syzbot


INFO: task hung in blkdev_reread_part

Status: closed as dup on 2017/12/12 16:29
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+7ca1333efc3e4a9174c86149436ecea8053ec13c@syzkaller.appspotmail.com
First crash: 2546d, last: 2428d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
INFO: task hung in lo_ioctl block 47 2422d 2538d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 INFO: task hung in blkdev_reread_part C 538 1822d 2052d 0/1 public: reported C repro on 2019/04/10 16:04
android-49 INFO: task hung in blkdev_reread_part syz 380 1829d 2048d 0/3 public: reported syz repro on 2019/04/14 09:28
linux-4.14 INFO: task hung in blkdev_reread_part C error 40 797d 2051d 0/1 upstream: reported C repro on 2019/04/11 11:39
android-44 INFO: task hung in blkdev_reread_part syz 25 1845d 2048d 0/2 public: reported syz repro on 2019/04/14 00:02

Sample crash report:
netlink: 3 bytes leftover after parsing attributes in process `syz-executor7'.
INFO: task syz-executor0:18085 blocked for more than 120 seconds.
      Not tainted 4.15.0-rc8+ #268
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D24960 18085   4646 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2799 [inline]
 __schedule+0x8eb/0x2060 kernel/sched/core.c:3375
 schedule+0xf5/0x430 kernel/sched/core.c:3434
 schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:3492
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0xaad/0x1a80 kernel/locking/mutex.c:893
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
 blkdev_reread_part+0x1e/0x40 block/ioctl.c:192
 loop_reread_partitions+0x12f/0x1a0 drivers/block/loop.c:619
 loop_set_status+0x9ba/0xf60 drivers/block/loop.c:1161
 loop_set_status64+0x9d/0x110 drivers/block/loop.c:1271
 lo_ioctl+0xd86/0x1b70 drivers/block/loop.c:1381
 __blkdev_driver_ioctl block/ioctl.c:303 [inline]
 blkdev_ioctl+0x1759/0x1e00 block/ioctl.c:601
 block_ioctl+0xde/0x120 fs/block_dev.c:1860
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x452e99
RSP: 002b:00007f6568f04c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: cccccccccccccccd RCX: 0000000000452e99
RDX: 000000002034b000 RSI: 0000000000004c04 RDI: 0000000000000013
RBP: 00000000000005ee R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f6ef0
R13: 00000000ffffffff R14: 00007f6568f056d4 R15: 0000000000000001

Showing all locks held in the system:
2 locks held by khungtaskd/746:
 #0:  (rcu_read_lock){....}, at: [<0000000009cc4422>] check_hung_uninterruptible_tasks kernel/hung_task.c:175 [inline]
 #0:  (rcu_read_lock){....}, at: [<0000000009cc4422>] watchdog+0x1c5/0xd60 kernel/hung_task.c:249
 #1:  (tasklist_lock){.+.+}, at: [<000000007a0fc351>] debug_show_all_locks+0xd3/0x400 kernel/locking/lockdep.c:4464
1 lock held by rsyslogd/3505:
 #0:  (&f->f_pos_lock){+.+.}, at: [<000000005b29c5c1>] __fdget_pos+0x12b/0x190 fs/file.c:770
2 locks held by getty/3628:
 #0:  (&tty->ldisc_sem){++++}, at: [<000000008f9e8392>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<0000000045b96a65>] n_tty_read+0x2ef/0x1a00 drivers/tty/n_tty.c:2131
2 locks held by getty/3629:
 #0:  (&tty->ldisc_sem){++++}, at: [<000000008f9e8392>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<0000000045b96a65>] n_tty_read+0x2ef/0x1a00 drivers/tty/n_tty.c:2131
2 locks held by getty/3630:
 #0:  (&tty->ldisc_sem){++++}, at: [<000000008f9e8392>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<0000000045b96a65>] n_tty_read+0x2ef/0x1a00 drivers/tty/n_tty.c:2131
2 locks held by getty/3631:
 #0:  (&tty->ldisc_sem){++++}, at: [<000000008f9e8392>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<0000000045b96a65>] n_tty_read+0x2ef/0x1a00 drivers/tty/n_tty.c:2131
2 locks held by getty/3632:
 #0:  (&tty->ldisc_sem){++++}, at: [<000000008f9e8392>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<0000000045b96a65>] n_tty_read+0x2ef/0x1a00 drivers/tty/n_tty.c:2131
2 locks held by getty/3633:
 #0:  (&tty->ldisc_sem){++++}, at: [<000000008f9e8392>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<0000000045b96a65>] n_tty_read+0x2ef/0x1a00 drivers/tty/n_tty.c:2131
2 locks held by getty/3634:
 #0:  (&tty->ldisc_sem){++++}, at: [<000000008f9e8392>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<0000000045b96a65>] n_tty_read+0x2ef/0x1a00 drivers/tty/n_tty.c:2131
2 locks held by syz-executor0/18085:
 #0:  (&lo->lo_ctl_mutex/1){+.+.}, at: [<00000000d889cc26>] lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355
 #1:  (&bdev->bd_mutex){+.+.}, at: [<0000000025418b55>] blkdev_reread_part+0x1e/0x40 block/ioctl.c:192
2 locks held by syz-executor5/18061:
 #0:  (loop_index_mutex){+.+.}, at: [<0000000049bcc735>] loop_control_ioctl+0x89/0x490 drivers/block/loop.c:1938
 #1:  (&lo->lo_ctl_mutex#2){+.+.}, at: [<00000000118cc7ba>] loop_control_ioctl+0x1a7/0x490 drivers/block/loop.c:1952
2 locks held by blkid/18077:
 #0:  (&bdev->bd_mutex){+.+.}, at: [<000000002be69810>] __blkdev_put+0xbc/0x7f0 fs/block_dev.c:1757
 #1:  (loop_index_mutex){+.+.}, at: [<00000000596123f4>] lo_release+0x1f/0x190 drivers/block/loop.c:1614

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 746 Comm: khungtaskd Not tainted 4.15.0-rc8+ #268
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 nmi_cpu_backtrace+0x1d2/0x210 lib/nmi_backtrace.c:103
 nmi_trigger_cpumask_backtrace+0x122/0x180 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
 check_hung_task kernel/hung_task.c:132 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:190 [inline]
 watchdog+0x90c/0xd60 kernel/hung_task.c:249
 kthread+0x33c/0x400 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:541
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.15.0-rc8+ #268
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:idle_cpu kernel/sched/core.c:3913 [inline]
RIP: 0010:got_nohz_idle_kick kernel/sched/core.c:614 [inline]
RIP: 0010:scheduler_ipi+0x36e/0x820 kernel/sched/core.c:1777
RSP: 0018:ffff8801db307d70 EFLAGS: 00000046
RAX: ffff8801db300000 RBX: 000000000002c240 RCX: 0000000000000000
RDX: ffffffff86670ae8 RSI: 0000000000000000 RDI: ffff8801db32c278
RBP: ffff8801db307e90 R08: 1ffff1003b665985 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801db32c240
R13: 1ffff1003b660fb1 R14: ffff8801db307e68 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f85dc536000 CR3: 0000000006822004 CR4: 00000000001606e0
Call Trace:
 <IRQ>
 smp_reschedule_interrupt+0xe6/0x670 arch/x86/kernel/smp.c:277
 reschedule_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:961
 </IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
RSP: 0018:ffff8801d9f77cb0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff02
RAX: dffffc0000000000 RBX: 1ffff1003b3eef99 RCX: 0000000000000000
RDX: 1ffffffff0d19190 RSI: 0000000000000001 RDI: ffffffff868c8c80
RBP: ffff8801d9f77cb0 R08: ffffffff86670ae8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8801d9f77d68 R14: ffffffff870380a0 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:93 [inline]
 default_idle+0xbf/0x460 arch/x86/kernel/process.c:355
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:346
 default_idle_call+0x36/0x90 kernel/sched/idle.c:98
 cpuidle_idle_call kernel/sched/idle.c:156 [inline]
 do_idle+0x24a/0x3b0 kernel/sched/idle.c:246
 cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:351
 start_secondary+0x40a/0x590 arch/x86/kernel/smpboot.c:268
 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:237
Code: e8 fe ff ff 48 89 85 f0 fe ff ff e8 1d 2c 5a 00 48 8b 95 e8 fe ff ff 48 8b 85 f0 fe ff ff 41 8b 74 24 38 85 f6 0f 85 82 fe ff ff <49> 8d 46 80 49 8d bc 24 a0 0b 00 00 48 b9 00 00 00 00 00 fc ff 

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/19 14:51 upstream dda3e15231b3 161c1d64 .config console log report ci-upstream-kasan-gce
2017/12/02 01:22 upstream a0651c7fa2c0 48359b97 .config console log report ci-upstream-kasan-gce
2018/03/30 14:38 upstream c2a9838452a4 d47f0ed6 .config console log report ci-upstream-kasan-gce-386
2018/01/18 00:48 mmots ce3c209f6733 b8970f31 .config console log report ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.