syzbot


INFO: task hung in fuse_lookup

Status: upstream: reported syz repro on 2023/06/07 05:32
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+840bde9f70b05fb1c05e@syzkaller.appspotmail.com
First crash: 310d, last: 11d
Bug presence (1)
Date Name Commit Repro Result
2023/06/07 upstream (ToT) a4d7d7011219 C [report] INFO: task hung in fuse_lookup
Similar bugs (10)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 INFO: task hung in fuse_lookup 4 1655d 1808d 0/1 auto-closed as invalid on 2020/01/29 21:30
linux-4.19 INFO: task hung in fuse_lookup reiserfs C error 12 426d 1703d 0/1 upstream: reported C repro on 2019/08/14 05:24
linux-4.14 INFO: task hung in fuse_lookup (3) 1 819d 819d 0/1 auto-closed as invalid on 2022/05/15 00:47
upstream INFO: task hung in fuse_lookup (3) fuse C done error 44 10d 1703d 0/26 upstream: reported C repro on 2019/08/14 09:48
linux-5.15 INFO: task hung in fuse_lookup origin:upstream syz error 2 290d 311d 0/3 upstream: reported syz repro on 2023/06/07 02:49
linux-4.14 INFO: task hung in fuse_lookup (4) reiserfs C 2 431d 486d 0/1 upstream: reported C repro on 2022/12/13 09:09
linux-4.14 INFO: task hung in fuse_lookup (2) 1 1489d 1489d 0/1 auto-closed as invalid on 2020/07/13 23:30
upstream INFO: task hung in fuse_lookup fuse 16 2048d 2099d 0/26 closed as invalid on 2018/09/05 12:51
android-49 INFO: task hung in fuse_lookup C 112 1617d 1828d 0/3 public: reported C repro on 2019/04/11 08:44
upstream INFO: task hung in fuse_lookup (2) fuse C 13 1881d 2041d 0/26 closed as dup on 2018/09/10 08:43
Fix bisection attempts (3)
Created Duration User Patch Repo Result
2024/03/19 11:59 2h25m bisect fix linux-6.1.y job log (0) log
2024/01/02 09:49 1h33m bisect fix linux-6.1.y job log (0) log
2023/12/03 06:47 2h36m bisect fix linux-6.1.y job log (0) log

Sample crash report:
INFO: task syz-executor.0:4294 blocked for more than 143 seconds.
      Not tainted 6.1.83-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:0     pid:4294  ppid:1      flags:0x00000005
Call trace:
 __switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0xee4/0x1c98 kernel/sched/core.c:6558
 schedule+0xc4/0x170 kernel/sched/core.c:6634
 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6693
 __mutex_lock_common+0xbd8/0x21a0 kernel/locking/mutex.c:679
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 fuse_lock_inode+0xd4/0x11c fs/fuse/inode.c:520
 fuse_lookup+0xf0/0x4b0 fs/fuse/dir.c:432
 __lookup_slow+0x250/0x374 fs/namei.c:1690
 lookup_slow+0x60/0x84 fs/namei.c:1707
 walk_component fs/namei.c:1998 [inline]
 link_path_walk+0x830/0xcc8 fs/namei.c:2325
 path_openat+0x1c8/0x2548 fs/namei.c:3781
 do_filp_open+0x1bc/0x3cc fs/namei.c:3812
 do_sys_openat2+0x128/0x3d8 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1345
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
INFO: task syz-executor.0:4313 blocked for more than 143 seconds.
      Not tainted 6.1.83-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:0     pid:4313  ppid:4294   flags:0x0000000d
Call trace:
 __switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0xee4/0x1c98 kernel/sched/core.c:6558
 schedule+0xc4/0x170 kernel/sched/core.c:6634
 request_wait_answer fs/fuse/dev.c:407 [inline]
 __fuse_request_send fs/fuse/dev.c:426 [inline]
 fuse_simple_request+0xdd8/0x15c0 fs/fuse/dev.c:511
 fuse_lookup_name+0x27c/0x6ac fs/fuse/dir.c:392
 fuse_lookup+0x13c/0x4b0 fs/fuse/dir.c:433
 __lookup_slow+0x250/0x374 fs/namei.c:1690
 lookup_slow+0x60/0x84 fs/namei.c:1707
 walk_component fs/namei.c:1998 [inline]
 link_path_walk+0x830/0xcc8 fs/namei.c:2325
 path_openat+0x1c8/0x2548 fs/namei.c:3781
 do_filp_open+0x1bc/0x3cc fs/namei.c:3812
 do_sys_openat2+0x128/0x3d8 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1345
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffff800015a14e70 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:516
1 lock held by rcu_tasks_trace/13:
 #0: ffff800015a15670 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:516
1 lock held by khungtaskd/28:
 #0: ffff800015a14ca0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
2 locks held by getty/3983:
 #0: ffff0000d77c8098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
 #1: ffff80001bcc02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1214 drivers/tty/n_tty.c:2188
2 locks held by syz-executor.0/4294:
 #0: ffff0000e2208150 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
 #0: ffff0000e2208150 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1706
 #1: ffff0000e22085b8 (&fi->mutex){+.+.}-{3:3}, at: fuse_lock_inode+0xd4/0x11c fs/fuse/inode.c:520
2 locks held by syz-executor.0/4313:
 #0: ffff0000e2208150 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
 #0: ffff0000e2208150 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1706
 #1: ffff0000e22085b8 (&fi->mutex){+.+.}-{3:3}, at: fuse_lock_inode+0xd4/0x11c fs/fuse/inode.c:520

=============================================


Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/01 10:12 linux-6.1.y e5cd595e23c1 6baf5069 .config console log report syz [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 INFO: task hung in fuse_lookup
2023/06/07 05:30 linux-6.1.y 76ba310227d2 a4ae4f42 .config console log report syz [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 INFO: task hung in fuse_lookup
2023/08/13 01:53 linux-6.1.y 1321ab403b38 39990d51 .config console log report syz [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan INFO: task hung in fuse_lookup
* Struck through repros no longer work on HEAD.