syzbot


INFO: task hung in ext4_direct_IO

Status: auto-closed as invalid on 2019/09/14 20:30
Reported-by: syzbot+c229be7fd1b011e85b74@syzkaller.appspotmail.com
First crash: 2074d, last: 2074d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in ext4_direct_IO ext4 1 2383d 2383d 0/28 closed as dup on 2018/07/18 11:49
android-414 INFO: task hung in ext4_direct_IO 8 2066d 2049d 0/1 auto-closed as invalid on 2019/09/23 12:02

Sample crash report:
INFO: task syz-executor.4:23629 blocked for more than 140 seconds.
      Not tainted 4.9.155+ #27
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D26552 23629   3838 0x00000004
 ffff8801d3bbdf00 ffff8801a5e9d800 ffff8801db621000 ffff8801a5e797c0
 ffff8801db621018 ffff8801a650f450 ffffffff82806806 dffffc0000000000
 ffff8801a650f428 ffffffff81207081 00ffffff8281290b ffff8801db6218f0
Call Trace:
 [<ffffffff82807d92>] schedule+0x92/0x1c0 kernel/sched/core.c:3553
 [<ffffffff82812aa8>] rwsem_down_read_failed+0x258/0x3e0 kernel/locking/rwsem-xadd.c:260
 [<ffffffff81b78ff8>] call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
 [<ffffffff828108a2>] __down_read arch/x86/include/asm/rwsem.h:65 [inline]
 [<ffffffff828108a2>] down_read+0x52/0xb0 kernel/locking/rwsem.c:24
 [<ffffffff816e26ff>] inode_lock_shared include/linux/fs.h:778 [inline]
 [<ffffffff816e26ff>] ext4_direct_IO_read fs/ext4/inode.c:3595 [inline]
 [<ffffffff816e26ff>] ext4_direct_IO+0x51f/0x29c0 fs/ext4/inode.c:3662
 [<ffffffff814143cf>] generic_file_read_iter+0xaaf/0x1ac0 mm/filemap.c:1964
 [<ffffffff815ad69c>] generic_file_splice_read+0x28c/0x4c0 fs/splice.c:309
 [<ffffffff815add28>] do_splice_to+0x108/0x170 fs/splice.c:899
 [<ffffffff815adfd6>] splice_direct_to_actor+0x246/0x820 fs/splice.c:971
 [<ffffffff815ae755>] do_splice_direct+0x1a5/0x260 fs/splice.c:1080
 [<ffffffff8150f8f3>] do_sendfile+0x503/0xc00 fs/read_write.c:1395
 [<ffffffff815118e5>] SYSC_sendfile64 fs/read_write.c:1456 [inline]
 [<ffffffff815118e5>] SyS_sendfile64+0x145/0x160 fs/read_write.c:1442
 [<ffffffff810056bd>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
 [<ffffffff82816a93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bbab>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131bbab>] watchdog+0x11b/0xa40 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813fea8f>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1909:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156f2f8>] __fdget_pos+0xa8/0xd0 fs/file.c:781
2 locks held by getty/2037:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff82814b83>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d3982e>] n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.4/23629:
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8150fd2a>] file_start_write include/linux/fs.h:2642 [inline]
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8150fd2a>] do_sendfile+0x93a/0xc00 fs/read_write.c:1394
 #1:  (&sb->s_type->i_mutex_key#9){++++++}, at: [<ffffffff816e26ff>] inode_lock_shared include/linux/fs.h:778 [inline]
 #1:  (&sb->s_type->i_mutex_key#9){++++++}, at: [<ffffffff816e26ff>] ext4_direct_IO_read fs/ext4/inode.c:3595 [inline]
 #1:  (&sb->s_type->i_mutex_key#9){++++++}, at: [<ffffffff816e26ff>] ext4_direct_IO+0x51f/0x29c0 fs/ext4/inode.c:3662

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.155+ #27
 ffff8801d9907cd0 ffffffff81b47871 0000000000000000 0000000000000000
 0000000000000000 ffffffff81097301 00000000003ffd5d ffff8801d9907d08
 ffffffff81b52afc 0000000000000000 0000000000000000 0000000000000000
Call Trace:
 [<ffffffff81b47871>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b47871>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81b52afc>] nmi_cpu_backtrace.cold+0x47/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b52a84>] nmi_trigger_cpumask_backtrace+0x124/0x155 lib/nmi_backtrace.c:60
 [<ffffffff81097494>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131c087>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131c087>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131c087>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131c087>] watchdog+0x5f7/0xa40 kernel/hung_task.c:239
 [<ffffffff81142028>] kthread+0x278/0x310 kernel/kthread.c:211
 [<ffffffff82816c5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 13336 Comm: syz-executor.1 Not tainted 4.9.155+ #27
task: ffff8801a5e797c0 task.stack: ffff8801ab898000
RIP: 0033:[<000000000040159b>] c [<000000000040159b>] 0x40159b
RSP: 002b:00007f2ee5672690  EFLAGS: 00000286
RAX: 00000000baeaab3a RBX: 000000000000000b RCX: 0000000000458079
RDX: 0000000100000000 RSI: 00007f2ee56726c0 RDI: 000000000000000b
RBP: 0000000000000000 R08: 0077697275636573 R09: 0000000000000000
R10: 25328dfb00000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f2ee5673700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c42b50c000 CR3: 00000001a673e000 CR4: 00000000001606b0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/18 20:29 https://android.googlesource.com/kernel/common android-4.9 1597fdfe52ba 4656beca .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.