[v5.15] WARNING in io_ring_exit_work

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c957cbb87315 Linux 5.15.105
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12732b2ec80000
kernel config: https://syzkaller.appspot.com/x/.config?x=852dc3de44ba1f3f
dashboard link: https://syzkaller.appspot.com/bug?extid=ec2b0cb78dce7ef062f6
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/91d0cf1fc5fb/disk-c957cbb8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/346dc1169521/vmlinux-c957cbb8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f7005bdc0e20/Image-c957cbb8.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec2b0c...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 6561 at io_uring/io_uring.c:9682 io_ring_exit_work+0x228/0x126c
Modules linked in:
CPU: 1 PID: 6561 Comm: kworker/u4:17 Not tainted 5.15.105-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: events_unbound io_ring_exit_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : io_ring_exit_work+0x228/0x126c
lr : io_ring_exit_work+0x224/0x126c io_uring/io_uring.c:9682
sp : ffff8000209579a0
x29: ffff800020957b00 x28: 1fffe00019b27494 x27: 0000000000001770
x26: ffff80000a8ec60c x25: ffff0000cd93a4a0 x24: ffff0000cd93a000
x23: dfff800000000000 x22: 000000010000c3a4 x21: ffff0000cd93a920
x20: ffff800020957a40 x19: ffffffffffffffff x18: 1fffe00036903f8e
x17: 1fffe00036903f8e x16: ffff80000824bf58 x15: ffff80001495eda0
x14: 1ffff0000291806a x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000a91bf58 x10: 0000000000000000 x9 : ffff80000a91bf58
x8 : ffff0000d62e8000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff800008301f6c
x2 : 0000000000000001 x1 : ffffffffffffffff x0 : 0000000000000000
Call trace:
io_ring_exit_work+0x228/0x126c
process_one_work+0x790/0x11b8 kernel/workqueue.c:2306
worker_thread+0x910/0x1034 kernel/workqueue.c:2453
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 925884
hardirqs last enabled at (925883): [<ffff800011a13230>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
hardirqs last enabled at (925883): [<ffff800011a13230>] _raw_spin_unlock_irq+0x9c/0x134 kernel/locking/spinlock.c:202
hardirqs last disabled at (925884): [<ffff80001193ad90>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (879558): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (879558): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (879309): [<ffff8000081b4ee0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (879309): [<ffff8000081b4ee0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (879309): [<ffff8000081b4ee0>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 52872ef836263cb7 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 543aff194ab6 Linux 6.1.23
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=156a99efc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=e9affea290775ea7
dashboard link: https://syzkaller.appspot.com/bug?extid=35442b6e5a1cb852f200

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/6fe9097a8f09/disk-543aff19.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9df5aa0f6266/vmlinux-543aff19.xz
kernel image: https://storage.googleapis.com/syzbot-assets/84127c4bde2b/bzImage-543aff19.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+35442b...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 10382 at io_uring/io_uring.c:2747 io_ring_exit_work+0x31d/0x794
Modules linked in:
CPU: 0 PID: 10382 Comm: kworker/u4:19 Not tainted 6.1.23-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Workqueue: events_unbound io_ring_exit_work
RIP: 0010:io_ring_exit_work+0x31d/0x794 io_uring/io_uring.c:2747
Code: 78 23 e8 e2 bd 0c f7 48 8b 7c 24 30 48 8b 74 24 18 e8 d3 be 09 00 48 85 c0 75 3f e8 c9 bd 0c f7 e9 f9 fd ff ff e8 bf bd 0c f7 <0f> 0b b8 70 17 00 00 48 89 44 24 18 eb cf 48 8b 4c 24 10 80 e1 07
RSP: 0018:ffffc90005677ae0 EFLAGS: 00010293
RAX: ffffffff8a7cd001 RBX: 0000000100015e82 RCX: ffff888021849d40
RDX: 0000000000000000 RSI: fffffffffffffeff RDI: 0000000000000000
RBP: ffffc90005677c50 R08: ffffffff8a7ccfd4 R09: ffffed100395d006
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000100015f83
R13: ffff8880185a1260 R14: 1ffff110030b424c R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0093a9000 CR3: 000000004b6e6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
process_one_work+0x8aa/0x11f0 kernel/workqueue.c:2289
worker_thread+0xa5f/0x1210 kernel/workqueue.c:2436
kthread+0x268/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.

[syzbot]