syzbot

 sign-in | mailing list | source | docs
🐞 Open [1033] ≡ Subsystems 🐞 Fixed [5265] 🐞 Invalid [12592] ⬇ Missing Backports [85] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: task hung in dev_ioctl (2)

Status: closed as invalid on 2019/05/08 13:05
Subsystems: net
[Documentation on labels]
First crash: 1844d, last: 1844d
▶ ▼ Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in dev_ioctl (4) net 1 1086d 1086d 0/26 auto-closed as invalid on 2021/08/15 15:56
linux-4.14 INFO: task hung in dev_ioctl 1 749d 749d 0/1 auto-closed as invalid on 2022/08/17 13:11
android-49 INFO: task hung in dev_ioctl 1 2131d 2131d 0/3 auto-closed as invalid on 2019/02/22 12:59
android-414 INFO: task hung in dev_ioctl 2 2048d 2068d 0/1 auto-closed as invalid on 2019/03/27 22:33
android-414 INFO: task hung in dev_ioctl (2) 1 1621d 1621d 0/1 auto-closed as invalid on 2020/03/28 22:15
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 917 3d00h 1901d 0/26 upstream: reported C repro on 2019/02/22 17:00
upstream INFO: task hung in dev_ioctl net 2 2046d 2073d 0/26 auto-closed as invalid on 2019/03/30 00:48
upstream INFO: task hung in dev_ioctl (3) net 7 1222d 1351d 0/26 auto-closed as invalid on 2021/04/01 04:28
upstream INFO: task hung in dev_ioctl (5) net 20 930d 974d 0/26 auto-closed as invalid on 2022/01/19 01:57

Sample crash report:
INFO: task syz-executor.4:3705 blocked for more than 143 seconds.
      Not tainted 5.1.0-rc5-next-20190418 #28
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D28520  3705  13576 0x00004004
Call Trace:
 context_switch kernel/sched/core.c:2817 [inline]
 __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444
 schedule+0xa8/0x260 kernel/sched/core.c:3508
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3567
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0x726/0x1310 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76
 dev_ioctl+0x289/0xe30 net/core/dev_ioctl.c:488
 sock_do_ioctl+0x1bd/0x300 net/socket.c:1060
 sock_ioctl+0x32b/0x610 net/socket.c:1168
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: Bad RIP value.
RSP: 002b:00007f3cd2e5bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29
RDX: 0000000020000240 RSI: 0000000000008990 RDI: 0000000000000005
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3cd2e5c6d4
R13: 00000000004c42bc R14: 00000000004d7ad8 R15: 00000000ffffffff
INFO: task syz-executor.4:3727 blocked for more than 143 seconds.
      Not tainted 5.1.0-rc5-next-20190418 #28
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D27560  3727  13576 0x00004004
Call Trace:
 context_switch kernel/sched/core.c:2817 [inline]
 __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444
 schedule+0xa8/0x260 kernel/sched/core.c:3508
 synchronize_rcu_expedited+0x431/0x5b0 kernel/rcu/tree_exp.h:807
 synchronize_net+0x3b/0x60 net/core/dev.c:9277
 dev_deactivate_many+0x46f/0xb60 net/sched/sch_generic.c:1203
 __dev_close_many+0x13d/0x300 net/core/dev.c:1480
 dev_close_many+0x25b/0x6f0 net/core/dev.c:1518
 dev_close.part.0+0x11a/0x1e0 net/core/dev.c:1544
 dev_close+0x63/0x80 net/core/dev.c:1547
 __bond_release_one.cold+0x83c/0xe6f drivers/net/bonding/bond_main.c:2004
 bond_release drivers/net/bonding/bond_main.c:2030 [inline]
 bond_do_ioctl+0x416/0x870 drivers/net/bonding/bond_main.c:3557
 dev_ifsioc+0x257/0x990 net/core/dev_ioctl.c:322
 dev_ioctl+0x297/0xe30 net/core/dev_ioctl.c:489
 sock_do_ioctl+0x1bd/0x300 net/socket.c:1060
 sock_ioctl+0x32b/0x610 net/socket.c:1168
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: Bad RIP value.
RSP: 002b:00007f3cd2e19c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29
RDX: 00000000200000c0 RSI: 0000000000008991 RDI: 0000000000000005
RBP: 000000000073c0e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3cd2e1a6d4
R13: 00000000004c42bc R14: 00000000004d7ad8 R15: 00000000ffffffff
INFO: task syz-executor.2:3712 blocked for more than 144 seconds.
      Not tainted 5.1.0-rc5-next-20190418 #28
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D28240  3712   7478 0x00004004
Call Trace:
 context_switch kernel/sched/core.c:2817 [inline]
 __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444
 schedule+0xa8/0x260 kernel/sched/core.c:3508
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3567
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0x726/0x1310 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 __netlink_dump_start+0x10c/0x7e0 net/netlink/af_netlink.c:2325
 netlink_dump_start include/linux/netlink.h:226 [inline]
 rtnetlink_rcv_msg+0x73f/0xb00 net/core/rtnetlink.c:5158
 netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2486
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5213
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1926
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xdd/0x130 net/socket.c:661
 __sys_sendto+0x262/0x380 net/socket.c:1932
 __do_sys_sendto net/socket.c:1944 [inline]
 __se_sys_sendto net/socket.c:1940 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1940
 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: Bad RIP value.
RSP: 002b:00007f6a22ba7c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458c29
RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6a22ba86d4
R13: 00000000004c6580 R14: 00000000004daf28 R15: 00000000ffffffff
INFO: task syz-executor.2:3718 blocked for more than 145 seconds.
      Not tainted 5.1.0-rc5-next-20190418 #28
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D28336  3718   7478 0x00004006
Call Trace:
 context_switch kernel/sched/core.c:2817 [inline]
 __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444
 schedule+0xa8/0x260 kernel/sched/core.c:3508
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3567
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0x726/0x1310 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 netlink_dump+0xe7/0xfb0 net/netlink/af_netlink.c:2208
 netlink_recvmsg+0xb9f/0xf10 net/netlink/af_netlink.c:2009
 sock_recvmsg_nosec net/socket.c:881 [inline]
 sock_recvmsg net/socket.c:888 [inline]
 sock_recvmsg+0xd0/0x110 net/socket.c:884
 ___sys_recvmsg+0x273/0x5a0 net/socket.c:2422
 do_recvmmsg+0x27e/0x7a0 net/socket.c:2535
 __sys_recvmmsg+0xe5/0x270 net/socket.c:2616
 __do_sys_recvmmsg net/socket.c:2637 [inline]
 __se_sys_recvmmsg net/socket.c:2630 [inline]
 __x64_sys_recvmmsg+0xe6/0x140 net/socket.c:2630
 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: Bad RIP value.
RSP: 002b:00007f6a22b86c78 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458c29
RDX: 04000000000001de RSI: 00000000200037c0 RDI: 0000000000000003
RBP: 000000000073bfa0 R08: 0000000020003700 R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 00007f6a22b876d4
R13: 00000000004c5b80 R14: 00000000004da118 R15: 00000000ffffffff

Showing all locks held in the system:
3 locks held by kworker/0:1/12:
1 lock held by khungtaskd/1042:
 #0: 0000000030f4edda (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:5046
1 lock held by rsyslogd/7345:
 #0: 00000000c22477e7 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801
2 locks held by getty/7435:
 #0: 0000000028737c47 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000e5493237 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7436:
 #0: 000000004e7e371d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000055ab4fd5 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7437:
 #0: 00000000480f529e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000001a42f764 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7438:
 #0: 00000000d9d7cf0c (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000287bcead (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7439:
 #0: 0000000067b855cf (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000a8763d5e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7440:
 #0: 0000000071ea3177 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000b8d392be (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7441:
 #0: 0000000054d5f05a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000047c6cb14 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
1 lock held by syz-executor.2/13298:
 #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236
1 lock held by syz-executor.2/20398:
 #0: 000000005c65ccc0 (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline]
 #0: 000000005c65ccc0 (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598
3 locks held by kworker/u4:0/4505:
 #0: 0000000070829e24 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1168 [inline]
 #0: 0000000070829e24 (&rq->lock){-.-.}, at: __schedule+0x1f5/0x15c0 kernel/sched/core.c:3396
 #1: 0000000030f4edda (rcu_read_lock){....}, at: trace_sched_stat_runtime include/trace/events/sched.h:435 [inline]
 #1: 0000000030f4edda (rcu_read_lock){....}, at: update_curr+0x2ce/0x8a0 kernel/sched/fair.c:842
 #2: 00000000491206a7 (&base->lock){-.-.}, at: lock_timer_base+0x56/0x1b0 kernel/time/timer.c:932
4 locks held by kworker/u4:2/6896:
 #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: __write_once_size include/linux/compiler.h:224 [inline]
 #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline]
 #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline]
 #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: set_work_data kernel/workqueue.c:619 [inline]
 #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:646 [inline]
 #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: process_one_work+0x87e/0x1790 kernel/workqueue.c:2239
 #1: 00000000b710ecb0 (net_cleanup_work){+.+.}, at: process_one_work+0x8b4/0x1790 kernel/workqueue.c:2243
 #2: 0000000002969571 (pernet_ops_rwsem){++++}, at: cleanup_net+0xae/0x960 net/core/net_namespace.c:519
 #3: 00000000ad664485 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76
1 lock held by syz-executor.2/13864:
 #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236
1 lock held by syz-executor.4/19301:
 #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236
1 lock held by syz-executor.2/23337:
 #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236
1 lock held by syz-executor.2/25994:
 #0: 0000000012a83a0e (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline]
 #0: 0000000012a83a0e (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598
2 locks held by syz-executor.2/26008:
 #0: 00000000c76b30c5 (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline]
 #0: 00000000c76b30c5 (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598
 #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:318 [inline]
 #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: synchronize_rcu_expedited+0x26f/0x5b0 kernel/rcu/tree_exp.h:790
1 lock held by syz-executor.4/26766:
 #0: 00000000577b4564 (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline]
 #0: 00000000577b4564 (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598
1 lock held by syz-executor.4/26772:
 #0: 000000009d0a6cbb (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline]
 #0: 000000009d0a6cbb (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598
1 lock held by syz-executor.4/3705:
 #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76
2 locks held by syz-executor.4/3727:
 #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76
 #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:286 [inline]
 #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: synchronize_rcu_expedited+0x4ab/0x5b0 kernel/rcu/tree_exp.h:790
1 lock held by syz-executor.2/3712:
 #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: __netlink_dump_start+0x10c/0x7e0 net/netlink/af_netlink.c:2325
1 lock held by syz-executor.2/3718:
 #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: netlink_dump+0xe7/0xfb0 net/netlink/af_netlink.c:2208

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 5.1.0-rc5-next-20190418 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
 watchdog+0x9b7/0xec0 kernel/hung_task.c:288
 kthread+0x357/0x430 kernel/kthread.c:254
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/20 07:50 linux-next 3f018f4a019a b0e8efcb .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.