syzbot


INFO: task hung in lo_ioctl (2)

Status: upstream: reported on 2022/11/01 22:16
Reported-by: syzbot+a95db47f0eaa2012f743@syzkaller.appspotmail.com
First crash: 99d, last: 99d
similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 INFO: task hung in lo_ioctl syz 498 1378d 1400d 0/1 public: reported syz repro on 2019/04/10 16:14
linux-4.14 INFO: task hung in lo_ioctl 127 713d 1399d 0/1 auto-closed as invalid on 2021/06/25 19:54
android-44 INFO: task hung in lo_ioctl C 469 1192d 1399d 0/2 public: reported C repro on 2019/04/12 00:00
android-49 INFO: task hung in lo_ioctl C 1828 1199d 1399d 0/3 public: reported C repro on 2019/04/12 00:00
upstream INFO: task hung in lo_ioctl 47 1770d 1886d 12/24 fixed on 2019/03/06 07:43
upstream INFO: task hung in lo_ioctl (2) 3 445d 450d 0/24 closed as invalid on 2022/02/08 09:40

Sample crash report:
Bluetooth: hci8 command 0x040f tx timeout
Bluetooth: hci8 command 0x0419 tx timeout
Bluetooth: hci7 command 0x0406 tx timeout
Bluetooth: hci6 command 0x0406 tx timeout
Bluetooth: hci8 command 0x0406 tx timeout
INFO: task syz-executor.2:12035 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D28336 12035   8025 0x80000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
 __blkdev_driver_ioctl block/ioctl.c:297 [inline]
 blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
 ioctl_by_bdev+0xa0/0x110 fs/block_dev.c:2092
 udf_get_last_block+0x8a/0x180 fs/udf/lowlevel.c:59
 udf_load_vrs+0x48d/0xa90 fs/udf/super.c:1978
 udf_fill_super+0x715/0x1660 fs/udf/super.c:2177
 mount_bdev+0x2b3/0x360 fs/super.c:1134
 mount_fs+0x92/0x2a0 fs/super.c:1237
 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
 vfs_kern_mount fs/namespace.c:1036 [inline]
 do_new_mount fs/namespace.c:2572 [inline]
 do_mount+0xe65/0x2a30 fs/namespace.c:2905
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12051 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D30272 12051   8025 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
 __blkdev_driver_ioctl block/ioctl.c:297 [inline]
 blkdev_flushbuf block/ioctl.c:426 [inline]
 blkdev_ioctl+0x84e/0x1830 block/ioctl.c:514
 block_ioctl+0xd9/0x120 fs/block_dev.c:1893
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.4:12044 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D29048 12044   8027 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
 rwsem_down_read_failed+0x1e6/0x350 kernel/locking/rwsem-xadd.c:309
 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94
 __down_read arch/x86/include/asm/rwsem.h:66 [inline]
 down_read+0x44/0x80 kernel/locking/rwsem.c:26
 __get_super.part.0+0x271/0x390 fs/super.c:678
 __get_super include/linux/spinlock.h:317 [inline]
 get_super+0x2b/0x50 fs/super.c:707
 fsync_bdev+0x14/0xc0 fs/block_dev.c:495
 invalidate_partition+0x74/0xb0 block/genhd.c:1509
 drop_partitions.isra.0+0x83/0x150 block/partition-generic.c:442
 rescan_partitions+0xa9/0x800 block/partition-generic.c:515
 __blkdev_reread_part+0x140/0x1d0 block/ioctl.c:173
 blkdev_reread_part+0x23/0x40 block/ioctl.c:193
 loop_reread_partitions drivers/block/loop.c:624 [inline]
 loop_set_status+0xeeb/0x12b0 drivers/block/loop.c:1193
 loop_set_status64+0x92/0xe0 drivers/block/loop.c:1316
 lo_ioctl+0x587/0x1cd0 drivers/block/loop.c:1446
 __blkdev_driver_ioctl block/ioctl.c:297 [inline]
 blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
 block_ioctl+0xd9/0x120 fs/block_dev.c:1893
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.4:12171 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D25912 12171      1 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
 blkdev_get+0x88/0x890 fs/block_dev.c:1611
 blkdev_open+0x1cc/0x250 fs/block_dev.c:1772
 do_dentry_open+0x44b/0xec0 fs/open.c:777
 vfs_open+0x105/0x220 fs/open.c:888
 do_last fs/namei.c:3428 [inline]
 path_openat+0x628/0x2970 fs/namei.c:3571
 do_filp_open+0x179/0x3c0 fs/namei.c:3605
 do_sys_open+0x296/0x410 fs/open.c:1081
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12657 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D29368 12657  12169 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
 blkdev_get+0x88/0x890 fs/block_dev.c:1611
 blkdev_open+0x1cc/0x250 fs/block_dev.c:1772
 do_dentry_open+0x44b/0xec0 fs/open.c:777
 vfs_open+0x105/0x220 fs/open.c:888
 do_last fs/namei.c:3428 [inline]
 path_openat+0x628/0x2970 fs/namei.c:3571
 do_filp_open+0x179/0x3c0 fs/namei.c:3605
 do_sys_open+0x296/0x410 fs/open.c:1081
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12659 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D29968 12659  12169 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
 blkdev_get+0x441/0x890 fs/block_dev.c:1611
 blkdev_get_by_path+0x38/0xa0 fs/block_dev.c:1692
 mount_bdev+0x4c/0x360 fs/super.c:1092
 mount_fs+0x92/0x2a0 fs/super.c:1237
 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
 vfs_kern_mount fs/namespace.c:1036 [inline]
 do_new_mount fs/namespace.c:2572 [inline]
 do_mount+0xe65/0x2a30 fs/namespace.c:2905
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12937 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D28728 12937  12692 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
 __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
 blkdev_get+0x88/0x890 fs/block_dev.c:1611
 blkdev_open+0x1cc/0x250 fs/block_dev.c:1772
 do_dentry_open+0x44b/0xec0 fs/open.c:777
 vfs_open+0x105/0x220 fs/open.c:888
 do_last fs/namei.c:3428 [inline]
 path_openat+0x628/0x2970 fs/namei.c:3571
 do_filp_open+0x179/0x3c0 fs/namei.c:3605
 do_sys_open+0x296/0x410 fs/open.c:1081
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12939 blocked for more than 140 seconds.
      Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D30016 12939  12692 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2811 [inline]
 __schedule+0x88b/0x1de0 kernel/sched/core.c:3387
 schedule+0x8d/0x1b0 kernel/sched/core.c:3431
 bd_prepare_to_claim fs/block_dev.c:1078 [inline]
 bd_start_claiming fs/block_dev.c:1149 [inline]
 blkdev_get+0x3ee/0x890 fs/block_dev.c:1604
 blkdev_get_by_path+0x38/0xa0 fs/block_dev.c:1692
 mount_bdev+0x4c/0x360 fs/super.c:1092
 mount_fs+0x92/0x2a0 fs/super.c:1237
 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
 vfs_kern_mount fs/namespace.c:1036 [inline]
 do_new_mount fs/namespace.c:2572 [inline]
 do_mount+0xe65/0x2a30 fs/namespace.c:2905
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3

Showing all locks held in the system:
1 lock held by khungtaskd/1533:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffff87029579>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
1 lock held by in:imklog/7699:
 #0:  (&f->f_pos_lock){+.+.}, at: [<ffffffff818d8b5b>] __fdget_pos+0x1fb/0x2b0 fs/file.c:819
2 locks held by syz-executor.2/12035:
 #0:  (&type->s_umount_key#70/1){+.+.}, at: [<ffffffff81878e26>] alloc_super fs/super.c:251 [inline]
 #0:  (&type->s_umount_key#70/1){+.+.}, at: [<ffffffff81878e26>] sget_userns+0x556/0xc10 fs/super.c:516
 #1:  (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838dd557>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
1 lock held by syz-executor.2/12051:
 #0:  (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838dd557>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
3 locks held by syz-executor.4/12044:
 #0:  (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838dd557>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
 #1:  (&bdev->bd_mutex){+.+.}, at: [<ffffffff830c3fdb>] blkdev_reread_part+0x1b/0x40 block/ioctl.c:192
 #2:  (&type->s_umount_key#71){.+.+}, at: [<ffffffff8187a6c1>] __get_super.part.0+0x271/0x390 fs/super.c:678
1 lock held by syz-executor.4/12171:
 #0:  (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
1 lock held by syz-executor.2/12657:
 #0:  (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
1 lock held by syz-executor.2/12659:
 #0:  (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
1 lock held by syz-executor.2/12937:
 #0:  (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1533 Comm: khungtaskd Not tainted 4.14.297-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
 watchdog+0x5b9/0xb40 kernel/hung_task.c:274
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 7700 Comm: rs:main Q:Reg Not tainted 4.14.297-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
task: ffff8880a1dec540 task.stack: ffff8880907a0000
RIP: 0010:fput_many+0x0/0x140 fs/file_table.c:265
RSP: 0018:ffff8880907a7e78 EFLAGS: 00000297
RAX: ffff8880a1dec540 RBX: 0000000000000001 RCX: fffffbfff17d97b8
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880ab761580
RBP: ffff8880ab761580 R08: ffff8880a1dec540 R09: dffffc0000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff110120f4fd1
R13: 000000000005bbde R14: 00000000000004a6 R15: 000000000005b738
FS:  00007fecd2d70700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fafab90c028 CR3: 00000000b00f7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 fdput include/linux/file.h:41 [inline]
 fdput_pos include/linux/file.h:76 [inline]
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0x1ce/0x210 fs/read_write.c:582
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
Code: 20 00 75 1a 48 8b 5d 00 48 89 ef e8 0b ef ff ff 48 85 db 75 d9 5b 5d 41 5c e9 cd f0 cd ff 48 89 ef e8 85 ae f7 ff eb dc 0f 1f 00 <41> 54 55 48 89 fd 53 89 f3 e8 b2 f0 cd ff 89 de f0 48 29 75 70 

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-linux-4-14 2022/11/01 22:16 linux-4.14.y a85772d7ba90 08977f5d .config console log report info [disk image] [vmlinux] [kernel image] INFO: task hung in lo_ioctl
* Struck through repros no longer work on HEAD.