[PATCH] SUNRPC: Use TASK_FREEZABLE_UNSAFE in __rpc_execute()

[PATCH] SUNRPC: Use TASK_FREEZABLE_UNSAFE in __rpc_execute()

[syzbot]

From: Marco Elver <elver@google.com>

When a task executes a synchronous RPC call via __rpc_execute(), it waits
for the queued RPC task to wake up using out_of_line_wait_on_bit(). Callers
in subsystems such as NFS or NFSD (for example, write_ports() acquiring
nfsd_mutex during NFS server initialization and issuing an rpc_ping())
frequently hold locks across these synchronous RPC waits.

Historically, rpc_wait_bit_killable() invoked freezable_schedule_unsafe(),
which explicitly bypassed lockdep checks for held locks during freeze.
However, during the core freezer refactoring in commit f5d39b020809
("freezer,sched: Rewrite core freezer logic"), freezable_schedule_unsafe()
was removed, and callers were updated to pass freezer flags directly into
out_of_line_wait_on_bit(). While rpc_wait_for_completion_task() was
correctly updated to use TASK_KILLABLE | TASK_FREEZABLE_UNSAFE,
__rpc_execute() was mistakenly updated to use TASK_KILLABLE |
TASK_FREEZABLE without the unsafe flag.

As a result, if a system suspend occurs concurrently while a task is
waiting in __rpc_execute() with a lock held, __set_task_frozen() observes
p->lockdep_depth > 0 without __TASK_FREEZABLE_UNSAFE and triggers a lockdep
warning:

WARNING: kernel/freezer.c:139 at __set_task_frozen+0x260/0x340
Call Trace:
 <TASK>
 task_call_func+0x1aa/0x260 kernel/sched/core.c:4518
 __freeze_task kernel/freezer.c:150 [inline]
 freeze_task+0x216/0x390 kernel/freezer.c:169
 try_to_freeze_tasks+0x190/0x620 kernel/power/process.c:54
 freeze_processes+0xd0/0x1f0 kernel/power/process.c:137
 suspend_prepare kernel/power/suspend.c:387 [inline]
 enter_state kernel/power/suspend.c:609 [inline]
 pm_suspend+0x2f1/0x760 kernel/power/suspend.c:644
 state_store+0x206/0x290 kernel/power/main.c:819
 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Update __rpc_execute() to pass TASK_KILLABLE | TASK_FREEZABLE_UNSAFE to
out_of_line_wait_on_bit(). This restores the pre-regression behavior and
aligns __rpc_execute() with rpc_wait_for_completion_task(), avoiding the
false-positive lockdep warning when tasks holding locks are frozen during
synchronous RPC execution.

Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic")
Assisted-by: Gemini:gemini-3.8-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+209eccd8f507de9f7f1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=209eccd8f507de9f7f1b
Link: https://syzkaller.appspot.com/ai_job?id=cb10c20b-f568-4900-8b09-dc937852ee3f
Signed-off-by: Marco Elver <elver@google.com>

---
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 016f16ca5..494947d50 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -984,7 +984,7 @@ static void __rpc_execute(struct rpc_task *task)
 		trace_rpc_task_sync_sleep(task, task->tk_action);
 		status = out_of_line_wait_on_bit(&task->tk_runstate,
 				RPC_TASK_QUEUED, rpc_wait_bit_killable,
-				TASK_KILLABLE|TASK_FREEZABLE);
+				TASK_KILLABLE | TASK_FREEZABLE_UNSAFE);
 		if (status < 0) {
 			/*
 			 * When a sync task receives a signal, it exits with


base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
The person who has signed off on the patch is responsible for
addressing comments.
syzbot engineers can be reached at syzkaller@googlegroups.com.