When a task executes a synchronous RPC call via __rpc_execute(), it waits for the queued RPC task to wake up using out_of_line_wait_on_bit(). Callers in subsystems such as NFS or NFSD (for example, write_ports() acquiring nfsd_mutex during NFS server initialization and issuing an rpc_ping()) frequently hold locks across these synchronous RPC waits. Historically, rpc_wait_bit_killable() invoked freezable_schedule_unsafe(), which explicitly bypassed lockdep checks for held locks during freeze. However, during the core freezer refactoring in commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic"), freezable_schedule_unsafe() was removed, and callers were updated to pass freezer flags directly into out_of_line_wait_on_bit(). While rpc_wait_for_completion_task() was correctly updated to use TASK_KILLABLE | TASK_FREEZABLE_UNSAFE, __rpc_execute() was mistakenly updated to use TASK_KILLABLE | TASK_FREEZABLE without the unsafe flag. As a result, if a system suspend occurs concurrently while a task is waiting in __rpc_execute() with a lock held, __set_task_frozen() observes p->lockdep_depth > 0 without __TASK_FREEZABLE_UNSAFE and triggers a lockdep warning: WARNING: kernel/freezer.c:139 at __set_task_frozen+0x260/0x340 Call Trace: task_call_func+0x1aa/0x260 kernel/sched/core.c:4518 __freeze_task kernel/freezer.c:150 [inline] freeze_task+0x216/0x390 kernel/freezer.c:169 try_to_freeze_tasks+0x190/0x620 kernel/power/process.c:54 freeze_processes+0xd0/0x1f0 kernel/power/process.c:137 suspend_prepare kernel/power/suspend.c:387 [inline] enter_state kernel/power/suspend.c:609 [inline] pm_suspend+0x2f1/0x760 kernel/power/suspend.c:644 state_store+0x206/0x290 kernel/power/main.c:819 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345 vfs_write+0x61e/0xbb0 fs/read_write.c:687 ksys_write+0x156/0x270 fs/read_write.c:739 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Update __rpc_execute() to pass TASK_KILLABLE | TASK_FREEZABLE_UNSAFE to out_of_line_wait_on_bit(). This restores the pre-regression behavior and aligns __rpc_execute() with rpc_wait_for_completion_task(), avoiding the false-positive lockdep warning when tasks holding locks are frozen during synchronous RPC execution. Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic") Assisted-by: Gemini:gemini-3.8-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+209eccd8f507de9f7f1b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=209eccd8f507de9f7f1b Link: https://syzkaller.appspot.com/ai_job?id=cb10c20b-f568-4900-8b09-dc937852ee3f To: "Anna Schumaker" To: "Chuck Lever" To: "David S. Miller" To: "Eric Dumazet" To: "Jeff Layton" To: "Jakub Kicinski" To: To: To: "Paolo Abeni" To: "Trond Myklebust" To: "Peter Zijlstra" Cc: "Dai Ngo" Cc: "Simon Horman" Cc: Cc: "NeilBrown" Cc: "Olga Kornievskaia" Cc: "Tom Talpey" --- diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c index 016f16ca5..494947d50 100644 --- a/net/sunrpc/sched.c +++ b/net/sunrpc/sched.c @@ -984,7 +984,7 @@ static void __rpc_execute(struct rpc_task *task) trace_rpc_task_sync_sleep(task, task->tk_action); status = out_of_line_wait_on_bit(&task->tk_runstate, RPC_TASK_QUEUED, rpc_wait_bit_killable, - TASK_KILLABLE|TASK_FREEZABLE); + TASK_KILLABLE | TASK_FREEZABLE_UNSAFE); if (status < 0) { /* * When a sync task receives a signal, it exits with base-commit: 93f51579e7df248780214094418f205253383cc5 -- This is an AI-generated patch subject to moderation. Reply with '#syz upstream' to Sign-off the patch as a human author and send it to the upstream kernel mailing lists. Reply with '#syz reject' to reject it ('#syz unreject' to undo). See https://goo.gle/syzbot-ai-patches for information about AI-generated patches. You can comment on the patch as usual, syzbot will try to address the comments and send a new version of the patch if necessary. syzbot engineers can be reached at syzkaller@googlegroups.com.