syzbot


INFO: task hung in ext4_file_write_iter

Status: auto-closed as invalid on 2019/10/03 05:16
Reported-by: syzbot+6e6367adf64ea92eeef0@syzkaller.appspotmail.com
First crash: 2051d, last: 1840d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 INFO: task hung in ext4_file_write_iter 1 1705d 1705d 0/2 auto-closed as invalid on 2019/12/17 11:11
upstream INFO: task hung in ext4_file_write_iter ext4 4 1902d 2174d 0/26 auto-closed as invalid on 2019/08/02 09:02
upstream INFO: task hung in ext4_file_write_iter (4) ext4 2 375d 387d 0/26 auto-obsoleted due to no activity on 2023/07/09 14:32
upstream INFO: task hung in ext4_file_write_iter (3) ext4 1 487d 487d 0/26 auto-obsoleted due to no activity on 2023/03/28 01:11
upstream INFO: task hung in ext4_file_write_iter (2) ext4 1 1220d 1220d 0/26 auto-closed as invalid on 2021/03/16 20:08

Sample crash report:
audit: type=1400 audit(2000000952.075:58004): avc:  denied  { map } for  pid=14527 comm="getty" path="/etc/ld.so.cache" dev="sda1" ino=2503 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
ip6_tunnel: ip6tnl19 xmit: Local address not yet configured!
INFO: task syz-executor.4:14413 blocked for more than 140 seconds.
ip6_tunnel: ip6tnl77 xmit: Local address not yet configured!
      Not tainted 4.14.111+ #50
ip6_tunnel: ip6tnl14 xmit: Local address not yet configured!
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D
ip6_tunnel: ip6tnl64 xmit: Local address not yet configured!
27736 14413   6172 0x00000004
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3498
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
 rwsem_down_write_failed+0x3b1/0x760 kernel/locking/rwsem-xadd.c:601
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
 __down_write arch/x86/include/asm/rwsem.h:126 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:56
 inode_lock include/linux/fs.h:715 [inline]
 ext4_file_write_iter+0x1fe/0xe40 fs/ext4/file.c:233
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:471 [inline]
 __vfs_write+0x401/0x5a0 fs/read_write.c:484
 vfs_write+0x17f/0x4d0 fs/read_write.c:546
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0xc0/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
INFO: task syz-executor.4:14416 blocked for more than 140 seconds.
      Not tainted 4.14.111+ #50
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D28344 14416   6172 0x00000004
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3498
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3556
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x559/0x1430 kernel/locking/mutex.c:893
 __fdget_pos+0xa6/0xc0 fs/file.c:769
 fdget_pos include/linux/file.h:67 [inline]
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0x72/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
INFO: task syz-executor.4:14417 blocked for more than 140 seconds.
      Not tainted 4.14.111+ #50
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D29128 14417   6172 0x00000004
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3498
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
 rwsem_down_write_failed+0x3b1/0x760 kernel/locking/rwsem-xadd.c:601
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
 __down_write arch/x86/include/asm/rwsem.h:126 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:56
 inode_lock include/linux/fs.h:715 [inline]
 do_truncate2+0x10c/0x1e0 fs/open.c:61
 handle_truncate fs/namei.c:3039 [inline]
 do_last fs/namei.c:3464 [inline]
 path_openat+0x1208/0x2b70 fs/namei.c:3597
 do_filp_open+0x1a1/0x280 fs/namei.c:3631
 do_sys_open+0x2ca/0x590 fs/open.c:1077
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
INFO: task syz-executor.4:14418 blocked for more than 140 seconds.
      Not tainted 4.14.111+ #50
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D29184 14418   6172 0x00000004
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3498
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
 rwsem_down_write_failed+0x3b1/0x760 kernel/locking/rwsem-xadd.c:601
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
 __down_write arch/x86/include/asm/rwsem.h:126 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:56
 inode_lock include/linux/fs.h:715 [inline]
 do_truncate2+0x10c/0x1e0 fs/open.c:61
 handle_truncate fs/namei.c:3039 [inline]
 do_last fs/namei.c:3464 [inline]
 path_openat+0x1208/0x2b70 fs/namei.c:3597
 do_filp_open+0x1a1/0x280 fs/namei.c:3631
 do_sys_open+0x2ca/0x590 fs/open.c:1077
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
INFO: task syz-executor.4:14419 blocked for more than 140 seconds.
      Not tainted 4.14.111+ #50
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D28344 14419   6172 0x00000004
Call Trace:
 schedule+0x92/0x1c0 kernel/sched/core.c:3498
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
 rwsem_down_write_failed+0x3b1/0x760 kernel/locking/rwsem-xadd.c:601
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
 __down_write arch/x86/include/asm/rwsem.h:126 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:56
 inode_lock include/linux/fs.h:715 [inline]
 ext4_punch_hole+0x128/0x1030 fs/ext4/inode.c:4229
 ext4_fallocate+0x352/0x1e00 fs/ext4/extents.c:4942
 vfs_fallocate+0x348/0x790 fs/open.c:328
 SYSC_fallocate fs/open.c:351 [inline]
 SyS_fallocate+0x4a/0x80 fs/open.c:345
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289

Showing all locks held in the system:
1 lock held by khungtaskd/23:
 #0:  (tasklist_lock){.+.+}, at: [<00000000fafca6d3>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4544
2 locks held by getty/1763:
 #0:  (&tty->ldisc_sem){++++}, at: [<0000000087ecc635>] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<000000009ee58c9d>] n_tty_read+0x1f7/0x1700 drivers/tty/n_tty.c:2156
3 locks held by syz-executor.4/14413:
 #0:  (&f->f_pos_lock){+.+.}, at: [<000000000551a728>] __fdget_pos+0xa6/0xc0 fs/file.c:769
 #1:  (sb_writers#4){.+.+}, at: [<00000000aac8ad66>] file_start_write include/linux/fs.h:2726 [inline]
 #1:  (sb_writers#4){.+.+}, at: [<00000000aac8ad66>] vfs_write+0x3d8/0x4d0 fs/read_write.c:545
 #2:  (&sb->s_type->i_mutex_key#9){++++}, at: [<000000004345963d>] inode_lock include/linux/fs.h:715 [inline]
 #2:  (&sb->s_type->i_mutex_key#9){++++}, at: [<000000004345963d>] ext4_file_write_iter+0x1fe/0xe40 fs/ext4/file.c:233
1 lock held by syz-executor.4/14416:
 #0:  (&f->f_pos_lock){+.+.}, at: [<000000000551a728>] __fdget_pos+0xa6/0xc0 fs/file.c:769
2 locks held by syz-executor.4/14417:
 #0:  (sb_writers#4){.+.+}, at: [<0000000003e7ab55>] sb_start_write include/linux/fs.h:1545 [inline]
 #0:  (sb_writers#4){.+.+}, at: [<0000000003e7ab55>] mnt_want_write+0x3a/0xb0 fs/namespace.c:387
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<000000001f77dd54>] inode_lock include/linux/fs.h:715 [inline]
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<000000001f77dd54>] do_truncate2+0x10c/0x1e0 fs/open.c:61
2 locks held by syz-executor.4/14418:
 #0:  (sb_writers#4){.+.+}, at: [<0000000003e7ab55>] sb_start_write include/linux/fs.h:1545 [inline]
 #0:  (sb_writers#4){.+.+}, at: [<0000000003e7ab55>] mnt_want_write+0x3a/0xb0 fs/namespace.c:387
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<000000001f77dd54>] inode_lock include/linux/fs.h:715 [inline]
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<000000001f77dd54>] do_truncate2+0x10c/0x1e0 fs/open.c:61
2 locks held by syz-executor.4/14419:
 #0:  (sb_writers#4){.+.+}, at: [<000000008981f02c>] file_start_write include/linux/fs.h:2726 [inline]
 #0:  (sb_writers#4){.+.+}, at: [<000000008981f02c>] vfs_fallocate+0x5c3/0x790 fs/open.c:327
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<0000000025de865d>] inode_lock include/linux/fs.h:715 [inline]
 #1:  (&sb->s_type->i_mutex_key#9){++++}, at: [<0000000025de865d>] ext4_punch_hole+0x128/0x1030 fs/ext4/inode.c:4229

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.111+ #50
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 nmi_cpu_backtrace.cold+0x47/0x86 lib/nmi_backtrace.c:101
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1633 Comm: rs:main Q:Reg Not tainted 4.14.111+ #50
task: 0000000057dedc89 task.stack: 00000000d01c2414
RIP: 0010:trace_writeback_write_inode_start include/trace/events/writeback.h:194 [inline]
RIP: 0010:write_inode fs/fs-writeback.c:1212 [inline]
RIP: 0010:__writeback_single_inode+0x92e/0x1040 fs/fs-writeback.c:1412
RSP: 0018:ffff8881d478f958 EFLAGS: 00000283
RAX: 0000000000000000 RBX: ffff8881ce75daf8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8881ce75db18
RBP: ffff8881d478fa20 R08: 0000000000000001 R09: 0000000000000003
R10: ffff8881d4e966a8 R11: 0000000000000001 R12: ffffffff84500680
R13: 0000000000000000 R14: ffff8881ce75db20 R15: ffff8881ce75db80
FS:  00007fd2cf251700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f946ebbf834 CR3: 00000001d516e003 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 writeback_single_inode+0x1ec/0x360 fs/fs-writeback.c:1466
 sync_inode fs/fs-writeback.c:2494 [inline]
 sync_inode_metadata+0xb8/0xf0 fs/fs-writeback.c:2514
 __generic_file_fsync+0x121/0x190 fs/libfs.c:988
 ext4_sync_file+0x316/0x1280 fs/ext4/fsync.c:120
 vfs_fsync_range+0x106/0x260 fs/sync.c:196
 generic_write_sync include/linux/fs.h:2693 [inline]
 ext4_file_write_iter+0x7bc/0xe40 fs/ext4/file.c:268
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:471 [inline]
 __vfs_write+0x401/0x5a0 fs/read_write.c:484
 vfs_write+0x17f/0x4d0 fs/read_write.c:546
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0xc0/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
Code: 48 c7 c7 c0 90 4c 84 c6 05 d9 b9 23 02 01 e8 6b 43 c1 ff e9 76 fe ff ff e8 50 db d1 ff 65 ff 05 29 0e 43 7d 48 8b 05 12 03 24 02 <e8> 3d 14 c5 ff 85 c0 74 12 e8 34 db d1 ff 80 3d c3 b9 23 02 00 

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/06 05:15 android-4.14 171fc237b3cb fa763482 .config console log report ci-android-414-kasan-gce-root
2019/04/03 03:52 android-4.14 140cda105bb8 dfd3394d .config console log report ci-android-414-kasan-gce-root
2019/03/24 21:14 android-4.14 4344de2f79ab acbc5b7d .config console log report ci-android-414-kasan-gce-root
2019/03/10 13:47 android-4.14 b11964adfe4c 12365b99 .config console log report ci-android-414-kasan-gce-root
2018/09/24 04:47 android-4.14 666c420fa3ea 28d9ac76 .config console log report ci-android-414-kasan-gce-root
2018/09/07 14:55 android-4.14 b859aa7d7a0c 69cfeb80 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.