syzbot


INFO: task hung in sel_write_load

Status: auto-closed as invalid on 2019/04/07 22:03
First crash: 2070d, last: 2039d

Sample crash report:
Free swap  = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
313664 pages reserved
INFO: task syz-executor3:5447 blocked for more than 140 seconds.
      Not tainted 4.9.131+ #102
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D29688  5447   4919 0x00000004
 ffff8801c4d1df00 ffff8801af628580 ffff8801a8fa7900 ffff88019b1617c0
 ffff8801db621018 ffff8801898df978 ffffffff827f3542 0000000000000002
 ffff8801c4d1e7b0 ffffed00389a3cf5 00ff8801c4d1df00 ffff8801db6218f0
Call Trace:
 [<ffffffff827f4a6f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff827f53f3>] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3586
 [<ffffffff827f746d>] __mutex_lock_common kernel/locking/mutex.c:582 [inline]
 [<ffffffff827f746d>] mutex_lock_nested+0x38d/0x900 kernel/locking/mutex.c:621
 [<ffffffff81a0640a>] sel_write_load+0xba/0xfa0 security/selinux/selinuxfs.c:498
 [<ffffffff815081b5>] __vfs_write+0x115/0x580 fs/read_write.c:507
 [<ffffffff8150acc7>] vfs_write+0x187/0x520 fs/read_write.c:557
 [<ffffffff8150eaf9>] SYSC_write fs/read_write.c:604 [inline]
 [<ffffffff8150eaf9>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff828037d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bdc0>] rcu_read_unlock include/linux/rcupdate.h:927 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bdc0>] rcu_lock_break kernel/hung_task.c:143 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bdc0>] check_hung_uninterruptible_tasks kernel/hung_task.c:177 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bdc0>] watchdog+0x310/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fe394>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1896:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cdac>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2023:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82801892>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+.+.}, at: [<ffffffff81d2b2b2>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
2 locks held by syz-executor1/3434:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82801892>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+.+.}, at: [<ffffffff81d2b2b2>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
1 lock held by syz-executor2/31915:
 #0:  (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81520ea3>] prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
3 locks held by syz-executor3/5447:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cdac>] __fdget_pos+0xac/0xd0 fs/file.c:781
 #1:  (sb_writers#3){.+.+.+}, at: [<ffffffff8150af2b>] file_start_write include/linux/fs.h:2640 [inline]
 #1:  (sb_writers#3){.+.+.+}, at: [<ffffffff8150af2b>] vfs_write+0x3eb/0x520 fs/read_write.c:556
 #2:  (sel_mutex){+.+.+.}, at: [<ffffffff81a0640a>] sel_write_load+0xba/0xfa0 security/selinux/selinuxfs.c:498

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.131+ #102
 ffff8801d9907d08 ffffffff81b37029 0000000000000000 0000000000000000
 0000000000000000 0000000000000001 ffffffff81098450 ffff8801d9907d40
 ffffffff81b42139 0000000000000000 0000000000000000 0000000000000004
Call Trace:
 [<ffffffff81b37029>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b37029>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81b42139>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b420cc>] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60
 [<ffffffff81098554>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c15d>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c15d>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c15d>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c15d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff811429fd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff8280399c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 22524 Comm: syz-executor1 Not tainted 4.9.131+ #102
task: ffff8801d265c740 task.stack: ffff8801d1cb8000
RIP: 0033:[<0000000000401584>] c [<0000000000401584>] 0x401584
RSP: 002b:00007fb5005e3b50  EFLAGS: 00000202
RAX: 0000000075d854e9 RBX: 0000000000000ff4 RCX: 0000000000457579
RDX: 0000000000410f91 RSI: 0000000000a44bf0 RDI: 0000000000000043
RBP: 00000000004bc251 R08: 000000000000000e R09: 0000000000000000
R10: 00007fb5005e4700 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000004c3037 R14: 00000000004d50d0 R15: 00000000ffffffff
FS:  00007fb5005e4700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001bb83e0 CR3: 00000001d2dce000 CR4: 00000000001606b0

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/09 21:56 https://android.googlesource.com/kernel/common android-4.9 7bebf33f9d46 8b311eaf .config console log report ci-android-49-kasan-gce
2018/09/23 11:33 https://android.googlesource.com/kernel/common android-4.9 1c57ba4f543b 37079712 .config console log report ci-android-49-kasan-gce
2018/09/21 09:56 https://android.googlesource.com/kernel/common android-4.9 1c57ba4f543b 37079712 .config console log report ci-android-49-kasan-gce
2018/09/13 11:20 https://android.googlesource.com/kernel/common android-4.9 a8c1ea6c63ed 19e9088b .config console log report ci-android-49-kasan-gce
2018/09/08 17:57 https://android.googlesource.com/kernel/common android-4.9 dcae9fa1319b 6b5120a4 .config console log report ci-android-49-kasan-gce
* Struck through repros no longer work on HEAD.