From nobody Sat Apr 4 00:13:59 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75DA9230BE9 for ; Sun, 22 Mar 2026 11:19:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774178350; cv=none; b=WCWtyFqChJQgpHv51Bikr93pA1xw3nUXrlMglr5e7KMeigZigqTPcQI9/mhyur7+kfOVpSN/uUpyPz83X8Xwx6RoMF8I6LyffR/Nw/MbtAhmp4ZlHp5czKoMxwrSc1kSEOJJ/3bqEU5ZyX6mCoiDH6DX/Iu13p75eWt5fCnQyiI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774178350; c=relaxed/simple; bh=a4OneQuk562HQPe43TEMpcXX38g4+4czxvfIH7fmsD0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Pn+UCkjUaYtsrYUkA7DaTtMrjQUY0s8YCBbu08PUO508UYkd7thd0y//1e60/abDx+Jtv0ReED67S9LNtk4nyryxAABfA5jA3QBWLvjkjtivbADyw0mWei+8WtPWnOSlJ26i5PBVMwXmU6pC46ONXzrrxW6x73zajG820EfBDqY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=SkI5XEia; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=rzY9CtlA; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="SkI5XEia"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="rzY9CtlA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774178348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=6Ji7333s+3Gv2Csfphv4Wte2Ssxb62LRHJq7IxSIvYA=; b=SkI5XEiaoYsnk4tps4Am1i58e6vgSRQ0eEjlUkNsjnf/JRbqSxbRNc78saoTuIZDzbZP5N CFTIuchVzkBJ/ULfGf3XUVzHr9Es2QybCRS7kCbM5He4lfwHYLr4nYQAUehCgk8ZPRltwD Ud2ZdFTN63UpT0LmlF6jG6DrAMJMZSM= Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-711-Mzi3v-Q5M824ML03ZXqoqQ-1; Sun, 22 Mar 2026 07:19:06 -0400 X-MC-Unique: Mzi3v-Q5M824ML03ZXqoqQ-1 X-Mimecast-MFC-AGG-ID: Mzi3v-Q5M824ML03ZXqoqQ_1774178346 Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2b059511554so260546175ad.0 for ; Sun, 22 Mar 2026 04:19:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1774178346; x=1774783146; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=6Ji7333s+3Gv2Csfphv4Wte2Ssxb62LRHJq7IxSIvYA=; b=rzY9CtlAHNg8Hv86Evk2R520ztrlgmmONQTojrNOYav7zEReKyBQZcVDMUFMXBAVsZ u6RcMu3c/dsP4eicmHIQqcyyO7BJ1qDZHCKUsCG4Jr5lzQrtnWfzf4PUL+km8W41DJ/7 ajkXZAVb97efdNPfrvfw9OtcMJRo+R7r6IycfhmtXUxUggy5WFPSgD13jQfhjoE+D15m aabw/GhUSsOPzZ2Mkjb1X1tvVkTwerPhRTXA/gf/EW1IuVaE9l1sqQEAIPozNjJTYN1t NTCxcURJ8ft+mvzIqdCsmCpB2ZHXAyDJgSTRM6CfyQUtYV/F3lGLM18nZxfmt9ydw6vm s6LQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774178346; x=1774783146; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=6Ji7333s+3Gv2Csfphv4Wte2Ssxb62LRHJq7IxSIvYA=; b=j+bsZ511gZXOO7Fic2kQ2rUUUuOTctfpdAFF1VHBOcGeii+weteB1sRKey/S/1JYwZ cF21fxl0q2/RbG0nWpDR0GZgDSBvk/ovftqhEVX+QQD8mm8wwl0vwnWc+5IoKfRCihI4 8P8dxdfWBdc6B0GnNZH4ij9LBFEOaR1cNdtxu0zw5YNvpMgZ9GGOJTIZkDwvHcvkHbai /LS6lu9vcmffv4lQmX9rx17BCnEsx1fYQKPG27/cmLh0D8Byq6icwIf8WaysZzIbmpgU LBW71e61VQ0Lxcs7CA2qPXPsoRxIm2Dr/uBnQSew207V+Wd7Q4n+tPaJfEyttChUMwZX fOwg== X-Forwarded-Encrypted: i=1; AJvYcCX3CSvUNi+qgqct9/168E8oF7GhPNNxZI0zHxjYKt0m9olPFPF98N4+nOXhohdPwatxi0cy0BgYE9osnRs=@vger.kernel.org X-Gm-Message-State: AOJu0YxPwvsdEFqBC66qlC9eaxLRN5S3zpi17L3hKSkP5vB7N7SWLiB6 fe0E5n4K3LvuNX7uZC+qNeyF0X49ROzCnoZMMdQnzx17LJUA4ZiO7ZenkLO1Dx7TcuELI4PTmXb JAvQZVp6Iz//6qGHU47UZbcePY3MeiqgFp5oJGHZsGoiTQmV/iHuqk3KA9VIUNgkBXw== X-Gm-Gg: ATEYQzyllWQuEXISfgxubqRbTEZez2DRZVRQBu9NpXclOGcUw5PSX+K4f8flNyHsItv v+4YrQE6WeOeeu3J1n8YtelZf3S+gtI1PQSk2bAUpIgAnpLOgCgQhJGqL0JIHqNSrQa9Wx98lN3 QLjrB9NjxyAw8HQoZdmR0GYAMqgE41XyGQQ+B7LeiQOLQLJfD6waq/KWTDVu1vVb0ZbrZ0eGBtA Kiwl1H2HCNWFRAj6axxaboRZGiIgJg4ufjHTkdnYtPE+y8Od5hZh3cAnFwww+J1OSgl/GvU9yNA NXYcfA2/bDt4k+sf5nq/U5Fk2H3D11LwIkHV83ulHWp9SZtjWCN8K+cwSONzFXM0F1lLe5gyeDE NJcI9hCnaycMepTLINy9vRrpgE9JduCpfiy8Q9GyOoB/YFg== X-Received: by 2002:a17:903:32c6:b0:2ae:ac0c:5a29 with SMTP id d9443c01a7336-2b0826d7421mr88536735ad.10.1774178345909; Sun, 22 Mar 2026 04:19:05 -0700 (PDT) X-Received: by 2002:a17:903:32c6:b0:2ae:ac0c:5a29 with SMTP id d9443c01a7336-2b0826d7421mr88536605ad.10.1774178345560; Sun, 22 Mar 2026 04:19:05 -0700 (PDT) Received: from kernel-devel.tail62cea.ts.net ([240d:1a:c0d:9f00:be24:11ff:fe35:71b3]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b0836744a5sm76174955ad.63.2026.03.22.04.19.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 22 Mar 2026 04:19:05 -0700 (PDT) From: Shigeru Yoshida To: Eric Van Hensbergen , Latchesar Ionkov , Dominique Martinet , Christian Schoenebeck , Tuomas Tynkkynen , Al Viro Cc: Shigeru Yoshida , syzbot+6ed94e81a1492fe1d512@syzkaller.appspotmail.com, v9fs@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH] 9p: don't ignore fatal signals during flush Date: Sun, 22 Mar 2026 20:18:47 +0900 Message-ID: <20260322111848.2837057-1-syoshida@redhat.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a 9P RPC request is interrupted by a signal, p9_client_rpc() clears TIF_SIGPENDING and attempts to flush the pending request by calling p9_client_flush(). Since commit 9523feac272c switched the wait from wait_event_interruptible() to wait_event_killable(), only SIGKILL can interrupt the wait. However, the flush path also clears TIF_SIGPENDING, which prevents subsequent wait_event_killable() calls from detecting the already-pending SIGKILL. This makes the task unkillable. When a coredump is initiated by another thread, zap_process() sends SIGKILL to all threads. If a thread is stuck in the flush path as described above, it never exits, and the dumper thread waits forever in coredump_wait(), resulting in a hung task. The same issue exists in p9_client_zc_rpc(). Skip the flush and the P9_TFLUSH retry loop when a fatal signal is pending so that the task can exit promptly. Fixes: 9523feac272c ("net/9p: Switch to wait_event_killable()") Reported-by: syzbot+6ed94e81a1492fe1d512@syzkaller.appspotmail.com Signed-off-by: Shigeru Yoshida --- net/9p/client.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/9p/client.c b/net/9p/client.c index f0dcf252af7e..28742f19041e 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -599,7 +599,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const c= har *fmt, ...) smp_rmb(); =20 if (err =3D=3D -ERESTARTSYS && c->status =3D=3D Connected && - type =3D=3D P9_TFLUSH) { + type =3D=3D P9_TFLUSH && !fatal_signal_pending(current)) { sigpending =3D 1; clear_thread_flag(TIF_SIGPENDING); goto again; @@ -609,7 +609,8 @@ p9_client_rpc(struct p9_client *c, int8_t type, const c= har *fmt, ...) p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); err =3D req->t_err; } - if (err =3D=3D -ERESTARTSYS && c->status =3D=3D Connected) { + if (err =3D=3D -ERESTARTSYS && c->status =3D=3D Connected && + !fatal_signal_pending(current)) { p9_debug(P9_DEBUG_MUX, "flushing\n"); sigpending =3D 1; clear_thread_flag(TIF_SIGPENDING); @@ -694,7 +695,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_clie= nt *c, int8_t type, p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); err =3D req->t_err; } - if (err =3D=3D -ERESTARTSYS && c->status =3D=3D Connected) { + if (err =3D=3D -ERESTARTSYS && c->status =3D=3D Connected && + !fatal_signal_pending(current)) { p9_debug(P9_DEBUG_MUX, "flushing\n"); sigpending =3D 1; clear_thread_flag(TIF_SIGPENDING); --=20 2.52.0