syzbot

 sign-in | mailing list | source | docs
🐞 Open [717] 🐞 Fixed [181] 🐞 Invalid [640] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: task hung in d_alloc_parallel

Status: upstream: reported C repro on 2019/08/14 00:43
Reported-by: syzbot+7e73f7fd42e647eb1e57@syzkaller.appspotmail.com
First crash: 1716d, last: 1107d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 INFO: task hung in d_alloc_parallel 85 1688d 1837d 0/3 auto-closed as invalid on 2020/01/08 20:52
linux-5.15 INFO: task hung in d_alloc_parallel 5 9h36m 6d18h 0/3 upstream: reported on 2024/04/18 05:41
android-414 INFO: task hung in d_alloc_parallel 1 1647d 1647d 0/1 auto-closed as invalid on 2020/02/18 04:29
linux-4.19 INFO: task hung in d_alloc_parallel vfs C error 5 437d 1454d 0/1 upstream: reported C repro on 2020/05/01 20:49
upstream INFO: task hung in d_alloc_parallel fuse 213 1881d 2212d 0/26 closed as dup on 2018/09/08 15:40
linux-6.1 INFO: task hung in d_alloc_parallel 5 3d09h 9d20h 0/3 upstream: reported on 2024/04/15 03:31
upstream INFO: task hung in d_alloc_parallel (2) fs C done error 330 1h55m 1646d 0/26 upstream: reported C repro on 2019/10/22 22:44
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2023/02/06 23:32 10m retest repro linux-4.14.y report log
2023/02/06 22:32 9m retest repro linux-4.14.y report log
2023/02/06 21:32 14m retest repro linux-4.14.y report log
2022/09/16 16:29 9m retest repro linux-4.14.y report log
2022/09/16 07:29 10m retest repro linux-4.14.y report log
2022/09/16 06:29 9m retest repro linux-4.14.y report log
▶ ▼ Fix bisection attempts (5)
Created Duration User Patch Repo Result
2020/04/11 12:38 19m bisect fix linux-4.14.y error job log (0)
2020/03/12 11:34 40m bisect fix linux-4.14.y job log (0) log
2020/02/11 09:01 38m bisect fix linux-4.14.y job log (0) log
2020/01/12 08:22 39m bisect fix linux-4.14.y job log (0) log
2019/12/13 07:35 37m bisect fix linux-4.14.y job log (0) log

Sample crash report:
audit: type=1400 audit(1571683562.516:36): avc:  denied  { map } for  pid=6832 comm="syz-executor275" path="/root/syz-executor275971265" dev="sda1" ino=2233 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
INFO: task init:1 blocked for more than 140 seconds.
      Not tainted 4.14.150 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D25168     1      0 0x00000000
Call Trace:
 context_switch kernel/sched/core.c:2807 [inline]
 __schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
 schedule+0x92/0x1c0 kernel/sched/core.c:3427
 d_wait_lookup fs/dcache.c:2479 [inline]
 d_alloc_parallel+0xf77/0x1800 fs/dcache.c:2561
 lookup_slow+0x188/0x440 fs/namei.c:1678
 walk_component+0x698/0x1d00 fs/namei.c:1824
 link_path_walk+0x81f/0x10a0 fs/namei.c:2153
 path_lookupat.isra.0+0xcb/0x7b0 fs/namei.c:2341
 filename_lookup+0x18e/0x380 fs/namei.c:2376
 user_path_at_empty+0x43/0x50 fs/namei.c:2630
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0xcd/0x160 fs/stat.c:185
 vfs_stat include/linux/fs.h:3060 [inline]
 SYSC_newstat+0x95/0x100 fs/stat.c:337
 SyS_newstat+0x1e/0x30 fs/stat.c:333
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7fa47a700c65
RSP: 002b:00007ffe5eb395a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00007ffe5eb397e0 RCX: 00007fa47a700c65
RDX: 00007ffe5eb397e0 RSI: 00007ffe5eb397e0 RDI: 0000000000407545
RBP: 0000000000000000 R08: 0000000001d2ab60 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00007ffe5eb39ce0 R14: 0000000000000000 R15: 0000000000000000
INFO: task cron:6730 blocked for more than 140 seconds.
      Not tainted 4.14.150 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
cron            D25968  6730      1 0x00000000
Call Trace:
 context_switch kernel/sched/core.c:2807 [inline]
 __schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
 schedule+0x92/0x1c0 kernel/sched/core.c:3427
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3485
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x73c/0x1470 kernel/locking/mutex.c:893
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
 fuse_lock_inode+0xbc/0xf0 fs/fuse/inode.c:365
 fuse_lookup+0x7a/0x380 fs/fuse/dir.c:360
 lookup_slow+0x226/0x440 fs/namei.c:1695
 walk_component+0x698/0x1d00 fs/namei.c:1824
 link_path_walk+0x81f/0x10a0 fs/namei.c:2153
 path_lookupat.isra.0+0xcb/0x7b0 fs/namei.c:2341
 filename_lookup+0x18e/0x380 fs/namei.c:2376
 user_path_at_empty+0x43/0x50 fs/namei.c:2630
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0xcd/0x160 fs/stat.c:185
 vfs_stat include/linux/fs.h:3060 [inline]
 SYSC_newstat+0x95/0x100 fs/stat.c:337
 SyS_newstat+0x1e/0x30 fs/stat.c:333
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f09fe6c7c65
RSP: 002b:00007ffd25dbb598 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00007f09fe745aa4 RCX: 00007f09fe6c7c65
RDX: 00007ffd25dbb5e0 RSI: 00007ffd25dbb5e0 RDI: 00007f09fe745aa4
RBP: 00007ffd25dbb6e0 R08: 0000000001eab710 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 000000000000002f R15: 0000000000000000
INFO: task syz-executor275:6832 blocked for more than 140 seconds.
      Not tainted 4.14.150 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor275 D28144  6832   6830 0x00000000
Call Trace:
 context_switch kernel/sched/core.c:2807 [inline]
 __schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
 schedule+0x92/0x1c0 kernel/sched/core.c:3427
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3485
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x73c/0x1470 kernel/locking/mutex.c:893
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
 fuse_lock_inode+0xbc/0xf0 fs/fuse/inode.c:365
 fuse_lookup+0x7a/0x380 fs/fuse/dir.c:360
 lookup_slow+0x226/0x440 fs/namei.c:1695
 walk_component+0x698/0x1d00 fs/namei.c:1824
 link_path_walk+0x81f/0x10a0 fs/namei.c:2153
 path_openat+0x189/0x3f70 fs/namei.c:3565
 do_filp_open+0x18e/0x250 fs/namei.c:3600
 do_sys_open+0x2c5/0x430 fs/open.c:1084
 SYSC_open fs/open.c:1102 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1097
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x444c90
RSP: 002b:00007ffc7a0b4ec0 EFLAGS: 00000206 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444c90
RDX: 0000000000000000 RSI: 0000000000090800 RDI: 00000000004ae8f6
RBP: 0000000000001ab4 R08: 0000000000001ab0 R09: 0000000000c76880
R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc7a0b50f0
R13: 00000000004075c0 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor275:6836 blocked for more than 140 seconds.
      Not tainted 4.14.150 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor275 D28480  6836   6832 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2807 [inline]
 __schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
 schedule+0x92/0x1c0 kernel/sched/core.c:3427
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3485
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x73c/0x1470 kernel/locking/mutex.c:893
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
 fuse_lock_inode+0xbc/0xf0 fs/fuse/inode.c:365
 fuse_lookup+0x7a/0x380 fs/fuse/dir.c:360
 lookup_slow+0x226/0x440 fs/namei.c:1695
 walk_component+0x698/0x1d00 fs/namei.c:1824
 link_path_walk+0x81f/0x10a0 fs/namei.c:2153
 path_openat+0x189/0x3f70 fs/namei.c:3565
 do_filp_open+0x18e/0x250 fs/namei.c:3600
 do_sys_open+0x2c5/0x430 fs/open.c:1084
 SYSC_open fs/open.c:1102 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1097
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x405800
RSP: 002b:00007ffc7a0b4bc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007ffc7a0b4bf4 RCX: 0000000000405800
RDX: 00007ffc7a0b4bfa RSI: 0000000000080001 RDI: 00000000004ae914
RBP: 00007ffc7a0b4bf0 R08: 0000000000000000 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000407530
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Showing all locks held in the system:
1 lock held by init/1:
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] inode_lock_shared include/linux/fs.h:728 [inline]
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] lookup_slow+0x138/0x440 fs/namei.c:1673
1 lock held by khungtaskd/1016:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffff814875a8>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4544
2 locks held by udevd/3536:
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] inode_lock_shared include/linux/fs.h:728 [inline]
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] lookup_slow+0x138/0x440 fs/namei.c:1673
 #1:  (&fi->mutex){+.+.}, at: [<ffffffff8219c43c>] fuse_lock_inode+0xbc/0xf0 fs/fuse/inode.c:365
1 lock held by rsyslogd/6685:
 #0:  (&f->f_pos_lock){+.+.}, at: [<ffffffff8194539b>] __fdget_pos+0xab/0xd0 fs/file.c:769
2 locks held by cron/6730:
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] inode_lock_shared include/linux/fs.h:728 [inline]
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] lookup_slow+0x138/0x440 fs/namei.c:1673
 #1:  (&fi->mutex){+.+.}, at: [<ffffffff8219c43c>] fuse_lock_inode+0xbc/0xf0 fs/fuse/inode.c:365
2 locks held by getty/6808:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff861c2fb3>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f4b6>] n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6809:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff861c2fb3>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f4b6>] n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6810:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff861c2fb3>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f4b6>] n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6811:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff861c2fb3>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f4b6>] n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6812:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff861c2fb3>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f4b6>] n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6813:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff861c2fb3>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f4b6>] n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6814:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff861c2fb3>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f4b6>] n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by syz-executor275/6832:
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] inode_lock_shared include/linux/fs.h:728 [inline]
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] lookup_slow+0x138/0x440 fs/namei.c:1673
 #1:  (&fi->mutex){+.+.}, at: [<ffffffff8219c43c>] fuse_lock_inode+0xbc/0xf0 fs/fuse/inode.c:365
2 locks held by syz-executor275/6836:
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] inode_lock_shared include/linux/fs.h:728 [inline]
 #0:  (&type->i_mutex_dir_key#6){++++}, at: [<ffffffff818fe258>] lookup_slow+0x138/0x440 fs/namei.c:1673
 #1:  (&fi->mutex){+.+.}, at: [<ffffffff8219c43c>] fuse_lock_inode+0xbc/0xf0 fs/fuse/inode.c:365

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1016 Comm: khungtaskd Not tainted 4.14.150 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x138/0x197 lib/dump_stack.c:53
 nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
 watchdog+0x5e7/0xb90 kernel/hung_task.c:274
 kthread+0x319/0x430 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff861c3a9e

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/21 18:53 linux-4.14.y b98aebd29824 b24d2b8a .config console log report syz C ci2-linux-4-14
2019/10/02 03:03 linux-4.14.y f6e27dbb1afa b7a87a83 .config console log report syz C ci2-linux-4-14
2019/08/13 23:42 linux-4.14.y 3ffe1e79c174 74d61399 .config console log report syz C ci2-linux-4-14
2021/04/13 22:48 linux-4.14.y 958e517f4e16 a184b83e .config console log report info ci2-linux-4-14 INFO: task hung in d_alloc_parallel
* Struck through repros no longer work on HEAD.