[BUG] KVM: hung task during vCPU destruction in kvm_clear_async_pf_completion_queue()

[JiaHong Su]

Hello,

I found the following issue using Syzkaller on:

HEAD commit:    9ace475 Linux 6.19-rc4
Kernel config:  https://gist.github.com/AxelHowe/7fb5b3917d2f4a18c1d8cefbfd5846ef

A hung task warning is reported during KVM vCPU destruction.

INFO: task repro:9778 blocked for more than 143 seconds.
      Not tainted 6.19.0-rc4 #8
      Blocked by coredump.
Call Trace:
  __schedule
  schedule
  schedule_timeout
  __wait_for_common
  __flush_work
  cancel_work_sync
  kvm_clear_async_pf_completion_queue
  kvm_arch_vcpu_destroy
  kvm_destroy_vcpus
  kvm_arch_destroy_vm
  kvm_put_kvm
  kvm_vcpu_release
  __fput
  task_work_run
  do_exit
  do_group_exit
  get_signal
  arch_do_signal_or_restart
  entry_SYSCALL_64_after_hwframe

The teardown path blocks in cancel_work_sync() while clearing the async
page fault completion queue. The wait exceeds the hung task timeout and
does not appear to make forward progress in this exit/coredump context.

C reproducer, full dmesg output are available at:
https://gist.github.com/AxelHowe/f09bce07178d13a2ee095f30eef8327e

Thanks,
JiaHong Su