syzbot


INFO: task hung in tun_chr_close (2)

Status: auto-closed as invalid on 2022/05/04 09:03
Reported-by: syzbot+6ac7c1dcb590b18db697@syzkaller.appspotmail.com
First crash: 1026d, last: 932d
Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in tun_chr_close 32 20d 128d 0/3 upstream: reported on 2024/03/18 08:54
linux-4.19 INFO: task hung in tun_chr_close 1 1443d 1443d 0/1 auto-closed as invalid on 2020/12/09 18:55
upstream INFO: task hung in tun_chr_close (4) net syz unreliable error 14 984d 1045d 0/27 auto-closed as invalid on 2022/09/18 21:51
upstream INFO: task hung in tun_chr_close net 5 1769d 2350d 0/27 closed as dup on 2018/02/16 08:24
linux-4.19 INFO: task hung in tun_chr_close (3) 1 720d 720d 0/1 auto-obsoleted due to no activity on 2022/12/03 04:48
linux-6.1 INFO: task hung in tun_chr_close 30 31d 65d 0/3 upstream: reported on 2024/05/21 01:17
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 1970 16d 1979d 27/27 fixed on 2024/07/09 19:14
android-49 INFO: task hung in tun_chr_close 1 2265d 2265d 0/3 auto-closed as invalid on 2019/02/22 14:33
linux-4.19 INFO: task hung in tun_chr_close (4) 3 526d 554d 0/1 upstream: reported on 2023/01/18 07:05
upstream INFO: task hung in tun_chr_close (3) net 1 1156d 1156d 0/27 auto-closed as invalid on 2021/08/23 13:06
android-44 INFO: task hung in tun_chr_close 1 2274d 2274d 0/2 auto-closed as invalid on 2019/02/22 15:23
upstream INFO: task hung in tun_chr_close (2) net 7 1265d 1486d 0/27 auto-closed as invalid on 2021/05/17 11:47

Sample crash report:
ieee802154 phy1 wpan1: encryption failed: -22
ieee802154 phy0 wpan0: encryption failed: -22
ieee802154 phy1 wpan1: encryption failed: -22
ieee802154 phy0 wpan0: encryption failed: -22
ieee802154 phy1 wpan1: encryption failed: -22
INFO: task syz-executor.0:14962 blocked for more than 140 seconds.
      Not tainted 4.19.211-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D28288 14962  13706 0x80000002
Call Trace:
 context_switch kernel/sched/core.c:2828 [inline]
 __schedule+0x887/0x2040 kernel/sched/core.c:3517
 schedule+0x8d/0x1b0 kernel/sched/core.c:3561
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3619
 __mutex_lock_common kernel/locking/mutex.c:1016 [inline]
 __mutex_lock+0x5f0/0x1190 kernel/locking/mutex.c:1078
 tun_detach drivers/net/tun.c:759 [inline]
 tun_chr_close+0x3a/0x180 drivers/net/tun.c:3323
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 get_signal+0x3f2/0x1f70 kernel/signal.c:2589
 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799
 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb4f0dfce99
Code: Bad RIP value.
RSP: 002b:00007fb4ef772218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fb4f0f0ff68 RCX: 00007fb4f0dfce99
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fb4f0f0ff68
RBP: 00007fb4f0f0ff60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb4f0f0ff6c
R13: 00007ffcff90438f R14: 00007fb4ef772300 R15: 0000000000022000

Showing all locks held in the system:
1 lock held by ksoftirqd/1/18:
1 lock held by khungtaskd/1570:
 #0: 000000006e8cd020 (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 kernel/locking/lockdep.c:4441
4 locks held by kworker/u4:5/3572:
 #0: 00000000aded60fe ((wq_completion)"%s""netns"){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2124
 #1: 00000000bd80592b (net_cleanup_work){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128
 #2: 000000004894cc29 (pernet_ops_rwsem){++++}, at: cleanup_net+0xa8/0x8b0 net/core/net_namespace.c:521
 #3: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: netdev_run_todo+0x719/0xab0 net/core/dev.c:9005
1 lock held by in:imklog/7802:
 #0: 000000007bb332a9 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767
2 locks held by agetty/7804:
 #0: 000000007034e763 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: 000000005e862f87 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1950 drivers/tty/n_tty.c:2154
3 locks held by kworker/1:4/9337:
 #0: 00000000d6766e34 ((wq_completion)"events"){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2124
 #1: 00000000df6b5e92 ((linkwatch_work).work){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128
 #2: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: linkwatch_event+0xb/0x60 net/core/link_watch.c:236
3 locks held by kworker/1:2/30018:
 #0: 0000000074b4ba8e ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2124
 #1: 00000000c3477d5b ((addr_chk_work).work){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128
 #2: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: addrconf_verify_work+0xa/0x20 net/ipv6/addrconf.c:4476
2 locks held by kworker/0:8/15069:
2 locks held by syz-executor.5/13695:
 #0: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: tun_detach drivers/net/tun.c:759 [inline]
 #0: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: tun_chr_close+0x3a/0x180 drivers/net/tun.c:3323
 #1: 0000000095dd7287 (rcu_preempt_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:329 [inline]
 #1: 0000000095dd7287 (rcu_preempt_state.exp_mutex){+.+.}, at: _synchronize_rcu_expedited+0x256/0x6f0 kernel/rcu/tree_exp.h:667
1 lock held by syz-executor.2/14841:
 #0: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: netdev_run_todo+0x719/0xab0 net/core/dev.c:9005
1 lock held by syz-executor.0/14962:
 #0: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: tun_detach drivers/net/tun.c:759 [inline]
 #0: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: tun_chr_close+0x3a/0x180 drivers/net/tun.c:3323
1 lock held by syz-executor.4/15106:
 #0: 00000000b7a21d85 (rtnl_mutex){+.+.}, at: netdev_run_todo+0x719/0xab0 net/core/dev.c:9005
3 locks held by syz-executor.1/15135:
 #0: 0000000007f6c386 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1826 [inline]
 #0: 0000000007f6c386 (&rq->lock){-.-.}, at: __schedule+0x1f9/0x2040 kernel/sched/core.c:3455
 #1: 000000006e8cd020 (rcu_read_lock){....}, at: trace_sched_stat_runtime include/trace/events/sched.h:428 [inline]
 #1: 000000006e8cd020 (rcu_read_lock){....}, at: update_curr+0x2c3/0x870 kernel/sched/fair.c:857
 #2: 000000005cdf4172 (mount_lock#2){+.+.}, at: put_mnt_ns fs/namespace.c:3271 [inline]
 #2: 000000005cdf4172 (mount_lock#2){+.+.}, at: put_mnt_ns+0x5f/0x80 fs/namespace.c:3267
1 lock held by syz-executor.1/15177:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15201:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15208:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15236:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15250:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15258:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15272:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15278:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15308:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15327:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15367:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15374:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15415:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15472:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15477:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15492:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15583:
 #0: 0000000054a7732f (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1826 [inline]
 #0: 0000000054a7732f (&rq->lock){-.-.}, at: __schedule+0x1f9/0x2040 kernel/sched/core.c:3455
1 lock held by syz-executor.1/15923:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/15970:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/16369:
 #0: 00000000939bcf1d (namespace_sem){++++}, at: namespace_lock fs/namespace.c:1370 [inline]
 #0: 00000000939bcf1d (namespace_sem){++++}, at: copy_mnt_ns+0x15d/0xad0 fs/namespace.c:2915
1 lock held by syz-executor.1/18912:
 #0: 0000000095dd7287 (rcu_preempt_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:329 [inline]
 #0: 0000000095dd7287 (rcu_preempt_state.exp_mutex){+.+.}, at: _synchronize_rcu_expedited+0x256/0x6f0 kernel/rcu/tree_exp.h:667

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1570 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0x991/0xe60 kernel/hung_task.c:287
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 14705 Comm: kworker/1:5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: rcu_gp wait_rcu_exp_gp
RIP: 0010:check_memory_region+0xb1/0x170 mm/kasan/kasan.c:268
Code: 08 48 39 d0 74 7b 48 83 38 00 74 f1 48 8d 50 08 eb 09 48 83 c0 01 48 39 d0 74 0e 80 38 00 74 f2 48 85 c0 0f 85 9c 00 00 00 5b <5d> 41 5c c3 48 85 d2 74 f6 48 01 ea eb 09 48 83 c0 01 48 39 d0 74
RSP: 0018:ffff8880469375f8 EFLAGS: 00000046
RAX: fffffbfff19ac63a RBX: 0000000000000000 RCX: ffffffff814afa31
RDX: fffffbfff19ac63a RSI: 0000000000000004 RDI: ffffffff8cd631c8
RBP: fffffbfff19ac639 R08: 0000000000000001 R09: fffffbfff19ac639
R10: ffffffff8cd631cb R11: ffffffff8c66505b R12: 0000000000000001
R13: ffff88802ffec0c0 R14: ffffffff89f85fa0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f190d17803c CR3: 0000000049a76000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 atomic_inc include/asm-generic/atomic-instrumented.h:109 [inline]
 __lock_acquire+0x251/0x3ff0 kernel/locking/lockdep.c:3308
 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
 rcu_lock_acquire include/linux/rcupdate.h:242 [inline]
 rcu_read_lock include/linux/rcupdate.h:627 [inline]
 cgroup_account_cputime include/linux/cgroup.h:769 [inline]
 update_curr+0x2f3/0x870 kernel/sched/fair.c:858
 enqueue_entity+0xdba/0x3850 kernel/sched/fair.c:3955
 enqueue_task_fair+0x12e/0x2270 kernel/sched/fair.c:5177
 ttwu_activate kernel/sched/core.c:1639 [inline]
 ttwu_do_activate+0xce/0x1e0 kernel/sched/core.c:1698
 ttwu_queue kernel/sched/core.c:1843 [inline]
 try_to_wake_up+0x700/0x1050 kernel/sched/core.c:2052
 autoremove_wake_function+0x12/0x140 kernel/sched/wait.c:375
 __wake_up_common+0x147/0x650 kernel/sched/wait.c:92
 __wake_up_common_lock+0x10a/0x170 kernel/sched/wait.c:126
 rcu_exp_wait_wake+0x1fb/0x480 kernel/rcu/tree_exp.h:616
 process_one_work+0x864/0x1570 kernel/workqueue.c:2153
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
----------------
Code disassembly (best guess):
   0:	08 48 39             	or     %cl,0x39(%rax)
   3:	d0 74 7b 48          	shlb   0x48(%rbx,%rdi,2)
   7:	83 38 00             	cmpl   $0x0,(%rax)
   a:	74 f1                	je     0xfffffffd
   c:	48 8d 50 08          	lea    0x8(%rax),%rdx
  10:	eb 09                	jmp    0x1b
  12:	48 83 c0 01          	add    $0x1,%rax
  16:	48 39 d0             	cmp    %rdx,%rax
  19:	74 0e                	je     0x29
  1b:	80 38 00             	cmpb   $0x0,(%rax)
  1e:	74 f2                	je     0x12
  20:	48 85 c0             	test   %rax,%rax
  23:	0f 85 9c 00 00 00    	jne    0xc5
  29:	5b                   	pop    %rbx
* 2a:	5d                   	pop    %rbp <-- trapping instruction
  2b:	41 5c                	pop    %r12
  2d:	c3                   	retq
  2e:	48 85 d2             	test   %rdx,%rdx
  31:	74 f6                	je     0x29
  33:	48 01 ea             	add    %rbp,%rdx
  36:	eb 09                	jmp    0x41
  38:	48 83 c0 01          	add    $0x1,%rax
  3c:	48 39 d0             	cmp    %rdx,%rax
  3f:	74                   	.byte 0x74

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/01/04 09:02 linux-4.19.y 3f8a27f9e27b 7f723fbe .config console log report info ci2-linux-4-19 INFO: task hung in tun_chr_close
2021/12/30 11:21 linux-4.19.y 3f8a27f9e27b 2e49f10d .config console log report info ci2-linux-4-19 INFO: task hung in tun_chr_close
2021/12/26 09:22 linux-4.19.y 3f8a27f9e27b 6caa12e4 .config console log report info ci2-linux-4-19 INFO: task hung in tun_chr_close
2021/12/17 07:27 linux-4.19.y 3f8a27f9e27b 44068e19 .config console log report info ci2-linux-4-19 INFO: task hung in tun_chr_close
2021/12/13 03:55 linux-4.19.y 3f8a27f9e27b 49ca1f59 .config console log report info ci2-linux-4-19 INFO: task hung in tun_chr_close
2021/10/02 12:39 linux-4.19.y c2276d585654 db0f5787 .config console log report info ci2-linux-4-19 INFO: task hung in tun_chr_close
* Struck through repros no longer work on HEAD.