[BUG] Hung task in path_openat (possible rwsem lock inversion)

[Tianyu Li]

Hi,

I'm encountering a hang in path_openat() that appears to involve an rwsem reader being blocked by a writer in the same tgid. The issue was first detected by a fuzzing framework on Linux 6.18-rc6, and I have confirmed that it is reproducible on Linux 6.18.

The task gets stuck in the following call chain:

    openat -> path_openat -> open_last_lookups -> inode_lock_shared

The kernel logs indicate that the read-side rwsem is likely owned by a sibling thread (writer), which suggests a potential VFS/namei locking interaction. When reproduced on a test machine, the code would stably trigger a several-minute hang.

Additional information is provided below:

More information is provided below:

    Kernel source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.tar.xz
    Kernel configuration: https://github.com/j1akai/KConfigFuzz_bug/raw/refs/heads/main/x86/mainline-config
    Kernel log(fuzz): https://github.com/Wxm-233/KConfigFuzz_crashes/raw/refs/heads/main/5d9d684e10184c0e83d615412abea5f59537ff18/report0
    Kernel log(repro): https://github.com/Wxm-233/KConfigFuzz_crashes/raw/refs/heads/main/5d9d684e10184c0e83d615412abea5f59537ff18/repro_report0
    Reproduction C Code: https://github.com/Wxm-233/KConfigFuzz_crashes/raw/refs/heads/main/5d9d684e10184c0e83d615412abea5f59537ff18/repro.cprog
    Syscall sequence for reproduction (more precise): https://github.com/Wxm-233/KConfigFuzz_crashes/raw/refs/heads/main/5d9d684e10184c0e83d615412abea5f59537ff18/repro.prog
    GCC info: https://github.com/Wxm-233/KConfigFuzz_crashes/raw/refs/heads/main/0f85fc661af1e3c69b26b97eaaaa43d629de449c/gccinfo

I hope this report helps in identifying and resolving the issue. Thanks for your time and attention.

Best regards,
Tianyu Li