syzbot


INFO: task hung in write_cache_pages (2)

Status: upstream: reported on 2024/11/23 22:08
Reported-by: syzbot+15372748558335944fb3@syzkaller.appspotmail.com
First crash: 4h35m, last: 4h35m
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in write_cache_pages fs mm 65 2169d 2540d 0/28 closed as dup on 2017/12/12 16:30
upstream INFO: task hung in write_cache_pages (2) mm fs C done 36 562d 633d 22/28 fixed on 2023/06/08 14:41
android-44 INFO: task hung in write_cache_pages 10 2403d 2458d 0/2 auto-closed as invalid on 2019/02/22 13:49
android-49 INFO: task hung in write_cache_pages syz 17 2410d 2050d 0/3 public: reported syz repro on 2019/04/14 09:28
upstream INFO: task hung in write_cache_pages (3) gfs2 C done done 10 321d 446d 25/28 fixed on 2024/02/21 18:23
linux-5.15 INFO: task hung in write_cache_pages 1 561d 561d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:07

Sample crash report:
INFO: task kworker/u4:0:9 blocked for more than 143 seconds.
      Not tainted 5.15.173-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:0    state:D stack:    0 pid:    9 ppid:     2 flags:0x00000008
Workqueue: writeback wb_workfn (flush-7:1)
Call trace:
 __switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
 context_switch kernel/sched/core.c:5027 [inline]
 __schedule+0xf10/0x1e48 kernel/sched/core.c:6373
 schedule+0x11c/0x1c8 kernel/sched/core.c:6456
 io_schedule+0x8c/0x194 kernel/sched/core.c:8481
 wait_on_page_bit_common+0x6fc/0xc14 mm/filemap.c:1356
 __lock_page+0x8c/0xa8 mm/filemap.c:1648
 lock_page include/linux/pagemap.h:625 [inline]
 write_cache_pages+0x440/0xf58 mm/page-writeback.c:2244
 generic_writepages mm/page-writeback.c:2368 [inline]
 do_writepages+0x3f8/0x5ec mm/page-writeback.c:2388
 __writeback_single_inode+0x148/0x13a4 fs/fs-writeback.c:1647
 writeback_sb_inodes+0x94c/0x1654 fs/fs-writeback.c:1930
 __writeback_inodes_wb+0x110/0x39c fs/fs-writeback.c:2001
 wb_writeback+0x410/0xfc8 fs/fs-writeback.c:2106
 wb_check_background_flush fs/fs-writeback.c:2172 [inline]
 wb_do_writeback fs/fs-writeback.c:2260 [inline]
 wb_workfn+0xc44/0x1070 fs/fs-writeback.c:2288
 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310
 worker_thread+0x910/0x1034 kernel/workqueue.c:2457
 kthread+0x37c/0x45c kernel/kthread.c:334
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
INFO: task kworker/0:1:13 blocked for more than 143 seconds.
      Not tainted 5.15.173-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:1     state:D stack:    0 pid:   13 ppid:     2 flags:0x00000008
Workqueue: events_long flush_old_commits
Call trace:
 __switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
 context_switch kernel/sched/core.c:5027 [inline]
 __schedule+0xf10/0x1e48 kernel/sched/core.c:6373
 schedule+0x11c/0x1c8 kernel/sched/core.c:6456
 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6515
 __mutex_lock_common+0xba0/0x2154 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
 reiserfs_sync_fs fs/reiserfs/super.c:76 [inline]
 flush_old_commits+0x1b0/0x2b8 fs/reiserfs/super.c:111
 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310
 worker_thread+0x910/0x1034 kernel/workqueue.c:2457
 kthread+0x37c/0x45c kernel/kthread.c:334
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
INFO: task syz.1.12:4127 blocked for more than 143 seconds.
      Not tainted 5.15.173-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.12        state:D stack:    0 pid: 4127 ppid:  4023 flags:0x00000009
Call trace:
 __switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
 context_switch kernel/sched/core.c:5027 [inline]
 __schedule+0xf10/0x1e48 kernel/sched/core.c:6373
 schedule+0x11c/0x1c8 kernel/sched/core.c:6456
 io_schedule+0x8c/0x194 kernel/sched/core.c:8481
 wait_on_page_bit_common+0x6fc/0xc14 mm/filemap.c:1356
 __lock_page mm/filemap.c:1648 [inline]
 lock_page include/linux/pagemap.h:625 [inline]
 pagecache_get_page+0x66c/0xd94 mm/filemap.c:1910
 find_or_create_page include/linux/pagemap.h:420 [inline]
 grab_cache_page include/linux/pagemap.h:502 [inline]
 grab_tail_page fs/reiserfs/inode.c:2209 [inline]
 reiserfs_truncate_file+0x1bc/0x6f0 fs/reiserfs/inode.c:2277
 reiserfs_file_release+0x710/0x884 fs/reiserfs/file.c:109
 __fput+0x1c4/0x800 fs/file_table.c:280
 ____fput+0x20/0x30 fs/file_table.c:308
 task_work_run+0x130/0x1e4 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
INFO: task syz.1.12:4143 blocked for more than 143 seconds.
      Not tainted 5.15.173-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.12        state:D stack:    0 pid: 4143 ppid:  4023 flags:0x00000009
Call trace:
 __switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
 context_switch kernel/sched/core.c:5027 [inline]
 __schedule+0xf10/0x1e48 kernel/sched/core.c:6373
 schedule+0x11c/0x1c8 kernel/sched/core.c:6456
 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6515
 __mutex_lock_common+0xba0/0x2154 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
 reiserfs_write_lock_nested+0x68/0xd8 fs/reiserfs/lock.c:78
 reiserfs_mutex_lock_safe fs/reiserfs/reiserfs.h:815 [inline]
 lock_journal fs/reiserfs/journal.c:534 [inline]
 do_journal_end+0x2cc/0x3c50 fs/reiserfs/journal.c:4025
 journal_end fs/reiserfs/journal.c:3414 [inline]
 reiserfs_end_persistent_transaction+0x1e4/0x374 fs/reiserfs/journal.c:3183
 reiserfs_write_end+0x2d4/0x6fc fs/reiserfs/inode.c:2964
 pagecache_write_end+0xa0/0xc0 mm/filemap.c:3619
 generic_cont_expand_simple+0x18c/0x208 fs/buffer.c:2367
 reiserfs_setattr+0x37c/0xd94 fs/reiserfs/inode.c:3319
 notify_change+0xa34/0xcf8 fs/attr.c:505
 do_truncate+0x1c0/0x28c fs/open.c:65
 vfs_truncate+0x2e0/0x388 fs/open.c:111
 do_sys_truncate+0xec/0x1b4 fs/open.c:134
 __do_sys_truncate fs/open.c:146 [inline]
 __se_sys_truncate fs/open.c:144 [inline]
 __arm64_sys_truncate+0x5c/0x70 fs/open.c:144
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Showing all locks held in the system:
3 locks held by kworker/u4:0/9:
 #0: ffff0000c21d0138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x66c/0x11b8 kernel/workqueue.c:2283
 #1: ffff80001bc37c00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x6ac/0x11b8 kernel/workqueue.c:2285
 #2: ffff0000d95c20e0 (&type->s_umount_key#46){++++}-{3:3}, at: trylock_super+0x28/0xf8 fs/super.c:418
4 locks held by kworker/0:1/13:
 #0: ffff0000c0021138 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x66c/0x11b8 kernel/workqueue.c:2283
 #1: ffff80001bc77c00 ((work_completion)(&(&sbi->old_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6ac/0x11b8 kernel/workqueue.c:2285
 #2: 
ffff0000d95c20e0 (&type->s_umount_key#46){++++}-{3:3}, at: flush_old_commits+0xcc/0x2b8 fs/reiserfs/super.c:97
 #3: ffff0000d97ab090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
1 lock held by khungtaskd/27:
 #0: ffff800014c922e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:311
2 locks held by kworker/u4:4/497:
1 lock held by udevd/3641:
 #0: ffff0000cb998118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x12c/0x89c block/bdev.c:817
2 locks held by getty/3786:
 #0: ffff0000d3882098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x40/0x50 drivers/tty/tty_ldsem.c:340
 #1: ffff80001d60e2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1204 drivers/tty/n_tty.c:2158
2 locks held by syz.1.12/4127:
 #0: ffff0000e91a1498 (&ei->tailpack){+.+.}-{3:3}, at: reiserfs_file_release+0xd0/0x884 fs/reiserfs/file.c:41
 #1: ffff0000d97ab090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock_nested+0x68/0xd8 fs/reiserfs/lock.c:78
4 locks held by syz.1.12/4143:
 #0: ffff0000d95c2460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:377
 #1: ffff0000e91a16c0 (&sb->s_type->i_mutex_key#20){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline]
 #1: ffff0000e91a16c0 (&sb->s_type->i_mutex_key#20){+.+.}-{3:3}, at: do_truncate+0x1ac/0x28c fs/open.c:63
 #2: ffff8000204790f0 (&journal->j_mutex){+.+.}-{3:3}, at: reiserfs_mutex_lock_safe fs/reiserfs/reiserfs.h:814 [inline]
 #2: ffff8000204790f0 (&journal->j_mutex){+.+.}-{3:3}, at: lock_journal fs/reiserfs/journal.c:534 [inline]
 #2: ffff8000204790f0 (&journal->j_mutex){+.+.}-{3:3}, at: do_journal_end+0x2c0/0x3c50 fs/reiserfs/journal.c:4025
 #3: ffff0000d97ab090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock_nested+0x68/0xd8 fs/reiserfs/lock.c:78
2 locks held by kworker/1:8/4369:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x66c/0x11b8 kernel/workqueue.c:2283
 #1: ffff8000206d7c00 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x6ac/0x11b8 kernel/workqueue.c:2285
4 locks held by kworker/u4:11/4942:
3 locks held by kworker/0:9/5050:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x66c/0x11b8 kernel/workqueue.c:2283
 #1: ffff800020b37c00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6ac/0x11b8 kernel/workqueue.c:2285
 #2: ffff0000d5caf240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x274/0x33c4 drivers/net/netdevsim/fib.c:1480
1 lock held by syz.7.749/7398:
2 locks held by syz.8.751/7399:
 #0: ffff0000cb998118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0xe0/0x6b0 block/bdev.c:912
 #1: ffff0000cb9f0468 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_release+0x58/0x210 drivers/block/loop.c:2070
3 locks held by syz.6.750/7407:
1 lock held by dhcpcd/7408:
 #0: ffff0000d8e3c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1678 [inline]
 #0: ffff0000d8e3c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x4c/0xbc0 net/packet/af_packet.c:3227

=============================================


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/23 22:07 linux-5.15.y 0a51d2d4527b 68da6d95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in write_cache_pages
* Struck through repros no longer work on HEAD.