syzbot


INFO: task hung in perf_uprobe_destroy

Status: auto-closed as invalid on 2019/09/08 15:37
Subsystems: trace
[Documentation on labels]
First crash: 1896d, last: 1864d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in perf_uprobe_destroy (2) trace 1 886d 886d 0/26 auto-closed as invalid on 2022/01/13 17:48

Sample crash report:
libceph: parse_ips bad ip '[:::]'
libceph: parse_ips bad ip '[:::]'
INFO: task syz-executor.4:19344 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc5+ #63
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4  D28224 19344   7759 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2844 [inline]
 __schedule+0x817/0x1cc0 kernel/sched/core.c:3485
 schedule+0x92/0x180 kernel/sched/core.c:3529
 schedule_timeout+0x8ca/0xfd0 kernel/time/timer.c:1779
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common kernel/sched/completion.c:115 [inline]
 wait_for_completion+0x29c/0x440 kernel/sched/completion.c:136
 __synchronize_srcu+0x197/0x250 kernel/rcu/srcutree.c:946
 synchronize_srcu_expedited kernel/rcu/srcutree.c:971 [inline]
 synchronize_srcu+0x239/0x3e8 kernel/rcu/srcutree.c:1022
 tracepoint_synchronize_unregister include/linux/tracepoint.h:84 [inline]
 perf_trace_event_unreg.isra.0+0xcb/0x220 kernel/trace/trace_event_perf.c:163
 perf_uprobe_destroy+0xc3/0x130 kernel/trace/trace_event_perf.c:342
 _free_event+0x356/0x1220 kernel/events/core.c:4446
 put_event+0x47/0x60 kernel/events/core.c:4532
 perf_event_release_kernel+0x68f/0xbf0 kernel/events/core.c:4638
 perf_release+0x37/0x50 kernel/events/core.c:4648
 __fput+0x2df/0x8d0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x14a/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x411d41
Code: 00 00 8b b3 30 01 00 00 31 c0 bf d0 36 44 00 e8 05 f3 00 00 8b b3 08 01 00 00 31 c0 bf e4 36 44 00 e8 f3 f2 00 00 8b 83 e0 00 <00> 00 48 89 ee bf f9 36 44 00 85 c0 49 0f 44 f4 31 c0 e8 d8 f2 00
RSP: 002b:00007ffdb49f48c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000411d41
RDX: 0000000000000000 RSI: 0000000000740db0 RDI: 0000000000000005
RBP: 0000000000000000 R08: 00000000002ee635 R09: 00000000002ee635
R10: 00007ffdb49f47f0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 000000000000144a R15: 0000000000000004
INFO: task syz-executor.2:19376 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc5+ #63
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D28224 19376  21736 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2844 [inline]
 __schedule+0x817/0x1cc0 kernel/sched/core.c:3485
 schedule+0x92/0x180 kernel/sched/core.c:3529
 schedule_timeout+0x8ca/0xfd0 kernel/time/timer.c:1779
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common kernel/sched/completion.c:115 [inline]
 wait_for_completion+0x29c/0x440 kernel/sched/completion.c:136
 __synchronize_srcu+0x197/0x250 kernel/rcu/srcutree.c:946
 synchronize_srcu_expedited kernel/rcu/srcutree.c:971 [inline]
 synchronize_srcu+0x239/0x3e8 kernel/rcu/srcutree.c:1022
 mmu_notifier_unregister+0x2af/0x410 mm/mmu_notifier.c:372
 kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:744 [inline]
 kvm_put_kvm+0x553/0xc70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:769
 kvm_vcpu_release+0x7b/0xa0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2495
 __fput+0x2df/0x8d0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x14a/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x411d41
Code: 18 e8 03 1a 00 00 83 f8 05 48 8b 54 24 18 0f 8e e3 fe ff ff 48 8b 44 24 20 48 89 54 24 08 41 b9 30 f0 41 00 41 b8 18 f1 41 00 <b9> 4c 00 00 00 ba 10 f0 41 00 be 06 00 00 00 4c 89 ef 48 89 04 24
RSP: 002b:00007ffe2d76c7a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000411d41
RDX: 0000000000000000 RSI: 00000000007407b0 RDI: 0000000000000006
RBP: 0000000000000000 R08: 00000000002ee8b5 R09: 00000000002ee8b5
R10: 00007ffe2d76c6d0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 00000000000008f1 R15: 0000000000000002

Showing all locks held in the system:
1 lock held by khungtaskd/1039:
 #0: 00000000a13f0f87 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4389
1 lock held by rsyslogd/7582:
 #0: 00000000ebfc1fc9 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:795
2 locks held by getty/7705:
 #0: 0000000047765e88 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000f920d8d2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/7706:
 #0: 00000000add4c7c1 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000005a9ab728 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/7707:
 #0: 00000000ee8afb98 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000f2f4b027 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/7708:
 #0: 00000000e8dfea70 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000f8433aee (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/7709:
 #0: 000000008250cbc7 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000044287dee (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/7710:
 #0: 0000000057b6cc88 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000b2fc3fe8 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/7711:
 #0: 0000000091b88c8a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000b4d30887 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by syz-executor.3/1482:
 #0: 00000000e71fa36c (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000c25884a6 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by kworker/u4:0/29325:
 #0: 0000000087af0fba (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1149 [inline]
 #0: 0000000087af0fba (&rq->lock){-.-.}, at: __schedule+0x1fc/0x1cc0 kernel/sched/core.c:3423
 #1: 00000000a13f0f87 (rcu_read_lock){....}, at: trace_sched_stat_runtime include/trace/events/sched.h:428 [inline]
 #1: 00000000a13f0f87 (rcu_read_lock){....}, at: update_curr+0x2ce/0x8a0 kernel/sched/fair.c:829
3 locks held by kworker/0:3/29383:
1 lock held by syz-executor.4/19344:
 #0: 00000000e350e258 (event_mutex){+.+.}, at: perf_uprobe_destroy+0x28/0x130 kernel/trace/trace_event_perf.c:340

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1039 Comm: khungtaskd Not tainted 5.0.0-rc5+ #63
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0x9df/0xee0 kernel/hung_task.c:287
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 29325 Comm: kworker/u4:0 Not tainted 5.0.0-rc5+ #63
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:101
Code: 90 90 90 90 55 48 89 e5 48 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 98 12 92 7e 81 e2 00 01 1f 00 75 2b 8b 90 d8 12 00 00 <83> fa 02 75 20 48 8b 88 e0 12 00 00 8b 80 dc 12 00 00 48 8b 11 48
RSP: 0018:ffff88805001fcd0 EFLAGS: 00000246
RAX: ffff88809253a3c0 RBX: ffff88809aba5680 RCX: ffffffff86e6e478
RDX: 0000000000000000 RSI: ffffffff86e6e483 RDI: 0000000000000005
RBP: ffff88805001fcd0 R08: ffff88809253a3c0 R09: ffff88809253acb0
R10: ffff88809253ac90 R11: 0000000000000001 R12: 0000000000000001
R13: 000000000000012b R14: ffff88809a73ce18 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 0000000095aed000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 rcu_read_lock include/linux/rcupdate.h:608 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline]
 batadv_nc_worker+0x133/0x760 net/batman-adv/network-coding.c:730
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173
 worker_thread+0x98/0xe40 kernel/workqueue.c:2319
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/02/09 02:37 upstream 74e96711e337 fa6c7b70 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/12 14:25 linux-next cf08baa29613 a71bfb62 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.