syzbot


INFO: task can't die in synchronize_rcu_expedited (2)

Status: auto-closed as invalid on 2021/03/21 09:06
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 618d, last: 616d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task can't die in synchronize_rcu_expedited 1 773d 769d 0/24 auto-closed as invalid on 2020/10/15 13:33
upstream INFO: task hung in rtnetlink_rcv_msg C inconclusive inconclusive 368 6d14h 1314d 0/24 upstream: reported C repro on 2019/02/22 17:00

Sample crash report:
INFO: task syz-executor.5:30735 can't die for more than 143 seconds.
task:syz-executor.5  state:D stack:25680 pid:30735 ppid:  8522 flags:0x00004006
Call Trace:
 context_switch kernel/sched/core.c:4373 [inline]
 __schedule+0x90c/0x21a0 kernel/sched/core.c:5124
 schedule+0xcf/0x270 kernel/sched/core.c:5203
 synchronize_rcu_expedited+0x44e/0x610 kernel/rcu/tree_exp.h:852
 namespace_unlock+0x1af/0x410 fs/namespace.c:1425
 drop_collected_mounts fs/namespace.c:1917 [inline]
 put_mnt_ns fs/namespace.c:3868 [inline]
 put_mnt_ns+0x106/0x140 fs/namespace.c:3864
 create_new_namespaces+0x6d1/0xb20 kernel/nsproxy.c:141
 copy_namespaces+0x385/0x440 kernel/nsproxy.c:178
 copy_process+0x2ab5/0x6fd0 kernel/fork.c:2100
 kernel_clone+0xe7/0xab0 kernel/fork.c:2462
 __do_sys_clone+0xc8/0x110 kernel/fork.c:2579
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e219
RSP: 002b:00007fbbe7517c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e219
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000044020100
RBP: 000000000119bfd0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007fffee0e8ccf R14: 00007fbbe75189c0 R15: 000000000119bf8c

Showing all locks held in the system:
1 lock held by khungtaskd/1666:
 #0: 
ffffffff8b370ea0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6326
1 lock held by in:imklog/8175:
2 locks held by agetty/8178:
 #0: ffff888022d3d098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:266
 #1: ffffc90000f1c2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x21d/0x1aa0 drivers/tty/n_tty.c:2160
2 locks held by kworker/1:4/9613:
 #0: ffff88801007c538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff88801007c538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff88801007c538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff88801007c538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
 #0: ffff88801007c538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
 #0: ffff88801007c538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x871/0x15f0 kernel/workqueue.c:2246
 #1: ffffc90015c7fda8 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15f0 kernel/workqueue.c:2250
5 locks held by kworker/u4:9/16294:
 #0: ffff888010eb3138 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010eb3138 ((wq_completion)netns){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888010eb3138 ((wq_completion)netns){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888010eb3138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
 #0: ffff888010eb3138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
 #0: ffff888010eb3138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x871/0x15f0 kernel/workqueue.c:2246
 #1: ffffc900094ffda8 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15f0 kernel/workqueue.c:2250
 #2: ffffffff8ca4de90 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xb10 net/core/net_namespace.c:566
 #3: ffff8880223ad290 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_destruct+0x14b/0x450 drivers/net/wireguard/device.c:228
 #4: ffffffff8b379a68 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #4: ffffffff8b379a68 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4f5/0x610 kernel/rcu/tree_exp.h:836
3 locks held by syz-executor.4/30720:
 #0: ffff888051380f48 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x111/0x1110 net/bluetooth/hci_core.c:1726
 #1: ffff888051380078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26f/0x1110 net/bluetooth/hci_core.c:1763
 #2: ffffffff8cc68608 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1459 [inline]
 #2: ffffffff8cc68608 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1582
2 locks held by syz-executor.5/30735:
3 locks held by kworker/0:3/31463:
 #0: ffff888010062d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010062d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888010062d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888010062d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
 #0: ffff888010062d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
 #0: ffff888010062d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x871/0x15f0 kernel/workqueue.c:2246
 #1: ffffc900096cfda8 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15f0 kernel/workqueue.c:2250
 #2: ffffffff8b379a68 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #2: ffffffff8b379a68 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x27e/0x610 kernel/rcu/tree_exp.h:836
1 lock held by syz-executor.1/31969:
 #0: ffffffff8ca61348 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8ca61348 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5550
1 lock held by syz-executor.2/32156:

=============================================


Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-linux-next-kasan-gce-root 2021/01/20 09:04 linux-next 647060f3b592 d4f4eca5 .config log report info INFO: task can't die in synchronize_rcu_expedited
ci-upstream-linux-next-kasan-gce-root 2021/01/18 08:34 linux-next 93bf8b946e5f fd103621 .config log report info INFO: task can't die in synchronize_rcu_expedited
* Struck through repros no longer work on HEAD.