syzbot


INFO: task hung in tty_read

Status: auto-closed as invalid on 2019/10/01 12:09
Reported-by: syzbot+a9433cfa727c1ab9233b@syzkaller.appspotmail.com
First crash: 2191d, last: 2058d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in tty_read serial 1 2181d 2181d 0/28 auto-closed as invalid on 2019/05/31 14:17

Sample crash report:
INFO: task syz-executor.4:17289 blocked for more than 140 seconds.
      Not tainted 4.9.141+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D28792 17289   2116 0x00000000
 ffff8801a419af80 0000000000000000 ffff8801ad98c200 ffff8801a41997c0
 ffff8801db621018 ffff880195567950 ffffffff828075c2 ffff8801a41a66f8
 ffffffff83ce1a30 ffff880195567b00 0000000000005eb7 ffff8801db6218f0
Call Trace:
 [<ffffffff82808aef>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff828142d5>] schedule_timeout+0x735/0xe20 kernel/time/timer.c:1771
 [<ffffffff81d4312c>] down_read_failed drivers/tty/tty_ldsem.c:241 [inline]
 [<ffffffff81d4312c>] __ldsem_down_read_nested+0x33c/0x610 drivers/tty/tty_ldsem.c:332
 [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 [<ffffffff81d3ca85>] tty_ldisc_ref_wait+0x25/0x80 drivers/tty/tty_ldisc.c:275
 [<ffffffff81d221ca>] tty_read+0xfa/0x270 drivers/tty/tty_io.c:1084
 [<ffffffff81507b25>] __vfs_read+0x115/0x560 fs/read_write.c:449
 [<ffffffff8150a7a4>] vfs_read+0x124/0x390 fs/read_write.c:472
 [<ffffffff8150e809>] SYSC_read fs/read_write.c:588 [inline]
 [<ffffffff8150e809>] SyS_read+0xd9/0x1c0 fs/read_write.c:581
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fe63f>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
2 locks held by getty/2031:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d37362>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
2 locks held by syz-executor.1/2115:
 #0:  (&rq->lock){-.-.-.}, at: [<ffffffff8280709c>] __schedule+0x13c/0x1b10 kernel/sched/core.c:3448
 #1:  (rcu_read_lock){......}, at: [<ffffffff811fc3cc>] cpuacct_charge+0x7c/0x360 kernel/sched/cpuacct.c:354
2 locks held by syz-executor.4/17266:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d37362>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
1 lock held by syz-executor.4/17289:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
1 lock held by syz-executor.2/17938:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81520d73>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor.2/17943:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff810fec47>] ptrace_attach+0x167/0x590 kernel/ptrace.c:372
1 lock held by syz-executor.2/20196:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81520d73>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor.2/20197:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff810fec47>] ptrace_attach+0x167/0x590 kernel/ptrace.c:372
1 lock held by syz-executor.3/21989:
 #0:  (sk_lock-AF_PACKET){+.+.+.}, at: [<ffffffff827cd8a3>] lock_sock include/net/sock.h:1404 [inline]
 #0:  (sk_lock-AF_PACKET){+.+.+.}, at: [<ffffffff827cd8a3>] packet_do_bind+0x33/0xb10 net/packet/af_packet.c:3081

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1
 ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40
 ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000002
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b4df89>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b4df1c>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff810984b4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c65d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c65d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c65d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c65d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 2118 Comm: syz-executor.3 Not tainted 4.9.141+ #1
task: ffff8801c791af80 task.stack: ffff8801ab6c8000
RIP: 0010:[<ffffffff819f7dfc>] c [<ffffffff819f7dfc>] task_has_perm+0xcc/0x330 security/selinux/hooks.c:1612
RSP: 0018:ffff8801ab6cfb68  EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000004 RCX: ffffed0038f23705
RDX: 1ffff1003b1fb18f RSI: ffffffff819f7de2 RDI: ffff8801d8fd8c78
RBP: ffff8801ab6cfb88 R08: ffff8801c791b830 R09: d8a1064c1ba25689
R10: ffff8801c791af80 R11: 0000000000000001 R12: ffff8801d8fd8c00
R13: ffff8801c791af80 R14: ffff8801ab6cfe4c R15: ffff8801ab6cfe48
FS:  00000000016b3940(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3056637000 CR3: 00000001ab699000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffffffff819f7d30c ffff880192a4df00c dffffc0000000000c ffff880192a4df00c
 ffff8801ab6cfba0c ffffffff819f8083c ffffffff831cc760c ffff8801ab6cfbd0c
 ffffffff819e6e73c 00000000356d9fbbc 0000000040000005c 0000000000000000c
Call Trace:
 [<ffffffff819f8083>] selinux_task_wait+0x23/0x30 security/selinux/hooks.c:3954
 [<ffffffff819e6e73>] security_task_wait+0x73/0xb0 security/security.c:1032
 [<ffffffff810e91f1>] wait_consider_task+0x2a1/0x3620 kernel/exit.c:1377
 [<ffffffff810ec993>] do_wait_thread kernel/exit.c:1490 [inline]
 [<ffffffff810ec993>] do_wait+0x423/0x950 kernel/exit.c:1561
 [<ffffffff810eda0b>] SYSC_wait4 kernel/exit.c:1693 [inline]
 [<ffffffff810eda0b>] SyS_wait4+0x12b/0x1f0 kernel/exit.c:1658
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: c3d c66 c37 c9e c01 c00 c0f c84 cc9 c01 c00 c00 ce8 c7e c3c c92 cff c49 c8d c7c c24 c78 c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c48 c89 cfa c48 cc1 cea c03 c80 c3c c02 c00 c<0f> c85 c42 c02 c00 c00 c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c4d c8b c64 c24 c78 c

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/04 12:08 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 6a475fff .config console log report ci-android-49-kasan-gce
2018/11/22 11:07 https://android.googlesource.com/kernel/common android-4.9 c3282d18a9f4 2ee77802 .config console log report ci-android-49-kasan-gce
2019/02/12 02:17 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 65a0d619 .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.