syzbot


INFO: task hung in hfs_mdb_commit (3)

Status: upstream: reported on 2025/02/12 22:52
Reported-by: syzbot+ad5991f368734d3cad2b@syzkaller.appspotmail.com
First crash: 27d, last: 27d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in hfs_mdb_commit hfs C error done 25 407d 785d 25/28 fixed on 2024/03/20 11:33
linux-6.1 INFO: task hung in hfs_mdb_commit 1 658d 658d 0/3 auto-obsoleted due to no activity on 2023/08/31 05:50
linux-5.15 INFO: task hung in hfs_mdb_commit (2) origin:upstream C error 8 3d21h 337d 0/3 upstream: reported C repro on 2024/04/08 12:18
linux-4.19 INFO: task hung in hfs_mdb_commit hfs C error 1 777d 777d 0/1 upstream: reported C repro on 2023/01/25 02:58
linux-5.15 INFO: task hung in hfs_mdb_commit 1 640d 640d 0/3 auto-obsoleted due to no activity on 2023/09/18 06:33
linux-6.1 INFO: task hung in hfs_mdb_commit (2) 1 338d 338d 0/3 auto-obsoleted due to no activity on 2024/07/16 10:21
upstream INFO: task hung in hfs_mdb_commit (2) hfs 1 259d 259d 0/28 auto-obsoleted due to no activity on 2024/09/23 18:09

Sample crash report:
INFO: task syz-executor:4303 blocked for more than 144 seconds.
      Not tainted 6.1.128-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:0     pid:4303  ppid:1      flags:0x00000009
Call trace:
 __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0xef4/0x1d44 kernel/sched/core.c:6558
 schedule+0xc4/0x170 kernel/sched/core.c:6634
 io_schedule+0x8c/0x188 kernel/sched/core.c:8786
 bit_wait_io+0x1c/0xac kernel/sched/wait_bit.c:209
 __wait_on_bit_lock+0xcc/0x1e8 kernel/sched/wait_bit.c:90
 out_of_line_wait_on_bit_lock+0x194/0x21c kernel/sched/wait_bit.c:117
 wait_on_bit_lock_io include/linux/wait_bit.h:208 [inline]
 __lock_buffer+0x78/0xac fs/buffer.c:69
 lock_buffer include/linux/buffer_head.h:397 [inline]
 hfs_mdb_commit+0x9fc/0xf2c fs/hfs/mdb.c:325
 hfs_sync_fs+0x20/0x34 fs/hfs/super.c:35
 sync_filesystem+0xe8/0x218 fs/sync.c:56
 generic_shutdown_super+0x70/0x328 fs/super.c:474
 kill_block_super+0x70/0xdc fs/super.c:1470
 deactivate_locked_super+0xac/0x124 fs/super.c:332
 deactivate_super+0xf0/0x110 fs/super.c:363
 cleanup_mnt+0x394/0x41c fs/namespace.c:1186
 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193
 task_work_run+0x240/0x2f0 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x2080/0x2cb8 arch/arm64/kernel/signal.c:1132
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
INFO: task kworker/0:6:4342 blocked for more than 144 seconds.
      Not tainted 6.1.128-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:6     state:D stack:0     pid:4342  ppid:2      flags:0x00000008
Workqueue: events_long flush_mdb
Call trace:
 __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0xef4/0x1d44 kernel/sched/core.c:6558
 schedule+0xc4/0x170 kernel/sched/core.c:6634
 io_schedule+0x8c/0x188 kernel/sched/core.c:8786
 bit_wait_io+0x1c/0xac kernel/sched/wait_bit.c:209
 __wait_on_bit_lock+0xcc/0x1e8 kernel/sched/wait_bit.c:90
 out_of_line_wait_on_bit_lock+0x194/0x21c kernel/sched/wait_bit.c:117
 wait_on_bit_lock_io include/linux/wait_bit.h:208 [inline]
 __lock_buffer+0x78/0xac fs/buffer.c:69
 lock_buffer include/linux/buffer_head.h:397 [inline]
 hfs_mdb_commit+0x140/0xf2c fs/hfs/mdb.c:271
 flush_mdb+0x6c/0x9c fs/hfs/super.c:66
 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffff800015c65530 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffff800015c65d30 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517
3 locks held by kworker/1:1/24:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265
 #1: ffff80001d2e7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
 #2: ffff0000cd27f240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491
1 lock held by khungtaskd/28:
 #0: ffff800015c65360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
2 locks held by getty/4054:
 #0: ffff0000d66fc098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
 #1: ffff80001d8302f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1214 drivers/tty/n_tty.c:2198
1 lock held by syz-executor/4303:
 #0: ffff0000fa6b00e0 (&type->s_umount_key#61){+.+.}-{3:3}, at: deactivate_super+0xe8/0x110 fs/super.c:362
2 locks held by kworker/0:6/4342:
 #0: ffff0000c0021138 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265
 #1: ffff8000214f7c20 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
2 locks held by kworker/u4:7/4484:
 #0: ffff0001b3cf3158 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:537 [inline]
 #0: ffff0001b3cf3158 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1355 [inline]
 #0: ffff0001b3cf3158 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1645 [inline]
 #0: ffff0001b3cf3158 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2c4/0x1d44 kernel/sched/core.c:6474
 #1: ffff8000215a7c20 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
1 lock held by sed/8464:
2 locks held by syz.8.921/8466:

=============================================


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/12 22:51 linux-6.1.y 0cbb5f65e52f b27c2402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 INFO: task hung in hfs_mdb_commit
* Struck through repros no longer work on HEAD.