syzbot


INFO: task hung in cleanup_net (2)

Status: closed as invalid on 2019/05/08 13:05
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 1209d, last: 1208d
similar bugs (10):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 INFO: task hung in cleanup_net 10 1162d 1204d 0/2 auto-closed as invalid on 2019/10/25 08:38
upstream INFO: task hung in cleanup_net 1 1713d 1701d 3/23 fixed on 2018/01/03 02:35
linux-4.19 INFO: task hung in cleanup_net 1 827d 827d 0/1 auto-closed as invalid on 2020/09/08 00:00
linux-4.14 INFO: task hung in cleanup_net C inconclusive 23 215d 1221d 0/1 upstream: reported C repro on 2019/04/13 10:16
upstream INFO: task hung in cleanup_net (3) 1 1143d 1143d 0/23 auto-closed as invalid on 2019/10/25 14:21
android-49 INFO: task hung in cleanup_net 4 1212d 1220d 0/3 auto-closed as invalid on 2019/10/18 21:44
upstream INFO: task hung in cleanup_net (4) 2 727d 731d 0/23 auto-closed as invalid on 2020/11/17 15:39
android-414 INFO: task hung in cleanup_net C 45 1081d 1223d 0/1 public: reported C repro on 2019/04/11 00:00
android-49 INFO: task hung in cleanup_net (2) 1 996d 996d 0/3 auto-closed as invalid on 2020/03/23 02:35
upstream INFO: task hung in cleanup_net (5) 3 453d 499d 0/23 auto-closed as invalid on 2021/09/03 11:33

Sample crash report:
INFO: task kworker/u4:5:7827 blocked for more than 143 seconds.
      Not tainted 5.1.0-rc6+ #84
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:5    D24728  7827      2 0x80000000
Workqueue: netns cleanup_net
Call Trace:
 context_switch kernel/sched/core.c:2877 [inline]
 __schedule+0x813/0x1cc0 kernel/sched/core.c:3518
 schedule+0x92/0x180 kernel/sched/core.c:3562
 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:285 [inline]
 rwsem_down_read_failed+0x213/0x420 kernel/locking/rwsem-xadd.c:302
 call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
 __down_read arch/x86/include/asm/rwsem.h:83 [inline]
 down_read+0x49/0x90 kernel/locking/rwsem.c:26
 cleanup_net+0xae/0x960 net/core/net_namespace.c:519
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2269
 worker_thread+0x98/0xe40 kernel/workqueue.c:2415
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
INFO: task syz-executor.3:28835 blocked for more than 143 seconds.
      Not tainted 5.1.0-rc6+ #84
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.3  D28384 28835   7586 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2877 [inline]
 __schedule+0x813/0x1cc0 kernel/sched/core.c:3518
 schedule+0x92/0x180 kernel/sched/core.c:3562
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:582 [inline]
 rwsem_down_write_failed+0x774/0xc30 kernel/locking/rwsem-xadd.c:611
 call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
 __down_write arch/x86/include/asm/rwsem.h:142 [inline]
 down_write+0x53/0x90 kernel/locking/rwsem.c:72
 unregister_netdevice_notifier+0x7e/0x3a0 net/core/dev.c:1717
 raw_release+0x57/0x6f0 net/can/raw.c:358
 __sock_release+0xd3/0x2b0 net/socket.c:599
 sock_close+0x1b/0x30 net/socket.c:1247
 __fput+0x2e5/0x8d0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x14a/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x412b51
Code: 35 01 84 c0 0f 84 bd 02 00 00 48 85 d2 0f 85 33 01 00 00 64 48 8b 04 25 f8 ff ff ff 48 8b 40 30 48 8b 80 98 00 00 00 48 85 c0 <74> 15 48 8b 08 48 39 d1 77 0d 48 8b 40 08 48 39 c2 0f 82 fb 00 00
RSP: 002b:00007ffd8e03d6d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000412b51
RDX: 0000000000000001 RSI: 0000000000000002 RDI: 0000000000000003
RBP: 0000000000000000 R08: ffffffffffffffff R09: ffffffffffffffff
R10: 00007ffd8e03d7b0 R11: 0000000000000293 R12: 0000000000741b80
R13: 0000000000138272 R14: 000000000013829f R15: 000000000073c04c

Showing all locks held in the system:
1 lock held by khungtaskd/1042:
 #0: 00000000d5a31a85 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:5057
2 locks held by rsyslogd/7452:
 #0: 00000000b1322f95 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801
 #1: 00000000654cec32 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1168 [inline]
 #1: 00000000654cec32 (&rq->lock){-.-.}, at: __schedule+0x1f8/0x1cc0 kernel/sched/core.c:3456
2 locks held by getty/7541:
 #0: 00000000a4d21f92 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000007b71ff1e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7542:
 #0: 00000000a3fd47bf (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000eba49399 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7543:
 #0: 0000000001864ab2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000009f299fbe (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7544:
 #0: 0000000020b614cb (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000003d60a26e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7545:
 #0: 00000000474e501a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000033eaaecc (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7546:
 #0: 0000000057db8154 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000c1e21a25 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7547:
 #0: 00000000ce8f9919 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000aea5e5db (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
3 locks held by kworker/u4:5/7827:
 #0: 00000000a1b67aa3 ((wq_completion)netns){+.+.}, at: __write_once_size include/linux/compiler.h:220 [inline]
 #0: 00000000a1b67aa3 ((wq_completion)netns){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000a1b67aa3 ((wq_completion)netns){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline]
 #0: 00000000a1b67aa3 ((wq_completion)netns){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline]
 #0: 00000000a1b67aa3 ((wq_completion)netns){+.+.}, at: set_work_data kernel/workqueue.c:619 [inline]
 #0: 00000000a1b67aa3 ((wq_completion)netns){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:646 [inline]
 #0: 00000000a1b67aa3 ((wq_completion)netns){+.+.}, at: process_one_work+0x87e/0x1790 kernel/workqueue.c:2240
 #1: 00000000d96e3690 (net_cleanup_work){+.+.}, at: process_one_work+0x8b4/0x1790 kernel/workqueue.c:2244
 #2: 00000000eeb757ba (pernet_ops_rwsem){++++}, at: cleanup_net+0xae/0x960 net/core/net_namespace.c:519
2 locks held by syz-executor.3/28835:
 #0: 00000000a6c46852 (&sb->s_type->i_mutex_key#10){+.+.}, at: inode_lock include/linux/fs.h:772 [inline]
 #0: 00000000a6c46852 (&sb->s_type->i_mutex_key#10){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598
 #1: 00000000eeb757ba (pernet_ops_rwsem){++++}, at: unregister_netdevice_notifier+0x7e/0x3a0 net/core/dev.c:1717
1 lock held by syz-executor.3/28881:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1042 Comm: khungtaskd Not tainted 5.1.0-rc6+ #84
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
 watchdog+0x9b7/0xec0 kernel/hung_task.c:288
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2019/04/25 12:54 upstream cd8dead0c394 8e3c52b1 .config log report
ci-upstream-linux-next-kasan-gce-root 2019/04/26 03:32 linux-next c392798a85ab b617407b .config log report