syzbot ci has tested the following series [v1] net/rds: RDS-TCP reconnect and fanout improvements https://lore.kernel.org/all/[email protected] * [PATCH net-next v1 1/3] net/rds: Delegate fan-out to a background worker * [PATCH net-next v1 2/3] net/rds: Use proper peer port number even when not connected * [PATCH net-next v1 3/3] net/rds: rds_sendmsg should not discard payload_len
and found the following issue: BUG: sleeping function called from invalid context in rds_tcp_conn_free Full report is available here: https://ci.syzbot.org/series/1a5ef180-c02c-401d-9df7-670b18570a55 *** BUG: sleeping function called from invalid context in rds_tcp_conn_free tree: net-next URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next.git base: 7a4cd71fa4514cd85df39b3cf99da8142660cdcd arch: amd64 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 config: https://ci.syzbot.org/builds/77f47047-43cb-4c25-b0b6-73b8746cea2a/config syz repro: https://ci.syzbot.org/findings/49698f1e-4f36-4446-9dd1-c409366e6296/syz_repro BUG: sleeping function called from invalid context at kernel/workqueue.c:4390 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 6005, name: syz.2.19 preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 0 2 locks held by syz.2.19/6005: #0: ffffffff8e35a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e35a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e35a360 (rcu_read_lock){....}-{1:3}, at: __rds_conn_create+0x2e4/0x22d0 net/rds/connection.c:177 #1: ffffffff8fa00a98 (rds_conn_lock){....}-{3:3}, at: __rds_conn_create+0x18e2/0x22d0 net/rds/connection.c:304 irq event stamp: 752 hardirqs last enabled at (751): [<ffffffff8b7cc843>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (751): [<ffffffff8b7cc843>] _raw_spin_unlock_irq+0x23/0x50 kernel/locking/spinlock.c:202 hardirqs last disabled at (752): [<ffffffff8b7cc61a>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (752): [<ffffffff8b7cc61a>] _raw_spin_lock_irqsave+0x1a/0x60 kernel/locking/spinlock.c:162 softirqs last enabled at (32): [<ffffffff8ac0cd59>] rds_sendmsg+0x7b9/0x2150 net/rds/send.c:1266 softirqs last disabled at (30): [<ffffffff89463a1f>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (30): [<ffffffff89463a1f>] release_sock+0x2f/0x1f0 net/core/sock.c:3793 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 0 UID: 0 PID: 6005 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x378/0x4d0 kernel/sched/core.c:8829 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4390 rds_tcp_conn_free+0x2c/0x170 net/rds/tcp.c:361 __rds_conn_create+0x1bfb/0x22d0 net/rds/connection.c:334 rds_conn_create_outgoing+0x43/0x60 net/rds/connection.c:377 rds_sendmsg+0xff5/0x2150 net/rds/send.c:1321 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x4d7/0x810 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b6bf9acb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5b6cd8b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f5b6c216090 RCX: 00007f5b6bf9acb9 RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000004 RBP: 00007f5b6c008bf7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5b6c216128 R14: 00007f5b6c216090 R15: 00007ffc17760058 </TASK> *** If these findings have caused you to resend the series or submit a separate fix, please add the following tag to your commit message: Tested-by: [email protected] --- This report is generated by a bot. It may contain errors. syzbot ci engineers can be reached at [email protected].
