INFO: task hung in aead

INFO: task hung in aead_recvmsg
Status: fixed on 2020/02/18 14:31
Reported-by: syzbot+56c7151cad94eec37c521f0e47d2eee53f9361c4@syzkaller.appspotmail.com
Fix commit: bbefa1dd6a6d crypto: pcrypt - Avoid deadlock by using per-instance padata queues
First crash: 1464d, last: 681d

Cause bisection: introduced by (bisect log) :
commit 0c1e16cd1ec41987cc6671a2bff46ac958c41eb5
Author: Stephan Mueller <smueller@chronox.de>
Date: Mon Dec 5 14:26:19 2016 +0000

crypto: algif_aead - fix AEAD tag memory handling

Crash: KASAN: slab-out-of-bounds Read in aead_recvmsg (log)
Repro: C syz .config

duplicates (6):
Title	Repro	Cause bisect	Count	Last	Reported	Patched	Status
INFO: task hung in lock_sock_nested	C		2593	655d	1455d	0/22	closed as dup on 2017/12/23 20:15
INFO: task hung in tls_sw_free_resources_tx	C	done	109	864d	1096d	0/22	closed as dup on 2019/08/19 21:16
INFO: task hung in cancel_delayed_work_sync	C	done	166	776d	810d	0/22	closed as dup on 2019/09/19 05:15
INFO: task hung in tls_sw_sendmsg			18	812d	999d	0/22	closed as dup on 2019/08/19 21:10
INFO: task hung in tls_sw_release_resources_tx	C	done	20	682d	842d	0/22	closed as dup on 2019/08/17 05:47
INFO: task hung in exit_aio	C		17519	840d	1455d	0/22	closed as dup on 2018/04/08 22:50

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	INFO: task hung in aead_recvmsg	C		error	7	62d	956d	0/1	upstream: reported C repro on 2019/04/23 11:09
linux-4.14	INFO: task hung in aead_recvmsg	C		inconclusive	3	238d	958d	0/1	upstream: reported C repro on 2019/04/21 21:05

Sample crash report:

INFO: task syz-executor370:7818 blocked for more than 143 seconds.
      Not tainted 5.1.0-rc5+ #70
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor370 D28120  7818   7794 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2877 [inline]
 __schedule+0x813/0x1cc0 kernel/sched/core.c:3518
 schedule+0x92/0x180 kernel/sched/core.c:3562
 schedule_timeout+0x8ca/0xfd0 kernel/time/timer.c:1779
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common kernel/sched/completion.c:115 [inline]
 wait_for_completion+0x29c/0x440 kernel/sched/completion.c:136
 crypto_wait_req include/linux/crypto.h:680 [inline]
 _aead_recvmsg crypto/algif_aead.c:313 [inline]
 aead_recvmsg+0x1492/0x1ab0 crypto/algif_aead.c:334
 sock_recvmsg_nosec net/socket.c:881 [inline]
 sock_recvmsg net/socket.c:888 [inline]
 sock_recvmsg+0xd0/0x110 net/socket.c:884
 sock_read_iter+0x299/0x3b0 net/socket.c:966
 call_read_iter include/linux/fs.h:1860 [inline]
 do_iter_readv_writev+0x700/0x8e0 fs/read_write.c:679
 do_iter_read+0x27c/0x660 fs/read_write.c:920
 vfs_readv+0xf0/0x160 fs/read_write.c:984
 do_readv+0x15e/0x370 fs/read_write.c:1017
 __do_sys_readv fs/read_write.c:1104 [inline]
 __se_sys_readv fs/read_write.c:1101 [inline]
 __x64_sys_readv+0x75/0xb0 fs/read_write.c:1101
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441349
Code: Bad RIP value.
RSP: 002b:00007ffd03d84728 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00000000004a23d8 RCX: 0000000000441349
RDX: 0000000000000001 RSI: 00000000200007c0 RDI: 0000000000000004
RBP: 0000000000052e64 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000402170
R13: 0000000000402200 R14: 0000000000000000 R15: 0000000000000000

Showing all locks held in the system:
1 lock held by khungtaskd/1043:
 #0: 00000000e2e42ae5 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:5056
1 lock held by rsyslogd/7678:
 #0: 0000000033d8ba67 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801
2 locks held by getty/7768:
 #0: 00000000695c8b33 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000b0b463f2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7769:
 #0: 000000006818530d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000ed610f73 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7770:
 #0: 00000000fbcde1ed (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000817f6048 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7771:
 #0: 000000001606e8d4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000005557a95 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7772:
 #0: 00000000f6ef863e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000c55157f8 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7773:
 #0: 000000004cd964f4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000091a9b2ef (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7774:
 #0: 00000000e33d0631 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000001081adc (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
1 lock held by syz-executor370/7818:
 #0: 000000009baf1423 (sk_lock-AF_ALG){+.+.}, at: lock_sock include/net/sock.h:1513 [inline]
 #0: 000000009baf1423 (sk_lock-AF_ALG){+.+.}, at: af_alg_wait_for_data+0x215/0x540 crypto/af_alg.c:764

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1043 Comm: khungtaskd Not tainted 5.1.0-rc5+ #70
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
 watchdog+0x9b7/0xec0 kernel/hung_task.c:288
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:

Fix bisection attempts:
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kasan-gce-root	2019/12/11 10:23	upstream	6794862a16ef	505ab413	.config	log	report	syz	C

Crashes (11991):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro
ci-upstream-kasan-gce-root	2019/04/16 14:28	upstream	618d919cae2f	505ab413	.config	log	report	syz	C
ci-upstream-kasan-gce	2018/07/21 14:42	upstream	48e5aee81f32	8cc079c3	.config	log	report	syz	C
ci-upstream-net-this-kasan-gce	2019/04/16 18:47	net	614c70f35cd7	505ab413	.config	log	report	syz	C
ci-upstream-net-this-kasan-gce	2018/07/21 14:31	net	fcf4793e278e	8cc079c3	.config	log	report	syz	C
ci-upstream-net-kasan-gce	2019/04/16 10:14	net-next	47a1a225ab35	505ab413	.config	log	report	syz	C
ci-upstream-net-kasan-gce	2018/07/21 12:36	net-next	99d20a461c43	8cc079c3	.config	log	report	syz	C
ci-upstream-linux-next-kasan-gce-root	2019/04/16 12:49	linux-next	de3c659c83ce	505ab413	.config	log	report	syz	C
ci-upstream-linux-next-kasan-gce-root	2018/07/22 11:32	linux-next	89cf55353308	8cc079c3	.config	log	report	syz	C
ci-upstream-kasan-gce	2020/01/23 05:35	upstream	dbab40bdb42c	3334d684	.config	log	report
ci-upstream-kasan-gce	2019/09/07 23:45	upstream	1e3778cb223e	a60cb4cd	.config	log	report
ci-upstream-kasan-gce	2019/08/30 19:52	upstream	6525771f58cb	fd37b39e	.config	log	report
ci-upstream-kasan-gce-smack-root	2019/02/27 08:53	upstream	7d762d69145a	f2468c12	.config	log	report
ci-upstream-kasan-gce-386	2018/09/05 09:16	upstream	28619527b8a7	a4718693	.config	log	report
ci-upstream-net-this-kasan-gce	2019/09/04 11:27	net	e33b4325e60e	12381952	.config	log	report
ci-upstream-net-this-kasan-gce	2019/09/03 03:57	net	e1e54ec7fb55	14544a56	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/30 22:36	net	9e8312f5e160	fd37b39e	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/29 06:33	net	9e8312f5e160	fd37b39e	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/28 08:59	net	9e8312f5e160	fd37b39e	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/27 14:24	net	f53a7ad18959	d21c5d9d	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/26 15:09	net	f53a7ad18959	d21c5d9d	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/16 10:18	net	2aafdf5a5786	8fd428a1	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/13 23:31	net	bb0ce4c1517d	ef801a3e	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/12 19:36	net	125b7e0949d4	acb51638	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/06 02:22	net	107e47cc80ec	6affd8e8	.config	log	report
ci-upstream-net-this-kasan-gce	2019/08/02 19:54	net	107e47cc80ec	835dffe7	.config	log	report
ci-upstream-net-this-kasan-gce	2019/07/24 06:06	net	107e47cc80ec	de453f34	.config	log	report
ci-upstream-net-this-kasan-gce	2019/07/23 08:26	net	107e47cc80ec	55e0c077	.config	log	report
ci-upstream-net-kasan-gce	2019/09/20 18:33	net-next	b41dae061bbd	d96e88f3	.config	log	report
ci-upstream-net-kasan-gce	2019/08/22 10:14	net-next	4f830a5af7b5	984250d5	.config	log	report
ci-upstream-net-kasan-gce	2019/08/17 20:33	net-next	a4d2113e46c1	55bf8926	.config	log	report
ci-upstream-net-kasan-gce	2019/08/17 11:06	net-next	13b18f1d281b	8fd428a1	.config	log	report
ci-upstream-net-kasan-gce	2019/08/16 08:13	net-next	459c5fb44379	8fd428a1	.config	log	report
ci-upstream-net-kasan-gce	2019/08/15 14:52	net-next	ecb9f80db23a	0d298d6b	.config	log	report
ci-upstream-net-kasan-gce	2019/08/13 11:33	net-next	53f6f391786e	8620c2c2	.config	log	report
ci-upstream-net-kasan-gce	2019/08/13 06:11	net-next	53f6f391786e	8620c2c2	.config	log	report
ci-upstream-net-kasan-gce	2019/08/12 08:42	net-next	6e5ee483397a	acb51638	.config	log	report
ci-upstream-net-kasan-gce	2019/08/12 01:22	net-next	2cc2743d8fee	acb51638	.config	log	report
ci-upstream-net-kasan-gce	2019/08/07 15:32	net-next	13dfb3fa4943	cdde7486	.config	log	report
ci-upstream-net-kasan-gce	2019/08/05 17:11	net-next	31cc088a4f5d	6affd8e8	.config	log	report
ci-upstream-net-kasan-gce	2019/08/04 07:49	net-next	31cc088a4f5d	6affd8e8	.config	log	report
ci-upstream-net-kasan-gce	2019/08/03 17:48	net-next	31cc088a4f5d	6affd8e8	.config	log	report
ci-upstream-net-kasan-gce	2019/08/03 05:58	net-next	31cc088a4f5d	6affd8e8	.config	log	report
ci-upstream-net-kasan-gce	2019/08/02 17:12	net-next	31cc088a4f5d	835dffe7	.config	log	report
ci-upstream-net-kasan-gce	2019/08/02 14:52	net-next	31cc088a4f5d	835dffe7	.config	log	report
ci-upstream-net-kasan-gce	2019/07/30 20:59	net-next	31cc088a4f5d	f28bf2a5	.config	log	report
ci-upstream-net-kasan-gce	2019/07/29 05:05	net-next	31cc088a4f5d	c85e1c5b	.config	log	report
ci-upstream-net-kasan-gce	2019/07/28 18:38	net-next	31cc088a4f5d	c85e1c5b	.config	log	report
ci-upstream-net-kasan-gce	2019/07/25 16:29	net-next	31cc088a4f5d	32329ceb	.config	log	report
ci-upstream-net-kasan-gce	2019/07/24 02:07	net-next	31cc088a4f5d	de453f34	.config	log	report
ci-upstream-net-kasan-gce	2019/07/21 01:19	net-next	31cc088a4f5d	1656845f	.config	log	report
ci-upstream-net-kasan-gce	2019/06/30 17:03	net-next	f072218cca5b	7509bf36	.config	log	report
ci-upstream-net-kasan-gce	2019/06/30 10:24	net-next	f072218cca5b	7509bf36	.config	log	report
ci-upstream-net-kasan-gce	2019/06/29 09:41	net-next	ee7dd7733b20	7509bf36	.config	log	report