syzbot


INFO: task hung in path_openat

Status: upstream: reported C repro on 2025/09/15 16:26
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+c4d0a5e21a35f5f093c5@syzkaller.appspotmail.com
First crash: 81d, last: 32d
Fix bisection: the issue occurs on the latest tested release (bisect log)
Crash: INFO: task hung in path_openat (log)
Repro: C syz .config
  
Bug presence (2)
Date Name Commit Repro Result
2025/09/24 linux-6.6.y (ToT) af1544b5d072 C [report] INFO: task hung in path_openat
2025/09/24 upstream (ToT) cec1e6e5d1ab C Didn't crash
Similar bugs (19)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in path_openat 1 2 2276d 2308d 0/1 auto-closed as invalid on 2020/01/11 07:40
linux-6.1 INFO: task hung in path_openat (4) origin:upstream missing-backport 1 C 26 2d05h 397d 0/3 upstream: reported C repro on 2024/11/04 05:51
upstream INFO: task hung in path_openat (4) fuse 1 1 2046d 2046d 0/29 auto-closed as invalid on 2020/07/28 10:23
upstream INFO: task hung in path_openat (3) fs 1 4 2206d 2322d 0/29 auto-closed as invalid on 2020/02/19 20:16
linux-6.1 INFO: task hung in path_openat (2) 1 1 706d 706d 0/3 auto-obsoleted due to no activity on 2024/04/08 11:39
upstream INFO: task hung in path_openat (7) fs 1 C unreliable 4634 2d12h 1156d 0/29 upstream: reported C repro on 2022/10/06 10:29
linux-5.15 INFO: task hung in path_openat (2) missing-backport origin:upstream 1 C error 114 3d16h 601d 0/3 upstream: reported C repro on 2024/04/14 03:45
linux-4.19 INFO: task hung in path_openat (2) 1 1 1476d 1476d 0/1 auto-closed as invalid on 2022/03/21 04:47
linux-4.14 INFO: task hung in path_openat 1 1 1716d 1716d 0/1 auto-closed as invalid on 2021/07/23 23:26
android-49 INFO: task hung in path_openat 1 64 2446d 2427d 0/3 auto-closed as invalid on 2019/09/22 08:41
upstream INFO: task hung in path_openat (5) fs 1 23 1687d 1848d 0/29 auto-closed as invalid on 2021/07/22 20:44
linux-4.19 INFO: task hung in path_openat (3) f2fs jfs 1 20 1053d 1212d 0/1 upstream: reported on 2022/08/11 13:14
upstream INFO: task hung in path_openat (6) fs 1 13 1422d 1573d 0/29 closed as invalid on 2022/02/07 19:19
android-414 INFO: task hung in path_openat 1 42 2350d 2429d 0/1 auto-closed as invalid on 2019/10/28 21:04
linux-6.1 INFO: task hung in path_openat 1 3 874d 977d 0/3 auto-obsoleted due to no activity on 2023/10/23 12:08
linux-6.1 INFO: task hung in path_openat (3) 1 28 476d 600d 0/3 auto-obsoleted due to no activity on 2024/10/25 20:43
upstream INFO: task hung in path_openat exfat 1 246 2514d 2804d 0/29 closed as dup on 2018/09/08 15:37
linux-5.15 INFO: task hung in path_openat 1 C error 3 857d 969d 0/3 auto-obsoleted due to no activity on 2023/11/09 20:56
upstream INFO: task hung in path_openat (2) fs 1 1 2417d 2417d 0/29 closed as invalid on 2019/05/08 13:05
Fix bisection attempts (2)
Created Duration User Patch Repo Result
2025/11/24 09:06 2h38m fix candidate upstream OK (0) job log
2025/11/03 19:42 3h15m bisect fix linux-6.6.y OK (0) job log log

Sample crash report:
INFO: task syz.0.17:6017 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:28072 pid:6017  ppid:5904   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6832
 rwsem_down_read_slowpath+0x4f8/0x840 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1250 [inline]
 __down_read kernel/locking/rwsem.c:1263 [inline]
 down_read+0x98/0x2e0 kernel/locking/rwsem.c:1522
 inode_lock_shared include/linux/fs.h:814 [inline]
 open_last_lookups fs/namei.c:3555 [inline]
 path_openat+0x7b7/0x3190 fs/namei.c:3786
 do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
 do_open_execat+0x133/0x3d0 fs/exec.c:924
 bprm_execve+0x567/0x16f0 fs/exec.c:1867
 do_execveat_common+0x51b/0x6c0 fs/exec.c:1998
 do_execveat fs/exec.c:2083 [inline]
 __do_sys_execveat fs/exec.c:2157 [inline]
 __se_sys_execveat fs/exec.c:2151 [inline]
 __x64_sys_execveat+0xc4/0xe0 fs/exec.c:2151
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f4a1058eba9
RSP: 002b:00007f4a11472038 EFLAGS: 00000246 ORIG_RAX: 0000000000000142
RAX: ffffffffffffffda RBX: 00007f4a107d6090 RCX: 00007f4a1058eba9
RDX: 0000000000000000 RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007f4a10611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4a107d6128 R14: 00007f4a107d6090 R15: 00007ffd4d579588
 </TASK>
INFO: task syz.3.20:6023 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20        state:D stack:28072 pid:6023  ppid:5916   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6832
 rwsem_down_read_slowpath+0x4f8/0x840 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1250 [inline]
 __down_read kernel/locking/rwsem.c:1263 [inline]
 down_read+0x98/0x2e0 kernel/locking/rwsem.c:1522
 inode_lock_shared include/linux/fs.h:814 [inline]
 open_last_lookups fs/namei.c:3555 [inline]
 path_openat+0x7b7/0x3190 fs/namei.c:3786
 do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
 do_open_execat+0x133/0x3d0 fs/exec.c:924
 bprm_execve+0x567/0x16f0 fs/exec.c:1867
 do_execveat_common+0x51b/0x6c0 fs/exec.c:1998
 do_execveat fs/exec.c:2083 [inline]
 __do_sys_execveat fs/exec.c:2157 [inline]
 __se_sys_execveat fs/exec.c:2151 [inline]
 __x64_sys_execveat+0xc4/0xe0 fs/exec.c:2151
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f02ab38eba9
RSP: 002b:00007f02ac28f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000142
RAX: ffffffffffffffda RBX: 00007f02ab5d6090 RCX: 00007f02ab38eba9
RDX: 0000000000000000 RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007f02ab411e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f02ab5d6128 R14: 00007f02ab5d6090 R15: 00007ffd279a5368
 </TASK>
INFO: task syz.1.18:6024 blocked for more than 149 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18        state:D stack:28072 pid:6024  ppid:5908   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6832
 rwsem_down_read_slowpath+0x4f8/0x840 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1250 [inline]
 __down_read kernel/locking/rwsem.c:1263 [inline]
 down_read+0x98/0x2e0 kernel/locking/rwsem.c:1522
 inode_lock_shared include/linux/fs.h:814 [inline]
 open_last_lookups fs/namei.c:3555 [inline]
 path_openat+0x7b7/0x3190 fs/namei.c:3786
 do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
 do_open_execat+0x133/0x3d0 fs/exec.c:924
 bprm_execve+0x567/0x16f0 fs/exec.c:1867
 do_execveat_common+0x51b/0x6c0 fs/exec.c:1998
 do_execveat fs/exec.c:2083 [inline]
 __do_sys_execveat fs/exec.c:2157 [inline]
 __se_sys_execveat fs/exec.c:2151 [inline]
 __x64_sys_execveat+0xc4/0xe0 fs/exec.c:2151
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fce2f58eba9
RSP: 002b:00007fce303e4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000142
RAX: ffffffffffffffda RBX: 00007fce2f7d6090 RCX: 00007fce2f58eba9
RDX: 0000000000000000 RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007fce2f611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fce2f7d6128 R14: 00007fce2f7d6090 R15: 00007ffcd5122d68
 </TASK>

Showing all locks held in the system:
5 locks held by kworker/u4:1/12:
 #0: ffff8880b8f3c458 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:558
 #1: ffff8880b8f289c0 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:189 [inline]
 #1: ffff8880b8f289c0 (psi_seq){-.-.}-{0:0}, at: __schedule+0x20ee/0x44d0 kernel/sched/core.c:6694
 #2: ffffffff8cbcb210 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x12/0x20 kernel/jump_label.c:219
 #3: ffffffff9716c000 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x6c/0x4b0 lib/debugobjects.c:709
 #4: ffff8880b8e3c458 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:558
1 lock held by khungtaskd/29:
 #0: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by kworker/u4:2/40:
 #0: ffff888017871538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #0: ffff888017871538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #1: ffffc90000b0fd00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #1: ffffc90000b0fd00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
1 lock held by kswapd0/86:
2 locks held by getty/5549:
 #0: ffff88814c8840a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/16 05:12 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-6-kasan INFO: task hung in path_openat
2025/09/16 03:06 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-6-kasan INFO: task hung in path_openat
2025/09/16 00:59 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-6-kasan INFO: task hung in path_openat
2025/09/15 22:36 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-6-kasan INFO: task hung in path_openat
2025/09/15 20:29 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-6-kasan INFO: task hung in path_openat
2025/09/15 18:34 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-6-kasan INFO: task hung in path_openat
2025/09/15 16:25 linux-6.6.y 60a9e718726f e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in path_openat
* Struck through repros no longer work on HEAD.