syzbot


INFO: task hung in tty_open (2)

Status: upstream: reported on 2023/01/13 14:16
Reported-by: syzbot+801e4bfa67cb4ceacd52@syzkaller.appspotmail.com
First crash: 404d, last: 404d
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in tty_open serial 1 870d 870d 0/26 auto-closed as invalid on 2022/01/02 10:09
android-44 INFO: task hung in tty_open C 132 1559d 1775d 0/2 public: reported C repro on 2019/04/13 00:00
upstream INFO: task hung in tty_open (2) serial C error error 19 209d 744d 0/26 auto-obsoleted due to no activity on 2023/11/04 13:34
linux-4.14 INFO: task hung in tty_open 2 1311d 1363d 0/1 auto-closed as invalid on 2020/11/17 06:29
android-414 INFO: task hung in tty_open C 152 1755d 1777d 0/1 public: reported C repro on 2019/04/11 00:00
upstream INFO: task can't die in show_free_areas serial C error 39 3d03h 758d 0/26 upstream: reported C repro on 2022/01/24 13:23
android-49 INFO: task hung in tty_open C 447 1540d 1776d 0/3 public: reported C repro on 2019/04/12 00:00
upstream INFO: task can't die in irqentry_exit (2) kernel C error 22 749d 1165d 0/26 auto-obsoleted due to no activity on 2022/10/23 05:49

Sample crash report:
FAT-fs (loop3): Unrecognized mount option "nis" or missing value
INFO: task syz-executor.0:19839 blocked for more than 140 seconds.
      Not tainted 4.14.302-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D26984 19839   7998 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 tty_open_by_driver drivers/tty/tty_io.c:1937 [inline]
 tty_open+0x31f/0x8b0 drivers/tty/tty_io.c:2021
 chrdev_open+0x23c/0x6d0 fs/char_dev.c:423
 do_dentry_open+0x44b/0xec0 fs/open.c:777
 vfs_open+0x105/0x220 fs/open.c:888
 do_last fs/namei.c:3428 [inline]
 path_openat+0x628/0x2970 fs/namei.c:3571
 do_filp_open+0x179/0x3c0 fs/namei.c:3605
 do_sys_open+0x296/0x410 fs/open.c:1081
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f419c8e1254
RSP: 002b:00007f419aea0ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f419ca4ef80 RCX: 00007f419c8e1254
RDX: 0000000000000002 RSI: 00007f419aea0d40 RDI: 00000000ffffff9c
RBP: 00007f419aea0d40 R08: 0000000000000000 R09: 000000000000000e
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 00007ffd8d59052f R14: 00007f419aea1300 R15: 0000000000022000

Showing all locks held in the system:
1 lock held by khungtaskd/1533:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffff8702b3a4>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
1 lock held by in:imklog/7704:
 #0:  (&f->f_pos_lock){+.+.}, at: [<ffffffff818d8f8b>] __fdget_pos+0x1fb/0x2b0 fs/file.c:819
2 locks held by kworker/u4:5/9299:
 #0:  ("events_unbound"){+.+.}, at: [<ffffffff81366130>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088
 #1:  ((&sub_info->work)){+.+.}, at: [<ffffffff81366166>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092
3 locks held by syz-executor.3/19831:
 #0:  (&hdev->req_lock){+.+.}, at: [<ffffffff8661cb38>] hci_dev_do_close+0xa8/0xd80 net/bluetooth/hci_core.c:1589
 #1:  (&hdev->lock){+.+.}, at: [<ffffffff8661ccf4>] hci_dev_do_close+0x264/0xd80 net/bluetooth/hci_core.c:1628
 #2:  (uevent_sock_mutex){+.+.}, at: [<ffffffff86fece05>] kobject_uevent_env+0x755/0xf30 lib/kobject_uevent.c:460
4 locks held by syz-executor.1/19841:
 #0:  (&hdev->req_lock){+.+.}, at: [<ffffffff8661cb38>] hci_dev_do_close+0xa8/0xd80 net/bluetooth/hci_core.c:1589
 #1:  (&hdev->lock){+.+.}, at: [<ffffffff8661ccf4>] hci_dev_do_close+0x264/0xd80 net/bluetooth/hci_core.c:1628
 #2:  (hci_cb_list_lock){+.+.}, at: [<ffffffff8663250a>] hci_disconn_cfm include/net/bluetooth/hci_core.h:1228 [inline]
 #2:  (hci_cb_list_lock){+.+.}, at: [<ffffffff8663250a>] hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1393
 #3:  (rcu_preempt_state.exp_mutex){+.+.}, at: [<ffffffff81471452>] exp_funnel_lock kernel/rcu/tree_exp.h:272 [inline]
 #3:  (rcu_preempt_state.exp_mutex){+.+.}, at: [<ffffffff81471452>] _synchronize_rcu_expedited+0x2c2/0x770 kernel/rcu/tree_exp.h:596
1 lock held by syz-executor.0/19839:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff8354cadf>] tty_open_by_driver drivers/tty/tty_io.c:1937 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffff8354cadf>] tty_open+0x31f/0x8b0 drivers/tty/tty_io.c:2021

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1533 Comm: khungtaskd Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
 watchdog+0x5b9/0xb40 kernel/hung_task.c:274
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 19847 Comm: syz-executor.4 Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff88806b388200 task.stack: ffff8880b07c8000
RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:100
RSP: 0018:ffff8880ba407ba0 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffffff88ccc000 RCX: 0000000000000020
RDX: 1ffffffff119981d RSI: 0000000000000130 RDI: 0000000000000380
RBP: ffff8880ba4282c0 R08: ffff88823fff7018 R09: ffff88823fff700f
R10: ffff88823fff7017 R11: 0000008654e848c9 R12: 0000000000000130
R13: 0000000000000003 R14: 0000008509909741 R15: 68c61c99ba842ecd
FS:  00007f98c4cd3700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5aee606100 CR3: 00000000ab2ff000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:385 [inline]
 lapic_next_event+0x53/0x80 arch/x86/kernel/apic/apic.c:468
 clockevents_program_event+0x1f1/0x2d0 kernel/time/clockevents.c:339
 tick_program_event+0x78/0xd0 kernel/time/tick-oneshot.c:47
 hrtimer_interrupt+0x336/0x5e0 kernel/time/hrtimer.c:1334
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
 smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796
RIP: 0010:__kmalloc_node_track_caller+0x9/0x70 mm/slab.c:3695
RSP: 0018:ffff8880ba407d90 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff10
RAX: ffff88806b388200 RBX: 0000000000000000 RCX: ffffffff865fd5c1
RDX: 00000000ffffffff RSI: 0000000001090220 RDI: 00000000000001c0
RBP: 00000000000001c0 R08: 0000000000000140 R09: 0000000000000003
R10: 0000000000000000 R11: ffff88806b388200 R12: 0000000001080020
R13: 00000000ffffffff R14: ffff88823a8223c0 R15: ffff88804bb22b40
 __kmalloc_reserve net/core/skbuff.c:137 [inline]
 __alloc_skb+0x96/0x510 net/core/skbuff.c:205
 alloc_skb include/linux/skbuff.h:980 [inline]
 bcm_can_tx+0x1c1/0x690 net/can/bcm.c:301
 bcm_tx_timeout_tsklet+0x179/0x320 net/can/bcm.c:428
 tasklet_action+0x195/0x340 kernel/softirq.c:513
 __do_softirq+0x24d/0x9ff kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x193/0x240 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796
 </IRQ>
RIP: 0010:shift_maxindex lib/radix-tree.c:264 [inline]
RIP: 0010:node_maxindex lib/radix-tree.c:269 [inline]
RIP: 0010:radix_tree_load_root lib/radix-tree.c:608 [inline]
RIP: 0010:__radix_tree_lookup+0x9d/0x2e0 lib/radix-tree.c:1040
RSP: 0018:ffff8880b07cf8b8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: ffff8880807bc3c1 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffff88809318d070
RBP: ffff8880807bc3c0 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: ffff88806b388200 R12: 0000000000000040
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88809318cc00
 radix_tree_delete_item+0x89/0x1a0 lib/radix-tree.c:2043
 idr_remove_ext include/linux/idr.h:144 [inline]
 idr_remove include/linux/idr.h:149 [inline]
 ipc_rmid+0x5e/0x130 ipc/util.c:428
 shm_rmid ipc/shm.c:225 [inline]
 shm_destroy+0x2e5/0x600 ipc/shm.c:280
 do_shm_rmid+0x10b/0x190 ipc/shm.c:103
 free_ipcs+0x8c/0x170 ipc/namespace.c:124
 shm_exit_ns+0x1f/0x40 ipc/shm.c:109
 free_ipc_ns ipc/namespace.c:134 [inline]
 put_ipc_ns.part.0+0x3f/0x120 ipc/namespace.c:164
 put_ipc_ns+0x2f/0x40 ipc/namespace.c:166
 free_nsproxy+0xbd/0x1f0 kernel/nsproxy.c:180
 switch_task_namespaces+0x8f/0xb0 kernel/nsproxy.c:229
 do_exit+0xa3f/0x2850 kernel/exit.c:867
 do_group_exit+0x100/0x2e0 kernel/exit.c:965
 get_signal+0x38d/0x1ca0 kernel/signal.c:2412
 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
 do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f98c67610c9
RSP: 002b:00007f98c4cd3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: 0000000000000007 RBX: 00007f98c6880f80 RCX: 00007f98c67610c9
RDX: 0000000000000084 RSI: 0000000000000801 RDI: 000000000000000a
RBP: 00007f98c67bcae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff8b652cbf R14: 00007f98c4cd3300 R15: 0000000000022000
Code: 83 3d 3c e6 0b 0a 01 7f 02 5d c3 89 ef 5d e9 9f 88 df 05 48 c7 c7 00 84 2e 8b e8 f4 7c 5c 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff <c3> 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/01/13 14:15 linux-4.14.y c4215ee4771b 529798b0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 INFO: task hung in tty_open
* Struck through repros no longer work on HEAD.