syzbot


INFO: task hung in register_for_each_vma

Status: auto-closed as invalid on 2019/07/30 22:07
Subsystems: perf
[Documentation on labels]
First crash: 1910d, last: 1910d

Sample crash report:
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_1
INFO: task syz-executor0:8405 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc4+ #54
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D25320  8405   8185 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2844 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3485
 schedule+0xfe/0x350 kernel/sched/core.c:3529
 percpu_down_write+0x430/0x540 kernel/locking/percpu-rwsem.c:162
 register_for_each_vma+0x99/0xef0 kernel/events/uprobes.c:1012
 uprobe_apply+0xeb/0x140 kernel/events/uprobes.c:1192
 uprobe_perf_close kernel/trace/trace_uprobe.c:1035 [inline]
 uprobe_perf_close+0x432/0x650 kernel/trace/trace_uprobe.c:1018
 trace_uprobe_register+0x345/0xcf0 kernel/trace/trace_uprobe.c:1210
 perf_trace_event_close kernel/trace/trace_event_perf.c:187 [inline]
 perf_uprobe_destroy+0xa0/0x130 kernel/trace/trace_event_perf.c:341
 _free_event+0x3ee/0x15d0 kernel/events/core.c:4446
 put_event+0x47/0x60 kernel/events/core.c:4532
 perf_event_release_kernel+0x890/0xf70 kernel/events/core.c:4638
 perf_release+0x37/0x50 kernel/events/core.c:4648
 __fput+0x3c5/0xb10 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x1f4/0x2b0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x32a/0x3b0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x696/0x800 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x411d41
Code: ff 48 8b 4c 24 58 e9 78 ff ff ff 48 8b 44 24 38 48 8b 4c 24 58 e9 69 ff ff ff e8 1a 82 04 00 e9 c5 fe ff ff cc cc cc cc cc 48 <83> ec 20 48 89 6c 24 18 48 8d 6c 24 18 0f b6 05 cf bb 27 01 84 c0
RSP: 002b:00007fffa9f30d80 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000411d41
RDX: 0000000000000000 RSI: 0000000000741348 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000013623c
R10: 0000000000741338 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000606 R15: 0000000000000000
INFO: task syz-executor2:8410 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc4+ #54
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D26208  8410   8191 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2844 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3485
 schedule+0xfe/0x350 kernel/sched/core.c:3529
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3587
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xa3b/0x1670 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236
 tp_perf_event_destroy+0x16/0x20 kernel/events/core.c:8336
 _free_event+0x3ee/0x15d0 kernel/events/core.c:4446
 put_event+0x47/0x60 kernel/events/core.c:4532
 perf_event_release_kernel+0x890/0xf70 kernel/events/core.c:4638
 perf_release+0x37/0x50 kernel/events/core.c:4648
 __fput+0x3c5/0xb10 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x1f4/0x2b0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x32a/0x3b0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x696/0x800 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x411d41
Code: ff 48 8b 4c 24 58 e9 78 ff ff ff 48 8b 44 24 38 48 8b 4c 24 58 e9 69 ff ff ff e8 1a 82 04 00 e9 c5 fe ff ff cc cc cc cc cc 48 <83> ec 20 48 89 6c 24 18 48 8d 6c 24 18 0f b6 05 cf bb 27 01 84 c0
RSP: 002b:00007ffe610e9b10 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000009 RCX: 0000000000411d41
RDX: 0000000000000000 RSI: 0000000000745420 RDI: 0000000000000008
RBP: 0000000000000000 R08: 000000008139cc2d R09: 0000000000136284
R10: 00007ffe610e9a40 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000603 R15: 0000000000000002

Showing all locks held in the system:
1 lock held by khungtaskd/1040:
 #0: 0000000010926ab1 (rcu_read_lock){....}, at: debug_show_all_locks+0xc6/0x41d kernel/locking/lockdep.c:4389
1 lock held by rsyslogd/8060:
 #0: 000000006db78b7e (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1b3/0x1f0 fs/file.c:795
2 locks held by getty/8150:
 #0: 0000000043174036 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000006b1af4da (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8151:
 #0: 000000005b761a21 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000003cd95a8a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8152:
 #0: 0000000000bedacb (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000bc216028 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8153:
 #0: 000000002d7d9aba (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000ef36ce42 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8154:
 #0: 0000000026000148 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000fba41063 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8155:
 #0: 00000000e4f878ec (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000c9ed439e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8156:
 #0: 0000000032a2c6d7 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000000f1597be (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
1 lock held by syz-executor0/15884:
 #0: 00000000bcf62aa1 (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236
3 locks held by kworker/u4:7/19464:
 #0: 00000000482d620f (&rq->lock){-.-.}, at: idle_balance kernel/sched/fair.c:9933 [inline]
 #0: 00000000482d620f (&rq->lock){-.-.}, at: pick_next_task_fair+0x13e5/0x1c20 kernel/sched/fair.c:7016
 #1: 0000000010926ab1 (rcu_read_lock){....}, at: __update_idle_core+0xa8/0x5c0 kernel/sched/fair.c:6013
 #2: 00000000efa7ce0f (&base->lock){-.-.}, at: lock_timer_base+0xb7/0x2a0 kernel/time/timer.c:937
3 locks held by syz-executor0/8405:
 #0: 00000000bcf62aa1 (event_mutex){+.+.}, at: perf_uprobe_destroy+0x28/0x130 kernel/trace/trace_event_perf.c:340
 #1: 00000000f6fb0394 (&uprobe->register_rwsem){+.+.}, at: uprobe_apply+0x4a/0x140 kernel/events/uprobes.c:1188
 #2: 0000000058587bad (&dup_mmap_sem){++++}, at: percpu_down_write+0x9a/0x540 kernel/locking/percpu-rwsem.c:145
1 lock held by syz-executor2/8410:
 #0: 00000000bcf62aa1 (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236
1 lock held by syz-executor1/8435:
 #0: 0000000058587bad (&dup_mmap_sem){++++}, at: dup_mmap kernel/fork.c:472 [inline]
 #0: 0000000058587bad (&dup_mmap_sem){++++}, at: dup_mm kernel/fork.c:1320 [inline]
 #0: 0000000058587bad (&dup_mmap_sem){++++}, at: copy_mm kernel/fork.c:1375 [inline]
 #0: 0000000058587bad (&dup_mmap_sem){++++}, at: copy_process+0x3041/0x8860 kernel/fork.c:1917

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1040 Comm: khungtaskd Not tainted 5.0.0-rc4+ #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0xbbb/0x1170 kernel/hung_task.c:287
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:57

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/31 21:02 upstream 9f789567142c 0e8ea0a3 .config console log report ci-upstream-kasan-gce-root
* Struck through repros no longer work on HEAD.