syzbot


INFO: task hung in path_openat (5)

Status: auto-closed as invalid on 2021/07/22 20:44
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 638d, last: 477d
similar bugs (11):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in path_openat 2 1065d 1098d 0/1 auto-closed as invalid on 2020/01/11 07:40
upstream INFO: task hung in path_openat (4) 1 836d 836d 0/23 auto-closed as invalid on 2020/07/28 10:23
upstream INFO: task hung in path_openat (3) 4 996d 1112d 0/23 auto-closed as invalid on 2020/02/19 20:16
linux-4.19 INFO: task hung in path_openat (2) 1 265d 265d 0/1 auto-closed as invalid on 2022/03/21 04:47
linux-4.14 INFO: task hung in path_openat 1 506d 506d 0/1 auto-closed as invalid on 2021/07/23 23:26
android-49 INFO: task hung in path_openat 64 1236d 1217d 0/3 auto-closed as invalid on 2019/09/22 08:41
linux-4.19 INFO: task hung in path_openat (3) 1 2d14h 2d14h 0/1 upstream: reported on 2022/08/11 13:14
upstream INFO: task hung in path_openat (6) 13 212d 362d 0/23 closed as invalid on 2022/02/07 19:19
android-414 INFO: task hung in path_openat 42 1140d 1219d 0/1 auto-closed as invalid on 2019/10/28 21:04
upstream INFO: task hung in path_openat 246 1304d 1594d 0/23 closed as dup on 2018/09/08 15:37
upstream INFO: task hung in path_openat (2) 1 1207d 1207d 0/23 closed as invalid on 2019/05/08 13:05

Sample crash report:
INFO: task syz-executor.4:19268 blocked for more than 143 seconds.
      Not tainted 5.12.0-rc8-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4  state:D stack:26928 pid:19268 ppid:  8418 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4322 [inline]
 __schedule+0xa4d/0xf80 kernel/sched/core.c:5073
 schedule+0x14b/0x200 kernel/sched/core.c:5152
 rwsem_down_write_slowpath+0xe52/0x1590 kernel/locking/rwsem.c:1106
 __down_write_common kernel/locking/rwsem.c:1261 [inline]
 __down_write kernel/locking/rwsem.c:1270 [inline]
 down_write+0x165/0x170 kernel/locking/rwsem.c:1407
 inode_lock include/linux/fs.h:775 [inline]
 open_last_lookups fs/namei.c:3288 [inline]
 path_openat+0x7eb/0x39b0 fs/namei.c:3497
 do_filp_open+0x221/0x460 fs/namei.c:3527
 do_sys_openat2+0x124/0x460 fs/open.c:1187
 do_sys_open fs/open.c:1203 [inline]
 __do_sys_open fs/open.c:1211 [inline]
 __se_sys_open fs/open.c:1207 [inline]
 __x64_sys_open+0x221/0x270 fs/open.c:1207
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
RSP: 002b:00007f5f19d2d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000000141042 RDI: 0000000020000140
RBP: 00000000004bfbb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008
R13: 00007ffc963db1af R14: 00007f5f19d2d300 R15: 0000000000022000
INFO: task syz-executor.4:19309 blocked for more than 144 seconds.
      Not tainted 5.12.0-rc8-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4  state:D stack:27056 pid:19309 ppid:  8418 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4322 [inline]
 __schedule+0xa4d/0xf80 kernel/sched/core.c:5073
 schedule+0x14b/0x200 kernel/sched/core.c:5152
 rwsem_down_read_slowpath+0x58f/0x9f0 kernel/locking/rwsem.c:992
 __down_read_common+0xaa/0x450 kernel/locking/rwsem.c:1213
 inode_lock_shared include/linux/fs.h:785 [inline]
 lookup_slow fs/namei.c:1646 [inline]
 walk_component+0x4c8/0x740 fs/namei.c:1943
 lookup_last fs/namei.c:2398 [inline]
 path_lookupat+0x19d/0x9d0 fs/namei.c:2422
 filename_lookup+0x259/0x6e0 fs/namei.c:2455
 user_path_at include/linux/namei.h:60 [inline]
 __do_sys_chdir fs/open.c:493 [inline]
 __se_sys_chdir+0x95/0x290 fs/open.c:487
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
RSP: 002b:00007f5f19ceb188 EFLAGS: 00000246 ORIG_RAX: 0000000000000050
RAX: ffffffffffffffda RBX: 000000000056c158 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
RBP: 00000000004bfbb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c158
R13: 00007ffc963db1af R14: 00007f5f19ceb300 R15: 0000000000022000
INFO: task syz-executor.4:19311 blocked for more than 145 seconds.
      Not tainted 5.12.0-rc8-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4  state:D stack:26960 pid:19311 ppid:  8418 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4322 [inline]
 __schedule+0xa4d/0xf80 kernel/sched/core.c:5073
 schedule+0x14b/0x200 kernel/sched/core.c:5152
 rwsem_down_write_slowpath+0xe52/0x1590 kernel/locking/rwsem.c:1106
 __down_write_common kernel/locking/rwsem.c:1261 [inline]
 __down_write kernel/locking/rwsem.c:1270 [inline]
 down_write+0x165/0x170 kernel/locking/rwsem.c:1407
 inode_lock include/linux/fs.h:775 [inline]
 open_last_lookups fs/namei.c:3288 [inline]
 path_openat+0x7eb/0x39b0 fs/namei.c:3497
 do_filp_open+0x221/0x460 fs/namei.c:3527
 do_sys_openat2+0x124/0x460 fs/open.c:1187
 do_sys_open fs/open.c:1203 [inline]
 __do_sys_creat fs/open.c:1277 [inline]
 __se_sys_creat fs/open.c:1271 [inline]
 __x64_sys_creat+0x11f/0x160 fs/open.c:1271
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
RSP: 002b:00007f5f19cca188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 000000000056c200 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200002c0
RBP: 00000000004bfbb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c200
R13: 00007ffc963db1af R14: 00007f5f19cca300 R15: 0000000000022000

Showing all locks held in the system:
2 locks held by kworker/0:0/5:
 #0: ffff8880b9c34c98 (&rq->lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1321 [inline]
 #0: ffff8880b9c34c98 (&rq->lock){-.-.}-{2:2}, at: __schedule+0x144/0xf80 kernel/sched/core.c:4990
 #1: ffff8880b9c1f808 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x224/0x5c0 kernel/sched/psi.c:833
1 lock held by khungtaskd/1610:
 #0: ffffffff8cd10280 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 arch/x86/pci/mmconfig_64.c:151
1 lock held by in:imklog/8078:
 #0: ffff888021e75270 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x24e/0x2f0 fs/file.c:974
1 lock held by systemd-udevd/5408:
 #0: ffff8880b9c34c98 (&rq->lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1321 [inline]
 #0: ffff8880b9c34c98 (&rq->lock){-.-.}-{2:2}, at: __schedule+0x144/0xf80 kernel/sched/core.c:4990
1 lock held by systemd-udevd/5434:
3 locks held by syz-executor.4/19261:
2 locks held by syz-executor.4/19268:
 #0: ffff888151bb6460 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:375
 #1: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
 #1: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: open_last_lookups fs/namei.c:3288 [inline]
 #1: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: path_openat+0x7eb/0x39b0 fs/namei.c:3497
1 lock held by syz-executor.4/19309:
 #0: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:785 [inline]
 #0: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: lookup_slow fs/namei.c:1646 [inline]
 #0: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: walk_component+0x4c8/0x740 fs/namei.c:1943
2 locks held by syz-executor.4/19311:
 #0: ffff888151bb6460 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:375
 #1: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
 #1: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: open_last_lookups fs/namei.c:3288 [inline]
 #1: ffff88808497fa90 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: path_openat+0x7eb/0x39b0 fs/namei.c:3497

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1610 Comm: khungtaskd Not tainted 5.12.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x202/0x31e lib/dump_stack.c:120
 nmi_cpu_backtrace+0x16c/0x190 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x191/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
 watchdog+0xcfb/0xd40 kernel/hung_task.c:294
 kthread+0x39a/0x3c0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4818 Comm: systemd-udevd Not tainted 5.12.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0033:0x55d40f908203
Code: 4c 89 3c 24 48 89 44 24 08 e9 b6 00 00 00 66 0f 1f 84 00 00 00 00 00 45 8b 6e 70 45 85 ed 74 0a 44 3b 6b 70 0f 84 fd 00 00 00 <49> 8b 76 60 4c 8b 63 50 48 85 f6 74 10 4c 89 e7 e8 b8 90 ff ff 85
RSP: 002b:00007ffdb9197f30 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 000055d41006c340 RCX: 0000000000003470
RDX: 0000000000000007 RSI: 000055d4100f8dd0 RDI: 000055d4103d5680
RBP: 0000000000000704 R08: 000000000000001c R09: 000000000000001c
R10: 000000000000001c R11: 00007fb2d6ebb060 R12: 000055d4103d5664
R13: 0000000000000000 R14: 000055d4101aa980 R15: 0000000000014d74
FS:  00007fb2d7fba8c0 GS:  0000000000000000

Crashes (23):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2021/04/23 20:40 upstream 18a3c5f7abfd 17f0b706 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-selinux-root 2021/02/07 13:24 upstream 825b5991a46e 2ce644fc .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-smack-root 2021/02/07 12:52 upstream 825b5991a46e 2ce644fc .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce 2021/02/07 09:59 upstream 825b5991a46e 2ce644fc .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-root 2021/01/20 03:42 upstream 1e2a199f6ccd 63631df1 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-smack-root 2021/01/20 03:40 upstream 1e2a199f6ccd 63631df1 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce 2021/01/20 03:36 upstream 1e2a199f6ccd 63631df1 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-selinux-root 2021/01/17 17:31 upstream 0da0a8a0a0e1 813be542 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce 2021/01/17 17:24 upstream 0da0a8a0a0e1 813be542 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-root 2021/01/17 17:20 upstream 0da0a8a0a0e1 813be542 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-smack-root 2021/01/17 17:19 upstream 0da0a8a0a0e1 813be542 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-selinux-root 2021/01/17 17:17 upstream 0da0a8a0a0e1 813be542 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-386 2021/01/20 03:39 upstream 1e2a199f6ccd 63631df1 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-386 2021/01/17 17:26 upstream 0da0a8a0a0e1 813be542 .config log report info INFO: task hung in path_openat
ci-upstream-kasan-gce-root 2020/12/31 05:48 upstream f6e1ea196492 5cc121d6 .config log report info
ci-upstream-kasan-gce-selinux-root 2020/12/31 05:41 upstream f6e1ea196492 5cc121d6 .config log report info
ci-upstream-kasan-gce-root 2020/12/29 18:19 upstream dea8dcf2a9fa 80910769 .config log report info
ci-upstream-kasan-gce 2020/12/29 16:58 upstream dea8dcf2a9fa 80910769 .config log report info
ci-upstream-kasan-gce-root 2020/12/27 15:23 upstream f838f8d2b694 2242f77f .config log report info
ci-upstream-kasan-gce-selinux-root 2020/12/21 17:18 upstream e37b12e4bb21 04201c06 .config log report info
ci-upstream-kasan-gce 2020/11/13 13:42 upstream af5043c89a8e 16fca0c8 .config log report info
ci-upstream-kasan-gce-386 2020/12/29 20:15 upstream dea8dcf2a9fa 80910769 .config log report info
ci-upstream-kasan-gce-386 2020/12/21 15:50 upstream e37b12e4bb21 04201c06 .config log report info