Re: INFO: task hung in fuse_sb_destroy

[Miklos Szeredi]

On Mon, Nov 5, 2018 at 11:40 AM, Miklos Szeredi <miklos@xxxxxxxxxx> wrote:
> On Thu, Nov 1, 2018 at 12:05 PM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>> On Thu, Nov 1, 2018 at 11:49 AM, syzbot
>> <syzbot+6339eda9cb4ebbc4c37b@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>>> Hello,
>>>
>>> syzbot found the following crash on:
>>>
>>> HEAD commit:    59fc453b21f7 Merge branch 'akpm' (patches from Andrew)
>>> git tree:       upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=15fb2447400000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ea045471e4c756e8
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=6339eda9cb4ebbc4c37b
>>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178a105d400000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16651133400000
>>
>>
>> I can easily reproduce this.
>
> I can't reproduce on my meager dual core notebook.
>
>>
>> The repro gives me a task hanged at:
>>
>> # cat /proc/7563/task/*/stack
>> [<0>] fuse_wait_aborted+0x20b/0x320
>> [<0>] fuse_sb_destroy+0xe2/0x1d0
>> [<0>] fuse_kill_sb_anon+0x15/0x20
>> [<0>] deactivate_locked_super+0x97/0x100
>> [<0>] deactivate_super+0x2bb/0x320
>> [<0>] cleanup_mnt+0xbf/0x160
>> [<0>] __cleanup_mnt+0x16/0x20
>> [<0>] task_work_run+0x1e8/0x2a0
>> [<0>] exit_to_usermode_loop+0x318/0x380
>> [<0>] do_syscall_64+0x6be/0x820
>> [<0>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>> [<0>] 0xffffffffffffffff
>>
>> I double checked that writing to /sys/fs/fuse/connections/44/abort did
>> not help (the only entry in fuse/connections). Wrote multiple times,
>> and tried to kill the task, nothing helps.
>
> What's the output of
>
> cat /sys/fs/fuse/connections/NN/waiting
>
> ?

I think I found the culprit.  Does the attached patch fix it?

Thanks,
Miklos
---
 fs/fuse/dev.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1715,8 +1715,10 @@ static int fuse_retrieve(struct fuse_con
 	req->in.args[1].size = total_len;
 
 	err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
-	if (err)
+	if (err) {
 		fuse_retrieve_end(fc, req);
+		fuse_put_request(fc, req);
+	}
 
 	return err;
 }