syzbot


INFO: task hung in tty_ldisc_hangup (2)

Status: closed as invalid on 2022/02/07 19:09
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 371d, last: 371d
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in tty_ldisc_hangup (2) C error 1 434d 584d 0/1 upstream: reported C repro on 2021/05/02 05:40
linux-4.14 INFO: task hung in tty_ldisc_hangup (2) 1 633d 633d 0/1 auto-closed as invalid on 2021/07/12 09:20
linux-4.19 INFO: task hung in tty_ldisc_hangup C done 10 1028d 1095d 1/1 fixed on 2020/03/16 09:27
upstream INFO: task hung in tty_ldisc_hangup C inconclusive done 15 1021d 1096d 0/24 closed as dup on 2020/07/30 01:09
linux-4.14 INFO: task hung in tty_ldisc_hangup C done 17 1024d 1095d 1/1 fixed on 2020/03/18 22:57

Sample crash report:
INFO: task login:17183 blocked for more than 143 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:login           state:D stack:27576 pid:17183 ppid:     1 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857
 down_write_failed drivers/tty/tty_ldsem.c:262 [inline]
 __ldsem_down_write_nested+0x343/0x850 drivers/tty/tty_ldsem.c:324
 __tty_ldisc_lock drivers/tty/tty_ldisc.c:300 [inline]
 tty_ldisc_lock+0x61/0xb0 drivers/tty/tty_ldisc.c:324
 tty_ldisc_hangup+0x200/0x680 drivers/tty/tty_ldisc.c:738
 __tty_hangup.part.0+0x40a/0x830 drivers/tty/tty_io.c:639
 __tty_hangup drivers/tty/tty_io.c:594 [inline]
 tty_vhangup_session+0x20/0x30 drivers/tty/tty_io.c:747
 disassociate_ctty.part.0+0xaf/0x790 drivers/tty/tty_jobctrl.c:275
 disassociate_ctty+0x7a/0x90 drivers/tty/tty_jobctrl.c:269
 do_exit+0x1a70/0x2b40 kernel/exit.c:830
 do_group_exit+0x125/0x310 kernel/exit.c:929
 __do_sys_exit_group kernel/exit.c:940 [inline]
 __se_sys_exit_group kernel/exit.c:938 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:938
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f11a7879618
RSP: 002b:00007ffec39d11e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00007f11a7879618
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007ffec39d1750 R08: 00000000000000e7 R09: ffffffffffffff98
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000002 R14: 00007ffec39d1dc0 R15: 000055a95813baf8
 </TASK>
INFO: task syz-executor.2:18663 blocked for more than 144 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:26704 pid:18663 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
 tty_release+0xb3/0x1200 drivers/tty/tty_io.c:1753
 __fput+0x286/0x9f0 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb5a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f0981719020 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb5a300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:18728 blocked for more than 144 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:26984 pid:18728 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
 tty_release+0xb3/0x1200 drivers/tty/tty_io.c:1753
 __fput+0x286/0x9f0 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb5a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f0981719020 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb5a300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:18794 blocked for more than 144 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:26832 pid:18794 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
 tty_release+0xb3/0x1200 drivers/tty/tty_io.c:1753
 __fput+0x286/0x9f0 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb7b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f0981718f60 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb7b300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:18878 blocked for more than 145 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:26360 pid:18878 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
 tty_release+0xb3/0x1200 drivers/tty/tty_io.c:1753
 __fput+0x286/0x9f0 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb7b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f0981718f60 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb7b300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:18957 blocked for more than 145 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:26232 pid:18957 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
 tty_release+0xb3/0x1200 drivers/tty/tty_io.c:1753
 __fput+0x286/0x9f0 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb7b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f0981718f60 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb7b300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:19144 blocked for more than 146 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:28312 pid:19144 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
 tioclinux+0x126/0x560 drivers/tty/vt/vt.c:3204
 vt_ioctl+0x229a/0x2b10 drivers/tty/vt/vt_ioctl.c:762
 tty_ioctl+0xbbd/0x1670 drivers/tty/tty_io.c:2805
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb5a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0981719020 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb5a300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:19204 blocked for more than 146 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:28344 pid:19204 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
 tioclinux+0x126/0x560 drivers/tty/vt/vt.c:3204
 vt_ioctl+0x229a/0x2b10 drivers/tty/vt/vt_ioctl.c:762
 tty_ioctl+0xbbd/0x1670 drivers/tty/tty_io.c:2805
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb5a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0981719020 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb5a300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:19284 blocked for more than 147 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:28328 pid:19284 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
 tioclinux+0x126/0x560 drivers/tty/vt/vt.c:3204
 vt_ioctl+0x229a/0x2b10 drivers/tty/vt/vt_ioctl.c:762
 tty_ioctl+0xbbd/0x1670 drivers/tty/tty_io.c:2805
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb5a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0981719020 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb5a300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.2:19340 blocked for more than 147 seconds.
      Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:28344 pid:19340 ppid: 29142 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
 __mutex_lock_common kernel/locking/mutex.c:680 [inline]
 __mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
 paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
 tioclinux+0x126/0x560 drivers/tty/vt/vt.c:3204
 vt_ioctl+0x229a/0x2b10 drivers/tty/vt/vt_ioctl.c:762
 tty_ioctl+0xbbd/0x1670 drivers/tty/tty_io.c:2805
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0981605ae9
RSP: 002b:00007f097eb5a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0981719020 RCX: 00007f0981605ae9
RDX: 00000000200000c0 RSI: 000000000000541c RDI: 0000000000000004
RBP: 00007f098165ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef10d5af R14: 00007f097eb5a300 R15: 0000000000022000
 </TASK>

Showing all locks held in the system:
2 locks held by kworker/u4:0/8:
 #0: ffff888010c74138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010c74138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff888010c74138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff888010c74138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
 #0: ffff888010c74138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
 #0: ffff888010c74138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
 #1: ffff8880b9d279c8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x3a6/0x490 kernel/sched/psi.c:880
1 lock held by khungtaskd/26:
 #0: ffffffff8bb80fe0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
2 locks held by kworker/1:1/31:
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
 #1: ffffc90001087db0 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
1 lock held by systemd-udevd/2971:
1 lock held by in:imklog/6436:
 #0: ffff88801ceb8d70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990
3 locks held by kworker/1:5/8227:
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
 #1: ffffc9000b5e7db0 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
 #2: ffffffff8bb8a368 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #2: ffffffff8bb8a368 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d5/0x620 kernel/rcu/tree_exp.h:836
3 locks held by kworker/1:0/5813:
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
 #0: ffff888010c67d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
 #1: ffffc9000a45fdb0 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
 #2: ffffffff8bb8a368 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #2: ffffffff8bb8a368 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4fa/0x620 kernel/rcu/tree_exp.h:836
2 locks held by systemd-udevd/6085:
 #0: ffff88801aea5118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xc70 block/bdev.c:817
 #1: ffff8881473c5b60 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_open+0x75/0x120 drivers/block/loop.c:1733
2 locks held by systemd-udevd/6142:
 #0: ffff88801ae83118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xc70 block/bdev.c:817
 #1: ffff8881473c5360 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_open+0x75/0x120 drivers/block/loop.c:1733
2 locks held by systemd-udevd/6185:
 #0: ffff88801af51118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xc70 block/bdev.c:817
 #1: ffff88801af45b60 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_open+0x75/0x120 drivers/block/loop.c:1733
2 locks held by login/17183:
 #0: ffff88807d3cc1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
 #1: ffff88807d3cc098 (&tty->ldisc_sem){++++}-{0:0}, at: __tty_ldisc_lock drivers/tty/tty_ldisc.c:300 [inline]
 #1: ffff88807d3cc098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_lock+0x61/0xb0 drivers/tty/tty_ldisc.c:324
1 lock held by syz-executor.2/18663:
 #0: ffff88807d3cc1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
1 lock held by syz-executor.2/18728:
 #0: ffff88807d3cc1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
1 lock held by syz-executor.2/18794:
 #0: ffff88807d3cc1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
1 lock held by syz-executor.2/18878:
 #0: ffff88807d3cc1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
1 lock held by syz-executor.2/18957:
 #0: ffff88807d3cc1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:20
2 locks held by syz-executor.2/19052:
 #0: ffff88807d3cc098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
 #1: ffff88801147d0b8 (&buf->lock){+.+.}-{3:3}, at: paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
2 locks held by syz-executor.2/19144:
 #0: ffff88807d3cc098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
 #1: ffff88801147d0b8 (&buf->lock){+.+.}-{3:3}, at: paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
2 locks held by kworker/1:2/19180:
 #0: ffff888010c76538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010c76538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff888010c76538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff888010c76538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
 #0: ffff888010c76538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
 #0: ffff888010c76538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
 #1: ffffc90010a5fdb0 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
2 locks held by syz-executor.2/19204:
 #0: ffff88807d3cc098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
 #1: ffff88801147d0b8 (&buf->lock){+.+.}-{3:3}, at: paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
2 locks held by syz-executor.2/19284:
 #0: ffff88807d3cc098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
 #1: ffff88801147d0b8 (&buf->lock){+.+.}-{3:3}, at: paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
2 locks held by syz-executor.2/19340:
 #0: ffff88807d3cc098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
 #1: ffff88801147d0b8 (&buf->lock){+.+.}-{3:3}, at: paste_selection+0x110/0x4c0 drivers/tty/vt/selection.c:390
1 lock held by syz-executor.0/27942:
 #0: ffff8881473c5360 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x7a/0x1070 drivers/block/loop.c:1106
1 lock held by syz-executor.0/27973:
 #0: ffff88801ae83118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xc70 block/bdev.c:817
1 lock held by syz-executor.4/27947:
 #0: ffff88801af45b60 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x7a/0x1070 drivers/block/loop.c:1106
1 lock held by syz-executor.4/27974:
 #0: ffff88801af51118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xc70 block/bdev.c:817
1 lock held by syz-executor.1/27951:
 #0: ffff8881473c5b60 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x7a/0x1070 drivers/block/loop.c:1106
1 lock held by syz-executor.1/27975:
 #0: ffff88801aea5118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xc70 block/bdev.c:817
1 lock held by syz-executor.3/27961:
 #0: ffff88801af04b60 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x7a/0x1070 drivers/block/loop.c:1106

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 26 Comm: khungtaskd Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
 watchdog+0xc1d/0xf50 kernel/hung_task.c:295
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 27951 Comm: syz-executor.1 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:arch_atomic_fetch_add_unless include/linux/atomic/atomic-arch-fallback.h:1163 [inline]
RIP: 0010:arch_atomic_add_unless include/linux/atomic/atomic-arch-fallback.h:1183 [inline]
RIP: 0010:arch_atomic_inc_not_zero include/linux/atomic/atomic-arch-fallback.h:1199 [inline]
RIP: 0010:try_get_desc arch/x86/kernel/alternative.c:1136 [inline]
RIP: 0010:poke_int3_handler+0x28/0x150 arch/x86/kernel/alternative.c:1184
Code: cc cc f6 87 88 00 00 00 03 75 4d 48 8b 15 a0 4d d1 05 48 85 d2 74 41 8b 42 0c 85 c0 74 3a 8d 48 01 48 8d 72 0c f0 0f b1 4a 0c <75> ee 48 63 42 08 4c 8b 8f 80 00 00 00 48 8b 12 83 f8 01 49 8d 49
RSP: 0018:ffffc900046ff898 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000002
RDX: ffffc90000eefb40 RSI: ffffc90000eefb4c RDI: ffffc900046ff8b8
RBP: ffffc900046ff8b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f775d664700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbc07811000 CR3: 000000002597d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 exc_int3+0xb/0x80 arch/x86/kernel/traps.c:680
 asm_exc_int3+0x31/0x40 arch/x86/include/asm/idtentry.h:567
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:kfence_alloc include/linux/kfence.h:118 [inline]
RIP: 0010:slab_alloc mm/slab.c:3310 [inline]
RIP: 0010:kmem_cache_alloc_trace+0x11a/0x4a0 mm/slab.c:3573
Code: 02 00 00 e8 d8 7b a6 ff 48 c7 c6 23 d1 bc 81 48 c7 c7 e0 0f b8 8b e8 85 21 9f ff 31 f6 e9 ca 00 00 00 31 ed 48 85 db 74 f2 cc <1f> 44 00 00 48 c7 44 24 10 00 00 00 00 45 85 ff 0f 85 06 02 00 00
RSP: 0018:ffffc900046ff998 EFLAGS: 00000286
RAX: 0000000000000000 RBX: ffff888010c40900 RCX: 0000000000000001
RDX: 1ffffffff1799404 RSI: 0000000000001000 RDI: ffff8880843515c4
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000dc0
R13: 0000000000000dc0 R14: 0000000000000a20 R15: 0000000000000400
 kmalloc include/linux/slab.h:590 [inline]
 kzalloc include/linux/slab.h:724 [inline]
 kobject_uevent_env+0x240/0x1650 lib/kobject_uevent.c:524
 __loop_clr_fd+0x717/0x1070 drivers/block/loop.c:1150
 loop_clr_fd drivers/block/loop.c:1237 [inline]
 lo_ioctl+0x398/0x17c0 drivers/block/loop.c:1562
 blkdev_ioctl+0x37a/0x800 block/ioctl.c:609
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f77600ee8a7
Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 04 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f775d663fa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f77600ee8a7
RDX: 0000000000000000 RSI: 0000000000004c01 RDI: 0000000000000004
RBP: 00007f775d6646bc R08: 00007f775d664040 R09: 0000000020000000
R10: 0000000000000060 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000016 R14: 00007f775d664000 R15: 0000000020010800
 </TASK>
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	f6 87 88 00 00 00 03 	testb  $0x3,0x88(%rdi)
   9:	75 4d                	jne    0x58
   b:	48 8b 15 a0 4d d1 05 	mov    0x5d14da0(%rip),%rdx        # 0x5d14db2
  12:	48 85 d2             	test   %rdx,%rdx
  15:	74 41                	je     0x58
  17:	8b 42 0c             	mov    0xc(%rdx),%eax
  1a:	85 c0                	test   %eax,%eax
  1c:	74 3a                	je     0x58
  1e:	8d 48 01             	lea    0x1(%rax),%ecx
  21:	48 8d 72 0c          	lea    0xc(%rdx),%rsi
  25:	f0 0f b1 4a 0c       	lock cmpxchg %ecx,0xc(%rdx)
* 2a:	75 ee                	jne    0x1a <-- trapping instruction
  2c:	48 63 42 08          	movslq 0x8(%rdx),%rax
  30:	4c 8b 8f 80 00 00 00 	mov    0x80(%rdi),%r9
  37:	48 8b 12             	mov    (%rdx),%rdx
  3a:	83 f8 01             	cmp    $0x1,%eax
  3d:	49                   	rex.WB
  3e:	8d                   	.byte 0x8d
  3f:	49                   	rex.WB

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2021/12/01 17:12 upstream 58e1100fdc59 5fa3eacc .config log report info INFO: task hung in tty_ldisc_hangup
* Struck through repros no longer work on HEAD.