syzbot


INFO: task hung in pagecache_get_page (2)

Status: auto-closed as invalid on 2019/10/25 08:51
Reported-by: syzbot+05788afdc32b1522fbf6@syzkaller.appspotmail.com
First crash: 1820d, last: 1811d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in pagecache_get_page 1 481d 481d 0/1 upstream: reported on 2022/12/25 04:38
android-49 INFO: task hung in pagecache_get_page 89 2131d 2262d 0/3 auto-closed as invalid on 2019/02/22 12:49
upstream INFO: task hung in pagecache_get_page fs 144 2008d 2326d 0/26 closed as dup on 2017/12/12 16:52
android-44 INFO: task hung in pagecache_get_page 9 2185d 2239d 0/2 auto-closed as invalid on 2019/02/22 15:22
upstream INFO: task hung in pagecache_get_page (2) block 1 1338d 1338d 0/26 auto-closed as invalid on 2020/11/17 18:29

Sample crash report:
   Free memory is -13820kB above reserved
lowmemorykiller: Killing 'syz-executor.1' (4981) (tgid 4981), adj 1000,
   to free 34928kB on behalf of 'syz-fuzzer' (29652) because
   cache 348kB is below limit 6144kB for oom_score_adj 0
   Free memory is -13820kB above reserved
INFO: task rs:main Q:Reg:1905 blocked for more than 140 seconds.
      Not tainted 4.9.172+ #50
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
rs:main Q:Reg   D26344  1905      1 0x00000000
 ffff8801d3865f00 ffff8801d4c20580 ffff8801db721000 ffff8801da600000
 ffff8801db721018 ffff8801d3bef400 ffffffff8280081e ffffffff812080d0
 ffff8801d3866840 00ff8801d38667a0 ffff8801db7218f0 1ffff1003a77de6f
Call Trace:
 [<00000000a6a65ac5>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
 [<00000000918264f0>] schedule_timeout+0x766/0xe50 kernel/time/timer.c:1771
 [<0000000056689f3e>] io_schedule_timeout+0x1ba/0x390 kernel/sched/core.c:5171
 [<00000000a1ce46c2>] io_schedule include/linux/sched.h:432 [inline]
 [<00000000a1ce46c2>] wait_on_page_bit_common mm/filemap.c:910 [inline]
 [<00000000a1ce46c2>] __lock_page+0x314/0x6c0 mm/filemap.c:1062
 [<00000000735e1828>] lock_page include/linux/pagemap.h:463 [inline]
 [<00000000735e1828>] pagecache_get_page+0x36f/0x740 mm/filemap.c:1344
 [<00000000d8ca9d0d>] grab_cache_page_write_begin+0x6b/0xa0 mm/filemap.c:2883
 [<00000000a02b96be>] ext4_da_write_begin+0x249/0x1080 fs/ext4/inode.c:2959
 [<00000000f2acc012>] generic_perform_write+0x24a/0x500 mm/filemap.c:2939
 [<00000000a7c4acd1>] __generic_file_write_iter+0x340/0x530 mm/filemap.c:3064
 [<00000000eb6fcd37>] ext4_file_write_iter+0x66e/0xdd0 fs/ext4/file.c:165
 [<00000000be12be8b>] new_sync_write fs/read_write.c:498 [inline]
 [<00000000be12be8b>] __vfs_write+0x3c1/0x560 fs/read_write.c:511
 [<00000000ce0d2e8f>] vfs_write+0x185/0x520 fs/read_write.c:559
 [<000000006a48f8d4>] SYSC_write fs/read_write.c:606 [inline]
 [<000000006a48f8d4>] SyS_write+0xdc/0x1c0 fs/read_write.c:598
 [<0000000085ed632e>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
 [<000000001463cf16>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<0000000031b2fed8>] check_hung_uninterruptible_tasks kernel/hung_task.c:169 [inline]
 #0:  (rcu_read_lock){......}, at: [<0000000031b2fed8>] watchdog+0x14b/0xaf0 kernel/hung_task.c:263
 #1:  (tasklist_lock){.+.+..}, at: [<00000000debbf7c2>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4336
3 locks held by rs:main Q:Reg/1905:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<000000003ad2d4a6>] __fdget_pos+0xa8/0xd0 fs/file.c:782
 #1:  (sb_writers#4){.+.+.+}, at: [<0000000095e2e675>] file_start_write include/linux/fs.h:2642 [inline]
 #1:  (sb_writers#4){.+.+.+}, at: [<0000000095e2e675>] vfs_write+0x3e9/0x520 fs/read_write.c:558
 #2:  (&sb->s_type->i_mutex_key#9){+.+.+.}, at: [<000000007f44c367>] inode_lock include/linux/fs.h:768 [inline]
 #2:  (&sb->s_type->i_mutex_key#9){+.+.+.}, at: [<000000007f44c367>] ext4_file_write_iter+0x11e/0xdd0 fs/ext4/file.c:100
1 lock held by rsyslogd/1908:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<000000003ad2d4a6>] __fdget_pos+0xa8/0xd0 fs/file.c:782
2 locks held by getty/2035:
 #0:  (&tty->ldisc_sem){++++++}, at: [<000000001acf902f>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<00000000df4d604d>] n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
4 locks held by kworker/u4:4/24619:
 #0:  ("%s""netns"){.+.+.+}, at: [<000000007e1efa4c>] process_one_work+0x790/0x1600 kernel/workqueue.c:2107
 #1:  (net_cleanup_work){+.+.+.}, at: [<00000000197009bb>] process_one_work+0x7ce/0x1600 kernel/workqueue.c:2111
 #2:  (net_mutex){+.+.+.}, at: [<00000000c9131c04>] cleanup_net+0x131/0x8a0 net/core/net_namespace.c:440
 #3:  (rcu_preempt_state.barrier_mutex){+.+...}, at: [<0000000025f74cef>] _rcu_barrier+0x5d/0x340 kernel/rcu/tree.c:3645
1 lock held by init/18954:
 #0:  (tty_mutex){+.+.+.}, at: [<000000007262aa24>] tty_open_by_driver drivers/tty/tty_io.c:2062 [inline]
 #0:  (tty_mutex){+.+.+.}, at: [<000000007262aa24>] tty_open+0x3f9/0xe10 drivers/tty/tty_io.c:2140

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.172+ #50
 ffff8801d98d7cc8 ffffffff81b4fc11 0000000000000001 0000000000000000
 0000000000000001 ffffffff81097501 dffffc0000000000 ffff8801d98d7d00
 ffffffff81b5aeac 0000000000000001 0000000000000000 0000000000000001
Call Trace:
 [<000000009b51d98d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<000000009b51d98d>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<0000000030d021f1>] nmi_cpu_backtrace.cold+0x47/0x87 lib/nmi_backtrace.c:99
 [<00000000a1f3c11f>] nmi_trigger_cpumask_backtrace+0x124/0x155 lib/nmi_backtrace.c:60
 [<000000006c9881ae>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<0000000079e69ea6>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<0000000079e69ea6>] check_hung_task kernel/hung_task.c:126 [inline]
 [<0000000079e69ea6>] check_hung_uninterruptible_tasks kernel/hung_task.c:183 [inline]
 [<0000000079e69ea6>] watchdog+0x670/0xaf0 kernel/hung_task.c:263
 [<0000000028b80c67>] kthread+0x278/0x310 kernel/kthread.c:211
 [<00000000bf45a287>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 11808 Comm: kworker/u4:0 Not tainted 4.9.172+ #50
Workqueue: writeback wb_workfnc (flush-8:0)c
task: 0000000073d86236 task.stack: 00000000a21b9288
RIP: 0010:[<ffffffff81d6f72b>] c [<00000000224e2a3a>] io_serial_in+0x6b/0x90 drivers/tty/serial/8250/8250_port.c:414
RSP: 0000:ffff8801a087e108  EFLAGS: 00000002
RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000
RDX: 00000000000003fd RSI: ffffffff81d6f6d1 RDI: ffffffff84b63b58
RBP: ffff8801a087e118 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff841d23ef R12: ffffffff84b63b20
R13: 0000000000000020 R14: fffffbfff096c7ab R15: fffffbfff096c76d
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000f59000 CR3: 00000001c4f40000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff84b63b20c 0000000000002710c ffff8801a087e168c ffffffff81d71974c
 ffffffff841d2380c ffffffff84b63b68c ffffffff84b63d5ac ffffffff841d2387c
 ffffffff84b63b20c 000000000000002ec dffffc0000000000c 000000000000002ec
Call Trace:
 [<000000005a18c4ef>] serial_in drivers/tty/serial/8250/8250.h:111 [inline]
 [<000000005a18c4ef>] wait_for_xmitr+0x94/0x1e0 drivers/tty/serial/8250/8250_port.c:1997
 [<00000000d407df2b>] serial8250_console_putchar+0x20/0x60 drivers/tty/serial/8250/8250_port.c:3103
 [<000000008303c2f7>] uart_console_write+0x56/0xe0 drivers/tty/serial/serial_core.c:1886
 [<00000000aeebaf10>] serial8250_console_write+0x2fb/0x860 drivers/tty/serial/8250/8250_port.c:3169
 [<000000002397dfe2>] univ8250_console_write+0x5f/0x70 drivers/tty/serial/8250/8250_core.c:594
 [<000000009cb7b5b3>] call_console_drivers.isra.0.constprop.0+0x1ac/0x360 kernel/printk/printk.c:1594
 [<000000003c975189>] console_unlock+0x47c/0xb20 kernel/printk/printk.c:2454
 [<000000005d53b079>] vprintk_emit+0x43f/0x6f0 kernel/printk/printk.c:1908
 [<000000001d59e0fa>] vprintk+0x28/0x30 kernel/printk/printk.c:1918
 [<000000003f88d86c>] vprintk_func kernel/printk/internal.h:36 [inline]
 [<000000003f88d86c>] printk+0xc2/0xf5 kernel/printk/printk.c:1980
 [<0000000021c36d4d>] lowmem_scan.cold+0x2d7/0x361 drivers/staging/android/lowmemorykiller.c:177
 [<00000000bda9693f>] do_shrink_slab mm/vmscan.c:399 [inline]
 [<00000000bda9693f>] shrink_slab.part.0+0x3cf/0xa20 mm/vmscan.c:502
 [<00000000237959ec>] shrink_slab mm/vmscan.c:466 [inline]
 [<00000000237959ec>] shrink_node+0x1ed/0x750 mm/vmscan.c:2604
 [<00000000dd17db0b>] shrink_zones mm/vmscan.c:2751 [inline]
 [<00000000dd17db0b>] do_try_to_free_pages mm/vmscan.c:2793 [inline]
 [<00000000dd17db0b>] try_to_free_pages+0x397/0xbd0 mm/vmscan.c:3004
 [<00000000587d15fb>] __perform_reclaim mm/page_alloc.c:3332 [inline]
 [<00000000587d15fb>] __alloc_pages_direct_reclaim mm/page_alloc.c:3354 [inline]
 [<00000000587d15fb>] __alloc_pages_slowpath mm/page_alloc.c:3704 [inline]
 [<00000000587d15fb>] __alloc_pages_nodemask+0x930/0x1a80 mm/page_alloc.c:3861
 [<0000000046858bb0>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<0000000046858bb0>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<0000000046858bb0>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<0000000046858bb0>] __page_cache_alloc include/linux/pagemap.h:208 [inline]
 [<0000000046858bb0>] pagecache_get_page+0x248/0x740 mm/filemap.c:1367
 [<00000000fd01cefb>] find_or_create_page include/linux/pagemap.h:310 [inline]
 [<00000000fd01cefb>] ext4_mb_load_buddy_gfp+0x659/0x1100 fs/ext4/mballoc.c:1208
 [<0000000027403c06>] ext4_mb_load_buddy fs/ext4/mballoc.c:1255 [inline]
 [<0000000027403c06>] ext4_mb_regular_allocator+0x6d0/0xfd0 fs/ext4/mballoc.c:2194
 [<000000002f654ff8>] ext4_mb_new_blocks+0x165c/0x3930 fs/ext4/mballoc.c:4520
 [<00000000fa83bbad>] ext4_new_meta_blocks+0x1f4/0x370 fs/ext4/balloc.c:668
 [<0000000073600352>] ext4_ext_grow_indepth fs/ext4/extents.c:1294 [inline]
 [<0000000073600352>] ext4_ext_create_new_leaf fs/ext4/extents.c:1396 [inline]
 [<0000000073600352>] ext4_ext_insert_extent+0x1002/0x3930 fs/ext4/extents.c:2080
 [<0000000015954b94>] ext4_ext_map_blocks+0x1605/0x5150 fs/ext4/extents.c:4513
 [<00000000c3cba286>] ext4_map_blocks+0x7d2/0x1710 fs/ext4/inode.c:612
 [<000000004df1c7e2>] mpage_map_one_extent fs/ext4/inode.c:2387 [inline]
 [<000000004df1c7e2>] mpage_map_and_submit_extent fs/ext4/inode.c:2443 [inline]
 [<000000004df1c7e2>] ext4_writepages+0x157d/0x2d60 fs/ext4/inode.c:2784
 [<00000000a69d6dbc>] do_writepages+0xfc/0x1e0 mm/page-writeback.c:2338
 [<00000000ebd041d5>] __writeback_single_inode+0xd9/0x1040 fs/fs-writeback.c:1320
 [<0000000051638a37>] writeback_sb_inodes+0x50f/0xea0 fs/fs-writeback.c:1584
 [<00000000f094eeff>] __writeback_inodes_wb+0xc3/0x210 fs/fs-writeback.c:1653
 [<00000000b3e91d2d>] wb_writeback+0x637/0xbd0 fs/fs-writeback.c:1762
 [<00000000d907f61a>] wb_do_writeback fs/fs-writeback.c:1894 [inline]
 [<00000000d907f61a>] wb_workfn+0x1c4/0xe70 fs/fs-writeback.c:1930
 [<00000000cb4d4d1e>] process_one_work+0x88b/0x1600 kernel/workqueue.c:2114
 [<0000000088cd7f10>] worker_thread+0x5df/0x11d0 kernel/workqueue.c:2251
 [<0000000028b80c67>] kthread+0x278/0x310 kernel/kthread.c:211
 [<00000000bf45a287>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Code: c24 cc9 c00 c00 c00 c49 c8d c7c c24 c38 c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c48 c89 cfa c48 cc1 cea c03 cd3 ce3 c80 c3c c02 c00 c75 c17 c41 c03 c5c c24 c38 c89 cda cec c<5b> c0f cb6 cc0 c41 c5c c5d cc3 ce8 c08 c97 c78 cff ceb cc2 ce8 c61 c97 c78 cff ceb c

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/04 08:00 https://android.googlesource.com/kernel/common android-4.9 2dbf78bcd85b d28f4ce5 .config console log report ci-android-49-kasan-gce-root
2019/04/25 19:16 https://android.googlesource.com/kernel/common android-4.9 6cf3205cc803 f46aabc8 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.