syzbot


INFO: task hung in sdr_cap_stop_streaming

Status: fixed on 2019/12/31 04:23
Reported-by: syzbot+3774865aab936ee8e875@syzkaller.appspotmail.com
Fix commit: 467052f6ea5a media: vivid: Fix wrong locking that causes race conditions on streaming stop
First crash: 2051d, last: 1817d
Fix bisection: fixed by (bisect log) :
commit 467052f6ea5a51524992e43f02b543550495c391
Author: Alexander Popov <alex.popov@linux.com>
Date: Sun Nov 3 22:17:19 2019 +0000

  media: vivid: Fix wrong locking that causes race conditions on streaming stop

  
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 INFO: task hung in sdr_cap_stop_streaming C inconclusive 180 1638d 2051d 0/1 upstream: reported C repro on 2019/04/11 13:03

Sample crash report:
INFO: task syz-executor039:7601 blocked for more than 140 seconds.
      Not tainted 4.19.73 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor039 D27664  7601   7580 0x80000002
Call Trace:
 context_switch kernel/sched/core.c:2826 [inline]
 __schedule+0x866/0x1dc0 kernel/sched/core.c:3474
 schedule+0x92/0x1c0 kernel/sched/core.c:3518
 schedule_timeout+0x8c8/0xfc0 kernel/time/timer.c:1780
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common kernel/sched/completion.c:115 [inline]
 wait_for_completion+0x29c/0x440 kernel/sched/completion.c:136
 kthread_stop+0x116/0x6c0 kernel/kthread.c:550
 sdr_cap_stop_streaming+0x213/0x330 drivers/media/platform/vivid/vivid-sdr-cap.c:301
 __vb2_queue_cancel+0xb1/0x790 drivers/media/common/videobuf2/videobuf2-core.c:1682
 vb2_core_streamoff+0x60/0x150 drivers/media/common/videobuf2/videobuf2-core.c:1816
 __vb2_cleanup_fileio+0x78/0x170 drivers/media/common/videobuf2/videobuf2-core.c:2343
 vb2_core_queue_release+0x20/0x80 drivers/media/common/videobuf2/videobuf2-core.c:2070
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:671 [inline]
 _vb2_fop_release+0x1cf/0x2a0 drivers/media/common/videobuf2/videobuf2-v4l2.c:842
 vb2_fop_release+0x75/0xc0 drivers/media/common/videobuf2/videobuf2-v4l2.c:856
 vivid_fop_release+0x18e/0x430 drivers/media/platform/vivid/vivid-core.c:474
 v4l2_release+0xf9/0x1a0 drivers/media/v4l2-core/v4l2-dev.c:448
 __fput+0x2dd/0x8b0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x994/0x2fa0 kernel/exit.c:876
 do_group_exit+0x135/0x370 kernel/exit.c:979
 __do_sys_exit_group kernel/exit.c:990 [inline]
 __se_sys_exit_group kernel/exit.c:988 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x443b98
Code: Bad RIP value.
RSP: 002b:00007ffdbfe6d4b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443b98
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004c3510 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d5180 R14: 0000000000000000 R15: 0000000000000000

Showing all locks held in the system:
1 lock held by khungtaskd/1037:
 #0: 00000000019b47ce (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4435
1 lock held by rsyslogd/7431:
 #0: 00000000ce0e4b68 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:767
2 locks held by getty/7554:
 #0: 00000000752a8ec9 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 00000000dd0df319 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7555:
 #0: 00000000dc1d4530 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 00000000f1ce2ba0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7556:
 #0: 000000006066776d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 00000000a8cb7797 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7557:
 #0: 000000007483bf5e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 00000000700762e2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7558:
 #0: 00000000076680d2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 00000000eac1d935 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7559:
 #0: 00000000033a9fda (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 00000000a3dc9186 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7560:
 #0: 0000000003ce467d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 00000000b17f8dd0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1037 Comm: khungtaskd Not tainted 4.19.73 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0x9df/0xee0 kernel/hung_task.c:287
 kthread+0x354/0x420 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 21289 Comm: syz-executor039 Not tainted 4.19.73 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:42 [inline]
RIP: 0010:update_stack_state+0x1e0/0x5f0 arch/x86/kernel/unwind_frame.c:238
Code: 03 00 00 41 8b 45 00 85 c0 74 8f 41 80 3c 24 00 0f 85 5b 03 00 00 49 8d 7d 10 49 8b 4d 08 48 89 fe 48 c1 ee 03 42 80 3c 3e 00 <0f> 85 1d 03 00 00 48 39 cb 49 8b 75 10 0f 82 5d ff ff ff 48 39 f3
RSP: 0018:ffff88808f927470 EFLAGS: 00000046
RAX: 0000000000000001 RBX: ffff88808f927918 RCX: ffff88808f920000
RDX: ffff88808f927628 RSI: 1ffff11011f24ec6 RDI: ffff88808f927630
RBP: ffff88808f927538 R08: 0000000000000001 R09: ffff88808f927678
R10: ffff88808f927648 R11: ffff88808f927658 R12: ffffed1011f24ec5
R13: ffff88808f927620 R14: 1ffff11011f24e96 R15: dffffc0000000000
FS:  000000000202d880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004c3548 CR3: 000000009a037000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 unwind_next_frame.part.0+0x1a9/0xa20 arch/x86/kernel/unwind_frame.c:333
 unwind_next_frame+0x3b/0x50 arch/x86/kernel/unwind_frame.c:287
 __save_stack_trace+0x83/0x100 arch/x86/kernel/stacktrace.c:44
 save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcf/0x220 mm/slab.c:3822
 vb2_vmalloc_put drivers/media/common/videobuf2/videobuf2-vmalloc.c:70 [inline]
 vb2_vmalloc_put+0x5f/0x80 drivers/media/common/videobuf2/videobuf2-vmalloc.c:64
 __vb2_buf_mem_free+0x10f/0x210 drivers/media/common/videobuf2/videobuf2-core.c:246
 __vb2_free_mem drivers/media/common/videobuf2/videobuf2-core.c:415 [inline]
 __vb2_queue_free+0x6e7/0x8a0 drivers/media/common/videobuf2/videobuf2-core.c:460
 vb2_core_reqbufs+0x229/0xd70 drivers/media/common/videobuf2/videobuf2-core.c:699
 __vb2_cleanup_fileio+0xf8/0x170 drivers/media/common/videobuf2/videobuf2-core.c:2346
 vb2_core_queue_release+0x20/0x80 drivers/media/common/videobuf2/videobuf2-core.c:2070
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:671 [inline]
 _vb2_fop_release+0x1cf/0x2a0 drivers/media/common/videobuf2/videobuf2-v4l2.c:842
 vb2_fop_release+0x75/0xc0 drivers/media/common/videobuf2/videobuf2-v4l2.c:856
 vivid_fop_release+0x18e/0x430 drivers/media/platform/vivid/vivid-core.c:474
 v4l2_release+0xf9/0x1a0 drivers/media/v4l2-core/v4l2-dev.c:448
 __fput+0x2dd/0x8b0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x994/0x2fa0 kernel/exit.c:876
 do_group_exit+0x135/0x370 kernel/exit.c:979
 __do_sys_exit_group kernel/exit.c:990 [inline]
 __se_sys_exit_group kernel/exit.c:988 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x443b98
Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00
RSP: 002b:00007ffdbfe6d4b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443b98
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004c3510 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d5180 R14: 0000000000000000 R15: 0000000000000000

Crashes (152):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/18 02:21 linux-4.19.y db2d0b7c1dde 03e0d245 .config console log report syz C ci2-linux-4-19
2019/04/14 21:34 linux-4.19.y 4d552acf3370 505ab413 .config console log report syz C ci2-linux-4-19
2019/04/11 05:47 linux-4.19.y 4d552acf3370 e955ac50 .config console log report syz C ci2-linux-4-19
2019/11/30 21:34 linux-4.19.y 14260788bbb9 a76bf83f .config console log report ci2-linux-4-19
2019/11/30 01:57 linux-4.19.y 14260788bbb9 3a75be00 .config console log report ci2-linux-4-19
2019/11/27 16:13 linux-4.19.y 14260788bbb9 0d63f89c .config console log report ci2-linux-4-19
2019/11/19 05:02 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/18 11:00 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/11 16:16 linux-4.19.y 7d8dbefc22ff 377d77fa .config console log report ci2-linux-4-19
2019/11/07 15:56 linux-4.19.y 5ee93551c703 f39aff9e .config console log report ci2-linux-4-19
2019/11/04 19:14 linux-4.19.y ef244c308885 18e12644 .config console log report ci2-linux-4-19
2019/11/04 13:06 linux-4.19.y ef244c308885 18e12644 .config console log report ci2-linux-4-19
2019/11/03 01:21 linux-4.19.y ef244c308885 d603afc9 .config console log report ci2-linux-4-19
2019/10/31 18:45 linux-4.19.y ef244c308885 a41ca8fa .config console log report ci2-linux-4-19
2019/10/31 03:37 linux-4.19.y ef244c308885 a41ca8fa .config console log report ci2-linux-4-19
2019/10/31 02:31 linux-4.19.y ef244c308885 a41ca8fa .config console log report ci2-linux-4-19
2019/10/29 11:53 linux-4.19.y ef244c308885 5ea87a66 .config console log report ci2-linux-4-19
2019/10/26 23:19 linux-4.19.y c3038e718a19 25bb509e .config console log report ci2-linux-4-19
2019/10/26 12:14 linux-4.19.y c3038e718a19 25bb509e .config console log report ci2-linux-4-19
2019/10/26 07:30 linux-4.19.y c3038e718a19 413926c5 .config console log report ci2-linux-4-19
2019/10/21 20:18 linux-4.19.y c3038e718a19 b24d2b8a .config console log report ci2-linux-4-19
2019/10/18 06:45 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/16 13:33 linux-4.19.y dafd634415a7 d4ea592f .config console log report ci2-linux-4-19
2019/10/05 21:26 linux-4.19.y 6cad9d0cf87b f3f7d9c8 .config console log report ci2-linux-4-19
2019/10/02 02:11 linux-4.19.y 555161ee1b7a b7a87a83 .config console log report ci2-linux-4-19
2019/09/24 16:15 linux-4.19.y d573e8a79f70 f8368f99 .config console log report ci2-linux-4-19
2019/09/24 07:57 linux-4.19.y d573e8a79f70 c68252d2 .config console log report ci2-linux-4-19
2019/09/23 18:08 linux-4.19.y d573e8a79f70 c68252d2 .config console log report ci2-linux-4-19
2019/09/20 09:29 linux-4.19.y dbc29aff8d04 d96e88f3 .config console log report ci2-linux-4-19
2019/09/18 07:55 linux-4.19.y db2d0b7c1dde 03e0d245 .config console log report ci2-linux-4-19
2019/09/16 20:59 linux-4.19.y db2d0b7c1dde 51ca0454 .config console log report ci2-linux-4-19
2019/09/13 23:03 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/13 01:10 linux-4.19.y ee809c7e0895 40fa42bc .config console log report ci2-linux-4-19
2019/09/09 05:31 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
2019/09/06 09:00 linux-4.19.y 97ab07e11fbf c16be727 .config console log report ci2-linux-4-19
2019/08/30 02:17 linux-4.19.y 97ab07e11fbf cd626f3b .config console log report ci2-linux-4-19
2019/08/29 17:47 linux-4.19.y 97ab07e11fbf cd626f3b .config console log report ci2-linux-4-19
2019/08/28 22:30 linux-4.19.y def4c11b3131 40203c15 .config console log report ci2-linux-4-19
2019/08/28 10:16 linux-4.19.y def4c11b3131 1eb076e9 .config console log report ci2-linux-4-19
2019/08/27 21:56 linux-4.19.y def4c11b3131 fd37b39e .config console log report ci2-linux-4-19
2019/08/22 15:24 linux-4.19.y a5aa80588fcd c6c81a0b .config console log report ci2-linux-4-19
2019/08/19 22:05 linux-4.19.y a5aa80588fcd ae348fb7 .config console log report ci2-linux-4-19
2019/08/15 19:22 linux-4.19.y 893af1c79e42 faeffb00 .config console log report ci2-linux-4-19
2019/08/14 06:52 linux-4.19.y 893af1c79e42 ef801a3e .config console log report ci2-linux-4-19
2019/08/04 08:32 linux-4.19.y b3060a1a313f 6affd8e8 .config console log report ci2-linux-4-19
2019/04/11 02:04 linux-4.19.y 4d552acf3370 e955ac50 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.