syzbot


INFO: task hung in vfs_setxattr (2)

Status: auto-closed as invalid on 2020/07/28 17:13
Subsystems: fs
[Documentation on labels]
First crash: 1754d, last: 1754d
Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in vfs_setxattr (2) syz error 1 559d 559d 0/3 auto-obsoleted due to no activity on 2023/12/15 17:11
upstream INFO: task hung in vfs_setxattr (5) fs 1 275d 275d 0/28 auto-obsoleted due to no activity on 2024/09/15 03:42
android-49 INFO: task hung in vfs_setxattr 4 2411d 2437d 0/3 auto-closed as invalid on 2019/02/22 13:09
linux-5.15 INFO: task hung in vfs_setxattr (3) 1 324d 324d 0/3 auto-obsoleted due to no activity on 2024/08/06 16:46
upstream INFO: task hung in vfs_setxattr (3) fs syz done error 49 1227d 1645d 0/28 closed as invalid on 2022/02/08 10:51
upstream INFO: task hung in vfs_setxattr fs 46 2284d 2444d 0/28 auto-closed as invalid on 2019/06/15 01:37
linux-4.19 INFO: task hung in vfs_setxattr (2) C error 3 1257d 1537d 0/1 upstream: reported C repro on 2021/01/01 10:53
android-414 INFO: task hung in vfs_setxattr 1 2160d 2160d 0/1 auto-closed as invalid on 2019/10/16 16:43
linux-5.15 INFO: task hung in vfs_setxattr 1 710d 710d 0/3 auto-obsoleted due to no activity on 2023/08/06 19:50
upstream INFO: task hung in vfs_setxattr (4) ext4 1 623d 623d 0/28 auto-obsoleted due to no activity on 2023/10/02 09:30
linux-4.19 INFO: task hung in vfs_setxattr 3 1956d 2018d 0/1 auto-closed as invalid on 2020/03/08 20:30
android-44 INFO: task hung in vfs_setxattr C 3 2035d 2040d 0/2 public: reported C repro on 2019/08/17 15:36

Sample crash report:
INFO: task syz-executor.2:8201 blocked for more than 143 seconds.
      Not tainted 5.7.0-rc7-next-20200529-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D29608  8201   7044 0x00000000
Call Trace:
 context_switch kernel/sched/core.c:3430 [inline]
 __schedule+0x8f3/0x1f80 kernel/sched/core.c:4155
 schedule+0xd0/0x2a0 kernel/sched/core.c:4230
 rwsem_down_write_slowpath+0x6f0/0xf90 kernel/locking/rwsem.c:1235
 __down_write kernel/locking/rwsem.c:1389 [inline]
 down_write+0x137/0x150 kernel/locking/rwsem.c:1532
 inode_lock include/linux/fs.h:809 [inline]
 vfs_setxattr+0x92/0xf0 fs/xattr.c:219
 setxattr+0x23d/0x330 fs/xattr.c:451
 path_setxattr+0x170/0x190 fs/xattr.c:470
 __do_sys_lsetxattr fs/xattr.c:492 [inline]
 __se_sys_lsetxattr fs/xattr.c:488 [inline]
 __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:488
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45ca69
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f336c8e8c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 00000000004f5940 RCX: 000000000045ca69
RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000020000000
RBP: 000000000078c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 000000000000072b R14: 00000000004d5638 R15: 00007f336c8e96d4

Showing all locks held in the system:
2 locks held by kworker/u4:1/21:
4 locks held by kworker/u4:8/408:
1 lock held by khungtaskd/1138:
 #0: ffffffff89bbde00 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:5779
3 locks held by kworker/0:7/2664:
 #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline]
 #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline]
 #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x844/0x1690 kernel/workqueue.c:2239
 #1: ffffc90008ad7dc0 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x878/0x1690 kernel/workqueue.c:2243
 #2: ffffffff8a7b06a8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:74
1 lock held by in:imklog/6545:
 #0: ffff88809e0f66b0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:826
2 locks held by syz-executor.2/8181:
 #0: ffff88805eb1c450 (sb_writers#14){.+.+}-{0:0}, at: sb_start_write include/linux/fs.h:1683 [inline]
 #0: ffff88805eb1c450 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x3a/0xb0 fs/namespace.c:368
 #1: ffff8880629a07d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:809 [inline]
 #1: ffff8880629a07d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: vfs_setxattr+0x92/0xf0 fs/xattr.c:219
2 locks held by syz-executor.2/8201:
 #0: ffff88805eb1c450 (sb_writers#14){.+.+}-{0:0}, at: sb_start_write include/linux/fs.h:1683 [inline]
 #0: ffff88805eb1c450 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x3a/0xb0 fs/namespace.c:368
 #1: ffff8880629a07d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:809 [inline]
 #1: ffff8880629a07d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: vfs_setxattr+0x92/0xf0 fs/xattr.c:219

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1138 Comm: khungtaskd Not tainted 5.7.0-rc7-next-20200529-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1e6/0x221 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:147 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:253 [inline]
 watchdog+0xf97/0x14e0 kernel/hung_task.c:339
 kthread+0x3b5/0x4a0 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3920 Comm: systemd-journal Not tainted 5.7.0-rc7-next-20200529-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:lock_acquire+0x282/0x8f0 kernel/locking/lockdep.c:4931
Code: 5b 08 00 0f 84 62 04 00 00 48 8b 3c 24 57 9d 0f 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 03 44 24 08 48 c7 00 00 00 00 00 <48> c7 40 08 00 00 00 00 48 8b 84 24 b8 00 00 00 65 48 33 04 25 28
RSP: 0018:ffffc90001077a98 EFLAGS: 00000082
RAX: fffff5200020ef57 RBX: ffff88809400a240 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 0000000000000082
RBP: 0000000000000000 R08: 0000000000000001 R09: fffffbfff18b1145
R10: ffffffff8c588a27 R11: fffffbfff18b1144 R12: 0000000000000000
R13: ffffffff8cae6d38 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f28aff058c0(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f28ad2dd000 CR3: 0000000094066000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
 __debug_check_no_obj_freed lib/debugobjects.c:955 [inline]
 debug_check_no_obj_freed+0xc8/0x449 lib/debugobjects.c:998
 free_pages_prepare mm/page_alloc.c:1218 [inline]
 __free_pages_ok+0x253/0xfa0 mm/page_alloc.c:1470
 slab_destroy+0x14/0x40 mm/slab.c:1620
 slabs_destroy+0x6a/0x90 mm/slab.c:1636
 cache_flusharray mm/slab.c:3413 [inline]
 ___cache_free+0x29f/0x3a0 mm/slab.c:3457
 qlink_free mm/kasan/quarantine.c:148 [inline]
 qlist_free_all+0x79/0x140 mm/kasan/quarantine.c:167
 quarantine_reduce+0x135/0x170 mm/kasan/quarantine.c:260
 __kasan_kmalloc.constprop.0+0x97/0xd0 mm/kasan/common.c:475
 slab_post_alloc_hook mm/slab.h:586 [inline]
 slab_alloc mm/slab.c:3320 [inline]
 kmem_cache_alloc+0x11b/0x740 mm/slab.c:3484
 prepare_creds+0x39/0x6b0 kernel/cred.c:258
 access_override_creds fs/open.c:353 [inline]
 do_faccessat+0x3da/0x830 fs/open.c:417
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f28af1c19c7
Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe018ef878 EFLAGS: 00000246 ORIG_RAX: 0000000000000015
RAX: ffffffffffffffda RBX: 00007ffe018f2790 RCX: 00007f28af1c19c7
RDX: 00007f28afc32a00 RSI: 0000000000000000 RDI: 000055c2a2ad69a3
RBP: 00007ffe018ef8b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ffe018f2790 R15: 00007ffe018efda0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/29 17:04 linux-next e7b08814b16b 3905eaae .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.