bisecting fixing commit since 5b7a52cd2eef952cee8a72512ef370bcdef46636 building syzkaller on a1839e81524f4e427a4b57bca0e4633d459d3d18 testing commit 5b7a52cd2eef952cee8a72512ef370bcdef46636 with gcc (GCC) 8.1.0 kernel signature: 9cf7b046a55355fb002bea6fbe44b31a9237b073fbcbe0c42bd61d33cf5f4514 run #0: crashed: INFO: task hung in ext4_find_entry run #1: crashed: INFO: task hung in scsi_block_when_processing_errors run #2: crashed: INFO: task hung in blk_mq_make_request run #3: crashed: INFO: task hung in ext4_find_entry run #4: crashed: INFO: task hung in virtscsi_tmf run #5: crashed: INFO: task hung in blk_mq_make_request run #6: crashed: INFO: task hung in ext4_find_entry run #7: OK run #8: OK run #9: OK testing current HEAD 2762b48e9611529239da2e68cba908dbbec9805f testing commit 2762b48e9611529239da2e68cba908dbbec9805f with gcc (GCC) 8.1.0 kernel signature: b22b07c8f07109a747475a6d04bc448fae377be9dd50998a79260fb2266ffbc8 run #0: crashed: INFO: task hung in blk_mq_make_request run #1: crashed: INFO: task hung in virtscsi_tmf run #2: crashed: INFO: task hung in scsi_block_when_processing_errors run #3: crashed: INFO: task hung in blk_mq_make_request run #4: crashed: INFO: task hung in virtscsi_tmf run #5: crashed: INFO: task hung in scsi_block_when_processing_errors run #6: crashed: INFO: task hung in ext4_find_entry run #7: OK run #8: OK run #9: OK revisions tested: 2, total time: 39m33.059402601s (build: 15m54.095325358s, test: 23m9.059604867s) the crash still happens on HEAD commit msg: Linux 4.14.216 crash: INFO: task hung in ext4_find_entry sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset INFO: task syz-executor.3:7714 blocked for more than 140 seconds. Not tainted 4.14.216-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D24792 7714 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5032 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_rmdir+0x166/0xd90 fs/ext4/namei.c:2990 vfs_rmdir+0x1dc/0x3c0 fs/namei.c:3908 do_rmdir+0x295/0x330 fs/namei.c:3968 SYSC_rmdir fs/namei.c:3986 [inline] SyS_rmdir+0x11/0x20 fs/namei.c:3984 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dbc7 RSP: 002b:00007fff5b163e38 EFLAGS: 00000207 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045dbc7 RDX: 0000000000000000 RSI: 000000000074e678 RDI: 00007fff5b164f70 RBP: 00000000000018dc R08: 0000000000000000 R09: 0000000000000001 R10: 000000000000000a R11: 0000000000000207 R12: 00007fff5b164f70 R13: 0000000001da9a60 R14: 0000000000000000 R15: 00007fff5b164f70 INFO: task syz-executor.0:7715 blocked for more than 140 seconds. Not tainted 4.14.216-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D24616 7715 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5032 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xfd0 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007ffe4b9ad6f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007ffe4b9ad710 RSI: 00007ffe4b9ad710 RDI: 00007ffe4b9ad7a0 RBP: 00000000000018f7 R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007ffe4b9ae830 R13: 0000000001d5aa60 R14: 0000000000000000 R15: 00007ffe4b9ae830 INFO: task syz-executor.4:7718 blocked for more than 140 seconds. Not tainted 4.14.216-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D24616 7718 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5032 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_rmdir+0x166/0xd90 fs/ext4/namei.c:2990 vfs_rmdir+0x1dc/0x3c0 fs/namei.c:3908 do_rmdir+0x295/0x330 fs/namei.c:3968 SYSC_rmdir fs/namei.c:3986 [inline] SyS_rmdir+0x11/0x20 fs/namei.c:3984 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dbc7 RSP: 002b:00007ffea7b01df8 EFLAGS: 00000207 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045dbc7 RDX: 0000000000000000 RSI: 000000000074e678 RDI: 00007ffea7b02f30 RBP: 00000000000018ce R08: 0000000000000000 R09: 0000000000000001 R10: 000000000000000a R11: 0000000000000207 R12: 00007ffea7b02f30 R13: 00000000021cea60 R14: 0000000000000000 R15: 00007ffea7b02f30 INFO: task syz-executor.5:7720 blocked for more than 140 seconds. Not tainted 4.14.216-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D24792 7720 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5032 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_rmdir+0x166/0xd90 fs/ext4/namei.c:2990 vfs_rmdir+0x1dc/0x3c0 fs/namei.c:3908 do_rmdir+0x295/0x330 fs/namei.c:3968 SYSC_rmdir fs/namei.c:3986 [inline] SyS_rmdir+0x11/0x20 fs/namei.c:3984 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dbc7 RSP: 002b:00007ffff24a1848 EFLAGS: 00000207 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045dbc7 RDX: 0000000000000000 RSI: 000000000074e678 RDI: 00007ffff24a2980 RBP: 0000000000001878 R08: 0000000000000000 R09: 0000000000000001 R10: 000000000000000a R11: 0000000000000207 R12: 00007ffff24a2980 R13: 00000000021aba60 R14: 0000000000000000 R15: 00007ffff24a2980 INFO: task syz-executor.1:7722 blocked for more than 140 seconds. Not tainted 4.14.216-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D24472 7722 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5032 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xfd0 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007ffd428ed9c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007ffd428ed9e0 RSI: 00007ffd428ed9e0 RDI: 00007ffd428eda70 RBP: 0000000000001827 R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007ffd428eeb00 R13: 000000000213da60 R14: 0000000000000000 R15: 00007ffd428eeb00 INFO: task syz-executor.2:24680 blocked for more than 140 seconds. Not tainted 4.14.216-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D29672 24680 7721 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5032 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_lookup+0x10a/0x610 fs/ext4/namei.c:1584 lookup_real fs/namei.c:1555 [inline] __lookup_hash+0xed/0x160 fs/namei.c:1575 filename_create+0x183/0x400 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_symlinkat fs/namei.c:4176 [inline] SyS_symlinkat+0xbd/0x1c0 fs/namei.c:4163 SYSC_symlink fs/namei.c:4196 [inline] SyS_symlink+0x11/0x20 fs/namei.c:4194 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45db87 RSP: 002b:00007ffe78172be8 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87 RDX: 00007ffe78172c83 RSI: 00000000004c3889 RDI: 00007ffe78172c70 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013 R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001 R13: 00007ffe78172c20 R14: 0000000000000000 R15: 00007ffe78172c30 Showing all locks held in the system: 1 lock held by khungtaskd/1529: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4548 1 lock held by in:imklog/7133: #0: (&f->f_pos_lock){+.+.}, at: [] __fdget_pos+0x8e/0xc0 fs/file.c:769 3 locks held by syz-executor.3/7714: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_rmdir+0x20f/0x330 fs/namei.c:3956 #2: (&type->i_mutex_dir_key#3){++++}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&type->i_mutex_dir_key#3){++++}, at: [] vfs_rmdir+0xb7/0x3c0 fs/namei.c:3897 3 locks held by syz-executor.0/7715: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 3 locks held by syz-executor.4/7718: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_rmdir+0x20f/0x330 fs/namei.c:3956 #2: (&type->i_mutex_dir_key#3){++++}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&type->i_mutex_dir_key#3){++++}, at: [] vfs_rmdir+0xb7/0x3c0 fs/namei.c:3897 3 locks held by syz-executor.5/7720: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_rmdir+0x20f/0x330 fs/namei.c:3956 #2: (&type->i_mutex_dir_key#3){++++}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&type->i_mutex_dir_key#3){++++}, at: [] vfs_rmdir+0xb7/0x3c0 fs/namei.c:3897 3 locks held by syz-executor.1/7722: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 2 locks held by syz-executor.2/24680: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] filename_create+0x150/0x400 fs/namei.c:3674 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1529 Comm: khungtaskd Not tainted 4.14.216-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x120 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x51b/0xa70 kernel/hung_task.c:274 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 8 Comm: rcu_preempt Not tainted 4.14.216-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8881f5388200 task.stack: ffff8881f5390000 RIP: 0010:rcu_gp_kthread+0xb6c/0x1df0 kernel/rcu/tree.c:2255 RSP: 0018:ffff8881f5397dc8 EFLAGS: 00000286 RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffffffff8afa1bc0 RBP: ffff8881f5397f00 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: fffffbfff11c1b30 R14: ffffffff88f78600 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f6500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f094b1b5000 CR3: 0000000008e6a005 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Code: ff ff 48 c1 e8 03 42 80 3c 38 00 0f 85 88 0f 00 00 49 83 be a8 00 00 00 00 74 51 48 85 db 74 4c 48 89 df e8 77 b5 ec 05 48 89 c3 <48> 8b bd 00 ff ff ff 48 8d 75 98 ba 02 04 00 00 e8 ff d2 f8 ff