From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f72.google.com (mail-oo1-f72.google.com [209.85.161.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2787B2C027F for ; Wed, 25 Feb 2026 10:51:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.72 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772016667; cv=none; b=UlsUlekMwrQ4rcCbaBxh7xC1bit1BnfuEeNTXBY3yerobc1RlnlZP/0BCbXyXCuJ9Q6wYEUc9qpO6zmaJqHopICCvPEEQ2KrfzQ7TE7GWsghCkReUNqpzBBmidJc5oYEF8Q2Zu+bcMHctcP08g9FJQOo8qKNyeq8kgMIxTHF+Pg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772016667; c=relaxed/simple; bh=pA4FeAGmfVTqmGNZZxfdBYuBpiO0O0J7UoBR/J81jok=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=Nr/Td3NnB8IYPL6ZhFclJLpQ8bWKmO2v9FodFhaSeY7Yn/7V4YoP+KjIaaPUYFHW3B4eAjVK1SUvqU0Q6EbtL3yLluz/TVqWAXOqZ00dW6SU+QKkEukWwoz3vzP6CwiAQDxvnjA/C4HQt0vvNIgIN/bh30e42MgXd8HLyevN0hc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f72.google.com with SMTP id 006d021491bc7-679c44ae7abso11298377eaf.1 for ; Wed, 25 Feb 2026 02:51:05 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772016665; x=1772621465; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=R4oJ/vNegbaUtpIT/cfYMbuOnhdbTHJqLCTsHt+NXZQ=; b=dHM25lsx0+wy0mfyErAZYapxIwZSu6zVuGjq8ouUUWtjkERlzlLQytpBUrc5HiqVUT jqh/60+yV2pZiKWKlpTdQyiRH9X6Ge/YLB1078l7Jl13Z0evr5vJbLs8hum8LDlGD5BA 7EoG5Y92MNVXa6ZBqCLRb+4SREqhTFtBkADK5yNgRgxvJ/6WEZwH4eGkCXvA3lMXXrCh wl56D7xTtZIRj+bDuGHCZy4MeS1/A/ZEWnJg4AZBuuRwJIjDhadPH3sYXbPZeKbAxHv1 RxoS93Y3ezzaUmgudyF96HUyzDqGEB+p/ZgY6bA1VpIhhJHNAPkZFBGh0Kwt7Xgz2k+M XqGg== X-Forwarded-Encrypted: i=1; AJvYcCU3AN8SqFsl6/Iv4uu7yTtNywYECUUwlFN4m4j68ooGbaUT8sGMqU40MSnu/WjiS3YBKeMOtWqCxMkh1HE=@vger.kernel.org X-Gm-Message-State: AOJu0YwLOMAmyppQuoPnyigqq7iJrnAzl210Z9cCnkGjXr68xjFkhUu+ CgQy5MKdfwjQF2rdmVgpVqPFbW6d7dR9YquYtKMKoWfsyf53RykBkxSoOzzof9E5W2jl/waWrnS nlwIVsak/UF9PdD8UFnpyCCf08GVP8TVMjy6OYDik7A8zOGX25JDZ3Y+4w4Y= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:2204:b0:679:c346:d8cd with SMTP id 006d021491bc7-679e62ec369mr1727542eaf.28.1772016665101; Wed, 25 Feb 2026 02:51:05 -0800 (PST) Date: Wed, 25 Feb 2026 02:51:05 -0800 In-Reply-To: <20260225102245.434-1-hdanton@sina.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <699ed419.050a0220.1cd54b.0008.GAE@google.com> Subject: Re: [syzbot] [lsm] [kernel] INFO: task hung in restrict_one_thread_callback From: syzbot To: hdanton@sina.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in restrict_one_thread_callback INFO: task syz.0.140:6853 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.140 state:D stack:25600 pid:6853 tgid:6853 ppid:6361 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0x1585/0x5340 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0x164/0x360 kernel/sched/core.c:7004 schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153 restrict_one_thread security/landlock/tsync.c:128 [inline] restrict_one_thread_callback+0x320/0x570 security/landlock/tsync.c:162 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11eb/0x1330 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2c1c79bf79 RSP: 002b:00007ffccde0b128 EFLAGS: 00000246 ORIG_RAX: 00000000000000db RAX: fffffffffffffdfc RBX: 000000000001f230 RCX: 00007f2c1c79bf79 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2c1ca1618c RBP: 0000000000000032 R08: 3fffffffffffffff R09: 0000000000000000 R10: 00007ffccde0b230 R11: 0000000000000246 R12: 00007ffccde0b250 R13: 00007f2c1ca1618c R14: 000000000001f262 R15: 00007ffccde0b230 INFO: task syz.0.140:6854 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.140 state:D stack:28264 pid:6854 tgid:6853 ppid:6361 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0x1585/0x5340 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0x164/0x360 kernel/sched/core.c:7004 schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153 restrict_one_thread security/landlock/tsync.c:128 [inline] restrict_one_thread_callback+0x320/0x570 security/landlock/tsync.c:162 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11eb/0x1330 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2c1c79bf79 RSP: 002b:00007f2c1d6710e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f2c1ca15fa8 RCX: 00007f2c1c79bf79 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2c1ca15fa8 RBP: 00007f2c1ca15fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2c1ca16038 R14: 00007ffccde0aee0 R15: 00007ffccde0afc8 INFO: task syz.0.140:6855 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.140 state:D stack:28216 pid:6855 tgid:6853 ppid:6361 task_flags:0x400140 flags:0x00080006 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0x1585/0x5340 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0x164/0x360 kernel/sched/core.c:7004 schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153 landlock_restrict_sibling_threads+0xe9c/0x11f0 security/landlock/tsync.c:539 __do_sys_landlock_restrict_self security/landlock/syscalls.c:574 [inline] __se_sys_landlock_restrict_self+0x540/0x810 security/landlock/syscalls.c:482 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2c1c79bf79 RSP: 002b:00007f2c1d650028 EFLAGS: 00000246 ORIG_RAX: 00000000000001be RAX: ffffffffffffffda RBX: 00007f2c1ca16090 RCX: 00007f2c1c79bf79 RDX: 0000000000000000 RSI: 000000000000000e RDI: 0000000000000003 RBP: 00007f2c1c8327e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2c1ca16128 R14: 00007f2c1ca16090 R15: 00007ffccde0afc8 INFO: task syz.0.140:6856 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.140 state:D stack:28368 pid:6856 tgid:6853 ppid:6361 task_flags:0x400140 flags:0x00080006 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0x1585/0x5340 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0x164/0x360 kernel/sched/core.c:7004 schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153 landlock_restrict_sibling_threads+0xe9c/0x11f0 security/landlock/tsync.c:539 __do_sys_landlock_restrict_self security/landlock/syscalls.c:574 [inline] __se_sys_landlock_restrict_self+0x540/0x810 security/landlock/syscalls.c:482 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2c1c79bf79 RSP: 002b:00007f2c1d62f028 EFLAGS: 00000246 ORIG_RAX: 00000000000001be RAX: ffffffffffffffda RBX: 00007f2c1ca16180 RCX: 00007f2c1c79bf79 RDX: 0000000000000000 RSI: 000000000000000e RDI: 0000000000000003 RBP: 00007f2c1c8327e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2c1ca16218 R14: 00007f2c1ca16180 R15: 00007ffccde0afc8 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #0: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #0: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 5 locks held by kworker/u8:10/1152: #0: ffff8880b873ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647 #1: ffff8880b8724588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933 #2: ffff888053c88788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6441 [inline] #2: ffff888053c88788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x4a0 net/wireless/core.c:426 #3: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #3: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #3: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: ieee80211_sta_active_ibss+0xc3/0x330 net/mac80211/ibss.c:635 #4: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #4: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #4: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1193 [inline] #4: ffffffff8e9602e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa5/0x23c0 arch/x86/kernel/unwind_orc.c:495 2 locks held by getty/5584: #0: ffff888037fb00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xfd9/0x1030 kernel/hung_task.c:515 kthread+0x388/0x470 kernel/kthread.c:467 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 13992 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:rcu_read_unlock include/linux/rcupdate.h:879 [inline] RIP: 0010:xa_load+0x16a/0x210 lib/xarray.c:1621 Code: 06 04 00 00 75 07 e8 f5 4e 0f f6 eb c3 e8 6e bb 01 00 89 c5 31 ff 89 c6 e8 23 53 0f f6 85 ed 74 10 e8 9a 68 f4 f5 84 c0 74 0e d1 4e 0f f6 eb 56 e8 ca 4e 0f f6 eb 4f e8 43 bb 01 00 89 c5 31 RSP: 0018:ffffc90003497230 EFLAGS: 00000202 RAX: 0000000000000001 RBX: ffffffff8bb68ba0 RCX: 0000000080000001 RDX: ffff8880584c3c80 RSI: ffffffff8c29ba60 RDI: ffffffff8c29ba20 RBP: 0000000000000001 R08: ffff8880584c3c80 R09: 0000000000000002 R10: 0000000000000406 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: ffff88803369ca00 R15: ffffc90003497230 FS: 000055558749a500(0000) GS:ffff888125311000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f92f6facc00 CR3: 0000000074826000 CR4: 00000000003526f0 Call Trace: memcg_list_lru_allocated mm/list_lru.c:510 [inline] memcg_list_lru_alloc+0x14c/0x800 mm/list_lru.c:521 __memcg_slab_post_alloc_hook+0x312/0xa80 mm/memcontrol.c:3220 memcg_slab_post_alloc_hook mm/slub.c:2459 [inline] slab_post_alloc_hook mm/slub.c:4512 [inline] slab_alloc_node mm/slub.c:4830 [inline] kmem_cache_alloc_lru_noprof+0x346/0x640 mm/slub.c:4849 __d_alloc+0x37/0x6f0 fs/dcache.c:1740 d_alloc_parallel+0xe6/0x1610 fs/dcache.c:2604 __lookup_slow+0x137/0x410 fs/namei.c:1901 lookup_slow+0x53/0x70 fs/namei.c:1933 walk_component fs/namei.c:2279 [inline] link_path_walk+0x1273/0x18d0 fs/namei.c:2644 path_openat+0x2c3/0x3860 fs/namei.c:4826 do_file_open+0x23e/0x4a0 fs/namei.c:4859 do_sys_openat2+0x113/0x200 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1383 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f92f6f5c84e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffcaf09ae38 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055558749a500 RCX: 00007f92f6f5c84e RDX: 0000000000080001 RSI: 00007f92f703376c RDI: ffffffffffffff9c RBP: 00007f92f703376c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: 00007ffcaf09af10 R14: 0000000000043e78 R15: 00007ffcaf09b480 Tested on: commit: 7dff99b3 Remove WARN_ALL_UNSEEDED_RANDOM kernel config.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16d4f152580000 kernel config: https://syzkaller.appspot.com/x/.config?x=56c0294cb1688557 dashboard link: https://syzkaller.appspot.com/bug?extid=7ea2f5e9dfd468201817 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 Note: no patches were applied.