syzbot


INFO: task hung in unlink_file_vma

Status: auto-closed as invalid on 2019/06/26 19:37
Reported-by: syzbot+2d7f74277c0edd4af8d2@syzkaller.appspotmail.com
First crash: 1939d, last: 1939d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in unlink_file_vma kasan mm 3 888d 945d 0/26 closed as invalid on 2022/02/07 19:19
android-414 INFO: task hung in unlink_file_vma 14 1599d 1833d 0/1 auto-closed as invalid on 2020/04/01 21:27

Sample crash report:
INFO: task syz-executor3:10482 blocked for more than 140 seconds.
      Not tainted 4.9.147+ #86
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D28912 10482   2047 0x80000004
 ffff88019d132f80 0000000000000000 ffff8801d9416e00 ffffffff8302d180
 ffff8801db621018 ffff8801d8c475e0 ffffffff8280a232 ffff8801d8c475b8
 ffffffff81206ef7 0000000000000000 00ff88019d133828 ffff8801db6218f0
Call Trace:
 [<ffffffff8280b75f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff8281555a>] __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:526 [inline]
 [<ffffffff8281555a>] rwsem_down_write_failed+0x39a/0x730 kernel/locking/rwsem-xadd.c:555
 [<ffffffff81b761d7>] call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
 [<ffffffff8281437c>] __down_write arch/x86/include/asm/rwsem.h:125 [inline]
 [<ffffffff8281437c>] down_write+0x5c/0xa0 kernel/locking/rwsem.c:54
 [<ffffffff814abed5>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 [<ffffffff814abed5>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
 [<ffffffff8149693f>] free_pgtables+0x7f/0x240 mm/memory.c:544
 [<ffffffff814b0f5b>] exit_mmap+0x1db/0x3a0 mm/mmap.c:3023
 [<ffffffff810d26ed>] __mmput kernel/fork.c:884 [inline]
 [<ffffffff810d26ed>] mmput+0xcd/0x360 kernel/fork.c:906
 [<ffffffff810e6c19>] exit_mm kernel/exit.c:514 [inline]
 [<ffffffff810e6c19>] do_exit+0x6c9/0x2a50 kernel/exit.c:820
 [<ffffffff810ed431>] do_group_exit+0x111/0x300 kernel/exit.c:937
 [<ffffffff8110ebe1>] get_signal+0x4e1/0x1460 kernel/signal.c:2321
 [<ffffffff81052b35>] do_signal+0x95/0x1b00 arch/x86/kernel/signal.c:807
 [<ffffffff81003e2e>] exit_to_usermode_loop+0x10e/0x150 arch/x86/entry/common.c:158
 [<ffffffff81005932>] prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 [<ffffffff81005932>] syscall_return_slowpath arch/x86/entry/common.c:263 [inline]
 [<ffffffff81005932>] do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
 [<ffffffff8281a4d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c2ac>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c2ac>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fec5f>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1898:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156d59c>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2025:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff828185c2>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d38172>] n_tty_read+0x202/0x1830 drivers/tty/n_tty.c:2156
1 lock held by syz-executor3/10482:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<ffffffff814abed5>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<ffffffff814abed5>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor3/6681:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor3/6763:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor1/14581:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor0/8985:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor0/9026:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.147+ #86
 ffff8801d9907d08 ffffffff81b43be9 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff81098440 ffff8801d9907d40
 ffffffff81b4ecf9 0000000000000001 0000000000000000 0000000000000003
Call Trace:
 [<ffffffff81b43be9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b43be9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b4ecf9>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b4ec8c>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff81098544>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c83d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c83d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c83d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c83d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff81142cbd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff8281a69c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff82819106

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/28 19:36 https://android.googlesource.com/kernel/common android-4.9 a2f9236e8131 fc6ae81a .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.