syzbot


INFO: task hung in __rt_mutex_slowlock

Status: auto-closed as invalid on 2019/05/18 00:53
Reported-by: syzbot+dd2f61e48f745a2cb8ad@syzkaller.appspotmail.com
First crash: 2194d, last: 2194d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 INFO: task hung in __rt_mutex_slowlock (2) 1 1985d 1985d 0/1 auto-closed as invalid on 2019/10/25 08:40
android-49 INFO: task hung in __rt_mutex_slowlock C 317 1950d 2051d 0/3 public: reported C repro on 2019/04/11 08:44

Sample crash report:
ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
audit: type=1400 audit(2000000131.890:116): avc:  denied  { search } for  pid=1845 comm="syz-executor2" name="/" dev="sysfs" ino=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:netcontrol_device_t:s0 tclass=dir permissive=1
ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
INFO: task udevd:302 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
udevd           D27688   302    190 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 SYSC_exit_group kernel/exit.c:979 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:977
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f1a425de1e8
RSP: 002b:00007ffd01999d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1a425de1e8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007f1a428b3840 R08: 00000000000000e7 R09: ffffffffffffff00
R10: 00007f1a428ba748 R11: 0000000000000246 R12: 00007f1a428b3840
R13: 0000000000000001 R14: 000000000097c030 R15: 000000000000000b
INFO: task udevd:303 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
udevd           D27464   303    190 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 SYSC_exit_group kernel/exit.c:979 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:977
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f1a425de1e8
RSP: 002b:00007ffd01999d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1a425de1e8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007f1a428b3840 R08: 00000000000000e7 R09: ffffffffffffff00
R10: 00007f1a428ba748 R11: 0000000000000246 R12: 00007f1a428b3840
R13: 0000000000000001 R14: 000000000097c030 R15: 000000000000000b
INFO: task udevd:4630 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
udevd           D28280  4630    190 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 SYSC_exit_group kernel/exit.c:979 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:977
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f1a425de1e8
RSP: 002b:00007ffd01999d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1a425de1e8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007f1a428b3840 R08: 00000000000000e7 R09: ffffffffffffff00
R10: 00007f1a428ba748 R11: 0000000000000246 R12: 00007f1a428b3840
R13: 0000000000000001 R14: 000000000097c030 R15: 000000000000000b
INFO: task syz-executor2:14426 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D28408 14426   1845 0x00000004
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 SYSC_exit_group kernel/exit.c:979 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:977
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007fff5d143be8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000001e RCX: 0000000000457569
RDX: 0000000000411021 RSI: fffffffffffffff7 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 000000000000014f R15: 0000000000000002
INFO: task syz-executor2:14430 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D25256 14430   1845 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 get_signal+0x4e5/0x1470 kernel/signal.c:2348
 do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
 do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007f41e8bc6cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000072bf08 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bf08
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c
R13: 00007fff5d1439ef R14: 00007f41e8bc79c0 R15: 0000000000000000
INFO: task syz-executor2:14439 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D28616 14439   1845 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 get_signal+0x4e5/0x1470 kernel/signal.c:2348
 do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
 do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007f41e8ba5cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000072bfa8 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bfa8
RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bfac
R13: 00007fff5d1439ef R14: 00007f41e8ba69c0 R15: 0000000000000001
INFO: task syz-executor2:14474 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D28312 14474   1845 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 get_signal+0x4e5/0x1470 kernel/signal.c:2348
 do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
 do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007f41e8b84cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000072c048 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072c048
RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072c04c
R13: 00007fff5d1439ef R14: 00007f41e8b859c0 R15: 0000000000000002
INFO: task syz-executor4:14438 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4   D28408 14438   1853 0x00000004
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 SYSC_exit_group kernel/exit.c:979 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:977
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007ffe3ea204c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000001e RCX: 0000000000457569
RDX: 0000000000411021 RSI: fffffffffffffff7 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000124 R15: 0000000000000004
INFO: task syz-executor4:14442 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4   D26464 14442   1853 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 get_signal+0x4e5/0x1470 kernel/signal.c:2348
 do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
 do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007fd7473decf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000072bf08 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bf08
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c
R13: 00007ffe3ea202cf R14: 00007fd7473df9c0 R15: 0000000000000000
INFO: task syz-executor4:14451 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4   D28712 14451   1853 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 __rt_mutex_slowlock+0x1b8/0x280 kernel/locking/rtmutex.c:1197
 rt_mutex_slowlock.constprop.8+0x16b/0x410 kernel/locking/rtmutex.c:1267
 process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
 notifier_call_chain+0x114/0x1b0 kernel/notifier.c:93
 __blocking_notifier_call_chain kernel/notifier.c:317 [inline]
 blocking_notifier_call_chain+0x77/0x8e kernel/notifier.c:328
 do_exit+0x97/0x28c0 kernel/exit.c:768
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 get_signal+0x4e5/0x1470 kernel/signal.c:2348
 do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
 do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007fd7473bdcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000072bfa8 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bfa8
RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bfac
R13: 00007ffe3ea202cf R14: 00007fd7473be9c0 R15: 0000000000000001

Showing all locks held in the system:
2 locks held by kworker/u4:0/5:
 #0:  ("events_unbound"){+.+.}, at: [<ffffffffb5f27d04>] process_one_work+0x784/0x1670 kernel/workqueue.c:2085
 #1:  ((&sub_info->work)){+.+.}, at: [<ffffffffb5f27d3c>] process_one_work+0x7bc/0x1670 kernel/workqueue.c:2089
1 lock held by khungtaskd/23:
 #0:  (tasklist_lock){.+.?}, at: [<ffffffffb60023b7>] debug_show_all_locks+0x74/0x20f kernel/locking/lockdep.c:4541
2 locks held by udevd/302:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by udevd/303:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by getty/1762:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffffb6b3cf30>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffffb6b384af>] n_tty_read+0x1ff/0x15e0 drivers/tty/n_tty.c:2142
2 locks held by syz-executor2/1842:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor5/1843:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor3/1846:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor1/1848:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor4/1849:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by kworker/u4:4/2238:
 #0:  ("events_unbound"){+.+.}, at: [<ffffffffb5f27d04>] process_one_work+0x784/0x1670 kernel/workqueue.c:2085
 #1:  ((&sub_info->work)){+.+.}, at: [<ffffffffb5f27d3c>] process_one_work+0x7bc/0x1670 kernel/workqueue.c:2089
2 locks held by udevd/4630:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor0/6113:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor2/14426:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor2/14430:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor2/14439:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor2/14474:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor4/14438:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor4/14442:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor4/14451:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor4/14455:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor1/14457:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor1/14462:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor0/14458:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor0/14463:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor0/14469:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor0/14471:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor5/14460:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor5/14466:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor5/14470:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor5/14472:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor5/14475:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor5/14476:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by syz-executor1/14464:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by true/14468:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633
2 locks held by modprobe/14473:
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] __blocking_notifier_call_chain kernel/notifier.c:316 [inline]
 #0:  ((task_exit_notifier).rwsem){++++}, at: [<ffffffffb5f40f41>] blocking_notifier_call_chain+0x61/0x8e kernel/notifier.c:328
 #1:  (uid_lock){+.+.}, at: [<ffffffffb6bf56e2>] process_notifier+0xa2/0x6a4 drivers/misc/uid_sys_stats.c:633

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 23 Comm: khungtaskd Not tainted 4.14.81+ #6
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 nmi_cpu_backtrace.cold.0+0x47/0x85 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x121/0x146 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
 watchdog+0x574/0xa70 kernel/hung_task.c:252
 kthread+0x348/0x420 kernel/kthread.c:232
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at pc 0xffffffffb7664982

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/19 00:52 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.