INFO: task hung in p9_fd

INFO: task hung in p9_fd_close
Status: upstream: reported C repro on 2019/08/30 19:28
Reported-by: syzbot+8b41a1365f1106fd0f33@syzkaller.appspotmail.com
First crash: 571d, last: 5d10h

Cause bisection: failed (bisect log)

Fix bisection: failed (bisect log)

similar bugs (3):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.14	INFO: task hung in p9_fd_close	C		inconclusive	51	8d01h	573d	0/1	upstream: reported C repro on 2019/08/11 15:06
linux-4.19	INFO: task hung in p9_fd_close	syz			43	5d07h	565d	0/1	upstream: reported syz repro on 2019/08/19 15:52
upstream	INFO: task can't die in p9_fd_close	C	done		13	10d	192d	0/21	upstream: reported C repro on 2020/08/26 10:38

Sample crash report:

INFO: task syz-executor135:7716 blocked for more than 143 seconds.
      Not tainted 5.9.0-rc1-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor135 state:D stack:27744 pid: 7716 ppid:  6844 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:3778 [inline]
 __schedule+0x8e5/0x21e0 kernel/sched/core.c:4527
 schedule+0xd0/0x2a0 kernel/sched/core.c:4602
 schedule_timeout+0x1d8/0x250 kernel/time/timer.c:1855
 do_wait_for_common kernel/sched/completion.c:85 [inline]
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x163/0x260 kernel/sched/completion.c:138
 __flush_work+0x51f/0xab0 kernel/workqueue.c:3046
 __cancel_work_timer+0x5de/0x700 kernel/workqueue.c:3133
 p9_conn_destroy net/9p/trans_fd.c:889 [inline]
 p9_fd_close+0x305/0x520 net/9p/trans_fd.c:919
 p9_client_destroy+0xbe/0x360 net/9p/client.c:1086
 v9fs_session_close+0x45/0x2c0 fs/9p/v9fs.c:498
 v9fs_kill_super+0x49/0x90 fs/9p/vfs_super.c:222
 deactivate_locked_super+0x94/0x160 fs/super.c:335
 v9fs_mount+0x77c/0x970 fs/9p/vfs_super.c:203
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1547
 do_new_mount fs/namespace.c:2875 [inline]
 path_mount+0x1387/0x2070 fs/namespace.c:3192
 do_mount fs/namespace.c:3205 [inline]
 __do_sys_mount fs/namespace.c:3413 [inline]
 __se_sys_mount fs/namespace.c:3390 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4469d9
Code: Bad RIP value.
RSP: 002b:00007fac80763d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000006dbc48 RCX: 00000000004469d9
RDX: 0000000020000200 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 00000000006dbc40 R08: 00000000200028c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc4c
R13: 00000000200003c0 R14: 00000000004aea18 R15: 0000000000000000
INFO: task syz-executor135:7982 blocked for more than 143 seconds.
      Not tainted 5.9.0-rc1-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor135 state:D stack:27744 pid: 7982 ppid:  6840 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:3778 [inline]
 __schedule+0x8e5/0x21e0 kernel/sched/core.c:4527
 schedule+0xd0/0x2a0 kernel/sched/core.c:4602
 schedule_timeout+0x1d8/0x250 kernel/time/timer.c:1855
 do_wait_for_common kernel/sched/completion.c:85 [inline]
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x163/0x260 kernel/sched/completion.c:138
 __flush_work+0x51f/0xab0 kernel/workqueue.c:3046
 __cancel_work_timer+0x5de/0x700 kernel/workqueue.c:3133
 p9_conn_destroy net/9p/trans_fd.c:889 [inline]
 p9_fd_close+0x305/0x520 net/9p/trans_fd.c:919
 p9_client_destroy+0xbe/0x360 net/9p/client.c:1086
 v9fs_session_close+0x45/0x2c0 fs/9p/v9fs.c:498
 v9fs_kill_super+0x49/0x90 fs/9p/vfs_super.c:222
 deactivate_locked_super+0x94/0x160 fs/super.c:335
 v9fs_mount+0x77c/0x970 fs/9p/vfs_super.c:203
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1547
 do_new_mount fs/namespace.c:2875 [inline]
 path_mount+0x1387/0x2070 fs/namespace.c:3192
 do_mount fs/namespace.c:3205 [inline]
 __do_sys_mount fs/namespace.c:3413 [inline]
 __se_sys_mount fs/namespace.c:3390 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4469d9
Code: Bad RIP value.
RSP: 002b:00007fac80763d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000006dbc48 RCX: 00000000004469d9
RDX: 0000000020000200 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 00000000006dbc40 R08: 00000000200028c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc4c
R13: 00000000200003c0 R14: 00000000004aea18 R15: 0000000000000000

Showing all locks held in the system:
1 lock held by khungtaskd/1169:
 #0: ffffffff89bd6340 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:5825
1 lock held by in:imklog/6525:
 #0: ffff888093858670 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:930
2 locks held by kworker/1:1/6826:
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240
 #1: ffffc90000e17da8 ((work_completion)(&m->wq)){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244
2 locks held by kworker/0:1/6829:
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
 #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240
 #1: ffffc900055d7da8 ((work_completion)(&m->wq)){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244
1 lock held by syz-executor135/8407:
 #0: ffff8880a89100e0 (&type->s_umount_key#45/1){+.+.}-{3:3}, at: alloc_super+0x1ba/0xa10 fs/super.c:229
1 lock held by syz-executor135/8904:
 #0: ffff8880a382e0e0 (&type->s_umount_key#45/1){+.+.}-{3:3}, at: alloc_super+0x1ba/0xa10 fs/super.c:229
1 lock held by syz-executor135/1259:
 #0: ffffffff89bda9a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #0: ffffffff89bda9a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4e8/0x5f0 kernel/rcu/tree_exp.h:838
1 lock held by syz-executor135/1262:
 #0: ffffffff89bda9a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #0: ffffffff89bda9a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x274/0x5f0 kernel/rcu/tree_exp.h:838

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1169 Comm: khungtaskd Not tainted 5.9.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b3/0x223 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
 watchdog+0xd7d/0x1000 kernel/hung_task.c:295
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 1271 Comm: systemd-udevd Not tainted 5.9.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:release_pages+0x519/0x17a0 mm/swap.c:839
Code: df e8 8b 6c db ff 39 eb 0f 84 fd 10 00 00 e8 7e 70 db ff 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 0f 85 2f 0f 00 00 48 83 3c 24 00 <4d> 8b 2e 0f 84 89 00 00 00 e8 59 70 db ff bf 20 00 00 00 83 44 24
RSP: 0018:ffffc900081efb40 EFLAGS: 00000246
RAX: 1ffff11010bd1873 RBX: 00000000000001be RCX: ffffffff8198ce85
RDX: ffff88808f260000 RSI: ffffffff8198ce92 RDI: 0000000000000004
RBP: 0000000000000071 R08: 0000000000000001 R09: ffffea00002f0d77
R10: 00000000000001be R11: 0000000000000000 R12: 0000000000000012
R13: ffffea00002f0d40 R14: ffff888085e8c398 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556aa8111ed8 CR3: 0000000009a8d000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:242 [inline]
 tlb_flush_mmu mm/mmu_gather.c:249 [inline]
 tlb_finish_mmu+0x165/0x8c0 mm/mmu_gather.c:328
 exit_mmap+0x2d1/0x530 mm/mmap.c:3185
 __mmput+0x122/0x470 kernel/fork.c:1076
 mmput+0x53/0x60 kernel/fork.c:1097
 exit_mm kernel/exit.c:483 [inline]
 do_exit+0xa8b/0x29f0 kernel/exit.c:793
 do_group_exit+0x125/0x310 kernel/exit.c:903
 __do_sys_exit_group kernel/exit.c:914 [inline]
 __se_sys_exit_group kernel/exit.c:912 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:912
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fa44bd6a618
Code: Bad RIP value.
RSP: 002b:00007fffe01ab4d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007fffe01ab5a0 RCX: 00007fa44bd6a618
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007fffe01ab650 R08: 00000000000000e7 R09: fffffffffffffe50
R10: 00000000ffffffff R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000003 R15: 000000000000000e

Crashes (108):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kasan-gce-root	2020/08/21 07:07	upstream	da2968ff	1d75fe45	.config	log	report	syz	C
ci-upstream-kasan-gce-root	2020/04/17 15:07	upstream	7a56db02	18397578	.config	log	report	syz	C
ci-upstream-kasan-gce-smack-root	2019/09/21 16:12	upstream	f97c81dc	d96e88f3	.config	log	report	syz	C
ci-upstream-kasan-gce-selinux-root	2019/10/01 07:40	upstream	54ecb8f7	c7a4fb99	.config	log	report	syz
ci-upstream-kasan-gce-root	2019/09/30 06:39	upstream	a3c0e7b1	c1ad5441	.config	log	report	syz
ci-upstream-kasan-gce-smack-root	2019/09/29 18:01	upstream	02dc96ef	c1ad5441	.config	log	report	syz
ci-upstream-kasan-gce-selinux-root	2019/09/20 21:43	upstream	574cc453	d96e88f3	.config	log	report	syz
ci-upstream-kasan-gce-selinux-root	2019/09/14 22:45	upstream	a7f89616	32d59357	.config	log	report	syz
ci-upstream-kasan-gce-smack-root	2019/08/29 10:35	upstream	6525771f	fd37b39e	.config	log	report	syz
ci-upstream-linux-next-kasan-gce-root	2019/10/03 17:21	linux-next	2521ffab	fc17ba49	.config	log	report	syz
ci-upstream-linux-next-kasan-gce-root	2019/09/17 19:02	linux-next	f84e1c16	13dcda9b	.config	log	report	syz
ci-upstream-kasan-gce-selinux-root	2021/03/01 17:09	upstream	fe07bfda	4c37c133	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-selinux-root	2021/02/27 08:33	upstream	3fb6d0e0	4c37c133	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-smack-root	2021/02/27 06:14	upstream	3fb6d0e0	4c37c133	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-selinux-root	2021/02/26 09:35	upstream	2c87f7a3	76f7fc95	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-root	2021/02/25 19:27	upstream	29c395c7	76f7fc95	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-selinux-root	2021/02/25 01:15	upstream	719bbd4a	fcc6d71b	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-root	2021/02/24 16:18	upstream	c03c21ba	fcc6d71b	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-root	2021/02/11 20:20	upstream	291009f6	a5f86b15	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-root	2021/02/06 03:01	upstream	1e0d27fc	23a562df	.config	log	report			info	INFO: task hung in p9_fd_close
ci-upstream-kasan-gce-selinux-root	2021/01/13 01:45	upstream	e609571b	0cdd6185	.config	log	report			info
ci-upstream-kasan-gce-root	2021/01/13 00:41	upstream	e609571b	0cdd6185	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2021/01/11 04:12	upstream	0653161f	2c1f2513	.config	log	report			info
ci-upstream-kasan-gce-root	2021/01/03 06:42	upstream	3516bd72	79264ae3	.config	log	report			info
ci-upstream-kasan-gce-root	2021/01/02 16:16	upstream	eda809ae	79264ae3	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/12/23 00:50	upstream	614cb589	04201c06	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/12/18 04:34	upstream	d64c6f96	04201c06	.config	log	report			info
ci-upstream-kasan-gce-smack-root	2020/12/13 19:08	upstream	6bff9bb8	bca53db9	.config	log	report			info
ci-upstream-kasan-gce-root	2020/12/13 18:07	upstream	6bff9bb8	bca53db9	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/12/08 13:23	upstream	cd796ed3	51a9082e	.config	log	report			info
ci-upstream-kasan-gce-root	2020/12/08 12:09	upstream	cd796ed3	51a9082e	.config	log	report			info
ci-upstream-kasan-gce-root	2020/12/06 16:03	upstream	7059c2c0	f12ba0c5	.config	log	report			info
ci-upstream-kasan-gce-smack-root	2020/12/06 14:27	upstream	33256ce1	f12ba0c5	.config	log	report			info
ci-upstream-kasan-gce-smack-root	2020/11/29 20:09	upstream	aae5ab85	a0092f9d	.config	log	report			info
ci-upstream-kasan-gce-smack-root	2020/11/26 18:23	upstream	fa02fcd9	1d2b823e	.config	log	report			info
ci-upstream-kasan-gce-smack-root	2020/11/24 17:02	upstream	d5beb314	1ab681a4	.config	log	report			info
ci-upstream-kasan-gce-smack-root	2020/11/22 08:15	upstream	a349e4c6	0d27f508	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/11/19 14:44	upstream	c2e7554e	0767f13f	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/08/22 02:25	upstream	cd02217a	6436ce4b	.config	log	report
ci-upstream-kasan-gce-smack-root	2020/05/13 17:48	upstream	24085f70	9a6d42fb	.config	log	report
ci-upstream-kasan-gce-root	2020/03/29 15:37	upstream	906c4043	05736b29	.config	log	report
ci-upstream-kasan-gce-selinux-root	2020/03/05 02:31	upstream	63623fd4	c88c7b75	.config	log	report
ci-upstream-kasan-gce-smack-root	2020/03/02 09:41	upstream	63623fd4	c88c7b75	.config	log	report
ci-upstream-kasan-gce-smack-root	2020/02/29 22:57	upstream	f8788d86	59b57593	.config	log	report
ci-upstream-kasan-gce-root	2020/02/28 18:53	upstream	f8788d86	59b57593	.config	log	report
ci-upstream-kasan-gce-root	2020/02/26 17:05	upstream	f8788d86	59b57593	.config	log	report
ci-upstream-kasan-gce-root	2020/02/24 20:18	upstream	f8788d86	59b57593	.config	log	report
ci-upstream-kasan-gce-root	2020/02/22 14:39	upstream	54dedb5b	2c36e7a7	.config	log	report
ci-upstream-kasan-gce-smack-root	2019/11/24 17:09	upstream	6b8a7946	598ca6c8	.config	log	report
ci-upstream-kasan-gce-smack-root	2019/11/20 16:58	upstream	c74386d5	f4b7ed07	.config	log	report
ci-upstream-kasan-gce-smack-root	2019/11/19 12:16	upstream	af42d346	5bc70212	.config	log	report
ci-upstream-kasan-gce-selinux-root	2019/11/16 08:27	upstream	eb70e26c	cdac920b	.config	log	report
ci-upstream-kasan-gce-root	2019/08/13 15:19	upstream	d45331b0	8620c2c2	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/07/06 09:43	linux-next	9e50b94b	51095195	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/06/29 21:54	linux-next	36e3135d	a2cdad9d	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/03/11 04:35	linux-next	770fbb32	35f53e45	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/03/05 20:03	linux-next	c99b17ac	c88c7b75	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/03/05 15:59	linux-next	c99b17ac	c88c7b75	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/03/05 00:17	linux-next	c99b17ac	c88c7b75	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/03/04 16:31	linux-next	c99b17ac	c88c7b75	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/03/04 09:31	linux-next	c99b17ac	c88c7b75	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/02/27 00:36	linux-next	bdc5461b	59b57593	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/02/26 02:55	linux-next	bdc5461b	59b57593	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/02/24 19:16	linux-next	bdc5461b	59b57593	.config	log	report