this.
>
> I can't reproduce on my meager dual core notebook.
>
>>
>> The repro gives me a task hanged at:
>>
>> # cat /proc/7563/task/*/stack
>> [<0>] fuse_wait_aborted+0x20b/0x320
>> [<0>] fuse_sb_destroy+0xe2/0x1d0
>> [<0>] fuse_kill_sb_anon+0x15/0x20
>> [<0>] deactivate_locked_super+0x97/0x100
>> [<0>] deactivate_super+0x2bb/0x320
>> [<0>] cleanup_mnt+0xbf/0x160
>> [<0>] __cleanup_mnt+0x16/0x20
>> [<0>] task_work_run+0x1e8/0x2a0
>> [<0>] exit_to_usermode_loop+0x318/0x380
>> [<0>] do_syscall_64+0x6be/0x820
>> [<0>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>> [<0>] 0xffffffffffffffff
>>
>> I double checked that writing to /sys/fs/fuse/connections/44/abort did
>> not help (the only entry in fuse/connections). Wrote multiple times,
>> and tried to kill the task, nothing helps.
>
> What's the output of
>
> cat /sys/fs/fuse/connections/NN/waiting
>
> ?

I think I found the culprit. Does the attached patch fix it?

Thanks,
Miklos
---
fs/fuse/dev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1715,8 +1715,10 @@ static int fuse_retrieve(struct fuse_con
req->in.args[1].size = total_len;

err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
- if (err)
+ if (err) {
fuse_retrieve_end(fc, req);
+ fuse_put_request(fc, req);
+ }

return err;
}
\
 
 \ /
  Last update: 2018-11-05 13:04    [W:0.068 / U:0.760 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site