syzbot


INFO: task hung in addrconf_verify_work

Status: public: reported C repro on 2019/04/12 00:01
Reported-by: syzbot+8bf69a24ed00d750d3e3@syzkaller.appspotmail.com
First crash: 2127d, last: 1741d
Similar bugs (21)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 INFO: task hung in addrconf_verify_work 18 1751d 1923d 0/3 auto-closed as invalid on 2020/01/31 12:44
linux-6.1 INFO: task hung in addrconf_verify_work (2) 42 2d14h 172d 0/3 upstream: reported on 2024/01/29 22:05
linux-4.19 INFO: task hung in addrconf_verify_work (5) 3 737d 777d 0/1 auto-obsoleted due to no activity on 2022/11/10 09:18
linux-4.19 INFO: task hung in addrconf_verify_work (6) C error 4 519d 578d 0/1 upstream: reported C repro on 2022/12/19 15:22
linux-4.19 INFO: task hung in addrconf_verify_work (3) 1 1224d 1224d 0/1 auto-closed as invalid on 2021/07/11 07:19
linux-4.19 INFO: task hung in addrconf_verify_work (4) 6 919d 1005d 0/1 auto-closed as invalid on 2022/05/13 00:19
linux-4.14 INFO: task hung in addrconf_verify_work (2) C error 7 517d 1361d 0/1 upstream: reported C repro on 2020/10/28 05:47
upstream INFO: task hung in addrconf_verify_work (2) net C 22 1741d 1741d 13/27 fixed on 2019/11/04 14:50
linux-4.19 INFO: task hung in addrconf_verify_work (2) 2 1364d 1454d 0/1 auto-closed as invalid on 2021/02/21 08:05
linux-5.15 INFO: task hung in addrconf_verify_work origin:upstream missing-backport C 53 18d 60d 0/3 upstream: reported C repro on 2024/05/20 18:55
upstream INFO: task hung in addrconf_verify_work (8) net C error 1294 10d 214d 27/27 fixed on 2024/07/09 19:14
android-44 INFO: task hung in addrconf_verify_work 3 2257d 2286d 0/2 auto-closed as invalid on 2019/02/22 14:29
linux-4.19 INFO: task hung in addrconf_verify_work 1 1584d 1584d 0/1 auto-closed as invalid on 2020/07/16 23:17
upstream INFO: task hung in addrconf_verify_work (3) C done 75 1354d 1389d 15/27 fixed on 2020/11/16 12:12
upstream INFO: task hung in addrconf_verify_work (5) net C done done 68 932d 1024d 0/27 closed as invalid on 2022/02/01 17:39
upstream INFO: task hung in addrconf_verify_work (7) netfilter C error 64 233d 380d 0/27 closed as invalid on 2023/12/01 14:19
linux-6.1 INFO: task hung in addrconf_verify_work 2 442d 493d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:09
linux-4.14 INFO: task hung in addrconf_verify_work 4 1510d 1581d 0/1 auto-closed as invalid on 2020/09/29 04:19
upstream INFO: task hung in addrconf_verify_work net C 2 2307d 2307d 0/27 closed as invalid on 2018/03/27 11:14
upstream INFO: task hung in addrconf_verify_work (4) C done 132 1246d 1333d 20/27 fixed on 2021/04/09 19:46
upstream INFO: task hung in addrconf_verify_work (6) C done 86 515d 752d 22/27 fixed on 2023/02/24 13:51

Sample crash report:
INFO: task kworker/0:1:22 blocked for more than 140 seconds.
      Not tainted 4.14.149+ #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/0:1     D27344    22      2 0x80000000
Workqueue: ipv6_addrconf addrconf_verify_work
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3498
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3556
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x595/0x13e0 kernel/locking/mutex.c:893
 addrconf_verify_work+0xa/0x20 net/ipv6/addrconf.c:4431
 process_one_work+0x7f1/0x1580 kernel/workqueue.c:2134
 worker_thread+0xdd/0xdf0 kernel/workqueue.c:2271
 kthread+0x31f/0x430 kernel/kthread.c:232
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:404

Showing all locks held in the system:
3 locks held by kworker/0:1/22:
 #0:  ("%s"("ipv6_addrconf")){+.+.}, at: [<        (ptrval)>] process_one_work+0x6ff/0x1580 kernel/workqueue.c:2105
 #1:  ((addr_chk_work).work){+.+.}, at: [<        (ptrval)>] process_one_work+0x735/0x1580 kernel/workqueue.c:2109
 #2:  (rtnl_mutex){+.+.}, at: [<        (ptrval)>] addrconf_verify_work+0xa/0x20 net/ipv6/addrconf.c:4431
1 lock held by khungtaskd/23:
 #0:  (tasklist_lock){.+.+}, at: [<        (ptrval)>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4544
2 locks held by getty/1756:
 #0:  (&tty->ldisc_sem){++++}, at: [<        (ptrval)>] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<        (ptrval)>] n_tty_read+0x1f7/0x1700 drivers/tty/n_tty.c:2156

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.149+ #0
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xca/0x134 lib/dump_stack.c:53
 nmi_cpu_backtrace.cold+0x47/0x86 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x119/0x147 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
 watchdog+0x629/0xbe0 kernel/hung_task.c:274
 kthread+0x31f/0x430 kernel/kthread.c:232
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1910 Comm: syz-executor432 Not tainted 4.14.149+ #0
task:         (ptrval) task.stack:         (ptrval)
RIP: 0010:unwind_next_frame+0x101/0x1810 arch/x86/kernel/unwind_orc.c:339
RSP: 0018:ffff8881c9e070b0 EFLAGS: 00000246
RAX: ffff8881c9e071d0 RBX: ffff8881c9e07180 RCX: 0000000000000000
RDX: ffff8881c9e071d0 RSI: 0000000000000000 RDI: ffff8881cb619128
RBP: 1ffff110393c0e1d R08: 0000000000000001 R09: ffff8881c9e07a58
R10: ffff8881c9e071b5 R11: 000000000001c033 R12: 0000000000000000
R13: ffff8881c9e071b8 R14: ffff8881cb618000 R15: 0000000000000001
FS:  0000000000c91880(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000abe000 CR3: 00000001caefa002 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __save_stack_trace+0x7a/0xf0 arch/x86/kernel/stacktrace.c:44
 save_stack mm/kasan/common.c:76 [inline]
 set_track mm/kasan/common.c:85 [inline]
 __kasan_kmalloc.part.0+0x53/0xc0 mm/kasan/common.c:501
 slab_post_alloc_hook mm/slab.h:439 [inline]
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2800 [inline]
 __kmalloc_track_caller+0x10d/0x390 mm/slub.c:4367
 __kmalloc_reserve.isra.0+0x2d/0xc0 net/core/skbuff.c:137
 pskb_expand_head+0x11e/0xc10 net/core/skbuff.c:1462
 netlink_trim+0x1f6/0x270 net/netlink/af_netlink.c:1268
 netlink_broadcast_filtered+0x5f/0xa00 net/netlink/af_netlink.c:1465
 netlink_broadcast+0x35/0x40 net/netlink/af_netlink.c:1510
 rtnetlink_send+0xcb/0x100 net/core/rtnetlink.c:630
 tcf_add_notify net/sched/act_api.c:1065 [inline]
 tcf_action_add net/sched/act_api.c:1082 [inline]
 tc_ctl_action+0x420/0x526 net/sched/act_api.c:1126
 rtnetlink_rcv_msg+0x3d3/0xb40 net/core/rtnetlink.c:4285
 netlink_rcv_skb+0x137/0x3a0 net/netlink/af_netlink.c:2432
 netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
 netlink_unicast+0x478/0x650 net/netlink/af_netlink.c:1312
 netlink_sendmsg+0x66a/0xbe0 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb7/0x100 net/socket.c:656
 ___sys_sendmsg+0x752/0x890 net/socket.c:2062
 __sys_sendmsg+0xb6/0x150 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441799
RSP: 002b:00007ffc5183eb18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441799
RDX: 0000000020000010 RSI: 0000000020001480 RDI: 0000000000000003
RBP: 00000000006cc018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004025c0
R13: 0000000000402650 R14: 0000000000000000 R15: 0000000000000000
Code: c1 ea 03 80 3c 02 00 0f 85 08 11 00 00 48 8b 43 38 bf 01 00 00 00 48 89 44 24 08 e8 9a 73 0b 00 48 8d 43 50 48 89 c2 48 89 04 24 <48> b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 df 

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/14 05:00 android-4.14 1d75f58e4e19 2f661ec4 .config console log report syz C ci-android-414-kasan-gce-root
2019/02/04 03:41 android-4.14 80d7b06534fa c198d5dd .config console log report syz C ci-android-414-kasan-gce-root
2019/01/23 19:51 android-4.14 7af2b8dc5ab3 7cf3249c .config console log report syz C ci-android-414-kasan-gce-root
2018/12/19 10:18 android-4.14 3c9f3e0b62ad 4edaba93 .config console log report syz C ci-android-414-kasan-gce-root
2019/06/10 06:45 android-4.14 225970c2e89e 0159583c .config console log report ci-android-414-kasan-gce-root
2018/09/22 14:31 android-4.14 666c420fa3ea 37079712 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.