syzbot


INFO: task hung in anon_vma_clone

Status: auto-closed as invalid on 2021/01/28 14:44
Reported-by: syzbot+8f77b65238f7ba758bea@syzkaller.appspotmail.com
First crash: 1303d, last: 1303d

Sample crash report:
INFO: task syz-executor.0:6495 blocked for more than 140 seconds.
      Not tainted 4.19.148-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D23696  6495   6494 0x00000000
Call Trace:
 context_switch kernel/sched/core.c:2828 [inline]
 __schedule+0x8e5/0x22e0 kernel/sched/core.c:3517
 schedule+0x8d/0x1b0 kernel/sched/core.c:3561
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:589 [inline]
 rwsem_down_write_failed+0x3e2/0x820 kernel/locking/rwsem-xadd.c:618
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:117
 __down_write arch/x86/include/asm/rwsem.h:142 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:72
 lock_anon_vma_root mm/rmap.c:238 [inline]
 anon_vma_clone+0x145/0x5e0 mm/rmap.c:278
 anon_vma_fork+0x82/0x630 mm/rmap.c:332
 dup_mmap kernel/fork.c:504 [inline]
 dup_mm kernel/fork.c:1288 [inline]
 copy_mm kernel/fork.c:1344 [inline]
 copy_process.part.0+0x3616/0x7fb0 kernel/fork.c:1897
 copy_process kernel/fork.c:1694 [inline]
 _do_fork+0x22f/0x1020 kernel/fork.c:2207
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45c36a
Code: Bad RIP value.
RSP: 002b:00007ffd084e3bb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffd084e3bb0 RCX: 000000000045c36a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffd084e3bf0 R08: 0000000000000001 R09: 0000000001f42940
R10: 0000000001f42c10 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffd084e3c40

Showing all locks held in the system:
1 lock held by khungtaskd/1094:
 #0: 00000000e2604cea (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x291 kernel/locking/lockdep.c:4440
3 locks held by khugepaged/1102:
1 lock held by in:imklog/6125:
 #0: 00000000f3e9071a (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xe3/0x100 fs/file.c:767
2 locks held by agetty/6172:
 #0: 00000000e4dd6f0d (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: 00000000f1357761 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x18c0 drivers/tty/n_tty.c:2154
1 lock held by syz-executor.0/6494:
 #0: 00000000397f2599 (&anon_vma->rwsem){++++}, at: lock_anon_vma_root mm/rmap.c:238 [inline]
 #0: 00000000397f2599 (&anon_vma->rwsem){++++}, at: unlink_anon_vmas+0x178/0x840 mm/rmap.c:388
4 locks held by syz-executor.0/6495:
 #0: 00000000a7166bd6 (&dup_mmap_sem){.+.+}, at: dup_mmap kernel/fork.c:435 [inline]
 #0: 00000000a7166bd6 (&dup_mmap_sem){.+.+}, at: dup_mm kernel/fork.c:1288 [inline]
 #0: 00000000a7166bd6 (&dup_mmap_sem){.+.+}, at: copy_mm kernel/fork.c:1344 [inline]
 #0: 00000000a7166bd6 (&dup_mmap_sem){.+.+}, at: copy_process.part.0+0x2bba/0x7fb0 kernel/fork.c:1897
 #1: 0000000046e16384 (&mm->mmap_sem){++++}, at: dup_mmap kernel/fork.c:436 [inline]
 #1: 0000000046e16384 (&mm->mmap_sem){++++}, at: dup_mm kernel/fork.c:1288 [inline]
 #1: 0000000046e16384 (&mm->mmap_sem){++++}, at: copy_mm kernel/fork.c:1344 [inline]
 #1: 0000000046e16384 (&mm->mmap_sem){++++}, at: copy_process.part.0+0x2bd6/0x7fb0 kernel/fork.c:1897
 #2: 00000000618c05f8 (&mm->mmap_sem/1){+.+.}, at: dup_mmap kernel/fork.c:445 [inline]
 #2: 00000000618c05f8 (&mm->mmap_sem/1){+.+.}, at: dup_mm kernel/fork.c:1288 [inline]
 #2: 00000000618c05f8 (&mm->mmap_sem/1){+.+.}, at: copy_mm kernel/fork.c:1344 [inline]
 #2: 00000000618c05f8 (&mm->mmap_sem/1){+.+.}, at: copy_process.part.0+0x2c23/0x7fb0 kernel/fork.c:1897
 #3: 00000000397f2599 (&anon_vma->rwsem){++++}, at: lock_anon_vma_root mm/rmap.c:238 [inline]
 #3: 00000000397f2599 (&anon_vma->rwsem){++++}, at: anon_vma_clone+0x145/0x5e0 mm/rmap.c:278

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1094 Comm: khungtaskd Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x18/0x3d lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1a6/0x1eb lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0xa62/0x1020 kernel/hung_task.c:287
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3708 Comm: systemd-journal Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0033:0x7ffee134c960
Code: 77 01 c3 48 89 d0 c3 0f 1f 00 8b 15 ba d6 ff ff 4c 8d 05 b3 d6 ff ff 89 d6 83 e6 fe f6 05 c4 d6 ff ff 01 74 61 0f ae e8 0f 31 <48> c1 e2 20 48 09 c2 48 89 d0 0f be 15 ab d6 ff ff 48 2b 05 90 d6
RSP: 002b:00007ffee12cefb8 EFLAGS: 00000202
RAX: 000000005df39192 RBX: 0000000000000000 RCX: 0000000000000164
RDX: 000000000000076d RSI: 000000000000001c RDI: 00007ffee12cefcc
RBP: 00007ffee12cefe0 R08: 00007ffee134a000 R09: 0000000000000018
R10: 000e4948bfece78a R11: 0000000000000000 R12: 00007ffee1349080
R13: 00000000000aaeac R14: 0000000000000059 R15: 00007ffee12cf500
FS:  00007f446a5a38c0 GS:  0000000000000000

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/30 14:43 linux-4.19.y 10ad6cfd5736 8516f6d3 .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.