syzbot


INFO: task hung in copy_process

Status: auto-closed as invalid on 2019/09/30 05:31
Reported-by: syzbot+a705275d3dd63281e152@syzkaller.appspotmail.com
First crash: 1847d, last: 1847d
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in copy_process 1 1453d 1453d 0/1 auto-closed as invalid on 2020/08/29 04:01
upstream INFO: task hung in copy_process (2) kernel 1 1819d 1819d 0/26 closed as invalid on 2019/05/08 13:05
android-414 INFO: task hung in copy_process (2) 1 1632d 1632d 0/1 auto-closed as invalid on 2020/03/02 19:22
upstream INFO: task hung in copy_process kernel 2 1908d 2053d 0/26 closed as dup on 2018/09/08 14:03
linux-4.19 INFO: task hung in copy_process (2) 1 874d 874d 0/1 auto-closed as invalid on 2022/03/30 21:31
linux-4.19 INFO: task hung in copy_process (3) 1 465d 465d 0/1 upstream: reported on 2023/01/14 12:40
android-414 INFO: task hung in copy_process 2 1761d 1839d 0/1 auto-closed as invalid on 2019/10/25 13:42
linux-4.14 INFO: task hung in copy_process 4 1816d 1820d 0/1 auto-closed as invalid on 2019/10/25 08:48

Sample crash report:
INFO: task syz-executor.2:7231 blocked for more than 140 seconds.
      Not tainted 4.9.166+ #35
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D25016  7231   7230 0x00000000
 ffff8801c81dc740 ffff880181c58000 ffff8801db721000 ffff880187eeaf80
 ffff8801db721018 ffff8801c60a79d0 ffffffff827ffaae ffffffff8280b035
 ffff8801c395b8c8 00ff8801c60a7920 ffff8801db7218f0 1ffff10038c14f29
Call Trace:
 [<00000000171555ca>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
 [<000000009857de2d>] __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:533 [inline]
 [<000000009857de2d>] rwsem_down_write_failed+0x3a3/0x750 kernel/locking/rwsem-xadd.c:562
 [<00000000eac00a9c>] call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
 [<000000006175c8dd>] __down_write arch/x86/include/asm/rwsem.h:125 [inline]
 [<000000006175c8dd>] down_write+0x5c/0xa0 kernel/locking/rwsem.c:54
 [<00000000a2f396a8>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 [<00000000a2f396a8>] dup_mmap kernel/fork.c:642 [inline]
 [<00000000a2f396a8>] dup_mm kernel/fork.c:1156 [inline]
 [<00000000a2f396a8>] copy_mm kernel/fork.c:1210 [inline]
 [<00000000a2f396a8>] copy_process.part.0+0x3ec7/0x63f0 kernel/fork.c:1694
 [<00000000451f64c8>] copy_process kernel/fork.c:1505 [inline]
 [<00000000451f64c8>] _do_fork+0x1b8/0xd40 kernel/fork.c:1985
 [<00000000e5bb3f83>] SYSC_clone kernel/fork.c:2097 [inline]
 [<00000000e5bb3f83>] SyS_clone+0x37/0x50 kernel/fork.c:2091
 [<000000007f8b2102>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
 [<000000002f798948>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<00000000f984ae0f>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<00000000f984ae0f>] watchdog+0x13c/0xae0 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.?..}, at: [<00000000e55fd9be>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4339
2 locks held by getty/2038:
 #0:  (&tty->ldisc_sem){++++++}, at: [<00000000ecb11793>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<00000000af22a496>] n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
1 lock held by syz-executor.1/2120:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.0/2121:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.5/2123:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.4/4758:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.2/7230:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
4 locks held by syz-executor.2/7231:
 #0:  (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] dup_mmap kernel/fork.c:573 [inline]
 #0:  (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] dup_mm kernel/fork.c:1156 [inline]
 #0:  (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] copy_mm kernel/fork.c:1210 [inline]
 #0:  (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] copy_process.part.0+0x38ca/0x63f0 kernel/fork.c:1694
 #1:  (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] dup_mmap kernel/fork.c:574 [inline]
 #1:  (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] dup_mm kernel/fork.c:1156 [inline]
 #1:  (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] copy_mm kernel/fork.c:1210 [inline]
 #1:  (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] copy_process.part.0+0x38e5/0x63f0 kernel/fork.c:1694
 #2:  (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] dup_mmap kernel/fork.c:583 [inline]
 #2:  (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] dup_mm kernel/fork.c:1156 [inline]
 #2:  (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] copy_mm kernel/fork.c:1210 [inline]
 #2:  (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] copy_process.part.0+0x391e/0x63f0 kernel/fork.c:1694
 #3:  (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #3:  (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] dup_mmap kernel/fork.c:642 [inline]
 #3:  (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] dup_mm kernel/fork.c:1156 [inline]
 #3:  (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] copy_mm kernel/fork.c:1210 [inline]
 #3:  (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] copy_process.part.0+0x3ec7/0x63f0 kernel/fork.c:1694
1 lock held by syz-executor.3/20330:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.3/11937:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<000000005b5fa8b5>] prepare_bprm_creds+0x55/0x120 fs/exec.c:1369
1 lock held by syz-executor.0/5674:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.5/5678:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.3/5675:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.4/5668:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor.1/5667:
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline]
 #0:  (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.166+ #35
 ffff8801d98d7cc8 ffffffff81b4ef81 0000000000000001 0000000000000000
 0000000000000001 ffffffff81097401 dffffc0000000000 ffff8801d98d7d00
 ffffffff81b5a23c 0000000000000001 0000000000000000 0000000000000001
Call Trace:
 [<00000000b15cc3ad>] __dump_stack lib/dump_stack.c:15 [inline]
 [<00000000b15cc3ad>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<0000000046e06a05>] nmi_cpu_backtrace.cold+0x47/0x87 lib/nmi_backtrace.c:99
 [<00000000e498cf0f>] nmi_trigger_cpumask_backtrace+0x124/0x155 lib/nmi_backtrace.c:60
 [<000000004bdf6aca>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<0000000005f1b853>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<0000000005f1b853>] check_hung_task kernel/hung_task.c:125 [inline]
 [<0000000005f1b853>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<0000000005f1b853>] watchdog+0x661/0xae0 kernel/hung_task.c:239
 [<0000000012c22232>] kthread+0x278/0x310 kernel/kthread.c:211
 [<0000000064e9ca50>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 27260 Comm: syz-executor.2 Not tainted 4.9.166+ #35
task: 0000000087141d6c task.stack: 0000000024e50e03
RIP: 0033:[<0000000000401584>] c [<0000000064184ec5>] 0x401584
RSP: 002b:00007f4104bdc690  EFLAGS: 00000282
RAX: 00000000c4caa668 RBX: 000000000000000b RCX: 00000000004582b9
RDX: b700000001000000 RSI: 00007f4104bdc6c0 RDI: 000000000000000b
RBP: 0000000000000000 R08: 91726972ae636573 R09: 0000000000000000
R10: 5400007974dd0836 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f4104bdd700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f999cfe3000 CR3: 0000000195f6f000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/03 05:30 https://android.googlesource.com/kernel/common android-4.9 5f5c16578d2b dfd3394d .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.