syzbot


INFO: task hung in pipe_write

Status: public: reported C repro on 2019/04/14 08:51
Reported-by: syzbot+369b764936acd107d869@syzkaller.appspotmail.com
First crash: 1990d, last: 1720d
Similar bugs (10)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in pipe_write (3) fs 1 1639d 1639d 0/27 auto-closed as invalid on 2020/04/25 05:37
android-44 INFO: task hung in pipe_write 1 2054d 1926d 0/2 auto-closed as invalid on 2019/06/05 06:19
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 1970 13d 1976d 27/27 fixed on 2024/07/09 19:14
upstream INFO: task hung in pipe_write (2) ext4 C done 6 1768d 1767d 0/27 closed as invalid on 2019/09/28 02:25
upstream INFO: task hung in pipe_write fs 8 1998d 2112d 0/27 auto-closed as invalid on 2019/07/30 21:09
linux-4.14 INFO: task hung in pipe_write C 1 520d 637d 0/1 upstream: reported C repro on 2022/10/24 05:45
android-44 INFO: task hung in pipe_write (2) 1 1694d 1694d 0/2 auto-closed as invalid on 2020/03/31 01:26
linux-4.19 INFO: task hung in pipe_write C error 13 607d 1506d 0/1 upstream: reported C repro on 2020/06/07 01:40
upstream INFO: task hung in pipe_write (4) fs syz error 7 906d 1453d 0/27 auto-obsoleted due to no activity on 2022/10/22 17:00
android-414 INFO: task hung in pipe_write 1 1742d 1742d 0/1 auto-closed as invalid on 2020/02/11 22:17

Sample crash report:
Free swap  = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
313617 pages reserved
INFO: task syz-executor864:5578 blocked for more than 140 seconds.
      Not tainted 4.9.141+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor864 D29672  5578   2226 0x00000004
 ffff8801c53a5f00 ffff8801c68f4200 ffff8801c68f4200 ffff8801d8c78000
 ffff8801db621018 ffff8801d849fa08 ffffffff828075c2 0000000000000000
 ffff8801c53a67b0 ffffed0038a74cf5 00ff8801c53a5f00 ffff8801db6218f0
Call Trace:
 [<ffffffff82808aef>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff828094a3>] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3586
 [<ffffffff8280b51d>] __mutex_lock_common kernel/locking/mutex.c:582 [inline]
 [<ffffffff8280b51d>] mutex_lock_nested+0x38d/0x900 kernel/locking/mutex.c:621
 [<ffffffff81524a93>] pipe_lock_nested fs/pipe.c:66 [inline]
 [<ffffffff81524a93>] pipe_lock fs/pipe.c:74 [inline]
 [<ffffffff81524a93>] pipe_wait+0x1a3/0x1d0 fs/pipe.c:122
 [<ffffffff815250e7>] pipe_write+0x4e7/0xd50 fs/pipe.c:475
 [<ffffffff81508347>] new_sync_write fs/read_write.c:496 [inline]
 [<ffffffff81508347>] __vfs_write+0x3d7/0x580 fs/read_write.c:509
 [<ffffffff8150ab97>] vfs_write+0x187/0x520 fs/read_write.c:557
 [<ffffffff8150e9c9>] SYSC_write fs/read_write.c:604 [inline]
 [<ffffffff8150e9c9>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fe63f>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1902:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cc7c>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2029:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d37362>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
1 lock held by syz-executor864/5578:
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff81524a93>] pipe_lock_nested fs/pipe.c:66 [inline]
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff81524a93>] pipe_lock fs/pipe.c:74 [inline]
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff81524a93>] pipe_wait+0x1a3/0x1d0 fs/pipe.c:122
1 lock held by init/18475:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/18476:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/18477:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/18478:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/18479:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/18480:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1
 ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40
 ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000002
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b4df89>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b4df1c>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff810984b4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c65d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c65d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c65d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c65d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 20116 Comm: syz-executor864 Not tainted 4.9.141+ #1
task: ffff880100018000 task.stack: ffff880100008000
RIP: 0010:[<ffffffff82816ef2>] c [<ffffffff82816ef2>] __raw_spin_unlock include/linux/spinlock_api_smp.h:154 [inline]
RIP: 0010:[<ffffffff82816ef2>] c [<ffffffff82816ef2>] _raw_spin_unlock+0x22/0x50 kernel/locking/spinlock.c:183
RSP: 0018:ffff88010000f588  EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff880171c666c0 RCX: 0000000000000002
RDX: 1ffff1002e38ccd9 RSI: 0000000000000002 RDI: ffff880171c666c0
RBP: ffff88010000f590 R08: ffff880100018920 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff8801cbbc1700 R14: ffff880171c65f00 R15: 0000000000001000
FS:  00007f1bcabed700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f585e702060 CR3: 000000018e858000 CR4: 00000000001606b0
Stack:
 ffff880171c65f00c ffff88010000f640c ffffffff821f01d6c ffffffff821efedec
 ffff88010000f5e8c ffffffff81ba7d7bc 0000000000000246c ffff880100018000c
 ffffffff830cc2e0c ffff88010000f718c fffffbfff0601200c 000000000000f608c
Call Trace:
 [<ffffffff821f01d6>] spin_unlock include/linux/spinlock.h:347 [inline]
 [<ffffffff821f01d6>] task_unlock include/linux/sched.h:3262 [inline]
 [<ffffffff821f01d6>] lowmem_scan+0x546/0xaf0 drivers/staging/android/lowmemorykiller.c:146
 [<ffffffff81449cc6>] do_shrink_slab mm/vmscan.c:398 [inline]
 [<ffffffff81449cc6>] shrink_slab.part.8+0x3c6/0xa00 mm/vmscan.c:501
 [<ffffffff814557fd>] shrink_slab mm/vmscan.c:465 [inline]
 [<ffffffff814557fd>] shrink_node+0x1ed/0x740 mm/vmscan.c:2602
 [<ffffffff814560c7>] shrink_zones mm/vmscan.c:2749 [inline]
 [<ffffffff814560c7>] do_try_to_free_pages mm/vmscan.c:2791 [inline]
 [<ffffffff814560c7>] try_to_free_pages+0x377/0xb80 mm/vmscan.c:3002
 [<ffffffff81428a01>] __perform_reclaim mm/page_alloc.c:3324 [inline]
 [<ffffffff81428a01>] __alloc_pages_direct_reclaim mm/page_alloc.c:3345 [inline]
 [<ffffffff81428a01>] __alloc_pages_slowpath mm/page_alloc.c:3697 [inline]
 [<ffffffff81428a01>] __alloc_pages_nodemask+0x981/0x1bd0 mm/page_alloc.c:3862
 [<ffffffff810d3100>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<ffffffff810d3100>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<ffffffff810d3100>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<ffffffff810d3100>] alloc_thread_stack_node kernel/fork.c:212 [inline]
 [<ffffffff810d3100>] dup_task_struct kernel/fork.c:492 [inline]
 [<ffffffff810d3100>] copy_process.part.8+0x280/0x6a10 kernel/fork.c:1534
 [<ffffffff810d9d12>] copy_process kernel/fork.c:1505 [inline]
 [<ffffffff810d9d12>] _do_fork+0x1b2/0xd30 kernel/fork.c:1972
 [<ffffffff810da967>] SYSC_clone kernel/fork.c:2084 [inline]
 [<ffffffff810da967>] SyS_clone+0x37/0x50 kernel/fork.c:2078
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: c5d c5d cc3 c66 c0f c1f c44 c00 c00 c55 cbe c01 c00 c00 c00 c48 c89 ce5 c53 c48 c89 cfb c48 c83 cc7 c18 c48 c8b c55 c08 ce8 c96 c5c c9f cfe c48 c89 cdf ce8 c4e ce5 c9f cfe c<bf> c01 c00 c00 c00 ce8 cd4 c04 c95 cfe c65 c8b c05 c8d c0e c80 c7d c85 cc0 c74 c03 c

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/02/08 21:22 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 fa6c7b70 .config console log report syz C ci-android-49-kasan-gce
2019/10/18 02:55 https://android.googlesource.com/kernel/common android-4.9 7fe05eede1c8 8c88c9c1 .config console log report syz ci-android-49-kasan-gce-root
2019/11/06 09:10 https://android.googlesource.com/kernel/common android-4.9 7fe05eede1c8 bc2c6e45 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.