syzbot


INFO: task hung in ext4_map_blocks

Status: auto-closed as invalid on 2019/09/13 20:17
Reported-by: syzbot+e394de1f87d35877a433@syzkaller.appspotmail.com
First crash: 1960d, last: 1918d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 INFO: task hung in ext4_map_blocks C 3 2055d 1891d 0/3 public: reported C repro on 2019/04/14 08:51
upstream INFO: task hung in ext4_map_blocks ext4 C 5 2061d 2060d 0/27 closed as dup on 2018/10/27 13:40

Sample crash report:
audit: type=1400 audit(2000001372.767:75648): avc:  denied  { map } for  pid=5548 comm="getty" path="/etc/ld.so.cache" dev="sda1" ino=2503 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
INFO: task kworker/u4:44:11556 blocked for more than 140 seconds.
      Not tainted 4.14.106+ #30
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:44   D26216 11556      2 0x80000000
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3492
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
 rwsem_down_write_failed+0x3b1/0x760 kernel/locking/rwsem-xadd.c:601
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
 __down_write arch/x86/include/asm/rwsem.h:126 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:56
 ext4_map_blocks+0x728/0x1580 fs/ext4/inode.c:629
 mpage_map_one_extent fs/ext4/inode.c:2462 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2515 [inline]
 ext4_writepages+0x166f/0x3030 fs/ext4/inode.c:2886
 do_writepages+0xe5/0x280 mm/page-writeback.c:2348
 __writeback_single_inode+0xd2/0x1040 fs/fs-writeback.c:1353
 writeback_sb_inodes+0x4b7/0xd00 fs/fs-writeback.c:1617
 __writeback_inodes_wb+0xbc/0x200 fs/fs-writeback.c:1686
 wb_writeback+0x5f7/0xb70 fs/fs-writeback.c:1795
 wb_check_old_data_flush fs/fs-writeback.c:1908 [inline]
 wb_do_writeback fs/fs-writeback.c:1932 [inline]
 wb_workfn+0x83d/0xdd0 fs/fs-writeback.c:1961
 process_one_work+0x7c6/0x14e0 kernel/workqueue.c:2114
 worker_thread+0x5d7/0x1080 kernel/workqueue.c:2248
 kthread+0x310/0x420 kernel/kthread.c:232
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
INFO: task syz-executor.4:5463 blocked for more than 140 seconds.
      Not tainted 4.14.106+ #30
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D29152  5463  29098 0x00000004
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3492
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
 rwsem_down_write_failed+0x3b1/0x760 kernel/locking/rwsem-xadd.c:601
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
 __down_write arch/x86/include/asm/rwsem.h:126 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:56
 inode_lock include/linux/fs.h:715 [inline]
 do_truncate2+0x10c/0x1e0 fs/open.c:61
 handle_truncate fs/namei.c:3039 [inline]
 do_last fs/namei.c:3464 [inline]
 path_openat+0x1208/0x2b70 fs/namei.c:3597
 do_filp_open+0x1a1/0x280 fs/namei.c:3631
 do_sys_open+0x2ca/0x590 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289

Showing all locks held in the system:
1 lock held by khungtaskd/23:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffff9b800fec>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4541
2 locks held by getty/1759:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9c338a72>] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff9c333e97>] n_tty_read+0x1f7/0x1700 drivers/tty/n_tty.c:2156
5 locks held by kworker/u4:44/11556:
 #0:  ("writeback"){+.+.}, at: [<ffffffff9b7289b5>] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085
 #1:  ((&(&wb->dwork)->work)){+.+.}, at: [<ffffffff9b7289eb>] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089
 #2:  (&type->s_umount_key#34){++++}, at: [<ffffffff9bb60a1b>] trylock_super+0x1b/0xe0 fs/super.c:402
 #3:  (&sbi->s_journal_flag_rwsem){.+.+}, at: [<ffffffff9ba50c05>] do_writepages+0xe5/0x280 mm/page-writeback.c:2348
 #4:  (&ei->i_data_sem){++++}, at: [<ffffffff9bd41a08>] ext4_map_blocks+0x728/0x1580 fs/ext4/inode.c:629
2 locks held by syz-executor.4/5463:
 #0:  (sb_writers#4){.+.+}, at: [<ffffffff9bbc322a>] sb_start_write include/linux/fs.h:1545 [inline]
 #0:  (sb_writers#4){.+.+}, at: [<ffffffff9bbc322a>] mnt_want_write+0x3a/0xb0 fs/namespace.c:387
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff9bb4e6cc>] inode_lock include/linux/fs.h:715 [inline]
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff9bb4e6cc>] do_truncate2+0x10c/0x1e0 fs/open.c:61

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.106+ #30
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 nmi_cpu_backtrace.cold+0x47/0x86 lib/nmi_backtrace.c:101
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1631 Comm: rsyslogd Not tainted 4.14.106+ #30
task: ffff8881d51e2f00 task.stack: ffff8881dabb0000
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:94 [inline]
RIP: 0010:unwind_next_frame+0x211/0x1800 arch/x86/kernel/unwind_orc.c:331
RSP: 0018:ffff8881dba07a50 EFLAGS: 00000a02
RAX: 000000000001a039 RBX: 1ffff1103b740f51 RCX: ffffffff9d0039c4
RDX: dffffc0000000000 RSI: 000000000001a039 RDI: ffffffff9e2bd558
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000004f8d R11: 000000000001c033 R12: ffff8881dba07b55
R13: ffff8881dba07b58 R14: ffff8881dba07b20 R15: ffff8881dba07b68
FS:  00007fc92f01c700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2e69c58000 CR3: 00000001d6260006 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 </IRQ>
Code: 8d 53 ff 39 d0 0f 83 75 0f 00 00 48 ba 00 00 00 00 00 fc ff df 89 c6 48 8d 3c b5 74 54 25 9e 49 89 f8 49 c1 e8 03 45 0f b6 04 10 <48> 89 fa 83 e2 07 83 c2 03 44 38 c2 7c 32 45 84 c0 74 2d 48 89 

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/17 20:16 android-4.14 8ed9bc6e6401 ba18afea .config console log report ci-android-414-kasan-gce-root
2019/02/04 00:00 android-4.14 80d7b06534fa c198d5dd .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.