syzbot


INFO: task hung in aead_recvmsg

Status: upstream: reported C repro on 2019/04/23 11:09
Reported-by: syzbot+945dc44cf301f420ea4c@syzkaller.appspotmail.com
First crash: 1259d, last: 5d13h

Fix bisection: failed (bisect log)
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in aead_recvmsg C done 11991 984d 1758d 16/24 fixed on 2020/02/18 14:31
linux-4.14 INFO: task hung in aead_recvmsg C inconclusive 3 540d 1260d 0/1 upstream: reported C repro on 2019/04/21 21:05

Sample crash report:
kauditd_printk_skb: 3 callbacks suppressed
audit: type=1400 audit(1556013797.466:36): avc:  denied  { map } for  pid=7808 comm="syz-executor524" path="/root/syz-executor524503008" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
INFO: task syz-executor524:7829 blocked for more than 140 seconds.
      Not tainted 4.19.36 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor524 D28216  7829   7808 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2826 [inline]
 __schedule+0x813/0x1d00 kernel/sched/core.c:3474
 schedule+0x92/0x1c0 kernel/sched/core.c:3518
 schedule_timeout+0x8ca/0xfd0 kernel/time/timer.c:1780
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common kernel/sched/completion.c:115 [inline]
 wait_for_completion+0x29c/0x440 kernel/sched/completion.c:136
 crypto_wait_req include/linux/crypto.h:517 [inline]
 _aead_recvmsg crypto/algif_aead.c:313 [inline]
 aead_recvmsg+0x1451/0x1aa0 crypto/algif_aead.c:334
 sock_recvmsg_nosec net/socket.c:795 [inline]
 sock_recvmsg net/socket.c:802 [inline]
 sock_recvmsg+0xd0/0x110 net/socket.c:798
 sock_read_iter+0x299/0x3b0 net/socket.c:879
 call_read_iter include/linux/fs.h:1805 [inline]
 do_iter_readv_writev+0x67d/0x830 fs/read_write.c:678
 do_iter_read+0x268/0x650 fs/read_write.c:922
 vfs_readv+0xf0/0x160 fs/read_write.c:986
 do_readv+0xf6/0x290 fs/read_write.c:1019
 __do_sys_readv fs/read_write.c:1106 [inline]
 __se_sys_readv fs/read_write.c:1103 [inline]
 __x64_sys_readv+0x75/0xb0 fs/read_write.c:1103
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441349
Code: 2d 20 72 73 79 73 6c 6f 67 64 20 63 61 6e 20 6e 6f 74 20 72 75 6e 21 0a 00 4d 61 69 6e 20 70 72 6f 63 65 73 73 69 6e 67 20 71 <75> 65 75 65 20 69 73 20 69 6e 69 74 69 61 6c 69 7a 65 64 20 61 6e
RSP: 002b:00007fffb7aceab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00000000004a23d8 RCX: 0000000000441349
RDX: 0000000000000001 RSI: 00000000200007c0 RDI: 0000000000000004
RBP: 00000000000654fd R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000402170
R13: 0000000000402200 R14: 0000000000000000 R15: 0000000000000000

Showing all locks held in the system:
1 lock held by khungtaskd/1030:
 #0: 00000000cf39a5c1 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4438
1 lock held by rsyslogd/7659:
 #0: 000000006a8f2a16 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:767
2 locks held by getty/7782:
 #0: 000000003ecda970 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
 #1: 00000000a7f960a1 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7783:
 #0: 00000000054396ee (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
 #1: 00000000f9585a84 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7784:
 #0: 00000000ef45a8df (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
 #1: 00000000f95d6561 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7785:
 #0: 00000000bbb7f2cf (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
 #1: 0000000063342a38 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7786:
 #0: 00000000a472e438 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
 #1: 0000000098aa57f9 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7787:
 #0: 00000000bc6f6d24 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
 #1: 0000000085bfbb26 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7788:
 #0: 00000000e5bee4ae (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
 #1: 00000000f23a1c7a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
1 lock held by syz-executor524/7829:
 #0: 00000000bc5efc82 (sk_lock-AF_ALG){+.+.}, at: lock_sock include/net/sock.h:1501 [inline]
 #0: 00000000bc5efc82 (sk_lock-AF_ALG){+.+.}, at: af_alg_wait_for_data+0x215/0x540 crypto/af_alg.c:772

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1030 Comm: khungtaskd Not tainted 4.19.36 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0x9df/0xee0 kernel/hung_task.c:287
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:57

Crashes (9):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2019/04/23 10:08 linux-4.19.y c98875d930e9 53199d6e .config log report syz C
ci2-linux-4-19 2022/09/28 01:36 linux-4.19.y 3f8a27f9e27b 75c78242 .config log report info INFO: task hung in aead_recvmsg
ci2-linux-4-19 2022/04/16 17:15 linux-4.19.y 3f8a27f9e27b 8bcc32a6 .config log report info INFO: task hung in aead_recvmsg
ci2-linux-4-19 2021/08/04 13:19 linux-4.19.y 6ca2f514c578 6c236867 .config log report info INFO: task hung in aead_recvmsg
ci2-linux-4-19 2021/08/04 12:29 linux-4.19.y 6ca2f514c578 6c236867 .config log report info INFO: task hung in aead_recvmsg
ci2-linux-4-19 2019/08/28 21:27 linux-4.19.y def4c11b3131 1eb076e9 .config log report
ci2-linux-4-19 2019/08/11 17:44 linux-4.19.y 893af1c79e42 acb51638 .config log report
ci2-linux-4-19 2019/06/23 18:16 linux-4.19.y 78778071092e 3efccdd2 .config log report
ci2-linux-4-19 2019/06/05 19:00 linux-4.19.y e109a984cf38 bfb4a51e .config log report
* Struck through repros no longer work on HEAD.