syzbot


INFO: task hung in lookup_slow (3)

Status: upstream: reported C repro on 2022/11/11 00:21
Reported-by: syzbot+7cfc6a4f6b025f710423@syzkaller.appspotmail.com
First crash: 158d, last: 5d11h
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in lookup_slow (2) 2 1189d 1201d 0/24 auto-closed as invalid on 2019/11/26 02:54
upstream INFO: task hung in lookup_slow 148 1410d 1703d 0/24 closed as dup on 2018/09/08 15:36
android-49 INFO: task hung in lookup_slow syz 36 1215d 1325d 0/3 public: reported syz repro on 2019/04/14 08:51
linux-4.14 INFO: task hung in lookup_slow C error 1 88d 118d 0/1 upstream: reported C repro on 2022/08/03 08:46
linux-4.19 INFO: task hung in lookup_slow 1 897d 897d 0/1 auto-closed as invalid on 2020/10/13 00:17
Patch testing requests:
Created Duration User Patch Repo Result
2022/11/11 03:46 18m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git bbed346d5a96 OK log

Sample crash report:
INFO: task syslogd:2546 blocked for more than 143 seconds.
      Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syslogd         state:D stack:    0 pid: 2546 ppid:     1 flags:0x00000000
Call trace:
 __switch_to+0x180/0x298 arch/arm64/kernel/process.c:557
 context_switch kernel/sched/core.c:5182 [inline]
 __schedule+0x414/0x5a0 kernel/sched/core.c:6494
 schedule+0x64/0xa4 kernel/sched/core.c:6570
 rwsem_down_read_slowpath+0x228/0x444 kernel/locking/rwsem.c:1087
 __down_read_common+0x48/0x154 kernel/locking/rwsem.c:1252
 __down_read kernel/locking/rwsem.c:1261 [inline]
 down_read+0x68/0x78 kernel/locking/rwsem.c:1501
 inode_lock_shared include/linux/fs.h:766 [inline]
 lookup_slow+0x34/0x68 fs/namei.c:1701
 walk_component fs/namei.c:1993 [inline]
 link_path_walk+0x474/0x628 fs/namei.c:2320
 path_openat+0xb8/0x11c4 fs/namei.c:3687
 do_filp_open+0xdc/0x1b8 fs/namei.c:3718
 do_sys_openat2+0xb8/0x22c fs/open.c:1313
 do_sys_open fs/open.c:1329 [inline]
 __do_sys_openat fs/open.c:1345 [inline]
 __se_sys_openat fs/open.c:1340 [inline]
 __arm64_sys_openat+0xb0/0xe0 fs/open.c:1340
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
INFO: task syz-executor428:3073 blocked for more than 143 seconds.
      Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor428 state:D stack:    0 pid: 3073 ppid:  3071 flags:0x00000000
Call trace:
 __switch_to+0x180/0x298 arch/arm64/kernel/process.c:557
 context_switch kernel/sched/core.c:5182 [inline]
 __schedule+0x414/0x5a0 kernel/sched/core.c:6494
 schedule+0x64/0xa4 kernel/sched/core.c:6570
 rwsem_down_read_slowpath+0x228/0x444 kernel/locking/rwsem.c:1087
 __down_read_common+0x48/0x154 kernel/locking/rwsem.c:1252
 __down_read kernel/locking/rwsem.c:1261 [inline]
 down_read+0x68/0x78 kernel/locking/rwsem.c:1501
 inode_lock_shared include/linux/fs.h:766 [inline]
 lookup_slow+0x34/0x68 fs/namei.c:1701
 walk_component fs/namei.c:1993 [inline]
 link_path_walk+0x474/0x628 fs/namei.c:2320
 path_openat+0xb8/0x11c4 fs/namei.c:3687
 do_filp_open+0xdc/0x1b8 fs/namei.c:3718
 do_sys_openat2+0xb8/0x22c fs/open.c:1313
 do_sys_open fs/open.c:1329 [inline]
 __do_sys_openat fs/open.c:1345 [inline]
 __se_sys_openat fs/open.c:1340 [inline]
 __arm64_sys_openat+0xb0/0xe0 fs/open.c:1340
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
INFO: task syz-executor428:3075 blocked for more than 143 seconds.
      Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor428 state:D stack:    0 pid: 3075 ppid:  3073 flags:0x00000001
Call trace:
 __switch_to+0x180/0x298 arch/arm64/kernel/process.c:557
 context_switch kernel/sched/core.c:5182 [inline]
 __schedule+0x414/0x5a0 kernel/sched/core.c:6494
 schedule+0x64/0xa4 kernel/sched/core.c:6570
 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6629
 __mutex_lock_common+0x788/0xca8 kernel/locking/mutex.c:679
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 fuse_lock_inode+0x50/0x70 fs/fuse/inode.c:468
 fuse_lookup+0x74/0x274 fs/fuse/dir.c:432
 __lookup_slow+0x14c/0x204 fs/namei.c:1685
 lookup_slow+0x44/0x68 fs/namei.c:1702
 walk_component fs/namei.c:1993 [inline]
 link_path_walk+0x474/0x628 fs/namei.c:2320
 path_openat+0xb8/0x11c4 fs/namei.c:3687
 do_filp_open+0xdc/0x1b8 fs/namei.c:3718
 do_sys_openat2+0xb8/0x22c fs/open.c:1313
 do_sys_open fs/open.c:1329 [inline]
 __do_sys_openat fs/open.c:1345 [inline]
 __se_sys_openat fs/open.c:1340 [inline]
 __arm64_sys_openat+0xb0/0xe0 fs/open.c:1340
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
INFO: task syz-executor428:3077 blocked for more than 143 seconds.
      Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor428 state:D stack:    0 pid: 3077 ppid:  3073 flags:0x00000001
Call trace:
 __switch_to+0x180/0x298 arch/arm64/kernel/process.c:557
 context_switch kernel/sched/core.c:5182 [inline]
 __schedule+0x414/0x5a0 kernel/sched/core.c:6494
 schedule+0x64/0xa4 kernel/sched/core.c:6570
 rwsem_down_write_slowpath+0x258/0x468 kernel/locking/rwsem.c:1182
 __down_write_common kernel/locking/rwsem.c:1297 [inline]
 __down_write kernel/locking/rwsem.c:1306 [inline]
 down_write_nested+0x90/0xd8 kernel/locking/rwsem.c:1663
 inode_lock_nested include/linux/fs.h:791 [inline]
 fuse_reverse_inval_entry+0x58/0x3c4 fs/fuse/dir.c:1167
 fuse_dev_do_write+0x1208/0x1544 fs/fuse/dev.c:1872
 fuse_dev_write+0x78/0xc0 fs/fuse/dev.c:1956
 call_write_iter include/linux/fs.h:2187 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x2dc/0x46c fs/read_write.c:578
 ksys_write+0xb4/0x160 fs/read_write.c:631
 __do_sys_write fs/read_write.c:643 [inline]
 __se_sys_write fs/read_write.c:640 [inline]
 __arm64_sys_write+0x24/0x34 fs/read_write.c:640
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/11:
 #0: ffff80000d433568 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x3c/0x450 kernel/rcu/tasks.h:507
1 lock held by rcu_tasks_trace/12:
 #0: ffff80000d433bb8 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x3c/0x450 kernel/rcu/tasks.h:507
1 lock held by khungtaskd/27:
 #0: ffff80000d433440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x4/0x48 include/linux/rcupdate.h:279
1 lock held by syslogd/2546:
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:766 [inline]
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: lookup_slow+0x34/0x68 fs/namei.c:1701
2 locks held by udevd/2561:
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:766 [inline]
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: lookup_slow+0x34/0x68 fs/namei.c:1701
 #1: ffff0000c9e485b8 (&fi->mutex){+.+.}-{3:3}, at: fuse_lock_inode+0x50/0x70 fs/fuse/inode.c:468
2 locks held by getty/2711:
 #0: ffff0000c62cb898 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x28/0x58 drivers/tty/tty_ldisc.c:244
 #1: ffff80000f6162f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x19c/0x89c drivers/tty/n_tty.c:2177
1 lock held by syz-executor428/3073:
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:766 [inline]
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: lookup_slow+0x34/0x68 fs/namei.c:1701
2 locks held by syz-executor428/3075:
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:766 [inline]
 #0: ffff0000c9e48150 (&type->i_mutex_dir_key#6){++++}-{3:3}, at: lookup_slow+0x34/0x68 fs/namei.c:1701
 #1: ffff0000c9e485b8 (&fi->mutex){+.+.}-{3:3}, at: fuse_lock_inode+0x50/0x70 fs/fuse/inode.c:468
2 locks held by syz-executor428/3077:
 #0: ffff0000ca1f2738 (&fc->killsb){.+.+}-{3:3}, at: fuse_notify_delete fs/fuse/dev.c:1547 [inline]
 #0: ffff0000ca1f2738 (&fc->killsb){.+.+}-{3:3}, at: fuse_notify fs/fuse/dev.c:1797 [inline]
 #0: ffff0000ca1f2738 (&fc->killsb){.+.+}-{3:3}, at: fuse_dev_do_write+0x11f8/0x1544 fs/fuse/dev.c:1872
 #1: ffff0000c9e48150 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:791 [inline]
 #1: ffff0000c9e48150 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: fuse_reverse_inval_entry+0x58/0x3c4 fs/fuse/dir.c:1167

=============================================


Crashes (22):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-gce-arm64 2022/11/07 00:02 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 6d752409 .config log report syz C INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/23 22:59 upstream eb7081409f94 52fdf57a .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/20 04:50 upstream fe24a97cf254 5bb70014 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/19 23:04 upstream fe24a97cf254 5bb70014 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/14 03:45 upstream af7a05689189 7ba4d859 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/12 03:58 upstream eb037f16f7e8 f42ee5d8 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/05 20:39 upstream b208b9fbbcba 6d752409 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/05 15:27 upstream b208b9fbbcba 6d752409 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/11/02 06:51 upstream b229b6ca5abb 08977f5d .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/10/29 04:48 upstream b229b6ca5abb 899d812a .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/10/25 04:22 upstream 337a0a0b63f1 45645420 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/10/12 10:40 upstream 493ffd6605b2 02b6492e .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/09/25 09:38 upstream 3db61221f4e8 0042f2b4 .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/09/21 19:52 upstream 06f7db949993 380f82fb .config log report info INFO: task hung in lookup_slow
ci2-upstream-fs 2022/09/20 21:08 upstream 60891ec99e14 c4b8ccfd .config log report info INFO: task hung in lookup_slow
ci-upstream-kasan-gce-smack-root 2022/06/23 10:39 upstream 3abc3ae553c7 912f5df7 .config log report info INFO: task hung in lookup_slow
ci-upstream-gce-arm64 2022/11/13 13:49 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1621b6eaebf7 3ead01ad .config log report info INFO: task hung in lookup_slow
ci-upstream-gce-arm64 2022/11/07 03:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 6d752409 .config log report info INFO: task hung in lookup_slow
ci-upstream-gce-arm64 2022/11/06 14:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 6d752409 .config log report info INFO: task hung in lookup_slow
ci-upstream-gce-arm64 2022/11/06 03:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 6d752409 .config log report info INFO: task hung in lookup_slow
ci-upstream-gce-arm64 2022/09/04 19:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 85413d1e802e 28811d0a .config log report info INFO: task hung in lookup_slow
ci-upstream-gce-arm64 2022/08/20 09:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 680fb5b009e8 26a13b38 .config log report info INFO: task hung in lookup_slow
* Struck through repros no longer work on HEAD.