syzbot


INFO: task hung in _raw_spin_unlock

Status: auto-closed as invalid on 2019/02/22 12:31
First crash: 2141d, last: 2141d

Sample crash report:
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
INFO: task syz-executor0:3889 blocked for more than 120 seconds.
device loop0 blocksize: 4096
      Not tainted 4.9.107-gdb2c520 #46
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
__find_get_block_slow() failed. block=1, b_blocknr=8
syz-executor0   D
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
28024  3889      1 0x00000004
 ffff8801d868c800
__find_get_block_slow() failed. block=1, b_blocknr=8
 ffff8801cd451a40b_state=0x00000029, b_size=512
 ffff8801d8576f40device loop0 blocksize: 4096
 ffff8801cb91b000
__find_get_block_slow() failed. block=1, b_blocknr=8
 ffff88018a2e7b40b_state=0x00000029, b_size=512
 ffffffff839e8c1ddevice loop0 blocksize: 4096
 0000000000000002
__find_get_block_slow() failed. block=1, b_blocknr=8
 ffffffff843b9ea3b_state=0x00000029, b_size=512
 00ffffff81221500device loop0 blocksize: 4096
 ffff8801db3224e8
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
 [<ffffffff839ea21f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3557
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff81602a49>] wb_wait_for_completion+0x149/0x1b0 fs/fs-writeback.c:221
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff81602cb7>] __writeback_inodes_sb_nr+0x207/0x300 fs/fs-writeback.c:2310
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
 [<ffffffff81602e07>] writeback_inodes_sb_nr fs/fs-writeback.c:2327 [inline]
 [<ffffffff81602e07>] writeback_inodes_sb+0x27/0x30 fs/fs-writeback.c:2342
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff8161a9c3>] __sync_filesystem fs/sync.c:35 [inline]
 [<ffffffff8161a9c3>] sync_filesystem+0x93/0x240 fs/sync.c:63
b_state=0x00000029, b_size=512
 [<ffffffff81579455>] generic_shutdown_super+0x75/0x300 fs/super.c:423
device loop0 blocksize: 4096
 [<ffffffff81579d8f>] kill_block_super+0x9f/0x120 fs/super.c:1127
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff8157a105>] deactivate_locked_super+0x75/0xd0 fs/super.c:310
b_state=0x00000029, b_size=512
 [<ffffffff8157ab11>] deactivate_super+0x91/0xd0 fs/super.c:341
device loop0 blocksize: 4096
 [<ffffffff815dce52>] cleanup_mnt+0xb2/0x160 fs/namespace.c:1134
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff815dcf86>] __cleanup_mnt+0x16/0x20 fs/namespace.c:1141
b_state=0x00000029, b_size=512
 [<ffffffff8119832c>] task_work_run+0x10c/0x180 kernel/task_work.c:116
device loop0 blocksize: 4096
 [<ffffffff8100559c>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff8100559c>] exit_to_usermode_loop+0xfc/0x120 arch/x86/entry/common.c:161
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff810064d4>] prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
 [<ffffffff810064d4>] syscall_return_slowpath arch/x86/entry/common.c:260 [inline]
 [<ffffffff810064d4>] do_syscall_64+0x364/0x490 arch/x86/entry/common.c:287
b_state=0x00000029, b_size=512
 [<ffffffff839f9b13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
device loop0 blocksize: 4096

Showing all locks held in the system:
__find_get_block_slow() failed. block=1, b_blocknr=8
2 locks held by khungtaskd/519:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (rcu_read_lock__find_get_block_slow() failed. block=1, b_blocknr=8
){......}b_state=0x00000029, b_size=512
, at: [<ffffffff8136662c>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
, at: [<ffffffff8136662c>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock
__find_get_block_slow() failed. block=1, b_blocknr=8
){.+.+..}b_state=0x00000029, b_size=512
, at: [<ffffffff81425cb7>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
__find_get_block_slow() failed. block=1, b_blocknr=8
1 lock held by rsyslogd/3676:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (&f->f_pos_lock){+.+.+.}__find_get_block_slow() failed. block=1, b_blocknr=8
, at: [<ffffffff815d7fac>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/3772:
device loop0 blocksize: 4096
 #0:  (&tty->ldisc_sem
__find_get_block_slow() failed. block=1, b_blocknr=8
){++++++}b_state=0x00000029, b_size=512
, at: [<ffffffff839f7cc2>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock
__find_get_block_slow() failed. block=1, b_blocknr=8
){+.+...}b_state=0x00000029, b_size=512
, at: [<ffffffff8211fc62>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2133
1 lock held by syz-executor0/3889:
 #0: 
__find_get_block_slow() failed. block=1, b_blocknr=8
 (b_state=0x00000029, b_size=512
&type->s_umount_keydevice loop0 blocksize: 4096
#50){+.+...}, at: [<ffffffff8157ab09>] deactivate_super+0x89/0xd0 fs/super.c:340
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096

=============================================

__find_get_block_slow() failed. block=1, b_blocknr=8
NMI backtrace for cpu 1
b_state=0x00000029, b_size=512
CPU: 1 PID: 519 Comm: khungtaskd Not tainted 4.9.107-gdb2c520 #46
device loop0 blocksize: 4096
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d8697d08
__find_get_block_slow() failed. block=1, b_blocknr=8
 ffffffff81eb3da9b_state=0x00000029, b_size=512
 0000000000000000device loop0 blocksize: 4096
 0000000000000001
__find_get_block_slow() failed. block=1, b_blocknr=8
 0000000000000001b_state=0x00000029, b_size=512
 ffffffff810b96a0device loop0 blocksize: 4096
 ffff8801d8697d40
__find_get_block_slow() failed. block=1, b_blocknr=8
 0000000000000001b_state=0x00000029, b_size=512
 0000000000000000device loop0 blocksize: 4096
 0000000000000003
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff81eb3da9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb3da9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
 [<ffffffff81ebf0a7>] nmi_cpu_backtrace.cold.2+0x48/0x87 lib/nmi_backtrace.c:99
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 [<ffffffff81ebf03a>] nmi_trigger_cpumask_backtrace+0x12a/0x14f lib/nmi_backtrace.c:60
device loop0 blocksize: 4096
 [<ffffffff810b97a4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff81366bc4>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff81366bc4>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff81366bc4>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff81366bc4>] watchdog+0x6b4/0xa20 kernel/hung_task.c:239
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
 [<ffffffff8119d04d>] kthread+0x26d/0x300 kernel/kthread.c:211
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 [<ffffffff839f9cdc>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
device loop0 blocksize: 4096
Sending NMI from CPU 1 to CPUs 0:
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
NMI backtrace for cpu 0
CPU: 0 PID: 4173 Comm: kworker/u4:4 Not tainted 4.9.107-gdb2c520 #46
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfnc (flush-7:0)c
task: ffff8801cfef8000 task.stack: ffff880181698000
RIP: 0010:[<ffffffff811bb236>] c [<ffffffff811bb236>] __preempt_count_sub arch/x86/include/asm/preempt.h:74 [inline]
RIP: 0010:[<ffffffff811bb236>] c [<ffffffff811bb236>] preempt_count_sub+0x66/0x160 kernel/sched/core.c:3285
RSP: 0018:ffff88018169f3e8  EFLAGS: 00000093
RAX: 0000000080000002 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000001 RDI: ffffffff85b2d700
RBP: ffff88018169f3f0 R08: fffffbfff0b5efed R09: ffffffff85af7f66
R10: 0000000000000001 R11: ffffffff85af7f67 R12: 000000000000001e
R13: 000000000000001e R14: 0000000000000002 R15: ffffffff85aec6a0
FS:  0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e2380e000 CR3: 00000001cda5b000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff846d79e0c ffff88018169f408c ffffffff839f915cc 0000000000000004c
 ffff88018169f498c ffffffff8125f3b1c ffffffff85aec6a0c ffff88010000001ec
 ffff8801cfef8000c ffffed0039fdf118c ffff8801cfef88c8c ffffffff846defa0c
Call Trace:
 [<ffffffff839f915c>] __raw_spin_unlock include/linux/spinlock_api_smp.h:154 [inline]
 [<ffffffff839f915c>] _raw_spin_unlock+0x2c/0x50 kernel/locking/spinlock.c:183
 [<ffffffff8125f3b1>] vprintk_emit+0x241/0x790 kernel/printk/printk.c:1890
 [<ffffffff8125f928>] vprintk+0x28/0x30 kernel/printk/printk.c:1913
 [<ffffffff8125f94d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1914
 [<ffffffff8142ca8c>] vprintk_func kernel/printk/internal.h:36 [inline]
 [<ffffffff8142ca8c>] printk+0xaf/0xd7 kernel/printk/printk.c:1975
 [<ffffffff81cba355>] __find_get_block_slow.cold.57+0x82/0xf0 fs/buffer.c:242
 [<ffffffff8162434e>] __find_get_block+0x23e/0x4c0 fs/buffer.c:1360
 [<ffffffff81625159>] __getblk_slow fs/buffer.c:1101 [inline]
 [<ffffffff81625159>] __getblk_gfp+0x189/0x710 fs/buffer.c:1386
 [<ffffffff81628afd>] __bread_gfp+0x2d/0x270 fs/buffer.c:1420
 [<ffffffff818cba4b>] sb_bread include/linux/buffer_head.h:300 [inline]
 [<ffffffff818cba4b>] __fat_write_inode+0x2ab/0x980 fs/fat/inode.c:844
 [<ffffffff818cfc59>] fat_write_inode+0x79/0x170 fs/fat/inode.c:893
 [<ffffffff8160214d>] write_inode fs/fs-writeback.c:1180 [inline]
 [<ffffffff8160214d>] __writeback_single_inode+0x86d/0x1020 fs/fs-writeback.c:1379
 [<ffffffff8160344c>] writeback_sb_inodes+0x4ac/0xe70 fs/fs-writeback.c:1584
 [<ffffffff8160444f>] wb_writeback+0x2cf/0xbd0 fs/fs-writeback.c:1760
 [<ffffffff8160d97e>] wb_do_writeback fs/fs-writeback.c:1894 [inline]
 [<ffffffff8160d97e>] wb_workfn+0x20e/0xdb0 fs/fs-writeback.c:1930
 [<ffffffff8118d121>] process_one_work+0x7e1/0x1500 kernel/workqueue.c:2092
 [<ffffffff8118df16>] worker_thread+0xd6/0x10a0 kernel/workqueue.c:2226
 [<ffffffff8119d04d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff839f9cdc>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Code: c24 c97 c04 c85 cc9 c75 c1b c65 c8b c05 c37 ccb ce5 c7e c89 cc2 c81 ce2 cff cff cff c7f c39 cd3 c7f c14 c81 cfb cfe c00 c00 c00 c76 c71 cf7 cdb c65 c01 c1d c1a ccb ce5 c7e c<5b> c5d cc3 ce8 c12 cf1 cd2 c00 c85 cc0 c74 cf4 c48 cc7 cc7 c80 c29 cb9 c85 c48 cb8 c
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/10 11:39 https://android.googlesource.com/kernel/common android-4.9 db2c520bb56b 866118af .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.