syzbot


INFO: task hung in blkdev_issue_flush (2)

Status: fixed on 2020/06/30 18:57
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+e7624af9c1ef3b617512@syzkaller.appspotmail.com
Fix commit: 2b5c8f0063e4 nbd: replace kill_bdev() with __invalidate_device() again
First crash: 1969d, last: 1810d
Cause bisection: introduced by (bisect log) :
commit a32e236eb93e62a0f692e79b7c3c9636689559b9
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Fri Aug 3 19:22:09 2018 +0000

  Partially revert "block: fail op_is_write() requests to read-only partitions"

Crash: WARNING in generic_make_request_checks (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
Discussions (2)
Title Replies (including bot) Last reply
Reminder: 11 open syzbot bugs in block subsystem 1 (1) 2019/07/24 02:26
INFO: task hung in blkdev_issue_flush (2) 1 (2) 2019/07/02 16:01
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 INFO: task hung in blkdev_issue_flush 7 2328d 2439d 0/2 auto-closed as invalid on 2019/02/22 12:34
linux-4.19 INFO: task hung in blkdev_issue_flush C done 2 1969d 1969d 1/1 fixed on 2019/12/02 18:09
android-414 INFO: task hung in blkdev_issue_flush 1 1921d 1921d 0/1 auto-closed as invalid on 2019/12/17 04:03
android-49 INFO: task hung in blkdev_issue_flush 63 2322d 2458d 0/3 auto-closed as invalid on 2019/02/22 14:39
upstream INFO: task hung in blkdev_issue_flush block 12 2107d 2410d 0/28 closed as dup on 2019/02/16 05:19
Fix bisection attempts (2)
Created Duration User Patch Repo Result
2020/01/07 14:43 16m bisect fix upstream error job log
2019/12/08 05:04 25m bisect fix upstream OK (0) job log log

Sample crash report:
INFO: task syz-executor181:9127 blocked for more than 143 seconds.
      Not tainted 5.2.0-rc7 #39
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor181 D28528  9127   9124 0x00004004
Call Trace:
 context_switch kernel/sched/core.c:2818 [inline]
 __schedule+0x7cb/0x1560 kernel/sched/core.c:3445
 schedule+0xa8/0x260 kernel/sched/core.c:3509
 schedule_timeout+0x717/0xc50 kernel/time/timer.c:1783
 io_schedule_timeout+0x26/0x80 kernel/sched/core.c:5119
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common_io kernel/sched/completion.c:121 [inline]
 wait_for_completion_io+0x29c/0x440 kernel/sched/completion.c:169
 submit_bio_wait+0x11d/0x1c0 block/bio.c:1003
 blkdev_issue_flush+0x20d/0x300 block/blk-flush.c:449
 blkdev_fsync+0x95/0xd0 fs/block_dev.c:687
 vfs_fsync_range+0x141/0x230 fs/sync.c:197
 vfs_fsync fs/sync.c:211 [inline]
 do_fsync+0x54/0xa0 fs/sync.c:221
 __do_sys_fdatasync fs/sync.c:234 [inline]
 __se_sys_fdatasync fs/sync.c:232 [inline]
 __x64_sys_fdatasync+0x36/0x50 fs/sync.c:232
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x449ee9
Code: Bad RIP value.
RSP: 002b:00007f9585dc5ce8 EFLAGS: 00000246 ORIG_RAX: 000000000000004b
RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 0000000000449ee9
RDX: 0000000000449ee9 RSI: 0000000000000000 RDI: 0000000000000009
RBP: 00000000006dbc50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc5c
R13: 00007ffdff9c94cf R14: 00007f9585dc69c0 R15: 000000000000002d

Showing all locks held in the system:
1 lock held by khungtaskd/1042:
 #0: 00000000157a165b (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:5149
1 lock held by rsyslogd/8974:
 #0: 00000000b79d448d (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801
2 locks held by getty/9096:
 #0: 00000000828483d0 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000056df9ec9 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/9097:
 #0: 00000000d2c80559 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000f827a46b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/9098:
 #0: 0000000059cdb01f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000068caf1a6 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/9099:
 #0: 00000000c35eb1b4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000030d85cd9 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/9100:
 #0: 0000000027e907f0 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000540edcb4 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/9101:
 #0: 000000004f6f958d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000956fe3e2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/9102:
 #0: 000000003d70fbd4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000f02db2a4 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 5.2.0-rc7 #39
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
 watchdog+0x9b7/0xec0 kernel/hung_task.c:289
 kthread+0x354/0x420 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/02 08:14 upstream 6fbc7275c7a9 cccc4302 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/07/02 08:05 upstream 6fbc7275c7a9 cccc4302 .config console log report syz C ci-upstream-kasan-gce-root
2019/07/08 11:16 linux-next f9ca7f5a1eb9 f62e1e85 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.