syzbot

 sign-in | mailing list | source | docs
🐞 Open [991] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: task hung in misc_open (2)

Status: auto-closed as invalid on 2019/12/23 14:44
Subsystems: kernel
[Documentation on labels]
First crash: 1676d, last: 1675d
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in misc_open kernel 2 2012d 2092d 0/26 auto-closed as invalid on 2019/04/20 12:01
upstream INFO: task hung in misc_open (4) usb C error inconclusive 144 454d 1167d 22/26 fixed on 2023/02/24 13:50
upstream INFO: task hung in misc_open (3) kernel 2 1382d 1390d 0/26 auto-closed as invalid on 2020/10/12 03:30

Sample crash report:
INFO: task syz-executor.0:19683 blocked for more than 143 seconds.
      Not tainted 5.3.0+ #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D28472 19683   1746 0x00004004
Call Trace:
 schedule+0xca/0x250 kernel/sched/core.c:4132
 schedule_preempt_disabled+0xc/0x20 kernel/sched/core.c:4191
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x881/0x1360 kernel/locking/mutex.c:1103
 misc_open+0x55/0x4a0 drivers/char/misc.c:107
 chrdev_open+0x219/0x5c0 fs/char_dev.c:414
 do_dentry_open+0x494/0x1120 fs/open.c:797
 do_last fs/namei.c:3408 [inline]
 path_openat+0x1430/0x3f50 fs/namei.c:3525
 do_filp_open+0x1a1/0x280 fs/namei.c:3555
 do_sys_open+0x3c0/0x580 fs/open.c:1089
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a29
Code: cc 48 8b 74 24 08 48 8b 5c 24 10 8a 44 24 18 4c 8d 44 24 20 e9 08 00 00 00 cc cc cc cc cc cc cc cc 66 48 0f 6e c0 66 0f 60 c0 <66> 0f 60 c0 66 0f 70 c0 00 48 83 fb 10 7c 6e 49 c7 c4 00 00 00 00
RSP: 002b:00007fae1cd1cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a29
RDX: 000000000012d080 RSI: 0000000020000000 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fae1cd1d6d4
R13: 00000000004c67b9 R14: 00000000004db920 R15: 00000000ffffffff
INFO: task syz-executor.0:19684 blocked for more than 143 seconds.
      Not tainted 5.3.0+ #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D28520 19684   1746 0x00000004
Call Trace:
 schedule+0xca/0x250 kernel/sched/core.c:4132
 schedule_preempt_disabled+0xc/0x20 kernel/sched/core.c:4191
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x881/0x1360 kernel/locking/mutex.c:1103
 misc_open+0x55/0x4a0 drivers/char/misc.c:107
 chrdev_open+0x219/0x5c0 fs/char_dev.c:414
 do_dentry_open+0x494/0x1120 fs/open.c:797
 do_last fs/namei.c:3408 [inline]
 path_openat+0x1430/0x3f50 fs/namei.c:3525
 do_filp_open+0x1a1/0x280 fs/namei.c:3555
 do_sys_open+0x3c0/0x580 fs/open.c:1089
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a29
Code: cc 48 8b 74 24 08 48 8b 5c 24 10 8a 44 24 18 4c 8d 44 24 20 e9 08 00 00 00 cc cc cc cc cc cc cc cc 66 48 0f 6e c0 66 0f 60 c0 <66> 0f 60 c0 66 0f 70 c0 00 48 83 fb 10 7c 6e 49 c7 c4 00 00 00 00
RSP: 002b:00007fae1ccfbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a29
RDX: 000000000012d080 RSI: 0000000020000000 RDI: ffffffffffffff9c
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fae1ccfc6d4
R13: 00000000004c67b9 R14: 00000000004db920 R15: 00000000ffffffff

Showing all locks held in the system:
1 lock held by khungtaskd/23:
 #0: ffffffff86eff3e0 (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x269 kernel/locking/lockdep.c:5335
1 lock held by rsyslogd/1605:
 #0: ffff8881d632b260 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xe3/0x100 fs/file.c:801
2 locks held by getty/1695:
 #0: ffff8881d979e690 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: ffffc9000046d2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x223/0x1ae0 drivers/tty/n_tty.c:2156
2 locks held by getty/1696:
 #0: ffff8881d9126690 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: ffffc900004892e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x223/0x1ae0 drivers/tty/n_tty.c:2156
2 locks held by getty/1697:
 #0: ffff8881d9145590 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: ffffc900004692e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x223/0x1ae0 drivers/tty/n_tty.c:2156
2 locks held by getty/1698:
 #0: ffff8881d913bc10 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: ffffc9000047d2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x223/0x1ae0 drivers/tty/n_tty.c:2156
2 locks held by getty/1699:
 #0: ffff8881d9126f10 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: ffffc9000048d2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x223/0x1ae0 drivers/tty/n_tty.c:2156
2 locks held by getty/1700:
 #0: ffff8881d913de10 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: ffffc900004792e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x223/0x1ae0 drivers/tty/n_tty.c:2156
2 locks held by getty/1701:
 #0: ffff8881d97f1190 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: ffffc900004552e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x223/0x1ae0 drivers/tty/n_tty.c:2156
5 locks held by kworker/1:3/2726:
2 locks held by syz-executor.4/19659:
 #0: ffffffff87130260 (misc_mtx){+.+.}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
 #1: ffffffff86ed9e20 (system_transition_mutex){+.+.}, at: snapshot_open+0x9c/0x4a0 kernel/power/user.c:52
1 lock held by syz-executor.0/19683:
 #0: ffffffff87130260 (misc_mtx){+.+.}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
1 lock held by syz-executor.0/19684:
 #0: ffffffff87130260 (misc_mtx){+.+.}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x55/0x96 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b0/0x1c7 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
 watchdog+0x9a4/0xe50 kernel/hung_task.c:289
 kthread+0x318/0x420 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 239 Comm: udevd Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:find_held_lock+0xd1/0x110 kernel/locking/lockdep.c:4079
Code: 38 d0 7f 04 84 c0 75 4e 41 32 5c 24 21 83 e3 60 74 94 45 31 e4 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 0f b6 14 02 <4c> 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 11 5b 45 89 3e 4c
RSP: 0018:ffff8881d478fac0 EFLAGS: 00000806
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffff8881d478fb50
RDX: 0000000000000004 RSI: ffffffff86f10b48 RDI: ffff8881d454a060
RBP: ffffffff86f10b48 R08: ffffffff88f57698 R09: fffffbfff0f54e11
R10: fffffbfff0f54e10 R11: ffffffff87aa7087 R12: ffff8881d454a050
R13: ffffffff86f10b48 R14: ffff8881d478fb50 R15: 0000000000000000
FS:  00007f4011ca87a0(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c420bfbc80 CR3: 00000001d46b8000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __lock_release kernel/locking/lockdep.c:4242 [inline]
 lock_release+0x1c8/0x6b0 kernel/locking/lockdep.c:4506
 seqcount_lockdep_reader_access include/linux/seqlock.h:82 [inline]
 read_seqcount_begin include/linux/seqlock.h:164 [inline]
 ktime_get_ts64+0x9b/0x2b0 kernel/time/timekeeping.c:890
 select_estimate_accuracy+0xcc/0x320 fs/select.c:87
 ep_poll+0x3b3/0xe60 fs/eventpoll.c:1839
 do_epoll_wait+0x209/0x260 fs/eventpoll.c:2294
 __do_sys_epoll_wait fs/eventpoll.c:2304 [inline]
 __se_sys_epoll_wait fs/eventpoll.c:2301 [inline]
 __x64_sys_epoll_wait+0x93/0xf0 fs/eventpoll.c:2301
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f40113bc943
Code: 00 31 d2 48 29 c2 64 89 11 48 83 c8 ff eb ea 90 90 90 90 90 90 90 90 83 3d b5 dc 2a 00 00 75 13 49 89 ca b8 e8 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 3b c4 00 00 48 89 04 24
RSP: 002b:00007fff64ec3878 EFLAGS: 00000246 ORIG_RAX: 00000000000000e8
RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 00007f40113bc943
RDX: 0000000000000008 RSI: 00007fff64ec3970 RDI: 000000000000000a
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000bb8 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 0000000002015980 R15: 0000000002004250

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/24 14:37 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e f8368f99 .config console log report ci2-upstream-usb
2019/09/24 08:42 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config console log report ci2-upstream-usb
2019/09/24 07:35 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config console log report ci2-upstream-usb
2019/09/24 05:23 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config console log report ci2-upstream-usb
2019/09/24 03:59 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config console log report ci2-upstream-usb
2019/09/24 00:18 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config console log report ci2-upstream-usb
2019/09/23 20:26 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config console log report ci2-upstream-usb
2019/09/23 19:56 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.