INFO: task hung in n_tty_flush_buffer

Status: auto-closed as invalid on 2020/09/03 14:06
Reported-by: syzbot+584168ad7e265b8b63ff@syzkaller.appspotmail.com
First crash: 2290d, last: 2290d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 INFO: task hung in n_tty_flush_buffer 1 syz, C 6 2965d 2679d 0/3 public: reported C repro on 2019/04/14 00:00
upstream INFO: task hung in n_tty_flush_buffer (3) serial prio:high 1 1 154d 154d 0/29 auto-obsoleted due to no activity on 2026/06/11 06:05
upstream INFO: task hung in n_tty_flush_buffer serial 1 6 2966d 3040d 8/29 fixed on 2018/07/09 18:05
upstream INFO: task hung in n_tty_flush_buffer (2) serial 1 1 646d 646d 0/29 auto-obsoleted due to no activity on 2025/02/04 04:28

Sample crash report:
INFO: task agetty:6002 blocked for more than 140 seconds.
      Not tainted 4.14.179-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
agetty          D27904  6002      1 0x80000002
Call Trace:
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:588 [inline]
 rwsem_down_write_failed+0x5c3/0xbb0 kernel/locking/rwsem-xadd.c:617
 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
 __down_write arch/x86/include/asm/rwsem.h:126 [inline]
 down_write+0x4f/0x90 kernel/locking/rwsem.c:56
 n_tty_flush_buffer+0x1b/0x240 drivers/tty/n_tty.c:373
 tty_ldisc_hangup+0x81/0x5c0 drivers/tty/tty_ldisc.c:739
 __tty_hangup.part.0+0x2cd/0x6b0 drivers/tty/tty_io.c:622
 __tty_hangup drivers/tty/tty_io.c:572 [inline]
 tty_vhangup_session+0x20/0x30 drivers/tty/tty_io.c:732
 disassociate_ctty.part.0+0x96/0x6a0 drivers/tty/tty_jobctrl.c:266
 disassociate_ctty+0x71/0x90 drivers/tty/tty_jobctrl.c:260
 do_exit+0x1703/0x2b00 kernel/exit.c:856
 do_group_exit+0x100/0x310 kernel/exit.c:955
 SYSC_exit_group kernel/exit.c:966 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:964
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f2ed1479618
RSP: 002b:00007fffb4976ad8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f2ed1479618
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 00007f2ed17568e0 R08: 00000000000000e7 R09: ffffffffffffff98
R10: 00007fffb4976a58 R11: 0000000000000246 R12: 00007f2ed17568e0
R13: 00007f2ed175bc20 R14: 0000000000000001 R15: 000000000000000a

Showing all locks held in the system:
1 lock held by khungtaskd/1042:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffff81465d33>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
1 lock held by in:imklog/6000:
 #0:  (&f->f_pos_lock){+.+.}, at: [<ffffffff8191ba16>] __fdget_pos+0xa6/0xc0 fs/file.c:769
3 locks held by agetty/6002:
 #0:  (&tty->legacy_mutex){+.+.}, at: [<ffffffff833b776f>] tty_lock+0x5f/0x70 drivers/tty/tty_mutex.c:19
 #1:  (&tty->ldisc_sem){++++}, at: [<ffffffff833b1bfb>] tty_ldisc_ref+0x1b/0x80 drivers/tty/tty_ldisc.c:305
 #2:  (&tty->termios_rwsem){++++}, at: [<ffffffff833a6cab>] n_tty_flush_buffer+0x1b/0x240 drivers/tty/n_tty.c:373
2 locks held by agetty/6053:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff833b1b42>] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff833a5784>] n_tty_read+0x1e4/0x16f0 drivers/tty/n_tty.c:2156

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 4.14.179-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x13e/0x194 lib/dump_stack.c:58
 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x139/0x17e lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
 watchdog+0x5e2/0xb80 kernel/hung_task.c:274
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 15950 Comm: syz-executor.0 Not tainted 4.14.179-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888057e56080 task.stack: ffff88820b228000
RIP: 0010:rcu_is_watching+0x7a/0xb0 kernel/rcu/tree.c:1131
RSP: 0018:ffff8880aea07970 EFLAGS: 00000002
RAX: 0000000000000001 RBX: ffff8880aea23940 RCX: 1ffffffff0f419ac
RDX: 0000000000000000 RSI: ffffffff86e45880 RDI: ffff8880aea2394c
RBP: 000000000045c829 R08: 0000000000000000 R09: 00000000000a2012
R10: ffff888057e56a48 R11: ffff888057e56080 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888057e56080 R15: 000000000000ffff
FS:  00007fd41d710700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c430c567d0 CR3: 000000008dee0000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rcu_read_unlock include/linux/rcupdate.h:681 [inline]
 is_bpf_text_address+0xb4/0x120 kernel/bpf/core.c:458
 kernel_text_address+0x6e/0xe0 kernel/extable.c:150
 __kernel_text_address+0x9/0x30 kernel/extable.c:105
 unwind_get_return_address arch/x86/kernel/unwind_orc.c:255 [inline]
 unwind_get_return_address+0x5a/0xa0 arch/x86/kernel/unwind_orc.c:250
 __save_stack_trace+0x7b/0xd0 arch/x86/kernel/stacktrace.c:45
 save_stack+0x32/0xa0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758
 inet_bind_bucket_destroy net/ipv4/inet_hashtables.c:89 [inline]
 inet_bind_bucket_destroy+0xd8/0x110 net/ipv4/inet_hashtables.c:85
 inet_twsk_bind_unhash+0x115/0x180 net/ipv4/inet_timewait_sock.c:38
 inet_twsk_kill+0x316/0x430 net/ipv4/inet_timewait_sock.c:58
 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1279
 expire_timers kernel/time/timer.c:1318 [inline]
 __run_timers kernel/time/timer.c:1636 [inline]
 __run_timers kernel/time/timer.c:1604 [inline]
 run_timer_softirq+0x52a/0x1390 kernel/time/timer.c:1649
 __do_softirq+0x254/0x9bf kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x15b/0x1a0 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:648 [inline]
 smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1102
 apic_timer_interrupt+0x8f/0xa0 arch/x86/entry/entry_64.S:792
 </IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x3d/0x50 kernel/kcov.c:87
RSP: 0018:ffff88820b22f298 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000040000 RBX: ffff8880000a0000 RCX: ffffc90005b5e000
RDX: 000000000003ffff RSI: ffffffff831b2e9b RDI: 0000000000000a00
RBP: 0000000000000a00 R08: 0000000000000a00 R09: 0000000000000040
R10: ffffed1014b6401b R11: ffff8880a5b200df R12: 0000000000000040
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 bitfill_aligned drivers/video/fbdev/core/cfbfillrect.c:62 [inline]
 bitfill_aligned+0xab/0x190 drivers/video/fbdev/core/cfbfillrect.c:35
 cfb_fillrect+0x3d5/0x720 drivers/video/fbdev/core/cfbfillrect.c:327
 vga16fb_fillrect+0x61e/0x1880 drivers/video/fbdev/vga16fb.c:951
 bit_clear_margins+0x2a4/0x480 drivers/video/fbdev/core/bitblit.c:232
 fbcon_clear_margins+0x285/0x310 drivers/video/fbdev/core/fbcon.c:1320
 ypan_up_redraw drivers/video/fbdev/core/fbcon.c:1505 [inline]
 fbcon_scroll+0x125e/0x34c0 drivers/video/fbdev/core/fbcon.c:1883
 con_scroll+0x294/0x310 drivers/tty/vt/vt.c:327
 lf+0x226/0x270 drivers/tty/vt/vt.c:1134
 do_con_trol+0x4c3/0x5450 drivers/tty/vt/vt.c:1797
 do_con_write.part.0+0xc44/0x1a20 drivers/tty/vt/vt.c:2447
 do_con_write drivers/tty/vt/vt.c:2218 [inline]
 con_write+0x33/0xc0 drivers/tty/vt/vt.c:2798
 do_output_char+0x4f5/0x750 drivers/tty/n_tty.c:447
 __process_echoes+0x313/0x8c0 drivers/tty/n_tty.c:739
 flush_echoes drivers/tty/n_tty.c:829 [inline]
 __receive_buf drivers/tty/n_tty.c:1648 [inline]
 n_tty_receive_buf_common+0x8ca/0x2480 drivers/tty/n_tty.c:1742
 tty_ldisc_receive_buf+0x9e/0x170 drivers/tty/tty_buffer.c:455
 paste_selection+0x1cc/0x414 drivers/tty/vt/selection.c:391
 tioclinux+0xfd/0x400 drivers/tty/vt/vt.c:2707
 vt_ioctl+0x14e8/0x1f20 drivers/tty/vt/vt_ioctl.c:372
 tty_ioctl+0x6c5/0x1220 drivers/tty/tty_io.c:2661
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c829
RSP: 002b:00007fd41d70fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004eea20 RCX: 000000000045c829
RDX: 0000000020000040 RSI: 000000000000541c RDI: 0000000000000004
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000579 R14: 00000000004c80ca R15: 00007fd41d7106d4
Code: 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 22 8b 43 0c d1 e8 83 e0 01 65 ff 0d 96 83 b6 7e <74> 06 48 83 c4 08 5b c3 e8 c2 d5 b4 ff 48 83 c4 08 5b c3 e8 1e

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/06 14:05 linux-4.14.y d71f695ce745 4618eb2d .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.