syzbot


INFO: task hung in path_openat (2)

Status: upstream: reported on 2024/04/14 03:45
Reported-by: syzbot+1816b02f12155a30dc50@syzkaller.appspotmail.com
First crash: 38d, last: 6d11h
Similar bugs (17)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in path_openat 2 1713d 1746d 0/1 auto-closed as invalid on 2020/01/11 07:40
upstream INFO: task hung in path_openat (4) fuse 1 1484d 1484d 0/26 auto-closed as invalid on 2020/07/28 10:23
upstream INFO: task hung in path_openat (3) fs 4 1644d 1760d 0/26 auto-closed as invalid on 2020/02/19 20:16
linux-6.1 INFO: task hung in path_openat (2) 1 144d 144d 0/3 auto-obsoleted due to no activity on 2024/04/08 11:39
upstream INFO: task hung in path_openat (7) fs 1886 3h27m 594d 0/26 upstream: reported on 2022/10/06 10:29
linux-4.19 INFO: task hung in path_openat (2) 1 913d 913d 0/1 auto-closed as invalid on 2022/03/21 04:47
linux-4.14 INFO: task hung in path_openat 1 1153d 1153d 0/1 auto-closed as invalid on 2021/07/23 23:26
android-49 INFO: task hung in path_openat 64 1884d 1865d 0/3 auto-closed as invalid on 2019/09/22 08:41
upstream INFO: task hung in path_openat (5) fs 23 1125d 1286d 0/26 auto-closed as invalid on 2021/07/22 20:44
linux-4.19 INFO: task hung in path_openat (3) f2fs jfs 20 490d 650d 0/1 upstream: reported on 2022/08/11 13:14
upstream INFO: task hung in path_openat (6) fs 13 860d 1010d 0/26 closed as invalid on 2022/02/07 19:19
android-414 INFO: task hung in path_openat 42 1788d 1866d 0/1 auto-closed as invalid on 2019/10/28 21:04
linux-6.1 INFO: task hung in path_openat 3 312d 414d 0/3 auto-obsoleted due to no activity on 2023/10/23 12:08
linux-6.1 INFO: task hung in path_openat (3) 17 9d18h 38d 0/3 upstream: reported on 2024/04/14 13:03
upstream INFO: task hung in path_openat exfat 246 1952d 2242d 0/26 closed as dup on 2018/09/08 15:37
linux-5.15 INFO: task hung in path_openat C error 3 295d 406d 0/3 auto-obsoleted due to no activity on 2023/11/09 20:56
upstream INFO: task hung in path_openat (2) fs 1 1855d 1855d 0/26 closed as invalid on 2019/05/08 13:05

Sample crash report:
INFO: task syz-executor.1:5037 blocked for more than 143 seconds.
      Not tainted 5.15.158-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1  state:D stack:27520 pid: 5037 ppid:  4333 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 rwsem_down_write_slowpath+0xf0c/0x16a0 kernel/locking/rwsem.c:1165
 inode_lock include/linux/fs.h:789 [inline]
 open_last_lookups fs/namei.c:3529 [inline]
 path_openat+0x824/0x2f20 fs/namei.c:3739
 do_filp_open+0x21c/0x460 fs/namei.c:3769
 do_sys_openat2+0x13b/0x500 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1280
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f203d6e4ee9
RSP: 002b:00007f203bc370c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f203d814050 RCX: 00007f203d6e4ee9
RDX: 000000000000275a RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 00007f203d73149e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f203d814050 R15: 00007ffc6ab713a8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8c91fae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
5 locks held by kworker/u4:4/1410:
 #0: ffff888011dcd138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc900051ffd20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
 #2: ffffffff8d9dbf50 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 net/core/net_namespace.c:558
 #3: ffff88801f7e93e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_destruct+0x10c/0x2f0 drivers/net/wireguard/device.c:233
 #4: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #4: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x350/0x740 kernel/rcu/tree_exp.h:845
2 locks held by getty/3273:
 #0: ffff888023e05098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc90002bab2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 drivers/tty/n_tty.c:2158
2 locks held by kworker/0:4/3565:
 #0: ffff888011c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc90003817d20 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
1 lock held by syz-executor.3/4864:
1 lock held by syz-executor.1/5032:
1 lock held by syz-executor.1/5037:
 #0: ffff88805c9bc188 (&type->i_mutex_dir_key#16){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline]
 #0: ffff88805c9bc188 (&type->i_mutex_dir_key#16){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3529 [inline]
 #0: ffff88805c9bc188 (&type->i_mutex_dir_key#16){+.+.}-{3:3}, at: path_openat+0x824/0x2f20 fs/namei.c:3739
3 locks held by kworker/u4:13/6112:
3 locks held by kworker/0:19/6610:
 #0: ffff888011c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc900040e7d20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
 #2: ffffffff8d9e7b08 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251
2 locks held by syz-executor.4/7185:
 #0: ffffffff8d9e7b08 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d9e7b08 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626
 #1: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #1: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x280/0x740 kernel/rcu/tree_exp.h:845
3 locks held by syz-executor.1/7238:
3 locks held by syz-executor.3/7237:
3 locks held by syz-executor.2/7254:
 #0: ffffffff8da45230 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x124/0x14a0 net/netlink/genetlink.c:790
 #2: ffffffff8d9e7b08 (rtnl_mutex){+.+.}-{3:3}, at: nl802154_pre_doit+0xb1/0xa80 net/ieee802154/nl802154.c:2169
2 locks held by syz-executor.2/7256:
 #0: ffffffff8da45230 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x124/0x14a0 net/netlink/genetlink.c:790
2 locks held by syz-executor.0/7266:
 #0: ffffffff8da45230 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x124/0x14a0 net/netlink/genetlink.c:790
2 locks held by syz-executor.0/7267:
 #0: ffffffff8da45230 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
 #1: ffffffff8da450e8 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x124/0x14a0 net/netlink/genetlink.c:790

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
 watchdog+0xe72/0xeb0 kernel/hung_task.c:295
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 7270 Comm: syz-executor.0 Not tainted 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:217 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x4/0x80 kernel/kcov.c:284
Code: 89 f8 89 f6 48 c7 44 0a 08 03 00 00 00 48 89 44 0a 10 48 89 74 0a 18 4c 89 44 0a 20 49 ff c1 4c 89 09 c3 0f 1f 00 4c 8b 04 24 <65> 48 8b 15 94 0f 82 7e 65 8b 05 95 0f 82 7e a9 00 01 ff 00 74 10
RSP: 0000:ffffc9000439f9e0 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffff8880341bd940
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000439fb60 R08: ffffffff842ffdc6 R09: ffffffff8430074c
R10: 0000000000000002 R11: ffff8880341bd940 R12: 1ffff92000873f6d
R13: ffffc9000439fb78 R14: ffff8880120a8dc0 R15: ffff88801bab5e88
FS:  00005555570d3480(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f89dd676070 CR3: 00000000611b1000 CR4: 00000000003526f0
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 xa_parent+0x46/0xf0 include/linux/xarray.h:1199
 xas_find+0x80e/0xaa0 lib/xarray.c:1262
 next_map_page mm/filemap.c:3296 [inline]
 filemap_map_pages+0xf90/0x15c0 mm/filemap.c:3352
 do_fault_around mm/memory.c:4213 [inline]
 do_read_fault mm/memory.c:4228 [inline]
 do_fault mm/memory.c:4362 [inline]
 handle_pte_fault mm/memory.c:4621 [inline]
 __handle_mm_fault mm/memory.c:4756 [inline]
 handle_mm_fault+0x341b/0x5950 mm/memory.c:4854
 do_user_addr_fault arch/x86/mm/fault.c:1388 [inline]
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x271/0x740 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f89dd676070
Code: Unable to access opcode bytes at RIP 0x7f89dd676046.
RSP: 002b:00007ffe2f3becc8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00007ffe2f3bed90 RCX: 0000000000000000
RDX: 00007f89dd6fc3b4 RSI: 0000000000000040 RDI: 00007ffe2f3bed90
RBP: 0000000000000001 R08: 0000000000000000 R09: 00007f89de30e320
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/16 09:30 linux-5.15.y 284087d4f7d5 ef5d53ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/15 05:55 linux-5.15.y 284087d4f7d5 fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/13 22:05 linux-5.15.y 284087d4f7d5 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/13 16:55 linux-5.15.y 284087d4f7d5 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/13 12:17 linux-5.15.y 284087d4f7d5 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/04 16:12 linux-5.15.y 284087d4f7d5 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/02 01:19 linux-5.15.y b925f60c6ee7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/02 01:19 linux-5.15.y b925f60c6ee7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/04/28 02:00 linux-5.15.y b925f60c6ee7 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/04/22 02:50 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/04/22 00:21 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/04/20 10:15 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in path_openat
2024/05/14 13:38 linux-5.15.y 284087d4f7d5 fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/05/12 22:36 linux-5.15.y 284087d4f7d5 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/05/12 19:48 linux-5.15.y 284087d4f7d5 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/05/05 20:10 linux-5.15.y 284087d4f7d5 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/05/01 19:11 linux-5.15.y b925f60c6ee7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/04/25 22:03 linux-5.15.y c52b9710c83d 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/04/24 11:53 linux-5.15.y c52b9710c83d 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/04/20 05:24 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
2024/04/14 03:44 linux-5.15.y fa3df276cd36 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 INFO: task hung in path_openat
* Struck through repros no longer work on HEAD.