syzbot


INFO: task hung in do_exit

Status: public: reported syz repro on 2019/04/14 09:28
Reported-by: syzbot+f321b2782ec644debe61@syzkaller.appspotmail.com
First crash: 1975d, last: 1600d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in do_exit syz done error 125 762d 1785d 0/26 closed as invalid on 2022/02/08 10:54
linux-4.14 INFO: task hung in do_exit syz inconclusive 8 758d 1773d 0/1 upstream: reported syz repro on 2019/04/25 02:28
android-414 INFO: task hung in do_exit syz 19 1553d 1785d 0/1 public: reported syz repro on 2019/04/13 00:01
linux-4.19 INFO: task hung in do_exit C error 58 390d 1778d 0/1 upstream: reported C repro on 2019/04/19 20:32
upstream INFO: task can't die in show_free_areas serial C error 41 3d01h 767d 0/26 upstream: reported C repro on 2022/01/24 13:23

Sample crash report:
INFO: task syz-executor.2:28429 blocked for more than 140 seconds.
      Not tainted 4.9.189+ #20
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D28736 28429   2081 0x80000000
 0000000000000083 ffff8801c86917c0 ffff8801d4148000 ffff8801db621000
 ffff8801c733df00 ffff8801db621018 ffff8801d848fba0 ffffffff828176ae
 0000000041b58ab3 ffff8801c86917c0 00ff8801d848faf0 ffff8801db6218f0
Call Trace:
 [<00000000df82ac85>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
 [<00000000e0fa49b9>] rwsem_down_read_failed+0x258/0x3e0 kernel/locking/rwsem-xadd.c:283
 [<000000009467b7a2>] call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
 [<000000003932bb06>] __down_read arch/x86/include/asm/rwsem.h:65 [inline]
 [<000000003932bb06>] down_read+0x52/0xb0 kernel/locking/rwsem.c:24
 [<00000000e0c5ec88>] exit_mm kernel/exit.c:480 [inline]
 [<00000000e0c5ec88>] do_exit+0x3b7/0x2aa0 kernel/exit.c:828
 [<0000000053005bb0>] do_group_exit+0x111/0x300 kernel/exit.c:945
 [<0000000047e2aaa0>] SYSC_exit_group kernel/exit.c:956 [inline]
 [<0000000047e2aaa0>] SyS_exit_group+0x1d/0x20 kernel/exit.c:954
 [<000000003794ab50>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<00000000b41b43fc>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<0000000031cc86aa>] check_hung_uninterruptible_tasks kernel/hung_task.c:169 [inline]
 #0:  (rcu_read_lock){......}, at: [<0000000031cc86aa>] watchdog+0x14b/0xaf0 kernel/hung_task.c:263
 #1:  (tasklist_lock){.+.+..}, at: [<0000000014ecd20f>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4336
2 locks held by getty/2033:
 #0:  (&tty->ldisc_sem){++++++}, at: [<000000005bdacfdd>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
 #1:  (&ldata->atomic_read_lock){+.+.+.}, at: [<00000000ecd39b4b>] n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
1 lock held by syz-executor.2/28429:
 #0:  (&mm->mmap_sem){++++++}, at: [<00000000e0c5ec88>] exit_mm kernel/exit.c:480 [inline]
 #0:  (&mm->mmap_sem){++++++}, at: [<00000000e0c5ec88>] do_exit+0x3b7/0x2aa0 kernel/exit.c:828
1 lock held by syz-executor.2/28436:
 #0:  (&mm->mmap_sem){++++++}, at: [<00000000e0c5ec88>] exit_mm kernel/exit.c:480 [inline]
 #0:  (&mm->mmap_sem){++++++}, at: [<00000000e0c5ec88>] do_exit+0x3b7/0x2aa0 kernel/exit.c:828

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.189+ #20
 ffff8801d98d7cc8 ffffffff81b64a91 0000000000000001 0000000000000000
 0000000000000001 ffffffff81099a01 dffffc0000000000 ffff8801d98d7d00
 ffffffff81b6fd2c 0000000000000001 0000000000000000 0000000000000001
Call Trace:
 [<000000005cd85f74>] __dump_stack lib/dump_stack.c:15 [inline]
 [<000000005cd85f74>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<000000007183f431>] nmi_cpu_backtrace.cold+0x47/0x87 lib/nmi_backtrace.c:99
 [<00000000051862b1>] nmi_trigger_cpumask_backtrace+0x124/0x155 lib/nmi_backtrace.c:60
 [<000000009836f9e5>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<000000004e384a25>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<000000004e384a25>] check_hung_task kernel/hung_task.c:126 [inline]
 [<000000004e384a25>] check_hung_uninterruptible_tasks kernel/hung_task.c:183 [inline]
 [<000000004e384a25>] watchdog+0x670/0xaf0 kernel/hung_task.c:263
 [<000000005b3e8634>] kthread+0x278/0x310 kernel/kthread.c:211
 [<000000008ffbdb5d>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 28446 Comm: syz-executor.2 Not tainted 4.9.189+ #20
task: 00000000adfb916d task.stack: 00000000e18836a8
RIP: 0010:[<ffffffff8120797e>] c [<0000000024a4219d>] lock_is_held+0x3e/0x140 kernel/locking/lockdep.c:3787
RSP: 0018:ffff8801d9e07a98  EFLAGS: 00000202
RAX: 0000000000000007 RBX: ffff8801ca0f17c0 RCX: 1ffffffff063fb70
RDX: 0000000000000000 RSI: 000000000000026c RDI: ffff8801ca0f206c
RBP: ffff8801d9e07ab0 R08: 0000000000000000 R09: ffff8801ca0f2090
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff830d5820
R13: 000000000000026c R14: 0000000000000000 R15: ffff8801ca0ecf60
FS:  00007fe9d848f700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000014fad58 CR3: 00000001d5387000 CR4: 00000000001606b0
Stack:
 0000000000000000c ffffffff82a51c00c 000000000000026cc ffff8801d9e07ae8c
 ffffffff8116a3eac ffff8801ca0f17c0c ffffffff82a51c00c 000000000000026cc
 0000000000000000c ffff8801ca0ecf60c ffff8801d9e07b28c ffffffff8116a535c
Call Trace:
 [<00000000df5676d0>] ___might_sleep+0x1ca/0x280 kernel/sched/core.c:7970
 [<000000004ea821df>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7961
 [<0000000060c967dd>] mutex_lock_nested+0x87/0x920 kernel/locking/mutex.c:620
 [<00000000db95eb55>] perf_mmap+0x4d9/0x1580 kernel/events/core.c:5278
 [<00000000ec01e64a>] mmap_region+0x7e7/0xfa0 mm/mmap.c:1726
 [<00000000206edc12>] do_mmap+0x539/0xbc0 mm/mmap.c:1505
 [<00000000f249f2dc>] do_mmap_pgoff include/linux/mm.h:2071 [inline]
 [<00000000f249f2dc>] vm_mmap_pgoff+0x179/0x1c0 mm/util.c:329
 [<00000000e75288cd>] SYSC_mmap_pgoff mm/mmap.c:1555 [inline]
 [<00000000e75288cd>] SyS_mmap_pgoff+0xfa/0x1b0 mm/mmap.c:1513
 [<000000008e3ff629>] SYSC_mmap arch/x86/kernel/sys_x86_64.c:96 [inline]
 [<000000008e3ff629>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:87
 [<000000003794ab50>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<00000000b41b43fc>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: c89 cfc c53 c65 c48 c8b c1c c25 c00 c7e c01 c00 c48 c8d cbb cac c08 c00 c00 c48 c89 cfa c48 cc1 cea c03 c0f cb6 c14 c02 c48 c89 cf8 c83 ce0 c07 c83 cc0 c03 c38 cd0 c7c c08 c<84> cd2 c0f c85 cd4 c00 c00 c00 c8b c83 cac c08 c00 c00 c85 cc0 c0f c85 cb6 c00 c00 c

Crashes (18):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/12 16:48 https://android.googlesource.com/kernel/common android-4.9 2970e785e9bf acb51638 .config console log report syz ci-android-49-kasan-gce-root
2019/07/27 22:32 https://android.googlesource.com/kernel/common android-4.9 3244efed0310 c85e1c5b .config console log report syz ci-android-49-kasan-gce-root
2019/06/27 05:56 https://android.googlesource.com/kernel/common android-4.9 a80a7ab5f7c3 7509bf36 .config console log report syz ci-android-49-kasan-gce-root
2019/06/08 11:12 https://android.googlesource.com/kernel/common android-4.9 83ae225d5ce3 cf9c3a50 .config console log report syz ci-android-49-kasan-gce-root
2019/04/21 17:45 https://android.googlesource.com/kernel/common android-4.9 1ef64dae6217 b0e8efcb .config console log report syz ci-android-49-kasan-gce-root
2019/04/13 07:11 https://android.googlesource.com/kernel/common android-4.9 fc67a895f0a5 c402d8f1 .config console log report syz ci-android-49-kasan-gce-root
2018/10/11 09:49 https://android.googlesource.com/kernel/common android-4.9 38f2b4a8c277 5f818b4b .config console log report syz ci-android-49-kasan-gce-root
2019/10/15 08:40 https://android.googlesource.com/kernel/common android-4.9 7fe05eede1c8 05ad7292 .config console log report ci-android-49-kasan-gce-root
2019/04/07 11:02 https://android.googlesource.com/kernel/common android-4.9 286f971000f1 c34fde03 .config console log report ci-android-49-kasan-gce-root
2018/12/19 09:09 https://android.googlesource.com/kernel/common android-4.9 2ca7ab11eb36 4edaba93 .config console log report ci-android-49-kasan-gce-root
2018/11/24 02:31 https://android.googlesource.com/kernel/common android-4.9 f44ed2c9232d eb9ed731 .config console log report ci-android-49-kasan-gce-root
2018/10/26 20:18 https://android.googlesource.com/kernel/common android-4.9 322089173588 a8292de9 .config console log report ci-android-49-kasan-gce-root
2018/10/18 12:52 https://android.googlesource.com/kernel/common android-4.9 3917c4a8adcc d257b2d2 .config console log report ci-android-49-kasan-gce-root
2018/10/14 22:19 https://android.googlesource.com/kernel/common android-4.9 d589c0d40671 caf12900 .config console log report ci-android-49-kasan-gce-root
2018/10/09 14:12 https://android.googlesource.com/kernel/common android-4.9 7bebf33f9d46 8b311eaf .config console log report ci-android-49-kasan-gce-root
2018/10/08 06:13 https://android.googlesource.com/kernel/common android-4.9 7bebf33f9d46 8b311eaf .config console log report ci-android-49-kasan-gce-root
2018/10/05 20:13 https://android.googlesource.com/kernel/common android-4.9 7bebf33f9d46 8b311eaf .config console log report ci-android-49-kasan-gce-root
2018/10/04 23:23 https://android.googlesource.com/kernel/common android-4.9 713657425a18 8b311eaf .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.