INFO: task hung in fuse_simple

INFO: task hung in fuse_simple_request
Status: upstream: reported on 2020/12/13 21:13
Reported-by: syzbot+46fe899420456e014d6b@syzkaller.appspotmail.com
First crash: 298d, last: 10d

similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	INFO: task can't die in request_wait_answer	C	error		10	11d	269d	0/22	upstream: reported C repro on 2020/09/23 12:48

Sample crash report:

INFO: task syz-executor.5:13429 blocked for more than 143 seconds.
      Not tainted 5.13.0-rc5-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.5  state:D stack:29496 pid:13429 ppid: 11389 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4339 [inline]
 __schedule+0x916/0x23e0 kernel/sched/core.c:5147
 schedule+0xcf/0x270 kernel/sched/core.c:5226
 request_wait_answer+0x4a4/0x850 fs/fuse/dev.c:411
 __fuse_request_send fs/fuse/dev.c:430 [inline]
 fuse_simple_request+0x58a/0xd10 fs/fuse/dev.c:515
 fuse_listxattr+0x2c6/0x5d0 fs/fuse/xattr.c:145
 vfs_listxattr+0x105/0x190 fs/xattr.c:446
 listxattr+0xf6/0x180 fs/xattr.c:747
 path_listxattr+0xae/0x140 fs/xattr.c:771
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
RSP: 002b:00007f87b6b5d188 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007fff0fbc3c9f R14: 00007f87b6b5d300 R15: 0000000000022000

Showing all locks held in the system:
1 lock held by ksoftirqd/1/19:
 #0: ffff8880b9d35658 (&rq->lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1334 [inline]
 #0: ffff8880b9d35658 (&rq->lock){-.-.}-{2:2}, at: __schedule+0x21c/0x23e0 kernel/sched/core.c:5061
3 locks held by kworker/1:1/25:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x871/0x1600 kernel/workqueue.c:2247
 #1: ffffc90000dffda8 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1600 kernel/workqueue.c:2251
 #2: ffffffff8bf82468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #2: ffffffff8bf82468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x27e/0x620 kernel/rcu/tree_exp.h:837
1 lock held by khungtaskd/1643:
 #0: ffffffff8bf79260 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6333
1 lock held by systemd-udevd/4854:
1 lock held by in:imklog/8121:
 #0: ffff88801cdff4f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:974
2 locks held by kworker/1:8/9736:
 #0: ffff888011066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888011066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888011066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888011066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: ffff888011066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: ffff888011066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x871/0x1600 kernel/workqueue.c:2247
 #1: ffffc90016c47da8 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1600 kernel/workqueue.c:2251
3 locks held by kworker/u4:8/13297:
 #0: ffff8881400ea938 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff8881400ea938 ((wq_completion)netns){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff8881400ea938 ((wq_completion)netns){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff8881400ea938 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: ffff8881400ea938 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: ffff8881400ea938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x871/0x1600 kernel/workqueue.c:2247
 #1: ffffc900028d7da8 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1600 kernel/workqueue.c:2251
 #2: ffffffff8d692290 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xb10 net/core/net_namespace.c:557
3 locks held by kworker/0:11/16634:
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x871/0x1600 kernel/workqueue.c:2247
 #1: ffffc90002cf7da8 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1600 kernel/workqueue.c:2251
 #2: ffffffff8d6a5728 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xa3/0x1340 net/ipv6/addrconf.c:4031
2 locks held by kworker/1:11/16686:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x871/0x1600 kernel/workqueue.c:2247
 #1: ffffc90002e47da8 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1600 kernel/workqueue.c:2251
3 locks held by kworker/1:13/16692:
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: ffff888147824138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x871/0x1600 kernel/workqueue.c:2247
 #1: ffffc90002f27da8 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1600 kernel/workqueue.c:2251
 #2: ffffffff8d6a5728 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xa3/0x1340 net/ipv6/addrconf.c:4031
2 locks held by syz-executor.1/18987:
 #0: ffffffff8d6a5728 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:684 [inline]
 #0: ffffffff8d6a5728 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3a/0x180 drivers/net/tun.c:3397
 #1: ffffffff8bf82468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #1: ffffffff8bf82468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4fa/0x620 kernel/rcu/tree_exp.h:837
1 lock held by syz-executor.3/19296:
 #0: ffffffff8d6a5728 (rtnl_mutex){+.+.}-{3:3}, at: ip_rt_ioctl+0xe6/0x1460 net/ipv4/fib_frontend.c:622
1 lock held by syz-executor.3/19299:
 #0: ffffffff8d6a5728 (rtnl_mutex){+.+.}-{3:3}, at: ip_rt_ioctl+0xe6/0x1460 net/ipv4/fib_frontend.c:622

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1643 Comm: khungtaskd Not tainted 5.13.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
 watchdog+0xd48/0xfb0 kernel/hung_task.c:294
 kthread+0x3b1/0x4a0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 19316 Comm: syz-executor.0 Not tainted 5.13.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unwind_next_frame+0xed4/0x1ce0 arch/x86/kernel/unwind_orc.c:611
Code: c0 74 08 3c 03 0f 8e 90 0a 00 00 41 3b 2e 0f 84 b9 05 00 00 bf 01 00 00 00 e8 a8 c5 1b 00 b8 01 00 00 00 65 8b 15 8c c7 ce 7e <85> d2 0f 85 aa f1 ff ff e8 46 1d cd ff e9 a0 f1 ff ff 4c 8b 7c 24
RSP: 0018:ffffc90002bd7500 EFLAGS: 00000297
RAX: 0000000000000001 RBX: 1ffff9200057aea8 RCX: 0000000000000000
RDX: 0000000080000000 RSI: ffffc90002bd7d58 RDI: 0000000000000001
RBP: ffffc90002bd7d88 R08: ffffffff8e4ca8fc R09: 0000000000000001
R10: fffff5200057aec6 R11: 0000000000084087 R12: ffffc90002bd0000
R13: ffffc90002bd760d R14: ffffc90002bd75d8 R15: ffffc90002bd760c
FS:  0000000002a97400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8ad21ac000 CR3: 000000001e1b3000 CR4: 0000000000350ef0
Call Trace:
 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
 save_stack+0x151/0x1e0 mm/page_owner.c:119
 __set_page_owner+0x50/0x290 mm/page_owner.c:181
 prep_new_page mm/page_alloc.c:2358 [inline]
 get_page_from_freelist+0x1033/0x2b60 mm/page_alloc.c:3994
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5200
 __alloc_pages_node include/linux/gfp.h:549 [inline]
 alloc_pages_node include/linux/gfp.h:563 [inline]
 __vmalloc_area_node mm/vmalloc.c:2809 [inline]
 __vmalloc_node_range+0x44a/0x970 mm/vmalloc.c:2915
 vmalloc_user+0x67/0x80 mm/vmalloc.c:3032
 kcov_mmap+0x2b/0x140 kernel/kcov.c:465
 call_mmap include/linux/fs.h:2119 [inline]
 mmap_region+0xcde/0x1730 mm/mmap.c:1811
 do_mmap+0xcff/0x11d0 mm/mmap.c:1587
 vm_mmap_pgoff+0x1b7/0x290 mm/util.c:519
 ksys_mmap_pgoff+0x4a8/0x620 mm/mmap.c:1638
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x466622
Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64
RSP: 002b:00007ffda3eb49f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000466622
RDX: 0000000000000003 RSI: 0000000000200000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 00000000000000f1 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000246 R12: 000000000056c738
R13: 000000000056cb88 R14: 0000000000000000 R15: 00000000000000f2

Crashes (45):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Title
ci-upstream-kasan-gce-root	2021/06/09 13:51	upstream	368094df	84fe5d96	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-smack-root	2021/06/07 09:42	upstream	decad3e1	500c2339	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/06/04 23:22	upstream	16f0596f	966a236b	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-smack-root	2021/04/26 22:04	upstream	9f4ad9e4	805b5003	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/04/22 01:09	upstream	16fc44d6	2bc8999a	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce	2021/04/20 19:13	upstream	7af08140	c0ced557	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/04/08 02:30	upstream	3a229812	6a81331a	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce	2021/02/26 09:00	upstream	2c87f7a3	76f7fc95	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/02/02 05:34	upstream	88bb507a	e6b95f32	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/01/30 23:40	upstream	8c947645	fc9fd31e	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/01/27 08:35	upstream	2ab38c17	55a7d4df	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/01/23 23:00	upstream	e1ae4b0b	52e37319	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce-root	2021/01/23 08:34	upstream	fe75a218	52e37319	.config	log	report	info	INFO: task hung in fuse_simple_request
ci-upstream-kasan-gce	2020/12/13 05:19	upstream	7b1b868e	bca53db9	.config	log	report	info
ci-upstream-kasan-gce-root	2020/12/11 06:20	upstream	33dc9614	f900b48c	.config	log	report	info
ci-upstream-kasan-gce-root	2020/12/09 20:53	upstream	a68a0262	c090b4da	.config	log	report	info
ci-upstream-kasan-gce-root	2020/12/04 19:35	upstream	e87297fa	20366b87	.config	log	report	info
ci-upstream-kasan-gce-root	2020/12/03 11:10	upstream	34816d20	e6b0d314	.config	log	report	info
ci-upstream-kasan-gce-root	2020/12/01 03:12	upstream	b6505459	b3a34598	.config	log	report	info
ci-upstream-kasan-gce-root	2020/11/28 09:41	upstream	c84e1efa	486f93ef	.config	log	report	info
ci-upstream-kasan-gce	2020/11/26 13:15	upstream	fa02fcd9	1d2b823e	.config	log	report	info
ci-upstream-kasan-gce-root	2020/11/13 16:22	upstream	585e5b17	e1140d25	.config	log	report	info
ci-upstream-kasan-gce	2020/11/03 18:38	upstream	b7cbaf59	cba33199	.config	log	report	info
ci-upstream-kasan-gce-root	2020/10/23 19:47	upstream	0adc313c	2bb6666c	.config	log	report	info
ci-upstream-kasan-gce-root	2020/10/17 04:31	upstream	071a0578	6e262c73	.config	log	report	info
ci-upstream-kasan-gce-selinux-root	2020/10/08 08:17	upstream	c85fb28b	1880b4a9	.config	log	report	info
ci-upstream-kasan-gce-selinux-root	2020/10/06 11:56	upstream	7575fdda	1880b4a9	.config	log	report	info
ci-upstream-kasan-gce-selinux-root	2020/10/04 16:20	upstream	22fbc037	5ef9c291	.config	log	report	info
ci-upstream-kasan-gce	2020/10/04 11:33	upstream	22fbc037	5ef9c291	.config	log	report	info
ci-upstream-kasan-gce-selinux-root	2020/10/03 10:14	upstream	d3d45f82	2653fa43	.config	log	report	info
ci-upstream-kasan-gce	2020/09/30 14:45	upstream	02de58b2	8516f6d3	.config	log	report	info
ci-upstream-kasan-gce	2020/09/28 05:48	upstream	16bc1d54	5dd8aee8	.config	log	report	info
ci-upstream-kasan-gce	2020/09/25 20:10	upstream	171d4ff7	4a006f63	.config	log	report	info
ci-upstream-kasan-gce-selinux-root	2020/09/25 04:47	upstream	171d4ff7	54289b08	.config	log	report	info
ci-upstream-kasan-gce-root	2020/09/24 04:39	upstream	c9c9e6a4	54289b08	.config	log	report	info
ci-upstream-kasan-gce-selinux-root	2020/09/10 22:22	upstream	7fe10096	409809d8	.config	log	report
ci-upstream-kasan-gce-selinux-root	2020/09/01 22:58	upstream	b765a32a	abf9ba4f	.config	log	report
ci-upstream-kasan-gce-selinux-root	2020/08/31 17:17	upstream	f75aef39	d5a3ae1f	.config	log	report
ci-upstream-kasan-gce-root	2020/08/31 02:40	upstream	dcc5c6f0	d5a3ae1f	.config	log	report
ci-upstream-kasan-gce	2020/08/28 23:31	upstream	96d454cd	d5a3ae1f	.config	log	report
ci-upstream-kasan-gce-selinux-root	2020/08/28 19:03	upstream	15bc20c6	d5a3ae1f	.config	log	report
ci-upstream-kasan-gce	2020/08/25 21:24	upstream	abb3438d	344da168	.config	log	report
ci-upstream-kasan-gce	2020/08/25 14:33	upstream	6a9dc5fd	344da168	.config	log	report
ci-upstream-kasan-gce-386	2020/11/16 11:23	upstream	09162bc3	1bf9a662	.config	log	report	info
ci-upstream-kasan-gce-386	2020/10/07 09:20	upstream	c85fb28b	1880b4a9	.config	log	report	info