syzbot

 sign-in | mailing list | source | docs
🐞 Open [196] 🐞 Fixed [42] 🐞 Invalid [470] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: task hung in ip6mr_sk_done

Status: auto-closed as invalid on 2019/02/22 12:59
First crash: 2191d, last: 2191d
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in ip6mr_sk_done (2) net 1 1301d 1301d 0/26 auto-closed as invalid on 2021/01/01 18:48
upstream INFO: task hung in ip6mr_sk_done (3) net 15 918d 957d 0/26 auto-closed as invalid on 2022/01/19 01:57
android-44 INFO: task hung in ip6mr_sk_done 1 2203d 2203d 0/2 auto-closed as invalid on 2019/02/22 13:39
linux-4.14 INFO: task hung in ip6mr_sk_done 1 1502d 1502d 0/1 auto-closed as invalid on 2020/07/14 17:23
upstream INFO: task hung in ip6mr_sk_done net 1 1402d 1402d 0/26 auto-closed as invalid on 2020/09/23 10:25
linux-4.19 INFO: task hung in ip6mr_sk_done 1 834d 834d 0/1 auto-closed as invalid on 2022/05/13 06:41

Sample crash report:
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
INFO: task syz-executor3:9188 blocked for more than 120 seconds.
b_state=0x00000029, b_size=512
      Not tainted 4.9.96-g71fce1e #10
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
device loop0 blocksize: 4096
syz-executor3   D
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
29144  9188   1806 0x00000002
b_state=0x00000029, b_size=512
 ffff8801cbac3000
device loop0 blocksize: 4096
 0000000000000000 ffff88018ff1b9c0 ffff8801d9a6b000__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 ffff8801db321b98
device loop0 blocksize: 4096
 ffff8801cfecfa18 ffffffff839e240d ffff8801cbac38c8__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 ffffed0039758718
device loop0 blocksize: 4096
 ffff8801cbac3000 00fffc0000000000 ffff8801db322468__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
Call Trace:
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff839e3a0f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3557
b_state=0x00000029, b_size=512
 [<ffffffff839e4393>] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3590
device loop0 blocksize: 4096
 [<ffffffff839e8816>] __mutex_lock_common kernel/locking/mutex.c:582 [inline]
 [<ffffffff839e8816>] mutex_lock_nested+0x326/0x870 kernel/locking/mutex.c:621
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff830b06a7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
b_state=0x00000029, b_size=512
 [<ffffffff836247db>] ip6mr_sk_done+0x3b/0x1e0 net/ipv6/ip6mr.c:1616
device loop0 blocksize: 4096
 [<ffffffff835c7eac>] rawv6_close+0x4c/0x80 net/ipv6/raw.c:1212
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff8341b57f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:434
b_state=0x00000029, b_size=512
 [<ffffffff83543350>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:440
device loop0 blocksize: 4096
 [<ffffffff8300eab6>] sock_release+0x96/0x1c0 net/socket.c:599
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff8300ebf6>] sock_close+0x16/0x20 net/socket.c:1046
b_state=0x00000029, b_size=512
 [<ffffffff81575b13>] __fput+0x263/0x700 fs/file_table.c:208
device loop0 blocksize: 4096
 [<ffffffff81576035>] ____fput+0x15/0x20 fs/file_table.c:244
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff8119603c>] task_work_run+0x10c/0x180 kernel/task_work.c:116
b_state=0x00000029, b_size=512
 [<ffffffff8113ec91>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff8113ec91>] do_exit+0x9e1/0x27c0 kernel/exit.c:837
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff81144d91>] do_group_exit+0x111/0x340 kernel/exit.c:941
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
 [<ffffffff81144fdd>] SYSC_exit_group kernel/exit.c:952 [inline]
 [<ffffffff81144fdd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:950
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
b_state=0x00000029, b_size=512
 [<ffffffff839f3313>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
device loop0 blocksize: 4096

Showing all locks held in the system:
__find_get_block_slow() failed. block=1, b_blocknr=8
2 locks held by khungtaskd/518:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (rcu_read_lock__find_get_block_slow() failed. block=1, b_blocknr=8
){......}b_state=0x00000029, b_size=512
, at: [<ffffffff813646ec>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
, at: [<ffffffff813646ec>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock
__find_get_block_slow() failed. block=1, b_blocknr=8
){.+.+..}b_state=0x00000029, b_size=512
, at: [<ffffffff81423ce0>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
__find_get_block_slow() failed. block=1, b_blocknr=8
1 lock held by rsyslogd/3679:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (&f->f_pos_lock){+.+.+.}__find_get_block_slow() failed. block=1, b_blocknr=8
, at: [<ffffffff815d579c>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/3775:
device loop0 blocksize: 4096
 #0:  (&tty->ldisc_sem
__find_get_block_slow() failed. block=1, b_blocknr=8
){++++++}b_state=0x00000029, b_size=512
, at: [<ffffffff839f14b2>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock
__find_get_block_slow() failed. block=1, b_blocknr=8
){+.+...}b_state=0x00000029, b_size=512
, at: [<ffffffff8211c792>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2133
1 lock held by syz-executor3/1806:
 #0: 
__find_get_block_slow() failed. block=1, b_blocknr=8
 (b_state=0x00000029, b_size=512
rtnl_mutexdevice loop0 blocksize: 4096
){+.+.+.}, at: [<ffffffff830b06a7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
3 locks held by kworker/1:4/7392:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 ("%s"("ipv6_addrconf")){.+.+..}__find_get_block_slow() failed. block=1, b_blocknr=8
, at: [<ffffffff8118ad3e>] work_static include/linux/workqueue.h:186 [inline]
, at: [<ffffffff8118ad3e>] set_work_data kernel/workqueue.c:617 [inline]
, at: [<ffffffff8118ad3e>] set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
, at: [<ffffffff8118ad3e>] process_one_work+0x6ee/0x1500 kernel/workqueue.c:2085
 #1: 
device loop0 blocksize: 4096
 ((addr_chk_work).work){+.+...}__find_get_block_slow() failed. block=1, b_blocknr=8
, at: [<ffffffff8118ad78>] process_one_work+0x728/0x1500 kernel/workqueue.c:2089
 #2: 
device loop0 blocksize: 4096
 (rtnl_mutex){+.+.+.}, at: [<ffffffff830b06a7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor3/9188:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (rtnl_mutex){+.+.+.}, at: [<ffffffff830b06a7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor4/9273:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (rtnl_mutex){+.+.+.}, at: [<ffffffff830b51cb>] rtnl_lock net/core/rtnetlink.c:70 [inline]
 (rtnl_mutex){+.+.+.}, at: [<ffffffff830b51cb>] rtnetlink_rcv+0x1b/0x40 net/core/rtnetlink.c:4064
1 lock held by syz-executor4/9277:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (rtnl_mutex){+.+.+.}, at: [<ffffffff830b51cb>] rtnl_lock net/core/rtnetlink.c:70 [inline]
 (rtnl_mutex){+.+.+.}, at: [<ffffffff830b51cb>] rtnetlink_rcv+0x1b/0x40 net/core/rtnetlink.c:4064
2 locks held by syz-executor0/9271:
b_state=0x00000029, b_size=512
 #0: 
device loop0 blocksize: 4096
 (sb_writers#11__find_get_block_slow() failed. block=1, b_blocknr=8
){.+.+.+}b_state=0x00000029, b_size=512
, at: [<ffffffff815de03f>] sb_start_write include/linux/fs.h:1573 [inline]
, at: [<ffffffff815de03f>] mnt_want_write+0x3f/0xb0 fs/namespace.c:391
 #1:  (&sb->s_type->i_mutex_key
__find_get_block_slow() failed. block=1, b_blocknr=8
#25b_state=0x00000029, b_size=512
){++++++}device loop0 blocksize: 4096
, at: [<ffffffff815a2f2c>] inode_lock_shared include/linux/fs.h:776 [inline]
, at: [<ffffffff815a2f2c>] do_last fs/namei.c:3314 [inline]
, at: [<ffffffff815a2f2c>] path_openat+0x17dc/0x3590 fs/namei.c:3534

b_state=0x00000029, b_size=512
=============================================

device loop0 blocksize: 4096
NMI backtrace for cpu 0
CPU: 0 PID: 518 Comm: khungtaskd Not tainted 4.9.96-g71fce1e #10
__find_get_block_slow() failed. block=1, b_blocknr=8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
b_state=0x00000029, b_size=512
 ffff8801d8b07d08
device loop0 blocksize: 4096
 ffffffff81eb0b69 0000000000000000 0000000000000000__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 0000000000000000
device loop0 blocksize: 4096
 0000000000000001 ffffffff810b7d60 ffff8801d8b07d40__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 ffffffff81ebbe97
device loop0 blocksize: 4096
 0000000000000000 0000000000000000 0000000000000003__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
Call Trace:
device loop0 blocksize: 4096
 [<ffffffff81eb0b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb0b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 [<ffffffff81ebbe97>] nmi_cpu_backtrace.cold.2+0x48/0x87 lib/nmi_backtrace.c:99
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff81ebbe2a>] nmi_trigger_cpumask_backtrace+0x12a/0x14f lib/nmi_backtrace.c:60
b_state=0x00000029, b_size=512
 [<ffffffff810b7e64>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
device loop0 blocksize: 4096
 [<ffffffff81364c84>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff81364c84>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff81364c84>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff81364c84>] watchdog+0x6b4/0xa20 kernel/hung_task.c:239
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
 [<ffffffff8119ad5d>] kthread+0x26d/0x300 kernel/kthread.c:211
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
 [<ffffffff839f34dc>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
b_state=0x00000029, b_size=512
Sending NMI from CPU 0 to CPUs 1:
device loop0 blocksize: 4096
NMI backtrace for cpu 1
CPU: 1 PID: 9194 Comm: syz-executor0 Not tainted 4.9.96-g71fce1e #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88019418b000 task.stack: ffff8801b9b40000
RIP: 0010:[<ffffffff8135ca14>] c [<ffffffff8135ca14>] preempt_count arch/x86/include/asm/preempt.h:22 [inline]
RIP: 0010:[<ffffffff8135ca14>] c [<ffffffff8135ca14>] check_kcov_mode kernel/kcov.c:66 [inline]
RIP: 0010:[<ffffffff8135ca14>] c [<ffffffff8135ca14>] __sanitizer_cov_trace_pc+0x14/0x50 kernel/kcov.c:100
RSP: 0018:ffff8801b9b473a8  EFLAGS: 00000283
RAX: ffff88019418b000 RBX: ffff88018ae54f18 RCX: ffffc9000011f000
RDX: 0000000080000001 RSI: ffffffff8162169c RDI: ffff88018ae54e78
RBP: ffff8801b9b473a8 R08: ffff88019418b960 R09: 0000000000000001
R10: ffff88019418b000 R11: 1ffff10032831727 R12: dffffc0000000000
R13: ffffea0006a44840 R14: ffff88018ae541f8 R15: ffff8801d5d96350
FS:  00007f667bb0a700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c4219b3c00 CR3: 00000001d93f6000 CR4: 00000000001606f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffff8801b9b47408c ffffffff816216c0c ffff8801d5d96414c ffff8801d5d96650c
 ffff8801d5d961c0c 000000010000000fc 0000000000000001c 0000000000000010c
 0000000000000000c dffffc0000000000c ffff8801b6ba1888c 000000000000000fc
Call Trace:
 [<ffffffff816216c0>] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
 [<ffffffff816216c0>] buffer_mapped include/linux/buffer_head.h:122 [inline]
 [<ffffffff816216c0>] __find_get_block_slow+0x1b0/0x330 fs/buffer.c:222
 [<ffffffff81621b7e>] __find_get_block+0x23e/0x4c0 fs/buffer.c:1360
 [<ffffffff81622989>] __getblk_slow fs/buffer.c:1101 [inline]
 [<ffffffff81622989>] __getblk_gfp+0x189/0x710 fs/buffer.c:1386
 [<ffffffff8162632d>] __bread_gfp+0x2d/0x270 fs/buffer.c:1420
 [<ffffffff818b3d38>] sb_bread include/linux/buffer_head.h:300 [inline]
 [<ffffffff818b3d38>] fat__get_entry+0x4c8/0x8f0 fs/fat/dir.c:100
 [<ffffffff818b69c1>] fat_get_entry fs/fat/dir.c:128 [inline]
 [<ffffffff818b69c1>] fat_get_short_entry+0x131/0x2a0 fs/fat/dir.c:876
 [<ffffffff818b6f1d>] fat_scan+0xfd/0x340 fs/fat/dir.c:961
 [<ffffffff818de529>] msdos_find+0xf9/0x2d0 fs/fat/namei_msdos.c:128
 [<ffffffff818dee45>] msdos_lookup+0x135/0x250 fs/fat/namei_msdos.c:208
 [<ffffffff815989dd>] lookup_open+0x63d/0x1930 fs/namei.c:3203
 [<ffffffff815a2f53>] do_last fs/namei.c:3315 [inline]
 [<ffffffff815a2f53>] path_openat+0x1803/0x3590 fs/namei.c:3534
 [<ffffffff815a8fa7>] do_filp_open+0x197/0x270 fs/namei.c:3568
 [<ffffffff8156b77d>] do_sys_open+0x30d/0x5c0 fs/open.c:1072
 [<ffffffff8156baa0>] SYSC_openat fs/open.c:1099 [inline]
 [<ffffffff8156baa0>] SyS_openat+0x30/0x40 fs/open.c:1093
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f3313>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: ce8 c92 cca c1d c00 ce9 cf9 cfe cff cff c66 c2e c0f c1f c84 c00 c00 c00 c00 c00 c0f c1f c00 c55 c48 c89 ce5 c65 c48 c8b c04 c25 c40 c7d c01 c00 c65 c8b c15 cbc cb2 ccb c7e c<81> ce2 c00 c01 c1f c00 c48 c8b c75 c08 c75 c2b c8b c90 c80 c12 c00 c00 c83 cfa c02 c
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096
__find_get_block_slow() failed. block=1, b_blocknr=8
b_state=0x00000029, b_size=512
device loop0 blocksize: 4096

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/27 11:02 https://android.googlesource.com/kernel/common android-4.9 71fce1edd26d 73417389 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.