INFO: task hung in n_tty_flush

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-49	INFO: task hung in n_tty_flush_buffer	C			6	2334d	2048d	0/3	public: reported C repro on 2019/04/14 00:00
upstream	INFO: task hung in n_tty_flush_buffer serial				6	2335d	2410d	8/28	fixed on 2018/07/09 18:05

INFO: task agetty:6002 blocked for more than 140 seconds. Not tainted 4.14.179-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. agetty D27904 6002 1 0x80000002 Call Trace: schedule+0x8d/0x1b0 kernel/sched/core.c:3428 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:588 [inline] rwsem_down_write_failed+0x5c3/0xbb0 kernel/locking/rwsem-xadd.c:617 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105 __down_write arch/x86/include/asm/rwsem.h:126 [inline] down_write+0x4f/0x90 kernel/locking/rwsem.c:56 n_tty_flush_buffer+0x1b/0x240 drivers/tty/n_tty.c:373 tty_ldisc_hangup+0x81/0x5c0 drivers/tty/tty_ldisc.c:739 __tty_hangup.part.0+0x2cd/0x6b0 drivers/tty/tty_io.c:622 __tty_hangup drivers/tty/tty_io.c:572 [inline] tty_vhangup_session+0x20/0x30 drivers/tty/tty_io.c:732 disassociate_ctty.part.0+0x96/0x6a0 drivers/tty/tty_jobctrl.c:266 disassociate_ctty+0x71/0x90 drivers/tty/tty_jobctrl.c:260 do_exit+0x1703/0x2b00 kernel/exit.c:856 do_group_exit+0x100/0x310 kernel/exit.c:955 SYSC_exit_group kernel/exit.c:966 [inline] SyS_exit_group+0x19/0x20 kernel/exit.c:964 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x7f2ed1479618 RSP: 002b:00007fffb4976ad8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f2ed1479618 RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 RBP: 00007f2ed17568e0 R08: 00000000000000e7 R09: ffffffffffffff98 R10: 00007fffb4976a58 R11: 0000000000000246 R12: 00007f2ed17568e0 R13: 00007f2ed175bc20 R14: 0000000000000001 R15: 000000000000000a Showing all locks held in the system: 1 lock held by khungtaskd/1042: #0: (tasklist_lock){.+.+}, at: [<ffffffff81465d33>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548 1 lock held by in:imklog/6000: #0: (&f->f_pos_lock){+.+.}, at: [<ffffffff8191ba16>] __fdget_pos+0xa6/0xc0 fs/file.c:769 3 locks held by agetty/6002: #0: (&tty->legacy_mutex){+.+.}, at: [<ffffffff833b776f>] tty_lock+0x5f/0x70 drivers/tty/tty_mutex.c:19 #1: (&tty->ldisc_sem){++++}, at: [<ffffffff833b1bfb>] tty_ldisc_ref+0x1b/0x80 drivers/tty/tty_ldisc.c:305 #2: (&tty->termios_rwsem){++++}, at: [<ffffffff833a6cab>] n_tty_flush_buffer+0x1b/0x240 drivers/tty/n_tty.c:373 2 locks held by agetty/6053: #0: (&tty->ldisc_sem){++++}, at: [<ffffffff833b1b42>] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284 #1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff833a5784>] n_tty_read+0x1e4/0x16f0 drivers/tty/n_tty.c:2156 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 4.14.179-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x139/0x17e lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x5e2/0xb80 kernel/hung_task.c:274 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 15950 Comm: syz-executor.0 Not tainted 4.14.179-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888057e56080 task.stack: ffff88820b228000 RIP: 0010:rcu_is_watching+0x7a/0xb0 kernel/rcu/tree.c:1131 RSP: 0018:ffff8880aea07970 EFLAGS: 00000002 RAX: 0000000000000001 RBX: ffff8880aea23940 RCX: 1ffffffff0f419ac RDX: 0000000000000000 RSI: ffffffff86e45880 RDI: ffff8880aea2394c RBP: 000000000045c829 R08: 0000000000000000 R09: 00000000000a2012 R10: ffff888057e56a48 R11: ffff888057e56080 R12: 0000000000000000 R13: 0000000000000000 R14: ffff888057e56080 R15: 000000000000ffff FS: 00007fd41d710700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c430c567d0 CR3: 000000008dee0000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> rcu_read_unlock include/linux/rcupdate.h:681 [inline] is_bpf_text_address+0xb4/0x120 kernel/bpf/core.c:458 kernel_text_address+0x6e/0xe0 kernel/extable.c:150 __kernel_text_address+0x9/0x30 kernel/extable.c:105 unwind_get_return_address arch/x86/kernel/unwind_orc.c:255 [inline] unwind_get_return_address+0x5a/0xa0 arch/x86/kernel/unwind_orc.c:250 __save_stack_trace+0x7b/0xd0 arch/x86/kernel/stacktrace.c:45 save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758 inet_bind_bucket_destroy net/ipv4/inet_hashtables.c:89 [inline] inet_bind_bucket_destroy+0xd8/0x110 net/ipv4/inet_hashtables.c:85 inet_twsk_bind_unhash+0x115/0x180 net/ipv4/inet_timewait_sock.c:38 inet_twsk_kill+0x316/0x430 net/ipv4/inet_timewait_sock.c:58 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1279 expire_timers kernel/time/timer.c:1318 [inline] __run_timers kernel/time/timer.c:1636 [inline] __run_timers kernel/time/timer.c:1604 [inline] run_timer_softirq+0x52a/0x1390 kernel/time/timer.c:1649 __do_softirq+0x254/0x9bf kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x15b/0x1a0 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:648 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1102 apic_timer_interrupt+0x8f/0xa0 arch/x86/entry/entry_64.S:792 </IRQ> RIP: 0010:__sanitizer_cov_trace_pc+0x3d/0x50 kernel/kcov.c:87 RSP: 0018:ffff88820b22f298 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: 0000000000040000 RBX: ffff8880000a0000 RCX: ffffc90005b5e000 RDX: 000000000003ffff RSI: ffffffff831b2e9b RDI: 0000000000000a00 RBP: 0000000000000a00 R08: 0000000000000a00 R09: 0000000000000040 R10: ffffed1014b6401b R11: ffff8880a5b200df R12: 0000000000000040 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 bitfill_aligned drivers/video/fbdev/core/cfbfillrect.c:62 [inline] bitfill_aligned+0xab/0x190 drivers/video/fbdev/core/cfbfillrect.c:35 cfb_fillrect+0x3d5/0x720 drivers/video/fbdev/core/cfbfillrect.c:327 vga16fb_fillrect+0x61e/0x1880 drivers/video/fbdev/vga16fb.c:951 bit_clear_margins+0x2a4/0x480 drivers/video/fbdev/core/bitblit.c:232 fbcon_clear_margins+0x285/0x310 drivers/video/fbdev/core/fbcon.c:1320 ypan_up_redraw drivers/video/fbdev/core/fbcon.c:1505 [inline] fbcon_scroll+0x125e/0x34c0 drivers/video/fbdev/core/fbcon.c:1883 con_scroll+0x294/0x310 drivers/tty/vt/vt.c:327 lf+0x226/0x270 drivers/tty/vt/vt.c:1134 do_con_trol+0x4c3/0x5450 drivers/tty/vt/vt.c:1797 do_con_write.part.0+0xc44/0x1a20 drivers/tty/vt/vt.c:2447 do_con_write drivers/tty/vt/vt.c:2218 [inline] con_write+0x33/0xc0 drivers/tty/vt/vt.c:2798 do_output_char+0x4f5/0x750 drivers/tty/n_tty.c:447 __process_echoes+0x313/0x8c0 drivers/tty/n_tty.c:739 flush_echoes drivers/tty/n_tty.c:829 [inline] __receive_buf drivers/tty/n_tty.c:1648 [inline] n_tty_receive_buf_common+0x8ca/0x2480 drivers/tty/n_tty.c:1742 tty_ldisc_receive_buf+0x9e/0x170 drivers/tty/tty_buffer.c:455 paste_selection+0x1cc/0x414 drivers/tty/vt/selection.c:391 tioclinux+0xfd/0x400 drivers/tty/vt/vt.c:2707 vt_ioctl+0x14e8/0x1f20 drivers/tty/vt/vt_ioctl.c:372 tty_ioctl+0x6c5/0x1220 drivers/tty/tty_io.c:2661 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45c829 RSP: 002b:00007fd41d70fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004eea20 RCX: 000000000045c829 RDX: 0000000020000040 RSI: 000000000000541c RDI: 0000000000000004 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000579 R14: 00000000004c80ca R15: 00007fd41d7106d4 Code: 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 22 8b 43 0c d1 e8 83 e0 01 65 ff 0d 96 83 b6 7e <74> 06 48 83 c4 08 5b c3 e8 c2 d5 b4 ff 48 83 c4 08 5b c3 e8 1e