Re: [syzbot] [io-uring?] WARNING in io_wq_put_and_exit (2)

[Jens Axboe <axboe@kernel.dk>]

On 11/15/26 8:22 AM, Ming Lei wrote:
> On Wed, May 27, 2026 at 1:53?AM syzbot
> <syzbot+b0d54b9e81de55179e47@syzkaller.appspotmail.com> wrote:
>>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    6a97c4d5262d Merge tag 'for-linus' of git://git.kernel.org..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=17a41ea6580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=e327ee9a867dd6b9
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b0d54b9e81de55179e47
>> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/5cc8b6debcbd/disk-6a97c4d5.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/649698f0231f/vmlinux-6a97c4d5.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/b297958f355b/bzImage-6a97c4d5.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+b0d54b9e81de55179e47@syzkaller.appspotmail.com
>>
>> ------------[ cut here ]------------
>> time_after(jiffies, warn_timeout)
>> WARNING: io_uring/io-wq.c:1370 at io_wq_exit_workers io_uring/io-wq.c:1370 [inline], CPU#1: syz.1.3756/22484
>> WARNING: io_uring/io-wq.c:1370 at io_wq_put_and_exit+0x36c/0x9d0 io_uring/io-wq.c:1399, CPU#1: syz.1.3756/22484
>> Modules linked in:
>> CPU: 1 UID: 0 PID: 22484 Comm: syz.1.3756 Tainted: G             L      syzkaller #0 PREEMPT(full)
>> Tainted: [L]=SOFTLOCKUP
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
>> RIP: 0010:io_wq_exit_workers io_uring/io-wq.c:1370 [inline]
>> RIP: 0010:io_wq_put_and_exit+0x36c/0x9d0 io_uring/io-wq.c:1399
>> Code: 00 00 0f 85 7d 05 00 00 48 8b 15 9f 3c 4c 09 4d 89 e7 31 ff 49 29 d7 4c 89 fe e8 cf f6 13 fd 4d 85 ff 79 aa e8 e5 fb 13 fd 90 <0f> 0b 90 eb 9f e8 da fb 13 fd 4c 8d 63 08 48 b8 00 00 00 00 00 fc
>> RSP: 0018:ffffc900077af8c0 EFLAGS: 00010293
>> RAX: 0000000000000000 RBX: ffff888033fdb000 RCX: ffffffff84f4b5f1
>> RDX: ffff888030d4ca00 RSI: ffffffff84f4b5fb RDI: ffff888030d4ca00
>> RBP: fffffbfff1c81e50 R08: 0000000000000007 R09: 0000000000000000
>> R10: ffffffffffffe7c3 R11: 0000000000000000 R12: 0000000100027def
>> R13: 0000000000001b58 R14: ffff888033fdb018 R15: ffffffffffffe7c3
>> FS:  00007ff97ac796c0(0000) GS:ffff88812446a000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00007f4b79c90b9b CR3: 0000000037235000 CR4: 00000000003526f0
>> Call Trace:
>>  <TASK>
>>  io_uring_clean_tctx+0x114/0x180 io_uring/tctx.c:248
>>  io_uring_cancel_generic+0x7b9/0x810 io_uring/cancel.c:657
>>  io_uring_files_cancel include/linux/io_uring.h:20 [inline]
>>  do_exit+0x344/0x2af0 kernel/exit.c:916
>>  do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
>>  get_signal+0x20ff/0x2210 kernel/signal.c:3037
>>  arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
>>  __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
>>  exit_to_user_mode_loop+0x8b/0x4f0 kernel/entry/common.c:98
>>  __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
>>  syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
>>  syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
>>  do_syscall_64+0x706/0x860 arch/x86/entry/syscall_64.c:100
>>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>> RIP: 0033:0x7ff979d9ce59
>> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
>> RSP: 002b:00007ff97ac79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
>> RAX: 0000000000018ff8 RBX: 00007ff97a015fa0 RCX: 00007ff979d9ce59
>> RDX: 0000000000018ff8 RSI: 0000200000009b80 RDI: 0000000000000003
>> RBP: 00007ff979e32d6f R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ff97a016038 R14: 00007ff97a015fa0 R15: 00007ffc1552e588
>>  </TASK>
> 
> It should be fixed by the following patch:
> 
> https://lore.kernel.org/linux-block/20260930042335.16199-1-zcgao@amazon.com/

Not the posted reproducer, that has nothing to do with ublk. But yes you
could certainly make one with ublk as well. In practice any of these
"exit is slow, use WARN_ON_ONCE()" will always be triggerable, as the
fuse case in the reproducer. That doesn't mean that the above isn't a
bug and should not be fixed in ublk, just that it is an instance of
something that can trigger the slow exit WARN_ON_ONCE().

-- 
Jens Axboe