syzbot


INFO: task hung in add_transaction_credits

Status: public: reported C repro on 2019/04/14 00:00
Reported-by: syzbot+a75cd3eb7b315ccc2b5d@syzkaller.appspotmail.com
First crash: 2253d, last: 2239d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in add_transaction_credits 1 595d 595d 0/3 auto-obsoleted due to no activity on 2023/08/04 14:01
android-414 INFO: task hung in add_transaction_credits C 11 2235d 2051d 0/1 public: reported C repro on 2019/04/10 16:14
android-44 INFO: task hung in add_transaction_credits 1 2388d 2388d 0/2 auto-closed as invalid on 2019/02/22 14:56
upstream INFO: task hung in add_transaction_credits ext4 C 13 2231d 2306d 0/28 closed as dup on 2018/09/24 00:42

Sample crash report:
INFO: task kworker/u4:1:64 blocked for more than 140 seconds.
      Not tainted 4.9.131+ #50
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:1    D25352    64      2 0x80000000
Workqueue: writeback wb_workfn (flush-8:0)
 ffff8801d7fe5f00 0000000000000000 ffff8801d4c78580 ffffffff83029180
 ffff8801db621018 ffff8801d793f130 ffffffff827f3542 ffff8801d7fe5f00
 0000000000000000 0000000000000000 0000000000000000 ffff8801db6218f0
Call Trace:
 [<ffffffff827f4a6f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff817e53b5>] wait_transaction_locked+0x1a5/0x230 fs/jbd2/transaction.c:163
 [<ffffffff817e5888>] add_transaction_credits+0x408/0x980 fs/jbd2/transaction.c:191
 [<ffffffff817e6240>] start_this_handle+0x340/0xe40 fs/jbd2/transaction.c:361
 [<ffffffff817e80f6>] jbd2__journal_start+0x306/0x8b0 fs/jbd2/transaction.c:457
 [<ffffffff8178dbbc>] __ext4_journal_start_sb+0x10c/0x460 fs/ext4/ext4_jbd2.c:76
 [<ffffffff816d5895>] __ext4_journal_start fs/ext4/ext4_jbd2.h:318 [inline]
 [<ffffffff816d5895>] ext4_writepages+0xe75/0x2e00 fs/ext4/inode.c:2767
 [<ffffffff81433d0f>] do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
 [<ffffffff8159eb89>] __writeback_single_inode+0xd9/0x1020 fs/fs-writeback.c:1320
 [<ffffffff8159ff7c>] writeback_sb_inodes+0x4ac/0xe70 fs/fs-writeback.c:1584
 [<ffffffff815a0a3b>] __writeback_inodes_wb+0xfb/0x1e0 fs/fs-writeback.c:1653
 [<ffffffff815a1032>] wb_writeback+0x512/0xbd0 fs/fs-writeback.c:1762
 [<ffffffff815a47ac>] wb_check_old_data_flush fs/fs-writeback.c:1877 [inline]
 [<ffffffff815a47ac>] wb_do_writeback fs/fs-writeback.c:1901 [inline]
 [<ffffffff815a47ac>] wb_workfn+0x8bc/0xe90 fs/fs-writeback.c:1930
 [<ffffffff81130e81>] process_one_work+0x831/0x1530 kernel/workqueue.c:2092
 [<ffffffff81131c56>] worker_thread+0xd6/0x1140 kernel/workqueue.c:2226
 [<ffffffff811429fd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff8280399c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bbcc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bbcc>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fe394>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
4 locks held by kworker/u4:1/64:
 #0:  ("writeback"){.+.+.+}, at: [<ffffffff81130d8c>] process_one_work+0x73c/0x1530 kernel/workqueue.c:2085
 #1:  ((&(&wb->dwork)->work)){+.+.+.}, at: [<ffffffff81130dc4>] process_one_work+0x774/0x1530 kernel/workqueue.c:2089
 #2:  (&type->s_umount_key#32){++++.+}, at: [<ffffffff81514b20>] trylock_super+0x20/0xf0 fs/super.c:393
 #3:  (&sbi->s_journal_flag_rwsem){.+.+.+}, at: [<ffffffff81433d0f>] do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
3 locks held by rs:main Q:Reg/1894:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cdac>] __fdget_pos+0xac/0xd0 fs/file.c:781
 #1:  (sb_writers#4){.+.+.+}, at: [<ffffffff8150af2b>] file_start_write include/linux/fs.h:2640 [inline]
 #1:  (sb_writers#4){.+.+.+}, at: [<ffffffff8150af2b>] vfs_write+0x3eb/0x520 fs/read_write.c:556
 #2:  (&sb->s_type->i_mutex_key#9){+.+.+.}, at: [<ffffffff816b2d92>] inode_lock include/linux/fs.h:766 [inline]
 #2:  (&sb->s_type->i_mutex_key#9){+.+.+.}, at: [<ffffffff816b2d92>] ext4_file_write_iter+0x122/0xd70 fs/ext4/file.c:100
2 locks held by getty/2024:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82801892>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d2b2b2>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.131+ #50
 ffff8801d9907d08 ffffffff81b37029 0000000000000000 0000000000000000
 0000000000000000 0000000000000001 ffffffff81098450 ffff8801d9907d40
 ffffffff81b42139 0000000000000000 0000000000000000 0000000000000003
Call Trace:
 [<ffffffff81b37029>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b37029>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b42139>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b420cc>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff81098554>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c15d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c15d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c15d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c15d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff811429fd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff8280399c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 2153 Comm: syz-executor348 Not tainted 4.9.131+ #50
task: ffff8801cb192f80 task.stack: ffff8801cad20000
RIP: 0010:[<ffffffff81202a26>] c [<ffffffff81202a26>] arch_local_save_flags arch/x86/include/asm/paravirt.h:763 [inline]
RIP: 0010:[<ffffffff81202a26>] c [<ffffffff81202a26>] arch_local_irq_save arch/x86/include/asm/paravirt.h:785 [inline]
RIP: 0010:[<ffffffff81202a26>] c [<ffffffff81202a26>] lock_is_held+0x56/0x140 kernel/locking/lockdep.c:3790
RSP: 0018:ffff8801cad274a8  EFLAGS: 00000246
RAX: 0000000000000246 RBX: ffff8801cb192f80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81b9be7b RDI: ffff8801cb19382c
RBP: ffff8801cad274c0 R08: ffff8801cb193918 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801c5094c78
R13: ffffffff830cc2e0 R14: ffff8801c5094c78 R15: 0000000000000000
FS:  0000000001197880(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004550a0 CR3: 00000001cb136000 CR4: 00000000001606b0
Stack:
 0000000000000003c ffff8801c5094c78c dffffc0000000000c ffff8801cad274d8c
 ffffffff81243993c 0000000000000000c ffff8801cad27528c ffffffff815bc6dbc
 00001000cad27528c 0000000000008608c ffff8801d9180b80c 0000000000008608c
Call Trace:
 [<ffffffff81243993>] rcu_read_lock_sched_held+0x103/0x120 kernel/rcu/update.c:112
 [<ffffffff815bc6db>] trace_block_touch_buffer include/trace/events/block.h:44 [inline]
 [<ffffffff815bc6db>] touch_buffer fs/buffer.c:64 [inline]
 [<ffffffff815bc6db>] __find_get_block+0x3eb/0x4d0 fs/buffer.c:1364
 [<ffffffff815bd8d8>] __getblk_gfp+0x38/0x700 fs/buffer.c:1382
 [<ffffffff817705ad>] sb_getblk_gfp include/linux/buffer_head.h:325 [inline]
 [<ffffffff817705ad>] __read_extent_tree_block+0xad/0x770 fs/ext4/extents.c:521
 [<ffffffff81773df1>] ext4_find_extent+0x351/0x940 fs/ext4/extents.c:920
 [<ffffffff817b9d56>] get_ext_path fs/ext4/move_extent.c:39 [inline]
 [<ffffffff817b9d56>] mext_check_coverage.constprop.2+0x256/0x400 fs/ext4/move_extent.c:106
 [<ffffffff817bb76b>] move_extent_per_page fs/ext4/move_extent.c:333 [inline]
 [<ffffffff817bb76b>] ext4_move_extents+0x17bb/0x2a50 fs/ext4/move_extent.c:681
 [<ffffffff816ed7fc>] ext4_ioctl+0x27fc/0x3620 fs/ext4/ioctl.c:594
 [<ffffffff81546f1c>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81546f1c>] file_ioctl fs/ioctl.c:493 [inline]
 [<ffffffff81546f1c>] do_vfs_ioctl+0x1ac/0x11a0 fs/ioctl.c:677
 [<ffffffff81547f9f>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff81547f9f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff828037d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: cea c03 c0f cb6 c14 c02 c48 c89 cf8 c83 ce0 c07 c83 cc0 c03 c38 cd0 c7c c08 c84 cd2 c0f c85 cd8 c00 c00 c00 c8b c83 cac c08 c00 c00 c85 cc0 c0f c85 cba c00 c00 c00 c9c c58 c<0f> c1f c44 c00 c00 c48 c89 cc3 cfa c66 c0f c1f c44 c00 c00 c65 c4c c8b c24 c25 c00 c

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/05 14:10 https://android.googlesource.com/kernel/common android-4.9 7bebf33f9d46 8b311eaf .config console log report syz C ci-android-49-kasan-gce-root
2018/09/26 00:05 https://android.googlesource.com/kernel/common android-4.9 36daaf708bc0 b7e11289 .config console log report syz C ci-android-49-kasan-gce-root
2018/09/30 01:47 https://android.googlesource.com/kernel/common android-4.9 1c7637ca0b04 41e4b329 .config console log report ci-android-49-kasan-gce-root
2018/09/21 16:08 https://android.googlesource.com/kernel/common android-4.9 1c57ba4f543b 37079712 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.