syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: task hung in pipe_write (3)

Status: auto-closed as invalid on 2020/04/25 05:37
Subsystems: fs
[Documentation on labels]
First crash: 1551d, last: 1551d
▶ ▼ Similar bugs (10)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 INFO: task hung in pipe_write 1 1966d 1838d 0/2 auto-closed as invalid on 2019/06/05 06:19
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 913 44d 1889d 0/26 upstream: reported C repro on 2019/02/22 17:00
upstream INFO: task hung in pipe_write (2) ext4 C done 6 1680d 1680d 0/26 closed as invalid on 2019/09/28 02:25
upstream INFO: task hung in pipe_write fs 8 1911d 2025d 0/26 auto-closed as invalid on 2019/07/30 21:09
linux-4.14 INFO: task hung in pipe_write C 1 432d 549d 0/1 upstream: reported C repro on 2022/10/24 05:45
android-44 INFO: task hung in pipe_write (2) 1 1607d 1607d 0/2 auto-closed as invalid on 2020/03/31 01:26
android-49 INFO: task hung in pipe_write C 3 1632d 1838d 0/3 public: reported C repro on 2019/04/14 08:51
linux-4.19 INFO: task hung in pipe_write C error 13 519d 1419d 0/1 upstream: reported C repro on 2020/06/07 01:40
upstream INFO: task hung in pipe_write (4) fs syz error 7 818d 1365d 0/26 auto-obsoleted due to no activity on 2022/10/22 17:00
android-414 INFO: task hung in pipe_write 1 1655d 1655d 0/1 auto-closed as invalid on 2020/02/11 22:17

Sample crash report:
INFO: task syz-executor.2:26444 blocked for more than 143 seconds.
      Not tainted 5.5.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D29400 26444   9683 0x00004004
Call Trace:
 context_switch kernel/sched/core.c:3385 [inline]
 __schedule+0x934/0x1f90 kernel/sched/core.c:4081
 schedule+0xdc/0x2b0 kernel/sched/core.c:4155
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4214
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x7ab/0x13c0 kernel/locking/mutex.c:1103
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1118
 __pipe_lock fs/pipe.c:86 [inline]
 pipe_write+0x598/0x15a0 fs/pipe.c:583
 call_write_iter include/linux/fs.h:1902 [inline]
 new_sync_write+0x4d3/0x770 fs/read_write.c:483
 __vfs_write+0xe1/0x110 fs/read_write.c:496
 vfs_write+0x268/0x5d0 fs/read_write.c:558
 ksys_write+0x220/0x290 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:620
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: Bad RIP value.
RSP: 002b:00007f34554abc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f34554ac6d4 RCX: 000000000045b349
RDX: 00000000fffffecc RSI: 0000000020000000 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000c9a R14: 00000000004cd79d R15: 000000000075bf2c
INFO: task syz-executor.2:26475 blocked for more than 143 seconds.
      Not tainted 5.5.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D29480 26475   9683 0x00004004
Call Trace:
 context_switch kernel/sched/core.c:3385 [inline]
 __schedule+0x934/0x1f90 kernel/sched/core.c:4081
 schedule+0xdc/0x2b0 kernel/sched/core.c:4155
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4214
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x7ab/0x13c0 kernel/locking/mutex.c:1103
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1118
 __pipe_lock fs/pipe.c:86 [inline]
 pipe_write+0x598/0x15a0 fs/pipe.c:583
 call_write_iter include/linux/fs.h:1902 [inline]
 new_sync_write+0x4d3/0x770 fs/read_write.c:483
 __vfs_write+0xe1/0x110 fs/read_write.c:496
 vfs_write+0x268/0x5d0 fs/read_write.c:558
 ksys_write+0x220/0x290 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:620
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: Bad RIP value.
RSP: 002b:00007f3455469c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f345546a6d4 RCX: 000000000045b349
RDX: 00000000fffffecc RSI: 0000000020000000 RDI: 0000000000000004
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000c9a R14: 00000000004cd79d R15: 000000000075c07c
INFO: task syz-executor.2:26478 blocked for more than 144 seconds.
      Not tainted 5.5.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D27128 26478   9683 0x00004004
Call Trace:
 context_switch kernel/sched/core.c:3385 [inline]
 __schedule+0x934/0x1f90 kernel/sched/core.c:4081
 schedule+0xdc/0x2b0 kernel/sched/core.c:4155
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4214
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x7ab/0x13c0 kernel/locking/mutex.c:1103
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1118
 nfnl_lock net/netfilter/nfnetlink.c:62 [inline]
 nfnetlink_rcv_msg+0x9ee/0xfb0 net/netfilter/nfnetlink.c:224
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
 nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:672
 kernel_sendmsg+0x44/0x50 net/socket.c:692
 sock_no_sendpage+0x116/0x150 net/core/sock.c:2740
 kernel_sendpage+0x92/0xf0 net/socket.c:3789
 sock_sendpage+0x8b/0xc0 net/socket.c:950
 pipe_to_sendpage+0x2da/0x3c0 fs/splice.c:458
 splice_from_pipe_feed fs/splice.c:512 [inline]
 __splice_from_pipe+0x3ee/0x7c0 fs/splice.c:636
 splice_from_pipe+0x108/0x170 fs/splice.c:671
 generic_splice_sendpage+0x3c/0x50 fs/splice.c:844
 do_splice_from fs/splice.c:863 [inline]
 do_splice+0xba4/0x1680 fs/splice.c:1170
 __do_sys_splice fs/splice.c:1447 [inline]
 __se_sys_splice fs/splice.c:1427 [inline]
 __x64_sys_splice+0x2c6/0x330 fs/splice.c:1427
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: Bad RIP value.
RSP: 002b:00007f3455448c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 00007f34554496d4 RCX: 000000000045b349
RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 000000000075c118 R08: 000000000004ffe0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000b61 R14: 00000000004cce12 R15: 000000000075c124

Showing all locks held in the system:
1 lock held by khungtaskd/1099:
 #0: ffffffff899a3e00 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279 kernel/locking/lockdep.c:5333
1 lock held by rsyslogd/9548:
 #0: ffff8880a30bb420 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801
2 locks held by getty/9638:
 #0: ffff88808d4d9090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340
 #1: ffffc9000182b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 drivers/tty/n_tty.c:2156
2 locks held by getty/9639:
 #0: ffff888098a3e090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340
 #1: ffffc9000183b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 drivers/tty/n_tty.c:2156
2 locks held by getty/9640:
 #0: ffff8880922aa090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340
 #1: ffffc9000187b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 drivers/tty/n_tty.c:2156
2 locks held by getty/9641:
 #0: ffff888094ce0090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340
 #1: ffffc900018ab2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 drivers/tty/n_tty.c:2156
2 locks held by getty/9642:
 #0: ffff8880a8941090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340
 #1: ffffc9000188b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 drivers/tty/n_tty.c:2156
2 locks held by getty/9643:
 #0: ffff888098b23090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340
 #1: ffffc900018bb2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 drivers/tty/n_tty.c:2156
2 locks held by getty/9644:
 #0: ffff8880a80c3090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340
 #1: ffffc900017fb2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 drivers/tty/n_tty.c:2156
1 lock held by syz-executor.2/26444:
 #0: ffff8880a741e060 (&pipe->mutex/1){+.+.}, at: __pipe_lock fs/pipe.c:86 [inline]
 #0: ffff8880a741e060 (&pipe->mutex/1){+.+.}, at: pipe_write+0x598/0x15a0 fs/pipe.c:583
3 locks held by syz-executor.2/26451:
1 lock held by syz-executor.2/26475:
 #0: ffff8880a741e860 (&pipe->mutex/1){+.+.}, at: __pipe_lock fs/pipe.c:86 [inline]
 #0: ffff8880a741e860 (&pipe->mutex/1){+.+.}, at: pipe_write+0x598/0x15a0 fs/pipe.c:583
2 locks held by syz-executor.2/26478:
 #0: ffff8880a741e860 (&pipe->mutex/1){+.+.}, at: pipe_lock_nested fs/pipe.c:65 [inline]
 #0: ffff8880a741e860 (&pipe->mutex/1){+.+.}, at: pipe_lock+0x65/0x80 fs/pipe.c:73
 #1: ffffffff8c1e0cd0 (&table[i].mutex){+.+.}, at: nfnl_lock net/netfilter/nfnetlink.c:62 [inline]
 #1: ffffffff8c1e0cd0 (&table[i].mutex){+.+.}, at: nfnetlink_rcv_msg+0x9ee/0xfb0 net/netfilter/nfnetlink.c:224

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1099 Comm: khungtaskd Not tainted 5.5.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x70/0xb2 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x23b/0x28b lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
 watchdog+0xb11/0x10c0 kernel/hung_task.c:289
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.189 msecs
NMI backtrace for cpu 1
CPU: 1 PID: 26451 Comm: syz-executor.2 Not tainted 5.5.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__kasan_check_read+0x11/0x20 mm/kasan/common.c:96
Code: c2 48 c7 c7 20 e2 42 89 f7 da e8 be f7 aa ff e9 3e ef ff ff cc cc cc cc cc 55 89 f6 31 d2 48 89 e5 48 8b 4d 08 e8 1f 2a 00 00 <5d> c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 55 89 f6 ba 01 00 00
RSP: 0018:ffffc90001646df0 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff8880ae938100 RCX: ffffffff816280c4
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880ae9381e0
RBP: ffffc90001646df0 R08: 1ffff11015d2703c R09: ffffed1015d2703d
R10: ffffed1015d2703c R11: ffff8880ae9381e3 R12: ffff8880ae9381e0
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880a8bc1080
FS:  00007f345548b700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001fd0008 CR3: 00000001d3ae9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
 rcu_dynticks_curr_cpu_in_eqs+0x54/0xb0 kernel/rcu/tree.c:301
 rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:922
 rcu_read_lock_held_common+0xb4/0x130 kernel/rcu/update.c:105
 rcu_read_lock_held+0x5b/0xb0 kernel/rcu/update.c:281
 hash_ip6_list+0xb66/0xf60 net/netfilter/ipset/ip_set_hash_gen.h:1135
 ip_set_dump_start+0x96c/0x1ca0 net/netfilter/ipset/ip_set_core.c:1632
 netlink_dump+0x558/0xfb0 net/netlink/af_netlink.c:2244
 __netlink_dump_start+0x673/0x930 net/netlink/af_netlink.c:2352
 netlink_dump_start include/linux/netlink.h:233 [inline]
 ip_set_dump+0x15a/0x1d0 net/netfilter/ipset/ip_set_core.c:1690
 nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
 nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:672
 kernel_sendmsg+0x44/0x50 net/socket.c:692
 sock_no_sendpage+0x116/0x150 net/core/sock.c:2740
 kernel_sendpage+0x92/0xf0 net/socket.c:3789
 sock_sendpage+0x8b/0xc0 net/socket.c:950
 pipe_to_sendpage+0x2da/0x3c0 fs/splice.c:458
 splice_from_pipe_feed fs/splice.c:512 [inline]
 __splice_from_pipe+0x3ee/0x7c0 fs/splice.c:636
 splice_from_pipe+0x108/0x170 fs/splice.c:671
 generic_splice_sendpage+0x3c/0x50 fs/splice.c:844
 do_splice_from fs/splice.c:863 [inline]
 do_splice+0xba4/0x1680 fs/splice.c:1170
 __do_sys_splice fs/splice.c:1447 [inline]
 __se_sys_splice fs/splice.c:1427 [inline]
 __x64_sys_splice+0x2c6/0x330 fs/splice.c:1427
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f345548ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 00007f345548b6d4 RCX: 000000000045b349
RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 000000000075bfc8 R08: 000000000004ffe0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000b61 R14: 00000000004cce12 R15: 000000000075bfd4

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/26 05:29 net-next-old 3333e50b64fe f4e7270e .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.