INFO: task hung in do

[upstream] INFO: task hung in do_exit
Status: moderation: reported on 2018/04/23 01:02
Reported-by: syzbot+8a19c77ce070f0d4d3bb@syzkaller.appspotmail.com
First: 273d, last: 3d19h

Sample crash report:

FAT-fs (loop2): bogus number of reserved sectors
FAT-fs (loop2): Can't find a valid FAT filesystem
FAT-fs (loop2): bogus number of reserved sectors
FAT-fs (loop2): Can't find a valid FAT filesystem
kworker/dying (7) used greatest stack depth: 224 bytes left
INFO: task syz-executor3:27706 blocked for more than 140 seconds.
      Not tainted 4.20.0+ #170
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D23400 27706  27173 0x80000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x86c/0x1ed0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
 rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
 call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
 __down_read arch/x86/include/asm/rwsem.h:83 [inline]
 down_read+0x9b/0x120 kernel/locking/rwsem.c:26
 exit_mm kernel/exit.c:511 [inline]
 do_exit+0x59c/0x26d0 kernel/exit.c:854
 do_group_exit+0x177/0x440 kernel/exit.c:970
 get_signal+0x8b0/0x1980 kernel/signal.c:2517
 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457a0a
Code: Bad RIP value.
RSP: 002b:00007ffd9bffea98 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 0000000000457a0a
RDX: 0000000000000003 RSI: 0000000000021000 RDI: 0000000000000000
RBP: ffffffffffffffff R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000020022 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000021000 R14: 0000000000020022 R15: 0000000000000000
INFO: task syz-executor3:27721 blocked for more than 140 seconds.
      Not tainted 4.20.0+ #170
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D20000 27721  27173 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x86c/0x1ed0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 __rwsem_down_write_failed_common+0xbbc/0x15e0 kernel/locking/rwsem-xadd.c:577
 rwsem_down_write_failed+0xe/0x10 kernel/locking/rwsem-xadd.c:606
 call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
 __down_write arch/x86/include/asm/rwsem.h:142 [inline]
 down_write+0xa5/0x130 kernel/locking/rwsem.c:72
 do_mmu_notifier_register+0x4f0/0x730 mm/mmu_notifier.c:265
 mmu_notifier_register+0x22/0x30 mm/mmu_notifier.c:316
 kvm_init_mmu_notifier arch/x86/kvm/../../../virt/kvm/kvm_main.c:515 [inline]
 kvm_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:683 [inline]
 kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:3325 [inline]
 kvm_dev_ioctl+0x1283/0x1ae0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3377
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4579b9
Code: Bad RIP value.
RSP: 002b:00007f5e497e0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004579b9
RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 000000000000000d
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5e497e16d4
R13: 00000000004c0650 R14: 00000000004d1e48 R15: 00000000ffffffff

Showing all locks held in the system:
1 lock held by khungtaskd/1026:
 #0: 00000000f5eff29b (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4389
1 lock held by rsyslogd/7883:
 #0: 0000000081331b2f (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200 fs/file.c:766
2 locks held by getty/7973:
 #0: 00000000426e4634 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000dd805982 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/7974:
 #0: 000000001e21e6a2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000e7e7a254 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/7975:
 #0: 00000000c81a80fc (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000dc7b909f (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/7976:
 #0: 00000000ea238524 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 000000008445b353 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/7977:
 #0: 0000000086e352d9 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000b3ac6b48 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/7978:
 #0: 00000000f5ba164f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000049277b7f (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/7979:
 #0: 00000000797a173f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000426fb84a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
1 lock held by syz-executor3/27706:
 #0: 0000000025e7a9a5 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511 [inline]
 #0: 0000000025e7a9a5 (&mm->mmap_sem){++++}, at: do_exit+0x59c/0x26d0 kernel/exit.c:854
2 locks held by syz-executor3/27711:
1 lock held by syz-executor3/27721:
 #0: 0000000025e7a9a5 (&mm->mmap_sem){++++}, at: do_mmu_notifier_register+0x4f0/0x730 mm/mmu_notifier.c:265

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1026 Comm: khungtaskd Not tainted 4.20.0+ #170
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold.4+0x63/0xa2 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1c2/0x22c lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
 watchdog+0xb51/0x1060 kernel/hung_task.c:289
 kthread+0x35a/0x440 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.367 msecs
NMI backtrace for cpu 0
CPU: 0 PID: 27711 Comm: syz-executor3 Not tainted 4.20.0+ #170
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:766 [inline]
RIP: 0010:lock_release+0x51d/0xa00 kernel/locking/lockdep.c:3863
Code: 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 55 03 00 00 48 83 3d 92 5f 10 08 00 0f 84 15 02 00 00 48 8b bd e0 fe ff ff 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00
RSP: 0018:ffff8880ae607678 EFLAGS: 00000086
RAX: dffffc0000000000 RBX: 1ffff11015cc0ed4 RCX: 1ffff1100ac991de
RDX: 1ffffffff12e4166 RSI: 1ffff1100ac991ea RDI: 0000000000000086
RBP: ffff8880ae6077a8 R08: 1ffff11015cc0ed8 R09: 0000000000000008
R10: 0000000000000003 R11: ffff8880564c8680 R12: ffff8880564c8680
R13: 0000000000000002 R14: ffff8880564c8680 R15: ffff8880ae6076c0
FS:  00007f5e49802700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 000000007b96e000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 seqcount_lockdep_reader_access include/linux/seqlock.h:82 [inline]
 read_seqcount_begin include/linux/seqlock.h:164 [inline]
 ktime_get+0x168/0x400 kernel/time/timekeeping.c:751
 hrtimer_forward_now include/linux/hrtimer.h:470 [inline]
 perf_swevent_hrtimer+0x405/0x510 kernel/events/core.c:9160
 __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
 __hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
 hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
 smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>
RIP: 0010:check_memory_region_inline mm/kasan/kasan.c:251 [inline]
RIP: 0010:check_memory_region+0x22/0x1b0 mm/kasan/kasan.c:267
Code: 0f 1f 84 00 00 00 00 00 48 85 f6 0f 84 3c 01 00 00 48 b8 ff ff ff ff ff 7f ff ff 55 0f b6 d2 48 39 c7 48 89 e5 41 55 41 54 53 <0f> 86 11 01 00 00 4c 8d 5c 37 ff 48 89 fb 49 b9 00 00 00 00 00 fc
RSP: 0018:ffff8880795d5808 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13
RAX: ffff7fffffffffff RBX: 1ffff1100f2bab09 RCX: ffffffff816a0082
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880ae62dc78
RBP: ffff8880795d5820 R08: ffff8880564c8680 R09: ffffed1015cc5b8f
R10: ffffed1015cc5b8f R11: ffff8880ae62dc7b R12: ffff8880ae62dbc0
R13: ffff8880795d58a8 R14: ffff8880ae62dc78 R15: 0000000000000001
 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
 rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 kernel/rcu/tree.c:305
 rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:932
 rcu_read_lock_held+0x87/0xc0 kernel/rcu/update.c:277
 blkg_lookup include/linux/blk-cgroup.h:337 [inline]
 blk_get_rl include/linux/blk-cgroup.h:547 [inline]
 blk_mq_bio_to_request+0x177/0x940 block/blk-mq.c:1678
 blk_mq_make_request+0x124a/0x2590 block/blk-mq.c:1880
 generic_make_request+0x9be/0x15a0 block/blk-core.c:2452
 submit_bio+0xba/0x460 block/blk-core.c:2560
 mpage_bio_submit fs/mpage.c:66 [inline]
 do_mpage_readpage+0x169a/0x24d0 fs/mpage.c:316
 mpage_readpages+0x56c/0x950 fs/mpage.c:404
 blkdev_readpages+0x2c/0x40 fs/block_dev.c:578
 read_pages+0x13a/0x680 mm/readahead.c:123
 __do_page_cache_readahead+0x560/0x810 mm/readahead.c:187
 ra_submit mm/internal.h:66 [inline]
 do_sync_mmap_readahead mm/filemap.c:2371 [inline]
 filemap_fault+0xf4e/0x25f0 mm/filemap.c:2447
 ? __sched_text_
Lost 94 message(s)!

All crashes (17):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Maintainers
ci-upstream-kasan-gce-smack-root	2018/12/27 18:01	upstream	fc2fd5f0	43cf01dd	.config	log	report	akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org
ci-upstream-kasan-gce-smack-root	2018/11/20 08:59	upstream	f2ce1065	9bc2a903	.config	log	report	akpm@linux-foundation.org, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org, sudipm.mukherjee@gmail.com
ci-upstream-kasan-gce-root	2018/11/16 13:59	upstream	da5322e6	f5e275d1	.config	log	report	akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org, sudipm.mukherjee@gmail.com
ci-upstream-kasan-gce-root	2018/10/14 23:49	upstream	3a272031	caf12900	.config	log	report	akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mark.rutland@arm.com, mcgrof@kernel.org, sudipm.mukherjee@gmail.com
ci-upstream-kasan-gce-selinux-root	2018/10/03 19:00	upstream	6bebe379	8b311eaf	.config	log	report	akpm@linux-foundation.org, ebiederm@xmission.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mark.rutland@arm.com, mingo@kernel.org, sudipm.mukherjee@gmail.com
ci-upstream-kasan-gce-root	2018/07/21 01:15	upstream	28c20cc7	af255b09	.config	log	report	akpm@linux-foundation.org, ebiederm@xmission.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mark.rutland@arm.com, mingo@kernel.org, paulmck@linux.vnet.ibm.com, sudipm.mukherjee@gmail.com, viro@zeniv.linux.org.uk
ci-upstream-net-kasan-gce	2018/04/20 23:48	net-next	0263ea5c	cc402841	.config	log	report	akpm@linux-foundation.org, keescook@chromium.org, linux-kernel@vger.kernel.org, mingo@kernel.org, paulmck@linux.vnet.ibm.com, viro@zeniv.linux.org.uk
ci-upstream-linux-next-kasan-gce-root	2019/01/15 04:36	linux-next	5aa6589e	ebacf5cb	.config	log	report	akpm@linux-foundation.org, ap420073@gmail.com, avagin@gmail.com, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org
ci-upstream-linux-next-kasan-gce-root	2019/01/13 07:02	linux-next	b808822a	c3f3344c	.config	log	report	akpm@linux-foundation.org, avagin@gmail.com, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org, sfr@canb.auug.org.au
ci-upstream-linux-next-kasan-gce-root	2019/01/12 07:39	linux-next	b808822a	c3f3344c	.config	log	report	avagin@gmail.com, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org, sfr@canb.auug.org.au
ci-upstream-linux-next-kasan-gce-root	2019/01/12 01:13	linux-next	b808822a	c3f3344c	.config	log	report	akpm@linux-foundation.org, avagin@gmail.com, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org
ci-upstream-linux-next-kasan-gce-root	2019/01/09 05:09	linux-next	d6e77253	010ed08b	.config	log	report	akpm@linux-foundation.org, avagin@gmail.com, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org
ci-upstream-linux-next-kasan-gce-root	2018/11/08 08:53	linux-next	f7af6d2c	e85d2a61	.config	log	report	akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mcgrof@kernel.org, sudipm.mukherjee@gmail.com
ci-upstream-linux-next-kasan-gce-root	2018/10/07 12:05	linux-next	12ffaa11	8b311eaf	.config	log	report	akpm@linux-foundation.org, ebiederm@xmission.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mark.rutland@arm.com, mcgrof@kernel.org, paulmck@linux.vnet.ibm.com, sudipm.mukherjee@gmail.com
ci-upstream-linux-next-kasan-gce-root	2018/10/02 07:10	linux-next	4794a36b	e06f7713	.config	log	report	akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux@dominikbrodowski.net, mark.rutland@arm.com, mcgrof@kernel.org, sudipm.mukherjee@gmail.com
ci-upstream-linux-next-kasan-gce-root	2018/09/03 20:17	linux-next	dceb9092	a4718693	.config	log	report	akpm@linux-foundation.org, ebiederm@xmission.com, keescook@chromium.org, linux-kernel@vger.kernel.org, mcgrof@kernel.org, sudipm.mukherjee@gmail.com, viro@zeniv.linux.org.uk
ci-upstream-linux-next-kasan-gce-root	2018/07/30 08:29	linux-next	d1e0b8e0	1a381291	.config	log	report	akpm@linux-foundation.org, byungchul.park@lge.com, j@bitron.ch, keescook@chromium.org, linux-kernel@vger.kernel.org, mingo@kernel.org, paulmck@linux.vnet.ibm.com, sudipm.mukherjee@gmail.com, viro@zeniv.linux.org.uk