syzbot


INFO: task hung in lo_ioctl

Status: auto-closed as invalid on 2021/06/25 19:54
Reported-by: syzbot+98a03aa2ad3f07072c81@syzkaller.appspotmail.com
First crash: 1175d, last: 489d
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 INFO: task hung in lo_ioctl syz 498 1154d 1176d 0/1 public: reported syz repro on 2019/04/10 16:14
android-44 INFO: task hung in lo_ioctl C 469 968d 1174d 0/2 public: reported C repro on 2019/04/12 00:00
android-49 INFO: task hung in lo_ioctl C 1828 975d 1174d 0/3 public: reported C repro on 2019/04/12 00:00
upstream INFO: task hung in lo_ioctl 47 1546d 1662d 12/22 fixed on 2019/03/06 07:43
upstream INFO: task hung in lo_ioctl (2) 3 221d 226d 0/22 closed as invalid on 2022/02/08 09:40

Sample crash report:
Bluetooth: hci0 command 0x0406 tx timeout
Bluetooth: hci4 command 0x0406 tx timeout
Bluetooth: hci5 command 0x0406 tx timeout
Bluetooth: hci1 command 0x0406 tx timeout
Bluetooth: hci2 command 0x0406 tx timeout
INFO: task syz-executor.1:12796 blocked for more than 140 seconds.
      Not tainted 4.14.222-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1  D28336 12796   8008 0x80000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1414
 __blkdev_driver_ioctl block/ioctl.c:297 [inline]
 blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
 ioctl_by_bdev+0xa0/0x110 fs/block_dev.c:2078
 udf_get_last_block+0x8a/0x180 fs/udf/lowlevel.c:59
 udf_load_vrs+0x48d/0xa90 fs/udf/super.c:1971
 udf_fill_super+0x715/0x1680 fs/udf/super.c:2170
 mount_bdev+0x2b3/0x360 fs/super.c:1134
 mount_fs+0x92/0x2a0 fs/super.c:1237
 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
 vfs_kern_mount fs/namespace.c:1036 [inline]
 do_new_mount fs/namespace.c:2549 [inline]
 do_mount+0xe53/0x2a00 fs/namespace.c:2879
 SYSC_mount fs/namespace.c:3095 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3072
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x465ef9
RSP: 002b:00007f88c3806188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465ef9
RDX: 0000000020000400 RSI: 00000000200001c0 RDI: 0000000020000240
RBP: 00000000004bcd1c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffeb6c81d8f R14: 00007f88c3806300 R15: 0000000000022000
INFO: task syz-executor.1:12805 blocked for more than 140 seconds.
      Not tainted 4.14.222-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1  D28224 12805   8008 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
 rwsem_down_read_failed+0x1e6/0x350 kernel/locking/rwsem-xadd.c:309
 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94
 __down_read arch/x86/include/asm/rwsem.h:66 [inline]
 down_read+0x44/0x80 kernel/locking/rwsem.c:26
 __get_super.part.0+0x271/0x390 fs/super.c:678
 __get_super include/linux/spinlock.h:317 [inline]
 get_super+0x2b/0x50 fs/super.c:707
 fsync_bdev+0x14/0xc0 fs/block_dev.c:495
 invalidate_partition+0x74/0xb0 block/genhd.c:1509
 drop_partitions.isra.0+0x83/0x150 block/partition-generic.c:442
 rescan_partitions+0xa9/0x800 block/partition-generic.c:515
 __blkdev_reread_part+0x140/0x1d0 block/ioctl.c:173
 blkdev_reread_part+0x23/0x40 block/ioctl.c:193
 loop_reread_partitions drivers/block/loop.c:624 [inline]
 loop_set_status+0xeeb/0x12b0 drivers/block/loop.c:1193
 loop_set_status64+0x92/0xe0 drivers/block/loop.c:1311
 lo_ioctl+0x587/0x1cd0 drivers/block/loop.c:1441
 __blkdev_driver_ioctl block/ioctl.c:297 [inline]
 blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
 block_ioctl+0xd9/0x120 fs/block_dev.c:1893
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x465cb7
RSP: 002b:00007f88c37e4ef8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f88c37e4f40 RCX: 0000000000465cb7
RDX: 00007f88c37e5050 RSI: 0000000000004c04 RDI: 0000000000000004
RBP: 00000000004bcd1c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007f88c37e5050
R13: 00007ffeb6c81d8f R14: 00007f88c37e5300 R15: 0000000000022000
INFO: task systemd-udevd:12804 blocked for more than 140 seconds.
      Not tainted 4.14.222-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
systemd-udevd   D28712 12804   4625 0x00000104
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
 blkdev_get+0x88/0x890 fs/block_dev.c:1611
 blkdev_open+0x1cc/0x250 fs/block_dev.c:1772
 do_dentry_open+0x44b/0xec0 fs/open.c:777
 vfs_open+0x105/0x220 fs/open.c:888
 do_last fs/namei.c:3428 [inline]
 path_openat+0x628/0x2970 fs/namei.c:3569
 do_filp_open+0x179/0x3c0 fs/namei.c:3603
 do_sys_open+0x296/0x410 fs/open.c:1081
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f1e0b76a840
RSP: 002b:00007ffc7c0c6bc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 000055608e2639d0 RCX: 00007f1e0b76a840
RDX: 000055608c4f6fe3 RSI: 00000000000a0800 RDI: 000055608e263fa0
RBP: 00007ffc7c0c6d40 R08: 000055608c4f6670 R09: 0000000000000010
R10: 000055608c4f6d0c R11: 0000000000000246 R12: 00007ffc7c0c6c90
R13: 000055608e2648b0 R14: 0000000000000003 R15: 000000000000000e

Showing all locks held in the system:
1 lock held by khungtaskd/1531:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffff86fef837>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
2 locks held by agetty/7922:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff83535bf2>] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8352af73>] n_tty_read+0x1e3/0x1680 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.1/12796:
 #0:  (&type->s_umount_key#73/1){+.+.}, at: [<ffffffff81870726>] alloc_super fs/super.c:251 [inline]
 #0:  (&type->s_umount_key#73/1){+.+.}, at: [<ffffffff81870726>] sget_userns+0x556/0xc10 fs/super.c:516
 #1:  (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838c1dc7>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1414
3 locks held by syz-executor.1/12805:
 #0:  (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838c1dc7>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1414
 #1:  (&bdev->bd_mutex){+.+.}, at: [<ffffffff830a199b>] blkdev_reread_part+0x1b/0x40 block/ioctl.c:192
 #2:  (&type->s_umount_key#74){.+.+}, at: [<ffffffff81871fc1>] __get_super.part.0+0x271/0x390 fs/super.c:678
1 lock held by systemd-udevd/12804:
 #0:  (&bdev->bd_mutex){+.+.}, at: [<ffffffff8193a4e1>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1531 Comm: khungtaskd Not tainted 4.14.222-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
 watchdog+0x5b9/0xb40 kernel/hung_task.c:274
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff8720ef7e

Crashes (127):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2021/02/25 19:54 linux-4.14.y 3242aa3a635c 76f7fc95 .config log report info INFO: task hung in lo_ioctl
ci2-linux-4-14 2021/01/15 12:17 linux-4.14.y f79dc86058bc 65a7a854 .config log report info
ci2-linux-4-14 2020/09/26 19:07 linux-4.14.y cbfa1702aaf6 2d5ea0cb .config log report info
ci2-linux-4-14 2020/09/08 05:06 linux-4.14.y 2f166cdcf8a9 abf9ba4f .config log report
ci2-linux-4-14 2020/09/03 04:13 linux-4.14.y d7e78d08fa77 abf9ba4f .config log report
ci2-linux-4-14 2020/09/01 18:00 linux-4.14.y d7e78d08fa77 d5a3ae1f .config log report
ci2-linux-4-14 2020/08/31 08:50 linux-4.14.y d7e78d08fa77 d5a3ae1f .config log report
ci2-linux-4-14 2020/08/30 21:02 linux-4.14.y d7e78d08fa77 d5a3ae1f .config log report
ci2-linux-4-14 2020/08/30 19:19 linux-4.14.y d7e78d08fa77 d5a3ae1f .config log report
ci2-linux-4-14 2020/08/30 12:06 linux-4.14.y d7e78d08fa77 d5a3ae1f .config log report
ci2-linux-4-14 2020/08/26 06:22 linux-4.14.y 6a24ca2506d6 344da168 .config log report
ci2-linux-4-14 2020/08/15 19:07 linux-4.14.y 14b58326976d 5ce13532 .config log report
ci2-linux-4-14 2020/07/21 07:41 linux-4.14.y b850307b279c d88894e6 .config log report
ci2-linux-4-14 2020/06/21 17:09 linux-4.14.y b850307b279c 4f2acff9 .config log report
ci2-linux-4-14 2020/05/17 04:53 linux-4.14.y ab9dfda23248 37bccd4e .config log report
ci2-linux-4-14 2020/05/09 17:18 linux-4.14.y d71f695ce745 88cb3e92 .config log report
ci2-linux-4-14 2020/05/07 16:56 linux-4.14.y d71f695ce745 98cbd87b .config log report
ci2-linux-4-14 2020/04/06 22:01 linux-4.14.y 4520f06b03ae 99a96044 .config log report
ci2-linux-4-14 2020/04/02 06:11 linux-4.14.y 01364dad1d45 a34e2c33 .config log report
ci2-linux-4-14 2020/03/17 23:28 linux-4.14.y 12cd844a39ed 97bc55ce .config log report
ci2-linux-4-14 2020/03/17 06:35 linux-4.14.y 12cd844a39ed 749688d2 .config log report
ci2-linux-4-14 2020/03/15 13:46 linux-4.14.y 12cd844a39ed 749688d2 .config log report
ci2-linux-4-14 2020/03/12 10:23 linux-4.14.y 12cd844a39ed d850e9d0 .config log report
ci2-linux-4-14 2020/02/16 02:43 linux-4.14.y 98db2bf27b9e 5d7b90f1 .config log report
ci2-linux-4-14 2020/02/12 12:51 linux-4.14.y e0f8b8a65a47 a75b198c .config log report
ci2-linux-4-14 2020/01/18 22:11 linux-4.14.y c1141b3aab36 bc8bc756 .config log report
ci2-linux-4-14 2019/12/27 14:53 linux-4.14.y e1f7d50ae3a3 be5c2c81 .config log report
ci2-linux-4-14 2019/12/08 03:35 linux-4.14.y a844dc4c5442 1508f453 .config log report
ci2-linux-4-14 2019/11/24 02:45 linux-4.14.y f56f3d0e65ad 598ca6c8 .config log report
ci2-linux-4-14 2019/11/20 00:25 linux-4.14.y 775d01b65b5d 432c7650 .config log report
ci2-linux-4-14 2019/11/10 04:54 linux-4.14.y c9fda4f22428 dc438b91 .config log report
ci2-linux-4-14 2019/09/02 05:22 linux-4.14.y 01fd1694b93c db7c31ca .config log report
ci2-linux-4-14 2019/08/01 03:45 linux-4.14.y 10d6aa565d05 c692b5bd .config log report
ci2-linux-4-14 2019/07/17 15:27 linux-4.14.y aea8526edf59 f613a7c4 .config log report
ci2-linux-4-14 2019/05/02 05:58 linux-4.14.y fa5941f45d7e 1852eb18 .config log report
ci2-linux-4-14 2019/05/01 22:22 linux-4.14.y fa5941f45d7e 7516d9fa .config log report
ci2-linux-4-14 2019/05/01 20:31 linux-4.14.y fa5941f45d7e 7516d9fa .config log report
ci2-linux-4-14 2019/05/01 19:04 linux-4.14.y fa5941f45d7e 7516d9fa .config log report
ci2-linux-4-14 2019/05/01 11:18 linux-4.14.y fa5941f45d7e 618456b4 .config log report
ci2-linux-4-14 2019/05/01 04:24 linux-4.14.y fa5941f45d7e 618456b4 .config log report
ci2-linux-4-14 2019/05/01 01:40 linux-4.14.y fa5941f45d7e 618456b4 .config log report
ci2-linux-4-14 2019/04/30 18:39 linux-4.14.y fa5941f45d7e 618456b4 .config log report
ci2-linux-4-14 2019/04/30 14:28 linux-4.14.y fa5941f45d7e 20f16bef .config log report
ci2-linux-4-14 2019/04/30 11:19 linux-4.14.y fa5941f45d7e 20f16bef .config log report
ci2-linux-4-14 2019/04/30 02:56 linux-4.14.y fa5941f45d7e b617407b .config log report
ci2-linux-4-14 2019/04/30 01:42 linux-4.14.y fa5941f45d7e b617407b .config log report
ci2-linux-4-14 2019/04/29 20:39 linux-4.14.y fa5941f45d7e b617407b .config log report
ci2-linux-4-14 2019/04/11 14:45 linux-4.14.y 1ec8f1f0bffe 13030ef8 .config log report