syzbot

 sign-in | mailing list | source | docs
🐞 Open [142] 🐞 Fixed [16] 🐞 Invalid [163] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: task hung in pipe_write

Status: auto-closed as invalid on 2019/06/05 06:19
Reported-by: syzbot+954589dd8456719dedfa@syzkaller.appspotmail.com
First crash: 1978d, last: 1978d
▶ ▼ Similar bugs (10)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in pipe_write (3) fs 1 1563d 1563d 0/26 auto-closed as invalid on 2020/04/25 05:37
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 917 2d10h 1900d 0/26 upstream: reported C repro on 2019/02/22 17:00
upstream INFO: task hung in pipe_write (2) ext4 C done 6 1692d 1691d 0/26 closed as invalid on 2019/09/28 02:25
upstream INFO: task hung in pipe_write fs 8 1922d 2036d 0/26 auto-closed as invalid on 2019/07/30 21:09
linux-4.14 INFO: task hung in pipe_write C 1 444d 561d 0/1 upstream: reported C repro on 2022/10/24 05:45
android-44 INFO: task hung in pipe_write (2) 1 1618d 1618d 0/2 auto-closed as invalid on 2020/03/31 01:26
android-49 INFO: task hung in pipe_write C 3 1644d 1850d 0/3 public: reported C repro on 2019/04/14 08:51
linux-4.19 INFO: task hung in pipe_write C error 13 531d 1430d 0/1 upstream: reported C repro on 2020/06/07 01:40
upstream INFO: task hung in pipe_write (4) fs syz error 7 830d 1377d 0/26 auto-obsoleted due to no activity on 2022/10/22 17:00
android-414 INFO: task hung in pipe_write 1 1666d 1666d 0/1 auto-closed as invalid on 2020/02/11 22:17

Sample crash report:
   Free memory is 2932kB above reserved
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-fuzzer' (2071) because
   cache 276kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2932kB above reserved
INFO: task syz-executor5:26709 blocked for more than 140 seconds.
      Not tainted 4.4.166+ #5
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor5   D ffff8800910cfa38 29032 26709   2121 0x00100004
 ffff8800910cfa38 0000000000000000 ffff8800a6cb3848 ffffed0014d96708
 ffff8800a6cb2f00 ffff8801db71f180 ffff8801db71f1a8 ffff8801db71e898
 ffff8801db71e880 ffff8801ab22df00 ffff8800a6cb2f80 0000000000000000
Call Trace:
 [<ffffffff82706dba>] schedule+0x7a/0x1b0 kernel/sched/core.c:3355
 [<ffffffff82707553>] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3388
 [<ffffffff827097ce>] __mutex_lock_common kernel/locking/mutex.c:582 [inline]
 [<ffffffff827097ce>] mutex_lock_nested+0x3be/0xb60 kernel/locking/mutex.c:621
 [<ffffffff814ab203>] pipe_lock_nested fs/pipe.c:65 [inline]
 [<ffffffff814ab203>] pipe_lock fs/pipe.c:73 [inline]
 [<ffffffff814ab203>] pipe_wait+0x1a3/0x1d0 fs/pipe.c:121
 [<ffffffff814ab8a5>] pipe_write+0x505/0xd80 fs/pipe.c:463
 [<ffffffff814918c4>] new_sync_write fs/read_write.c:478 [inline]
 [<ffffffff814918c4>] __vfs_write+0x304/0x3e0 fs/read_write.c:491
 [<ffffffff8149338e>] vfs_write+0x17e/0x4e0 fs/read_write.c:538
 [<ffffffff814959c9>] SYSC_write fs/read_write.c:585 [inline]
 [<ffffffff814959c9>] SyS_write+0xd9/0x1c0 fs/read_write.c:577
 [<ffffffff82715ce1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-executor1' (26702) because
   cache 276kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2932kB above reserved
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-fuzzer' (2076) because
   cache 276kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2932kB above reserved
1 lock held by syz-executor5/26709:
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814ab203>] pipe_lock_nested fs/pipe.c:65 [inline]
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814ab203>] pipe_lock fs/pipe.c:73 [inline]
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814ab203>] pipe_wait+0x1a3/0x1d0 fs/pipe.c:121
Sending NMI to all CPUs:
NMI backtrace for cpu 0
CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.166+ #5
task: ffff8801da7c2f80 task.stack: ffff8800001d0000
RIP: 0010:[<ffffffff8109c386>]  [<ffffffff8109c386>] native_apic_mem_write arch/x86/include/asm/apic.h:93 [inline]
RIP: 0010:[<ffffffff8109c386>]  [<ffffffff8109c386>] __default_send_IPI_dest_field arch/x86/include/asm/ipi.h:119 [inline]
RIP: 0010:[<ffffffff8109c386>]  [<ffffffff8109c386>] _flat_send_IPI_mask arch/x86/kernel/apic/apic_flat_64.c:61 [inline]
RIP: 0010:[<ffffffff8109c386>]  [<ffffffff8109c386>] flat_send_IPI_mask+0xf6/0x1a0 arch/x86/kernel/apic/apic_flat_64.c:69
RSP: 0018:ffff8800001d7cc8  EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000
RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300
RBP: ffff8800001d7cf0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246
R13: 0000000003000000 R14: ffffffff82e5f3a0 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000040427c CR3: 00000000a6bfd000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffffffff82e5f3a0 ffffffff831a6400 0000000000000007 fffffbfff0634b5c
 0000000000000008 ffff8800001d7d10 ffffffff810937b1 ffffffff82921f60
 0000000000000003 ffff8800001d7d68 ffffffff81ab115e ffffffff813a8a20
Call Trace:
 [<ffffffff810937b1>] nmi_raise_cpu_backtrace+0x61/0x80 arch/x86/kernel/apic/hw_nmi.c:33
 [<ffffffff81ab115e>] nmi_trigger_all_cpu_backtrace.cold.0+0x70/0xae lib/nmi_backtrace.c:85
 [<ffffffff81093854>] arch_trigger_all_cpu_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 [<ffffffff813b1c90>] trigger_all_cpu_backtrace include/linux/nmi.h:44 [inline]
 [<ffffffff813b1c90>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff813b1c90>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff813b1c90>] watchdog.cold.0+0xd3/0xee kernel/hung_task.c:238
 [<ffffffff81134788>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff82716105>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537
Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1a 4c 89 e7 57 9d 0f 1f 44 00 00 e8 d2 
NMI backtrace for cpu 1
CPU: 1 PID: 2076 Comm: syz-fuzzer Not tainted 4.4.166+ #5
task: ffff8800b8295f00 task.stack: ffff8801d4aa8000
RIP: 0010:[<ffffffff811fc68b>]  [<ffffffff811fc68b>] __lock_acquire+0x4b/0x5530 kernel/locking/lockdep.c:3072
RSP: 0018:ffff8801d4aaf160  EFLAGS: 00000086
RAX: 0000000000000000 RBX: ffff8800b8295f00 RCX: 0000000000000002
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffffffff82ea7360
RBP: ffff8801d4aaf300 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff82835d40 R11: ffffffff831a49b8 R12: ffffffff82ea7360
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000000c4201651e8(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f199ef62d50 CR3: 00000000b71f9000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8800b8296880 ffff8800b82967c0 ffff8800b8296888 0000000000000000
 ffff880000000000 ffff8800b82967b8 ffff8800b82967c8 1ffff1003a955e36
 ffffffff83a81e80 ffff880000000001 0000000041b58ab3 ffffffff82c4bd98
Call Trace:
 [<ffffffff812037de>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff813bfc46>] rcu_lock_acquire include/linux/rcupdate.h:477 [inline]
 [<ffffffff813bfc46>] rcu_read_lock include/linux/rcupdate.h:861 [inline]
 [<ffffffff813bfc46>] find_lock_task_mm+0x46/0x270 mm/oom_kill.c:106
 [<ffffffff821190af>] lowmem_scan+0x34f/0xb80 drivers/staging/android/lowmemorykiller.c:132
 [<ffffffff813eba79>] do_shrink_slab mm/vmscan.c:357 [inline]
 [<ffffffff813eba79>] shrink_slab.part.8+0x3e9/0xaf0 mm/vmscan.c:455
 [<ffffffff813f40bd>] shrink_slab mm/vmscan.c:425 [inline]
 [<ffffffff813f40bd>] shrink_zone+0x4bd/0x600 mm/vmscan.c:2448
 [<ffffffff813f4763>] shrink_zones mm/vmscan.c:2603 [inline]
 [<ffffffff813f4763>] do_try_to_free_pages mm/vmscan.c:2653 [inline]
 [<ffffffff813f4763>] try_to_free_pages+0x563/0xf20 mm/vmscan.c:2861
 [<ffffffff813cdf72>] __perform_reclaim mm/page_alloc.c:2915 [inline]
 [<ffffffff813cdf72>] __alloc_pages_direct_reclaim mm/page_alloc.c:2936 [inline]
 [<ffffffff813cdf72>] __alloc_pages_slowpath mm/page_alloc.c:3201 [inline]
 [<ffffffff813cdf72>] __alloc_pages_nodemask+0x862/0x1430 mm/page_alloc.c:3313
 [<ffffffff813d950b>] __alloc_pages include/linux/gfp.h:415 [inline]
 [<ffffffff813d950b>] __alloc_pages_node include/linux/gfp.h:428 [inline]
 [<ffffffff813d950b>] alloc_pages_node include/linux/gfp.h:442 [inline]
 [<ffffffff813d950b>] __page_cache_alloc include/linux/pagemap.h:226 [inline]
 [<ffffffff813d950b>] page_cache_alloc_readahead include/linux/pagemap.h:242 [inline]
 [<ffffffff813d950b>] __do_page_cache_readahead+0x22b/0x860 mm/readahead.c:184
 [<ffffffff813bcaa9>] ra_submit mm/internal.h:55 [inline]
 [<ffffffff813bcaa9>] do_sync_mmap_readahead mm/filemap.c:1917 [inline]
 [<ffffffff813bcaa9>] filemap_fault+0x729/0xbe0 mm/filemap.c:1994
 [<ffffffff8165f3a1>] ext4_filemap_fault+0x71/0xa0 fs/ext4/inode.c:5558
 [<ffffffff8142a5d7>] __do_fault+0x1d7/0x360 mm/memory.c:2822
 [<ffffffff81437379>] do_read_fault mm/memory.c:3012 [inline]
 [<ffffffff81437379>] do_fault mm/memory.c:3177 [inline]
 [<ffffffff81437379>] handle_pte_fault mm/memory.c:3346 [inline]
 [<ffffffff81437379>] __handle_mm_fault mm/memory.c:3474 [inline]
 [<ffffffff81437379>] handle_mm_fault+0x1cd9/0x2f30 mm/memory.c:3503
 [<ffffffff810ab7a1>] __do_page_fault+0x291/0x7e0 arch/x86/mm/fault.c:1243
 [<ffffffff810abd47>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1306
 [<ffffffff82716f75>] page_fault+0x25/0x30 arch/x86/entry/entry_64.S:1064
Code: 00 48 8b 45 10 89 54 24 68 48 ba 00 00 00 00 00 fc ff df 48 c7 84 24 90 00 00 00 b3 8a b5 41 48 c7 84 24 98 00 00 00 98 bd c4 82 <48> 89 84 24 80 00 00 00 48 8d 84 24 90 00 00 00 48 c1 e8 03 89 
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-fuzzer' (2076) because
   cache 276kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2932kB above reserved
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-executor1' (26702) because
   cache 276kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2932kB above reserved
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-fuzzer' (2076) because
   cache 504kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2964kB above reserved
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-executor1' (26682) because
   cache 504kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2964kB above reserved
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-fuzzer' (2071) because
   cache 556kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2892kB above reserved
lowmemorykiller: Killing 'syz-executor5' (26713) (tgid 26713), adj 1000,
   to free 38260kB on behalf of 'syz-executor1' (26702) because
   cache 556kB is below limit 6144kB for oom_score_adj 0
   Free memory is 2892kB above reserved

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/07 06:18 https://android.googlesource.com/kernel/common android-4.4 d40633ce0827 dcf836b1 .config console log report ci-android-44-kasan-gce
* Struck through repros no longer work on HEAD.