syzbot


INFO: task hung in sync_inodes_sb (2)

Status: auto-closed as invalid on 2019/10/19 16:22
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 1230d, last: 1212d
similar bugs (8):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in sync_inodes_sb (3) C done 6 955d 964d 16/23 fixed on 2020/02/14 01:19
upstream INFO: task hung in sync_inodes_sb 58 1310d 1548d 0/23 closed as dup on 2018/09/08 15:37
linux-4.14 INFO: task hung in sync_inodes_sb 1 925d 925d 0/1 auto-closed as invalid on 2020/06/02 17:26
android-49 INFO: task hung in sync_inodes_sb 11 1449d 1528d 0/3 auto-closed as invalid on 2019/02/24 06:19
android-49 INFO: task hung in sync_inodes_sb (2) 2 1039d 1201d 0/3 auto-closed as invalid on 2020/02/10 00:14
upstream INFO: task hung in sync_inodes_sb (4) C done inconclusive 6 126d 634d 0/23 upstream: reported C repro on 2020/11/21 04:55
linux-4.14 INFO: task hung in sync_inodes_sb (2) C 6 7h01m 586d 0/1 upstream: reported C repro on 2021/01/07 19:48
linux-4.19 INFO: task hung in sync_inodes_sb C error 4 254d 676d 0/1 upstream: reported C repro on 2020/10/09 07:19

Sample crash report:
INFO: task syz-executor.3:7994 blocked for more than 143 seconds.
      Not tainted 5.1.0-rc6 #79
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.3  D24176  7994      1 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2877 [inline]
 __schedule+0x813/0x1cc0 kernel/sched/core.c:3518
 schedule+0x92/0x180 kernel/sched/core.c:3562
 io_schedule+0x1c/0x70 kernel/sched/core.c:5183
 wait_on_page_bit_common+0x518/0xd00 mm/filemap.c:1141
 wait_on_page_bit mm/filemap.c:1190 [inline]
 wait_on_page_writeback include/linux/pagemap.h:536 [inline]
 __filemap_fdatawait_range+0x3ec/0x530 mm/filemap.c:518
 filemap_fdatawait_keep_errors+0x2d/0xd0 mm/filemap.c:591
 wait_sb_inodes fs/fs-writeback.c:2333 [inline]
 sync_inodes_sb+0x6b6/0xae0 fs/fs-writeback.c:2455
 __sync_filesystem fs/sync.c:34 [inline]
 sync_filesystem fs/sync.c:67 [inline]
 sync_filesystem+0x16a/0x270 fs/sync.c:48
 generic_shutdown_super+0x75/0x370 fs/super.c:444
 kill_block_super+0xa0/0x100 fs/super.c:1373
 deactivate_locked_super+0x9a/0x100 fs/super.c:331
 deactivate_super fs/super.c:362 [inline]
 deactivate_super+0x1b2/0x1d0 fs/super.c:358
 cleanup_mnt+0xbf/0x160 fs/namespace.c:1119
 __cleanup_mnt+0x16/0x20 fs/namespace.c:1126
 task_work_run+0x14a/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b677
Code: d9 ff d0 48 8b 7c 24 30 48 8b 77 08 48 2b 74 24 28 64 48 89 3c 25 f8 ff ff ff 48 89 f4 89 44 24 18 c3 48 83 ec 40 48 83 e4 f0 <48> c7 44 24 30 00 00 00 00 48 89 54 24 28 48 89 df 48 89 d9 ff d0
RSP: 002b:00007fff354cf5e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000045b677
RDX: 0000000000403270 RSI: 0000000000000002 RDI: 00007fff354cf690
RBP: 00000000000000a6 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000005 R11: 0000000000000206 R12: 00007fff354d0720
R13: 0000000001e80940 R14: 0000000000000000 R15: 00007fff354d0720

Showing all locks held in the system:
1 lock held by khungtaskd/1041:
 #0: 000000003bc916ec (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:5057
1 lock held by rsyslogd/7859:
 #0: 000000004a2e647d (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801
2 locks held by getty/7950:
 #0: 00000000503e6ea4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000ce089e1d (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7951:
 #0: 000000005b6c8ff2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000332a2a78 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7952:
 #0: 00000000870fed9a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000007eadce85 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7953:
 #0: 000000007e8982e4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000f2f39826 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7954:
 #0: 00000000f6e9751f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000002764b64 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7955:
 #0: 000000007cbf59f5 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000007730ce6 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7956:
 #0: 000000009e77c034 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000016238aff (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.3/7994:
 #0: 00000000482230c0 (&type->s_umount_key#50){+.+.}, at: deactivate_super fs/super.c:361 [inline]
 #0: 00000000482230c0 (&type->s_umount_key#50){+.+.}, at: deactivate_super+0x1aa/0x1d0 fs/super.c:358
 #1: 0000000039b1a407 (&s->s_sync_lock){+.+.}, at: wait_sb_inodes fs/fs-writeback.c:2272 [inline]
 #1: 0000000039b1a407 (&s->s_sync_lock){+.+.}, at: sync_inodes_sb+0x22d/0xae0 fs/fs-writeback.c:2455
4 locks held by kworker/u4:5/8201:
 #0: 000000002bdd5f27 (&rq->lock){-.-.}, at: idle_balance kernel/sched/fair.c:10078 [inline]
 #0: 000000002bdd5f27 (&rq->lock){-.-.}, at: pick_next_task_fair+0x1214/0x19a0 kernel/sched/fair.c:7087
 #1: 000000003bc916ec (rcu_read_lock){....}, at: __update_idle_core+0x45/0x3f0 kernel/sched/fair.c:6084
 #2: 000000002af7b1c6 (&base->lock){-.-.}, at: lock_timer_base+0x56/0x1b0 kernel/time/timer.c:937
 #3: 00000000694f5dc2 (&obj_hash[i].lock){-.-.}, at: debug_object_activate+0x131/0x4f0 lib/debugobjects.c:472

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1041 Comm: khungtaskd Not tainted 5.1.0-rc6 #79
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
 watchdog+0x9b7/0xec0 kernel/hung_task.c:288
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2019/04/22 12:24 upstream 085b7755808a 0a77c33c .config log report
ci-upstream-kasan-gce-selinux-root 2019/04/21 01:32 upstream 9e5de623a0cb b0e8efcb .config log report
ci-upstream-kasan-gce-selinux-root 2019/04/04 19:29 upstream 145f47c7381d 6a475fff .config log report
ci-upstream-linux-next-kasan-gce-root 2019/04/16 22:57 linux-next de3c659c83ce 505ab413 .config log report