syzbot


INFO: task hung in write_cache_pages

Status: public: reported syz repro on 2019/04/14 09:28
Reported-by: syzbot+576c33cc3e04e3d550a3@syzkaller.appspotmail.com
First crash: 2262d, last: 2191d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in write_cache_pages fs mm 65 1950d 2321d 0/26 closed as dup on 2017/12/12 16:30
upstream INFO: task hung in write_cache_pages (2) mm fs C done 36 343d 414d 22/26 fixed on 2023/06/08 14:41
android-44 INFO: task hung in write_cache_pages 10 2184d 2239d 0/2 auto-closed as invalid on 2019/02/22 13:49
upstream INFO: task hung in write_cache_pages (3) gfs2 C done done 10 103d 227d 26/26 fixed on 2024/02/21 18:23
linux-5.15 INFO: task hung in write_cache_pages 1 342d 342d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:07

Sample crash report:
Buffer I/O error on dev loop0, logical block 8, lost async page write
Buffer I/O error on dev loop0, logical block 9, lost async page write
buffer_io_error: 55 callbacks suppressed
Buffer I/O error on dev loop0, logical block 16, async page read
Buffer I/O error on dev loop0, logical block 16, async page read
INFO: task syz-executor0:3944 blocked for more than 120 seconds.
      Not tainted 4.9.92-g40a1830 #11
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D25824  3944   3903 0x20020004
 ffff8801d6ee0000 0000000000000000 ffff8801d68339c0 ffff8801d9b73000
 ffff8801db321b98 ffff8801d5776f80 ffffffff838a76cb 0000000041b58ab3
 ffffffff84193da8 00ffffff8123ac80 ffff8801db322468 ffff8801db322490
Call Trace:
 [<ffffffff838a8c6f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3551
 [<ffffffff838b4c2c>] schedule_timeout+0x56c/0x10b0 kernel/time/timer.c:1768
 [<ffffffff838a6e7e>] io_schedule_timeout+0x1be/0x390 kernel/sched/core.c:5173
 [<ffffffff838aa0e9>] io_schedule include/linux/sched.h:460 [inline]
 [<ffffffff838aa0e9>] bit_wait_io+0x19/0xa0 kernel/sched/wait.c:582
 [<ffffffff838a9952>] __wait_on_bit_lock+0xc2/0x1c0 kernel/sched/wait.c:421
 [<ffffffff8143202f>] __lock_page+0xff/0x160 mm/filemap.c:934
 [<ffffffff8145b8e3>] lock_page include/linux/pagemap.h:454 [inline]
 [<ffffffff8145b8e3>] write_cache_pages+0x833/0xec0 mm/page-writeback.c:2214
 [<ffffffff8145c04a>] generic_writepages+0xda/0x150 mm/page-writeback.c:2333
 [<ffffffff8162ab4d>] blkdev_writepages+0x1d/0x30 fs/block_dev.c:1764
 [<ffffffff8145ea0d>] do_writepages+0xed/0x1c0 mm/page-writeback.c:2347
 [<ffffffff8143a5b3>] __filemap_fdatawrite_range+0x1b3/0x250 mm/filemap.c:390
 [<ffffffff8143a869>] filemap_write_and_wait_range+0x59/0xb0 mm/filemap.c:580
 [<ffffffff81629e96>] blkdev_fsync+0x66/0xb0 fs/block_dev.c:369
 [<ffffffff816157ea>] vfs_fsync_range+0x10a/0x250 fs/sync.c:195
 [<ffffffff8162ca66>] generic_write_sync include/linux/fs.h:2590 [inline]
 [<ffffffff8162ca66>] blkdev_write_iter+0x2a6/0x380 fs/block_dev.c:1720
 [<ffffffff8156d500>] vfs_iter_write+0x2e0/0x450 fs/read_write.c:390
 [<ffffffff81612765>] iter_file_splice_write+0x5b5/0xb60 fs/splice.c:768
 [<ffffffff8160d5a5>] do_splice_from fs/splice.c:870 [inline]
 [<ffffffff8160d5a5>] direct_splice_actor+0x125/0x180 fs/splice.c:1037
 [<ffffffff8160eb6c>] splice_direct_to_actor+0x2cc/0x800 fs/splice.c:992
 [<ffffffff8160f247>] do_splice_direct+0x1a7/0x270 fs/splice.c:1080
 [<ffffffff8157221b>] do_sendfile+0x54b/0xd30 fs/read_write.c:1393
 [<ffffffff815742d1>] C_SYSC_sendfile fs/read_write.c:1469 [inline]
 [<ffffffff815742d1>] compat_SyS_sendfile+0xd1/0x160 fs/read_write.c:1458
 [<ffffffff81006f95>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81006f95>] do_fast_syscall_32+0x2f5/0x870 arch/x86/entry/common.c:387
 [<ffffffff838b9c90>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Showing all locks held in the system:
2 locks held by khungtaskd/515:
 #0:  (rcu_read_lock){......}, at: [<ffffffff813722b5>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff813722b5>] watchdog+0x125/0xa70 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff81236de0>] debug_show_all_locks+0x70/0x280 kernel/locking/lockdep.c:4336
3 locks held by kworker/u4:3/1805:
 #0:  ("writeback"){.+.+.+}, at: [<ffffffff8118b0d2>] work_static include/linux/workqueue.h:186 [inline]
 #0:  ("writeback"){.+.+.+}, at: [<ffffffff8118b0d2>] set_work_data kernel/workqueue.c:617 [inline]
 #0:  ("writeback"){.+.+.+}, at: [<ffffffff8118b0d2>] set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0:  ("writeback"){.+.+.+}, at: [<ffffffff8118b0d2>] process_one_work+0x6f2/0x1610 kernel/workqueue.c:2085
 #1:  ((&(&wb->dwork)->work)){+.+.+.}, at: [<ffffffff8118b10c>] process_one_work+0x72c/0x1610 kernel/workqueue.c:2089
 #2:  (&type->s_umount_key#29){.+.+..}, at: [<ffffffff815792b0>] trylock_super+0x20/0x100 fs/super.c:393
1 lock held by rsyslogd/3659:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff815d316f>] __fdget_pos+0x9f/0xc0 fs/file.c:781
2 locks held by getty/3755:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff838b67a2>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff8200a8f4>] n_tty_read+0x1f4/0x16c0 drivers/tty/n_tty.c:2133

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 515 Comm: khungtaskd Not tainted 4.9.92-g40a1830 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d8467d00 ffffffff81d95109 0000000000000000 0000000000000000
 0000000000000000 0000000000000001 ffffffff810bb8f0 ffff8801d8467d38
 ffffffff81da025d 0000000000000000 0000000000000000 ffff8801d6ee0418
Call Trace:
 [<ffffffff81d95109>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d95109>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81da025d>] nmi_cpu_backtrace+0xfd/0x120 lib/nmi_backtrace.c:99
 [<ffffffff81da0397>] nmi_trigger_cpumask_backtrace+0x117/0x190 lib/nmi_backtrace.c:60
 [<ffffffff810bb9e4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff81372880>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff81372880>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff81372880>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff81372880>] watchdog+0x6f0/0xa70 kernel/hung_task.c:239
 [<ffffffff8119c0dd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff838b875c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.92-g40a1830 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d9b73000 task.stack: ffff8801d9b88000
RIP: 0010:[<ffffffff8123b542>] c [<ffffffff8123b542>] __lock_acquire+0x8c2/0x3640 kernel/locking/lockdep.c:3349
RSP: 0018:ffff8801d9b8fac0  EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffff8801d9b738b0 RCX: 1ffff1003b36e71a
RDX: ffff8801d9b738a8 RSI: 000000006e84b7f3 RDI: ffffffff84d0c298
RBP: ffff8801d9b8fc78 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: ffff8801d9b73000 R12: ffffffff84d0c288
R13: 00000000fff7565d R14: 643e07b86e84b7f3 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c42044b038 CR3: 00000001ca1a6000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801d9b738a8c 0000000000000046c ffff8801d9b73000c ffffffff844ddde0c
 ffff8801d71a4a80c 0000000000000001c ffff8801d9b8fb18c 0000000000000046c
 0000000000000003c ffff8801db321c20c ffff8801d71a4a70c ffff8801d9b8fb30c
Call Trace:
 [<ffffffff8123ecfe>] lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
 [<ffffffff811ba095>] finish_lock_switch kernel/sched/sched.h:1210 [inline]
 [<ffffffff811ba095>] finish_task_switch+0x1e5/0x630 kernel/sched/core.c:2819
 [<ffffffff838a76d3>] context_switch kernel/sched/core.c:2952 [inline]
 [<ffffffff838a76d3>] __schedule+0x683/0x1ba0 kernel/sched/core.c:3496
 [<ffffffff838a8c6f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3551
 [<ffffffff838a95f3>] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3584
 [<ffffffff81225697>] cpu_idle_loop kernel/sched/idle.c:274 [inline]
 [<ffffffff81225697>] cpu_startup_entry+0x297/0x380 kernel/sched/idle.c:303
 [<ffffffff810b08f3>] start_secondary+0x303/0x3e0 arch/x86/kernel/smpboot.c:254
Code: c00 cfc cff cdf c48 cc1 cea c03 c80 c3c c02 c00 c0f c85 c91 c28 c00 c00 c48 c8b c94 c24 c90 c00 c00 c00 c4d c89 cb3 ca0 c08 c00 c00 c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c<48> cc1 cea c03 c0f cb6 c04 c02 c84 cc0 c74 c08 c3c c03 c0f c8e c42 c28 c00 c00 c41 c

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/03 12:35 https://android.googlesource.com/kernel/common android-4.9 40a18300721d 676bd07e .config console log report syz ci-android-49-kasan-gce-386
2018/04/19 01:47 https://android.googlesource.com/kernel/common android-4.9 8683408f8e81 829f0234 .config console log report ci-android-49-kasan-gce
2018/04/09 19:22 https://android.googlesource.com/kernel/common android-4.9 4fb542f2aa14 f13fb445 .config console log report ci-android-49-kasan-gce
2018/04/04 15:34 https://android.googlesource.com/kernel/common android-4.9 13b40d327b49 676bd07e .config console log report ci-android-49-kasan-gce
2018/04/04 07:16 https://android.googlesource.com/kernel/common android-4.9 13b40d327b49 676bd07e .config console log report ci-android-49-kasan-gce
2018/03/19 07:45 https://android.googlesource.com/kernel/common android-4.9 bb52bba67e35 08dacaa0 .config console log report ci-android-49-kasan-gce
2018/03/07 23:33 https://android.googlesource.com/kernel/common android-4.9 d3a2afb9382e a5e76540 .config console log report ci-android-49-kasan-gce
2018/02/07 19:56 https://android.googlesource.com/kernel/common android-4.9 550c01d0e051 9fb5ec43 .config console log report ci-android-49-kasan-gce
2018/04/19 14:19 https://android.googlesource.com/kernel/common android-4.9 8683408f8e81 3642839c .config console log report ci-android-49-kasan-gce-386
2018/04/10 13:58 https://android.googlesource.com/kernel/common android-4.9 eba1ffe631bc 8e873e9d .config console log report ci-android-49-kasan-gce-386
2018/04/03 10:32 https://android.googlesource.com/kernel/common android-4.9 40a18300721d 676bd07e .config console log report ci-android-49-kasan-gce-386
2018/04/02 16:58 https://android.googlesource.com/kernel/common android-4.9 9c3fb9cd6e63 dc889257 .config console log report ci-android-49-kasan-gce-386
2018/04/01 15:17 https://android.googlesource.com/kernel/common android-4.9 9c3fb9cd6e63 0a78e248 .config console log report ci-android-49-kasan-gce-386
2018/03/16 15:09 https://android.googlesource.com/kernel/common android-4.9 fc8bd0f6ffec 08dacaa0 .config console log report ci-android-49-kasan-gce-386
2018/03/15 13:14 https://android.googlesource.com/kernel/common android-4.9 3a3a0844ac38 08dacaa0 .config console log report ci-android-49-kasan-gce-386
2018/03/08 10:54 https://android.googlesource.com/kernel/common android-4.9 d3a2afb9382e d50edb7e .config console log report ci-android-49-kasan-gce-386
2018/02/18 07:35 https://android.googlesource.com/kernel/common android-4.9 cdfc8df1d262 833f78c7 .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.