syzbot


INFO: task hung in nf_unregister_net_hook (2)

Status: public: reported syz repro on 2019/08/06 04:26
Reported-by: syzbot+32d2fc4782f5346d68b2@syzkaller.appspotmail.com
First crash: 1734d, last: 1734d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 INFO: task hung in nf_unregister_net_hook 2 1953d 1848d 0/3 auto-closed as invalid on 2019/06/28 02:32

Sample crash report:
Free swap  = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
313617 pages reserved
INFO: task kworker/u4:1:64 blocked for more than 140 seconds.
      Not tainted 4.9.141+ #23
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:1    D22728    64      2 0x80000000
Workqueue: netns cleanup_net
 ffff8801d786af80 0000000000000000 ffff8801ca15a680 ffff8801da6b2f80
 ffff8801db721018 ffff8801d79af7b8 ffffffff828075c2 0000000000000286
 0000000000000002 0000000041b58ab3 00ffffff82e2b9d2 ffff8801db7218f0
Call Trace:
 [<ffffffff82808aef>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff8124a9a2>] _synchronize_rcu_expedited+0x592/0x840 kernel/rcu/tree_exp.h:588
 [<ffffffff8124fd62>] synchronize_rcu_expedited+0x22/0x30 kernel/rcu/tree_exp.h:687
 [<ffffffff82301f9f>] synchronize_net+0x2f/0x50 net/core/dev.c:7862
 [<ffffffff823dcd8c>] nf_unregister_net_hook+0x1ec/0x380 net/netfilter/core.c:161
 [<ffffffff823dd6c0>] nf_unregister_hook_list net/netfilter/core.c:482 [inline]
 [<ffffffff823dd6c0>] netfilter_net_exit+0x40/0xb0 net/netfilter/core.c:514
 [<ffffffff822e3d70>] ops_exit_list.isra.0+0xb0/0x160 net/core/net_namespace.c:136
 [<ffffffff822e6ad2>] cleanup_net+0x3f2/0x8b0 net/core/net_namespace.c:473
 [<ffffffff81131001>] process_one_work+0x831/0x15f0 kernel/workqueue.c:2092
 [<ffffffff81131e96>] worker_thread+0xd6/0x1140 kernel/workqueue.c:2226
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Showing all locks held in the system:
2 locks held by init/1:
 #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>] __do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
 #1:  (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>] ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
3 locks held by kworker/1:1/22:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ht->run_work)){+.+.+.}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
 #2:  (&ht->mutex){+.+.+.}, at: [<ffffffff81b98f89>] rht_deferred_worker+0x39/0x1a50 lib/rhashtable.c:365
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fe63f>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
5 locks held by kworker/u4:1/64:
 #0:  ("%s""netns"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  (net_cleanup_work){+.+.+.}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
 #2:  (net_mutex){+.+.+.}, at: [<ffffffff822e681f>] cleanup_net+0x13f/0x8b0 net/core/net_namespace.c:439
 #3:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
 #4:  (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a749>] exp_funnel_lock kernel/rcu/tree_exp.h:256 [inline]
 #4:  (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a749>] _synchronize_rcu_expedited+0x339/0x840 kernel/rcu/tree_exp.h:569
2 locks held by udevd/595:
 #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>] __do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
 #1:  (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>] ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
1 lock held by rsyslogd/1898:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cc7c>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by cron/1940:
 #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>] __do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
 #1:  (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>] ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
2 locks held by getty/2025:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d37362>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
2 locks held by syz-execprog/2155:
 #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>] __do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
 #1:  (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>] ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
3 locks held by kworker/0:0/2309:
 #0:  ("%s"("ipv6_addrconf")){.+.+..}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((addr_chk_work).work){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
 #2:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.1/2356:
 #0:  (net_mutex){+.+.+.}, at: [<ffffffff822e70e5>] copy_net_ns+0x155/0x330 net/core/net_namespace.c:406
1 lock held by syz-executor.2/2357:
 #0:  (net_mutex){+.+.+.}, at: [<ffffffff822e70e5>] copy_net_ns+0x155/0x330 net/core/net_namespace.c:406
2 locks held by blkid/2360:
 #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>] __do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
 #1:  (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>] ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
2 locks held by blkid/2361:
 #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>] __do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
 #1:  (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>] ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
2 locks held by syz-executor.0/2362:
 #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>] __do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
 #1:  (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>] ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #23
 ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40
 ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000003
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b4df89>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b4df1c>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff810984b4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c65d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c65d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c65d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c65d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 25 Comm: oom_reaper Not tainted 4.9.141+ #23
task: ffff8801d9c217c0 task.stack: ffff8801d9908000
RIP: 0010:[<ffffffff81b70843>] c [<ffffffff81b70843>] delay_tsc+0x33/0xc0 arch/x86/lib/delay.c:67
RSP: 0018:ffff8801d990f720  EFLAGS: 00000082
RAX: 0000000080000001 RBX: 000001cd23ee903d RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffffffff81ba7d7b RDI: ffffffff841eb840
RBP: ffff8801d990f740 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 000001cd23ee8f18
R13: 00000000000008fd R14: 0000000000000000 R15: fffffbfff096b76d
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6cf8978943 CR3: 0000000048a60000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff84b5bb20c 000000000000270bc 0000000000000020c fffffbfff096b7abc
 ffff8801d990f750c ffffffff81b70750c ffff8801d990f760c ffffffff81b7078ac
 ffff8801d990f7b0c ffffffff81d6473fc ffffffff81b6cdd8c ffffffff84b5bb68c
Call Trace:
 [<ffffffff81b70750>] __delay+0x10/0x20 arch/x86/lib/delay.c:160
 [<ffffffff81b7078a>] __const_udelay+0x2a/0x30 arch/x86/lib/delay.c:174
 [<ffffffff81d6473f>] wait_for_xmitr+0x6f/0x1e0 drivers/tty/serial/8250/8250_port.c:2005
 [<ffffffff81d648cf>] serial8250_console_putchar+0x1f/0x60 drivers/tty/serial/8250/8250_port.c:3103
 [<ffffffff81d4cce9>] uart_console_write+0x59/0xf0 drivers/tty/serial/serial_core.c:1866
 [<ffffffff81d6fae8>] serial8250_console_write+0x528/0x820 drivers/tty/serial/8250/8250_port.c:3169
 [<ffffffff81d5d4ff>] univ8250_console_write+0x5f/0x70 drivers/tty/serial/8250/8250_core.c:594
 [<ffffffff8122387d>] call_console_drivers.isra.0.constprop.15+0x1ad/0x360 kernel/printk/printk.c:1594
 [<ffffffff812265af>] console_unlock+0x47f/0xb50 kernel/printk/printk.c:2454
 [<ffffffff812270c8>] vprintk_emit+0x448/0x790 kernel/printk/printk.c:1908
 [<ffffffff81227438>] vprintk+0x28/0x30 kernel/printk/printk.c:1918
 [<ffffffff8122745d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1919
 [<ffffffff81402f9f>] vprintk_func kernel/printk/internal.h:36 [inline]
 [<ffffffff81402f9f>] printk+0xaf/0xd7 kernel/printk/printk.c:1980
 [<ffffffff814fb370>] __oom_reap_task_mm.cold.8+0x112/0x15e mm/oom_kill.c:555
 [<ffffffff81419ab5>] oom_reap_task mm/oom_kill.c:580 [inline]
 [<ffffffff81419ab5>] oom_reaper+0x155/0x390 mm/oom_kill.c:618
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Code: c49 c89 cfd cbf c01 c00 c00 c00 c41 c54 c53 ce8 c18 c6d c5f cff ce8 c13 c77 c03 c00 c41 c89 cc6 c0f cae ce8 c0f c31 c48 cc1 ce2 c20 c48 c09 cc2 c49 c89 cd4 ceb c16 cf3 c90 c<bf> c01 c00 c00 c00 ce8 cf3 c6c c5f cff ce8 cee c76 c03 c00 c44 c39 cf0 c75 c36 c0f c

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/06 03:25 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 6affd8e8 .config console log report syz ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.