syzbot


INFO: task hung in kern_unmount

Status: auto-closed as invalid on 2020/02/10 14:31
Reported-by: syzbot+8a5d4c309376f1176f8b@syzkaller.appspotmail.com
First crash: 2094d, last: 1866d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in kern_unmount fs 1 2458d 2458d 0/28 closed as invalid on 2018/03/27 11:08
android-414 INFO: task hung in kern_unmount 1 2250d 2250d 0/1 auto-closed as invalid on 2019/03/23 15:31

Sample crash report:
Killed process 14440 (syz-executor.0) total-vm:72708kB, anon-rss:164kB, file-rss:34816kB, shmem-rss:0kB
lowmemorykiller: Killing 'syz-executor.0' (20772) (tgid 20772), adj 1000,
   to free 35008kB on behalf of 'kswapd0' (33) because
   cache 996kB is below limit 6144kB for oom_score_adj 0
   Free memory is 472kB above reserved
INFO: task kworker/1:1:22 blocked for more than 140 seconds.
      Not tainted 4.9.141+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/1:1     D26712    22      2 0x80000000
Workqueue: events proc_cleanup_work
 ffff8801d9c20000 0000000000000000 ffff8801d1706300 ffff8801d99217c0
 ffff8801db721018 ffff8801d9c2f7f0 ffffffff828075c2 ffffffff83c311b0
 0000000041b58ab3 ffffffff82e33920 00ffffff83c7a7d0 ffff8801db7218f0
Call Trace:
 [<ffffffff82808aef>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff828142d5>] schedule_timeout+0x735/0xe20 kernel/time/timer.c:1771
 [<ffffffff8280a63f>] do_wait_for_common kernel/sched/completion.c:75 [inline]
 [<ffffffff8280a63f>] __wait_for_common kernel/sched/completion.c:93 [inline]
 [<ffffffff8280a63f>] wait_for_common+0x3ef/0x5d0 kernel/sched/completion.c:101
 [<ffffffff8280a838>] wait_for_completion+0x18/0x20 kernel/sched/completion.c:122
 [<ffffffff81243b37>] __wait_rcu_gp+0x137/0x1b0 kernel/rcu/update.c:369
 [<ffffffff8124c21a>] synchronize_rcu.part.55+0xfa/0x110 kernel/rcu/tree_plugin.h:684
 [<ffffffff8124c257>] synchronize_rcu+0x27/0x90 kernel/rcu/tree_plugin.h:685
 [<ffffffff815750c7>] kern_unmount+0x57/0xd0 fs/namespace.c:3344
 [<ffffffff8165e357>] pid_ns_release_proc+0x37/0x50 fs/proc/root.c:227
 [<ffffffff812ec609>] proc_cleanup_work+0x19/0x20 kernel/pid_namespace.c:76
 [<ffffffff81131001>] process_one_work+0x831/0x15f0 kernel/workqueue.c:2092
 [<ffffffff81131e96>] worker_thread+0xd6/0x1140 kernel/workqueue.c:2226
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Showing all locks held in the system:
2 locks held by kworker/1:1/22:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131c0cc>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fe63f>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
2 locks held by kworker/0:2/346:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:2/352:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
1 lock held by rsyslogd/1900:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cc7c>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2028:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+.+.}, at: [<ffffffff81d37362>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
1 lock held by syz-executor.1/4590:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.1/4614:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.1/7354:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.1/7368:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.1/9591:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.0/11505:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.2/15391:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.2/15404:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.2/15903:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.2/15937:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.0/16161:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.0/16167:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
2 locks held by syz-executor.2/18345:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&tty->atomic_write_lock){+.+.+.}, at: [<ffffffff81d1f7e1>] tty_write_lock+0x21/0x60 drivers/tty/tty_io.c:1107
2 locks held by kworker/0:0/18397:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
1 lock held by syz-executor.1/20663:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.1/20691:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.2/25286:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.2/25301:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
2 locks held by kworker/1:4/26859:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
1 lock held by syz-executor.0/28352:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.0/28364:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.3/28871:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
2 locks held by syz-executor.0/30409:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
 #1:  (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a7b7>] exp_funnel_lock kernel/rcu/tree_exp.h:289 [inline]
 #1:  (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a7b7>] _synchronize_rcu_expedited+0x3a7/0x840 kernel/rcu/tree_exp.h:569
1 lock held by syz-executor.4/10552:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.4/10561:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.4/10591:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.2/11909:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.0/13657:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.0/13681:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
3 locks held by kworker/u4:18/16082:
 #0:  ("%s""netns"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  (net_cleanup_work){+.+.+.}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
 #2:  (net_mutex){+.+.+.}, at: [<ffffffff822e681f>] cleanup_net+0x13f/0x8b0 net/core/net_namespace.c:439
1 lock held by syz-executor.3/16196:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.3/16200:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
2 locks held by syz-executor.5/18140:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+.+.}, at: [<ffffffff81d37362>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
1 lock held by syz-executor.5/18339:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.5/18349:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
2 locks held by syz-executor.2/21484:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
 #1:  (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a749>] exp_funnel_lock kernel/rcu/tree_exp.h:256 [inline]
 #1:  (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a749>] _synchronize_rcu_expedited+0x339/0x840 kernel/rcu/tree_exp.h:569
1 lock held by syz-executor.2/21595:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/21702:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/22064:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/22114:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/22242:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/22355:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/22370:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.1/22422:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/22441:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.2/22592:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
1 lock held by syz-executor.4/25880:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.4/25912:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.3/28389:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
1 lock held by syz-executor.1/32095:
 #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
2 locks held by kworker/0:1/32310:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
1 lock held by syz-executor.5/2301:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
2 locks held by syz-executor.1/6594:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
 #1:  (sk_lock-AF_PACKET){+.+.+.}, at: [<ffffffff827d136d>] lock_sock include/net/sock.h:1404 [inline]
 #1:  (sk_lock-AF_PACKET){+.+.+.}, at: [<ffffffff827d136d>] packet_release+0x4ad/0xb70 net/packet/af_packet.c:3029
2 locks held by syz-executor.1/6643:
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] inode_lock include/linux/fs.h:766 [inline]
 #0:  (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<ffffffff8229bd8b>] __sock_release+0x8b/0x260 net/socket.c:604
 #1:  (sk_lock-AF_PACKET){+.+.+.}, at: [<ffffffff827d136d>] lock_sock include/net/sock.h:1404 [inline]
 #1:  (sk_lock-AF_PACKET){+.+.+.}, at: [<ffffffff827d136d>] packet_release+0x4ad/0xb70 net/packet/af_packet.c:3029
2 locks held by kworker/0:4/8233:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&rew.rew_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:0/8235:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:3/8237:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:5/8239:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:6/8242:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:7/8243:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:8/8245:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:9/8246:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
3 locks held by kworker/1:11/8249:
 #0:  ("%s"("ipv6_addrconf")){.+.+..}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((addr_chk_work).work){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
 #2:  (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
2 locks held by kworker/0:5/8250:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/1:12/8251:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
2 locks held by kworker/0:6/8253:
 #0:  ("events"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&ns->proc_work)){+.+...}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
1 lock held by init/8255:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/8256:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/8257:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/8258:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/8259:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130
1 lock held by init/8260:
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open_by_driver drivers/tty/tty_io.c:2052 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81d2bb96>] tty_open+0x476/0xdf0 drivers/tty/tty_io.c:2130

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1
 ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40
 ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000002
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b4df89>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b4df1c>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff810984b4>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c65d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c65d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c65d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c65d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 33 Comm: kswapd0 Not tainted 4.9.141+ #1
task: ffff8801d99217c0 task.stack: ffff8801d8418000
RIP: 0010:[<ffffffff81207f07>] c [<ffffffff81207f07>] mark_irqflags kernel/locking/lockdep.c:2928 [inline]
RIP: 0010:[<ffffffff81207f07>] c [<ffffffff81207f07>] __lock_acquire+0xb57/0x4a10 kernel/locking/lockdep.c:3302
RSP: 0018:ffff8801d841f650  EFLAGS: 00000046
RAX: 0000000000000004 RBX: ffff8801d99220e8 RCX: ffff8801d9922109
RDX: 0000000000000002 RSI: 0000000000000002 RDI: ffff8801d992210c
RBP: ffff8801d841f800 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8801d99217c0 R11: 1ffff1003b32441c R12: 0000000000000075
R13: 0000000000000003 R14: 0000000000000000 R15: ffff8801d992210a
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000021000000 CR3: 000000000301e000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801d992205cc 0000000000000000c ffff8801d841f820c ffffffff81207a04c
 ffffffff00000003c ffff880100000000c ffffffff83c73d80c ffff8801d9922098c
 00000000000065b8c ffff8801d99220d8c ffff8801d9922060c ffff8801d99220e0c
Call Trace:
 [<ffffffff8120c8d0>] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
 [<ffffffff82816c26>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
 [<ffffffff82816c26>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
 [<ffffffff8141a061>] spin_lock include/linux/spinlock.h:302 [inline]
 [<ffffffff8141a061>] task_lock include/linux/sched.h:3257 [inline]
 [<ffffffff8141a061>] find_lock_task_mm+0xf1/0x270 mm/oom_kill.c:115
 [<ffffffff821effdf>] lowmem_scan+0x34f/0xaf0 drivers/staging/android/lowmemorykiller.c:134
 [<ffffffff81449cc6>] do_shrink_slab mm/vmscan.c:398 [inline]
 [<ffffffff81449cc6>] shrink_slab.part.8+0x3c6/0xa00 mm/vmscan.c:501
 [<ffffffff814557fd>] shrink_slab mm/vmscan.c:465 [inline]
 [<ffffffff814557fd>] shrink_node+0x1ed/0x740 mm/vmscan.c:2602
 [<ffffffff814570b9>] kswapd_shrink_node mm/vmscan.c:3202 [inline]
 [<ffffffff814570b9>] balance_pgdat mm/vmscan.c:3319 [inline]
 [<ffffffff814570b9>] kswapd+0x7e9/0x13b0 mm/vmscan.c:3512
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Code: c00 c00 c44 c89 c9c c24 c98 c00 c00 c00 c48 cc7 cc7 c80 c02 ca5 c82 ce8 c0e c3f ced cff c44 c8b c9c c24 c98 c00 c00 c00 ce9 c75 cfe cff cff ca8 c08 c0f c85 ce8 cfa cff cff c<a8> c03 c48 c89 c4c c24 c60 c0f c84 c37 c05 c00 c00 cba c03 c00 c00 c00 c48 c89 cde c

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/25 10:37 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 d21c5d9d .config console log report ci-android-49-kasan-gce
2019/06/25 03:55 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 82c13b6b .config console log report ci-android-49-kasan-gce
2019/05/02 22:09 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 e9039493 .config console log report ci-android-49-kasan-gce
2019/05/01 00:57 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 618456b4 .config console log report ci-android-49-kasan-gce
2019/02/27 08:36 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 f2468c12 .config console log report ci-android-49-kasan-gce
2019/10/13 14:30 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 2f661ec4 .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.