syzbot


INFO: task hung in ubi_detach_mtd_dev

Status: auto-closed as invalid on 2020/11/01 05:07
Reported-by: syzbot+430de41f39699858d20d@syzkaller.appspotmail.com
First crash: 1481d, last: 1390d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in ubi_detach_mtd_dev (2) syz error 1 1378d 1378d 0/1 upstream: reported syz repro on 2020/07/15 16:30
upstream INFO: task hung in ubi_detach_mtd_dev mtd syz error error 4 1435d 1521d 15/26 fixed on 2020/11/16 12:12
linux-4.19 INFO: task hung in ubi_detach_mtd_dev 1 1519d 1519d 0/1 auto-closed as invalid on 2020/06/24 16:43

Sample crash report:
NOHZ: local_softirq_pending 08
NOHZ: local_softirq_pending 08
NOHZ: local_softirq_pending 08
NOHZ: local_softirq_pending 08
NOHZ: local_softirq_pending 08
INFO: task syz-executor.0:12433 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D29888 12433   6356 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_timeout+0x86c/0xe50 kernel/time/timer.c:1723
 do_wait_for_common kernel/sched/completion.c:91 [inline]
 __wait_for_common kernel/sched/completion.c:112 [inline]
 wait_for_common+0x272/0x430 kernel/sched/completion.c:123
 kthread_stop+0xce/0x640 kernel/kthread.c:530
 ubi_detach_mtd_dev+0x1e3/0x3cc drivers/mtd/ubi/build.c:1084
 ctrl_cdev_ioctl+0x14b/0x220 drivers/mtd/ubi/cdev.c:1040
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007f280b2ccc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007f280b2cd6d4
INFO: task syz-executor.0:12436 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D29264 12436   6356 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007f280b2abc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007
RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007f280b2ac6d4
INFO: task syz-executor.4:12445 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D30080 12445   6357 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007f2679e50c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000003
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007f2679e516d4
INFO: task syz-executor.3:12448 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.3  D30080 12448   6360 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007fdfa1658c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000003
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007fdfa16596d4
INFO: task syz-executor.2:12450 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D30080 12450   6361 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007fbf0b361c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000003
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007fbf0b3626d4
INFO: task syz-executor.2:12457 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D28528 12457   6361 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007fbf0b340c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000005
RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007fbf0b3416d4
INFO: task syz-executor.5:12449 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.5  D29888 12449   6359 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007fca3e5bbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007fca3e5bc6d4
INFO: task syz-executor.5:12456 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.5  D29248 12456   6359 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007fca3e59ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007
RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007fca3e59b6d4
INFO: task syz-executor.1:12464 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1  D29504 12464   6358 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007f79fe6c8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007f79fe6c96d4
INFO: task syz-executor.1:12467 blocked for more than 140 seconds.
      Not tainted 4.14.184-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1  D29296 12467   6358 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x8a6/0x1d70 kernel/sched/core.c:3384
 schedule+0x8d/0x1b0 kernel/sched/core.c:3428
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3486
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x5f0/0x1430 kernel/locking/mutex.c:893
 ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cb29
RSP: 002b:00007f79fe6a7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004e1ba0 RCX: 000000000045cb29
RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007
RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000214 R14: 00000000004c469e R15: 00007f79fe6a86d4

Showing all locks held in the system:
1 lock held by khungtaskd/1057:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffff8146c8d0>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
1 lock held by syz-executor.0/12433:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
1 lock held by syz-executor.0/12436:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
1 lock held by syz-executor.4/12445:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
1 lock held by syz-executor.3/12448:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
1 lock held by syz-executor.2/12450:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
1 lock held by syz-executor.2/12457:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
1 lock held by syz-executor.5/12449:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
1 lock held by syz-executor.5/12456:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014
1 lock held by syz-executor.1/12464:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220 drivers/mtd/ubi/cdev.c:1039
1 lock held by syz-executor.1/12467:
 #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220 drivers/mtd/ubi/cdev.c:1014

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1057 Comm: khungtaskd Not tainted 4.14.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x13a/0x17f lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
 watchdog+0x5e2/0xb80 kernel/hung_task.c:274
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3629 Comm: systemd-journal Not tainted 4.14.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888094660480 task.stack: ffff888094668000
RIP: 0010:unwind_next_frame+0x299/0x1700 arch/x86/kernel/unwind_orc.c:353
RSP: 0018:ffff88809466f9f8 EFLAGS: 00000246
RAX: 0000000000000015 RBX: 1ffff110128cdf46 RCX: ffffffff88c91a94
RDX: 0000000000000000 RSI: ffffffff88c91a94 RDI: ffffffff887d0d18
RBP: 0000000000000001 R08: ffffffff88c91a98 R09: ffffffff88c91a94
R10: 000000000000a5c2 R11: 0000000000056071 R12: ffff88809466fb75
R13: ffff88809466fb78 R14: ffff88809466fb90 R15: ffff88809466fb40
FS:  00007fc93cb958c0(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc939fea000 CR3: 00000000945e4000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __unwind_start arch/x86/kernel/unwind_orc.c:586 [inline]
 __unwind_start+0x532/0x8c0 arch/x86/kernel/unwind_orc.c:512
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 __save_stack_trace+0x4a/0xd0 arch/x86/kernel/stacktrace.c:43
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc.part.0+0x4f/0xd0 mm/kasan/kasan.c:551
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc mm/slab.c:3390 [inline]
 kmem_cache_alloc+0x111/0x3c0 mm/slab.c:3550
 getname_flags+0xc8/0x550 fs/namei.c:138
 getname fs/namei.c:209 [inline]
 user_path_create fs/namei.c:3732 [inline]
 SYSC_mkdirat fs/namei.c:3864 [inline]
 SyS_mkdirat+0x83/0x220 fs/namei.c:3856
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fc93be51687
RSP: 002b:00007ffc4e9303e8 EFLAGS: 00000293 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007ffc4e933450 RCX: 00007fc93be51687
RDX: 0000000000000000 RSI: 00000000000001ed RDI: 000056127c5268c0
RBP: 00007ffc4e930420 R08: 000056127c4ed3e5 R09: 0000000000000018
R10: 0000000000000069 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 000056127c5268c0 R15: 00007ffc4e930a60
Code: 48 b8 00 00 00 00 00 fc ff df 4c 89 c2 48 c1 ea 03 0f b6 04 02 4c 89 c2 83 e2 07 38 d0 7f 08 84 c0 0f 85 44 0e 00 00 0f b6 41 04 <a8> 0f 0f 84 f2 01 00 00 49 8b 77 48 4c 89 c2 48 c1 ea 03 48 89 

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/04 05:06 linux-4.14.y b850307b279c 51095195 .config console log report ci2-linux-4-14
2020/06/22 09:34 linux-4.14.y b850307b279c eabcced4 .config console log report ci2-linux-4-14
2020/06/09 09:11 linux-4.14.y c6db52a88798 0d60b78a .config console log report ci2-linux-4-14
2020/05/18 15:04 linux-4.14.y ab9dfda23248 24d91142 .config console log report ci2-linux-4-14
2020/05/03 22:00 linux-4.14.y 773e2b1cd56a 58ae5e18 .config console log report ci2-linux-4-14
2020/04/03 20:01 linux-4.14.y 4520f06b03ae 5ed396e6 .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.