syzbot


INFO: task hung in fsnotify_mark_destroy_list

Status: auto-closed as invalid on 2019/03/02 04:21
First crash: 2205d, last: 2049d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 INFO: task hung in fsnotify_mark_destroy_list (2) 29 1734d 1747d 0/3 auto-closed as invalid on 2019/10/25 14:12

Sample crash report:
hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
INFO: task kworker/u4:4:2470 blocked for more than 140 seconds.
      Not tainted 4.9.124+ #85
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:4    D24648  2470      2 0x00000000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
 ffff8801aa212f80 ffff8801c4a52c00 ffff8801a7350580 ffff8801b9a097c0
 ffff8801db6210d8 ffff8801aa27f7f0 ffffffff8277cf52 0000000000000092
 ffffffff83ae4bc0 ffffffff82ed2ae0 000000000000304d ffff8801db6219b0
Call Trace:
 [<ffffffff8277e47f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff82788aa5>] schedule_timeout+0x735/0xe20 kernel/time/timer.c:1768
 [<ffffffff8277fea9>] do_wait_for_common kernel/sched/completion.c:75 [inline]
 [<ffffffff8277fea9>] __wait_for_common kernel/sched/completion.c:93 [inline]
 [<ffffffff8277fea9>] wait_for_common+0x2f9/0x400 kernel/sched/completion.c:101
 [<ffffffff8277ffc8>] wait_for_completion+0x18/0x20 kernel/sched/completion.c:122
 [<ffffffff812408d4>] __synchronize_srcu+0x254/0x3b0 kernel/rcu/srcu.c:448
 [<ffffffff81240a4e>] synchronize_srcu+0x1e/0x40 kernel/rcu/srcu.c:492
 [<ffffffff815d3eae>] fsnotify_mark_destroy_list+0xfe/0x230 fs/notify/mark.c:551
 [<ffffffff815d3fee>] fsnotify_mark_destroy_workfn+0xe/0x10 fs/notify/mark.c:561
 [<ffffffff8112fcf1>] process_one_work+0x791/0x1470 kernel/workqueue.c:2092
 [<ffffffff81130aa6>] worker_thread+0xd6/0x10a0 kernel/workqueue.c:2226
 [<ffffffff811410dd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff8278c21c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131401c>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131401c>] watchdog+0x11c/0xa20 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff813f99b9>] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/2121:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8155eadc>] __fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2217:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff8278a122>] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81cde522>] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
2 locks held by kworker/u4:4/2470:
 #0:  ("events_unbound"){.+.+.+}, at: [<ffffffff8112fc00>] process_one_work+0x6a0/0x1470 kernel/workqueue.c:2085
 #1:  ((reaper_work).work){+.+...}, at: [<ffffffff8112fc38>] process_one_work+0x6d8/0x1470 kernel/workqueue.c:2089

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.124+ #85
 ffff8801d9497d08 ffffffff81af4b39 0000000000000000 0000000000000001
 0000000000000001 0000000000000001 ffffffff81096740 ffff8801d9497d40
 ffffffff81aff897 0000000000000001 0000000000000000 0000000000000003
Call Trace:
 [<ffffffff81af4b39>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81af4b39>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81aff897>] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81aff82a>] nmi_trigger_cpumask_backtrace+0x12a/0x14f lib/nmi_backtrace.c:60
 [<ffffffff81096844>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff813145ad>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff813145ad>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff813145ad>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff813145ad>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
 [<ffffffff811410dd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff8278c21c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6373 Comm: syz-executor3 Not tainted 4.9.124+ #85
task: ffff8801a2ed8000 task.stack: ffff8801ccd70000
RIP: 0010:[<ffffffff8130c856>] c [<ffffffff8130c856>] __read_once_size include/linux/compiler.h:243 [inline]
RIP: 0010:[<ffffffff8130c856>] c [<ffffffff8130c856>] check_kcov_mode kernel/kcov.c:68 [inline]
RIP: 0010:[<ffffffff8130c856>] c [<ffffffff8130c856>] __sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:100
RSP: 0018:ffff8801ccd77ef0  EFLAGS: 00000246
RAX: ffff8801a2ed8000 RBX: ffff8801ccd77f58 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81005577 RDI: ffffffff8400f240
RBP: ffff8801ccd77ef0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffff
R13: ffff8801ccd77fd0 R14: ffff8801a2ed8000 R15: 0000000000000000
FS:  00007fb3c7d80700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000021d4000 CR3: 00000001ccd8f000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801ccd77f48c ffffffff81005577c 0000000000000000c 0000000000000000c
 0000000000000000c 0000000000000000c 0000000000000000c 0000000000000000c
 0000000000000000c 0000000000000000c 0000000000000000c 0000000000000000c
Call Trace:
 [<ffffffff81005577>] get_current arch/x86/include/asm/current.h:14 [inline]
 [<ffffffff81005577>] syscall_return_slowpath arch/x86/entry/common.c:243 [inline]
 [<ffffffff81005577>] do_syscall_64+0x1c7/0x480 arch/x86/entry/common.c:287
 [<ffffffff8278c053>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: c00 c00 c0f c1f c00 c55 c48 c89 ce5 c65 c48 c8b c04 c25 cc0 c7d c01 c00 c65 c8b c15 c0c cb5 cd0 c7e c81 ce2 c00 c01 c1f c00 c48 c8b c75 c08 c75 c2b c8b c90 c30 c12 c00 c00 c<83> cfa c02 c75 c20 c48 c8b c88 c38 c12 c00 c00 c8b c80 c34 c12 c00 c00 c48 c8b c11 c

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/09/03 04:18 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce
2018/03/31 11:35 https://android.googlesource.com/kernel/common android-4.9 cc88c05eca31 8fbce0e4 .config console log report ci-android-49-kasan-gce
* Struck through repros no longer work on HEAD.