syzbot


INFO: task hung in nf_unregister_net_hook

Status: auto-closed as invalid on 2019/06/28 02:32
Reported-by: syzbot+4034809bd9a1f8e209f7@syzkaller.appspotmail.com
First crash: 2021d, last: 1943d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 INFO: task hung in nf_unregister_net_hook (2) syz 1 1724d 1724d 0/3 public: reported syz repro on 2019/08/06 04:26

Sample crash report:
binder: undelivered TRANSACTION_ERROR: 29189
INFO: task kworker/u4:0:6 blocked for more than 140 seconds.
      Not tainted 4.9.133+ #52
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:0    D25352     6      2 0x80000000
Workqueue: netns cleanup_net
 ffff8801da678000 ffff8801d4c84200 ffff8801cea82100 ffff8801d3aa5f00
 ffff8801db721018 ffff8801da6877b8 ffffffff827f3792 0000000000000286
 0000000000000002 0000000041b58ab3 00ffffff82e29d4a ffff8801db7218f0
Call Trace:
 [<ffffffff827f4cbf>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff8124a489>] exp_funnel_lock kernel/rcu/tree_exp.h:279 [inline]
 [<ffffffff8124a489>] _synchronize_rcu_expedited+0x689/0x840 kernel/rcu/tree_exp.h:569
 [<ffffffff8124f752>] synchronize_rcu_expedited+0x22/0x30 kernel/rcu/tree_exp.h:687
 [<ffffffff822ef88f>] synchronize_net+0x2f/0x50 net/core/dev.c:7834
 [<ffffffff823ca51c>] nf_unregister_net_hook+0x1ec/0x380 net/netfilter/core.c:161
 [<ffffffff823cae50>] nf_unregister_hook_list net/netfilter/core.c:482 [inline]
 [<ffffffff823cae50>] netfilter_net_exit+0x40/0xb0 net/netfilter/core.c:514
 [<ffffffff822d1770>] ops_exit_list.isra.0+0xb0/0x160 net/core/net_namespace.c:136
 [<ffffffff822d44d2>] cleanup_net+0x3f2/0x8b0 net/core/net_namespace.c:473
 [<ffffffff81130d61>] process_one_work+0x831/0x1530 kernel/workqueue.c:2092
 [<ffffffff81131b36>] worker_thread+0xd6/0x1140 kernel/workqueue.c:2226
 [<ffffffff811428dd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82803bdc>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Showing all locks held in the system:
4 locks held by kworker/u4:0/6:
 #0:  ("%s""netns"){.+.+.+}, at: [<ffffffff81130c6c>] process_one_work+0x73c/0x1530 kernel/workqueue.c:2085
 #1:  (net_cleanup_work){+.+.+.}, at: [<ffffffff81130ca4>] process_one_work+0x774/0x1530 kernel/workqueue.c:2089
 #2:  (net_mutex){+.+.+.}, at: [<ffffffff822d421f>] cleanup_net+0x13f/0x8b0 net/core/net_namespace.c:439
 #3:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131baec>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131baec>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fe2b4>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1911:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cccc>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2038:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82801ae2>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d2b472>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
3 locks held by kworker/1:2/2188:
 #0:  ("%s"("ipv6_addrconf")){.+.+..}, at: [<ffffffff81130c6c>] process_one_work+0x73c/0x1530 kernel/workqueue.c:2085
 #1:  ((&(&ifa->dad_work)->work)){+.+...}, at: [<ffffffff81130ca4>] process_one_work+0x774/0x1530 kernel/workqueue.c:2089
 #2:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
3 locks held by kworker/0:3/5991:
 #0:  ("%s"("ipv6_addrconf")){.+.+..}, at: [<ffffffff81130c6c>] process_one_work+0x73c/0x1530 kernel/workqueue.c:2085
 #1:  ((&(&ifa->dad_work)->work)){+.+...}, at: [<ffffffff81130ca4>] process_one_work+0x774/0x1530 kernel/workqueue.c:2089
 #2:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
3 locks held by kworker/0:4/5996:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130c6c>] process_one_work+0x73c/0x1530 kernel/workqueue.c:2085
 #1:  ((linkwatch_work).work){+.+...}, at: [<ffffffff81130ca4>] process_one_work+0x774/0x1530 kernel/workqueue.c:2089
 #2:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor3/15911:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor4/15909:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor5/15912:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor1/15916:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor0/15913:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor2/15938:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8232eb57>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.133+ #52
 ffff8801d9907d08 ffffffff81b37069 0000000000000000 0000000000000000
 0000000000000000 0000000000000001 ffffffff81098330 ffff8801d9907d40
 ffffffff81b42179 0000000000000000 0000000000000000 0000000000000003
Call Trace:
 [<ffffffff81b37069>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b37069>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b42179>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b4210c>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff81098434>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c07d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c07d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c07d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c07d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff811428dd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82803bdc>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at pc 0xffffffff82802626

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/13 09:42 https://android.googlesource.com/kernel/common android-4.9 d589c0d40671 caf12900 .config console log report ci-android-49-kasan-gce-root
2018/12/30 02:31 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 35e3f847 .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.