bisecting fixing commit since 5b7a52cd2eef952cee8a72512ef370bcdef46636 building syzkaller on a1839e81524f4e427a4b57bca0e4633d459d3d18 testing commit 5b7a52cd2eef952cee8a72512ef370bcdef46636 with gcc (GCC) 8.1.0 kernel signature: 9f63fad2d2ff4f9685f8dff7f0b7c30279659a6961432149928b327700cc96d5 run #0: crashed: INFO: task hung in virtscsi_tmf run #1: crashed: INFO: task hung in ext4_find_entry run #2: crashed: INFO: task hung in virtscsi_tmf run #3: crashed: INFO: task hung in virtscsi_tmf run #4: crashed: INFO: task hung in scsi_block_when_processing_errors run #5: crashed: INFO: task hung in blk_mq_make_request run #6: crashed: INFO: task hung in ext4_find_entry run #7: crashed: INFO: task hung in ext4_find_entry run #8: crashed: INFO: task hung in ext4_find_entry run #9: crashed: INFO: task hung in blk_mq_make_request testing current HEAD 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae testing commit 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae with gcc (GCC) 8.1.0 kernel signature: b6ceded531a068f1ff17b73e38372daff6b836b7ac799a6ca0a4f4dce6a485ff run #0: crashed: INFO: task hung in virtscsi_tmf run #1: crashed: INFO: task hung in ext4_find_entry run #2: crashed: INFO: task hung in ext4_find_entry run #3: crashed: INFO: task hung in ext4_find_entry run #4: crashed: INFO: task hung in ext4_find_entry run #5: crashed: INFO: task hung in ext4_find_entry run #6: crashed: INFO: task hung in ext4_find_entry run #7: OK run #8: OK run #9: OK revisions tested: 2, total time: 39m14.286968241s (build: 16m5.344911793s, test: 22m26.411041698s) the crash still happens on HEAD commit msg: Linux 4.14.212 crash: INFO: task hung in ext4_find_entry sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset INFO: task syz-executor.0:7706 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D24192 7706 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xfd0 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007ffc09be3618 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007ffc09be3630 RSI: 00007ffc09be3630 RDI: 00007ffc09be36c0 RBP: 000000000000166c R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007ffc09be4750 R13: 00000000021e2a60 R14: 0000000000000000 R15: 00007ffc09be4750 INFO: task syz-executor.4:7710 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D24808 7710 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xfd0 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007ffdc07d2888 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007ffdc07d28a0 RSI: 00007ffdc07d28a0 RDI: 00007ffdc07d2930 RBP: 0000000000001638 R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007ffdc07d39c0 R13: 00000000017a8a60 R14: 0000000000000000 R15: 00007ffdc07d39c0 INFO: task syz-executor.5:7711 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D24616 7711 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xfd0 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007ffe9e025548 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007ffe9e025560 RSI: 00007ffe9e025560 RDI: 00007ffe9e0255f0 RBP: 0000000000001640 R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007ffe9e026680 R13: 0000000002321a60 R14: 0000000000000000 R15: 00007ffe9e026680 INFO: task syz-executor.3:20556 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28968 20556 7709 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_lookup+0x10a/0x610 fs/ext4/namei.c:1584 lookup_real fs/namei.c:1555 [inline] __lookup_hash+0xed/0x160 fs/namei.c:1575 filename_create+0x183/0x400 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_symlinkat fs/namei.c:4176 [inline] SyS_symlinkat+0xbd/0x1c0 fs/namei.c:4163 SYSC_symlink fs/namei.c:4196 [inline] SyS_symlink+0x11/0x20 fs/namei.c:4194 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45db87 RSP: 002b:00007ffff89c8d88 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87 RDX: 00007ffff89c8e27 RSI: 00000000004c3880 RDI: 00007ffff89c8e10 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001 R13: 00007ffff89c8dc0 R14: 0000000000000000 R15: 00007ffff89c8dd0 INFO: task syz-executor.1:20558 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D29688 20558 7707 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_lookup+0x10a/0x610 fs/ext4/namei.c:1584 lookup_real fs/namei.c:1555 [inline] __lookup_hash+0xed/0x160 fs/namei.c:1575 filename_create+0x183/0x400 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_symlinkat fs/namei.c:4176 [inline] SyS_symlinkat+0xbd/0x1c0 fs/namei.c:4163 SYSC_symlink fs/namei.c:4196 [inline] SyS_symlink+0x11/0x20 fs/namei.c:4194 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45db87 RSP: 002b:00007ffe00e3d088 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87 RDX: 00007ffe00e3d127 RSI: 00000000004c3880 RDI: 00007ffe00e3d110 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001 R13: 00007ffe00e3d0c0 R14: 0000000000000000 R15: 00007ffe00e3d0d0 INFO: task syz-executor.2:20559 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D29688 20559 7701 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_lookup+0x10a/0x610 fs/ext4/namei.c:1584 lookup_real fs/namei.c:1555 [inline] __lookup_hash+0xed/0x160 fs/namei.c:1575 filename_create+0x183/0x400 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_symlinkat fs/namei.c:4176 [inline] SyS_symlinkat+0xbd/0x1c0 fs/namei.c:4163 SYSC_symlink fs/namei.c:4196 [inline] SyS_symlink+0x11/0x20 fs/namei.c:4194 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45db87 RSP: 002b:00007ffec06e9e88 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87 RDX: 00007ffec06e9f27 RSI: 00000000004c3880 RDI: 00007ffec06e9f10 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001 R13: 00007ffec06e9ec0 R14: 0000000000000000 R15: 00007ffec06e9ed0 Showing all locks held in the system: 1 lock held by khungtaskd/1530: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4548 3 locks held by syz-executor.0/7706: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 3 locks held by syz-executor.4/7710: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 3 locks held by syz-executor.5/7711: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 2 locks held by syz-executor.3/20556: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] filename_create+0x150/0x400 fs/namei.c:3674 2 locks held by syz-executor.1/20558: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] filename_create+0x150/0x400 fs/namei.c:3674 2 locks held by syz-executor.2/20559: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] filename_create+0x150/0x400 fs/namei.c:3674 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1530 Comm: khungtaskd Not tainted 4.14.212-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1f1 lib/dump_stack.c:58 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x11a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x51b/0xa70 kernel/hung_task.c:274 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 778 Comm: kworker/u4:4 Not tainted 4.14.212-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker task: ffff8881f3632600 task.stack: ffff8881f3640000 RIP: 0010:mark_lock+0x90/0x11a0 kernel/locking/lockdep.c:3168 RSP: 0018:ffff8881f3647b90 EFLAGS: 00000086 RAX: 00000000000005b7 RBX: ffff8881f3632eb0 RCX: 1ffff1103e6c65da RDX: 0000000000000000 RSI: ffff8881f3632eb0 RDI: ffff8881f3632600 RBP: ffff8881f3647bd8 R08: ffff8881f3632ed0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8ab34860 R13: 0000000000000040 R14: 0000000000000006 R15: ffff8881f3632600 FS: 0000000000000000(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f27cd90e000 CR3: 0000000008e6a003 CR4: 00000000001606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mark_held_locks+0xc7/0x130 kernel/locking/lockdep.c:2854 __trace_hardirqs_on_caller kernel/locking/lockdep.c:2883 [inline] trace_hardirqs_on_caller+0x3bb/0x570 kernel/locking/lockdep.c:2930 trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2937 __local_bh_enable_ip+0xcc/0x150 kernel/softirq.c:190 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x30/0x40 kernel/locking/spinlock.c:208 spin_unlock_bh include/linux/spinlock.h:362 [inline] batadv_nc_purge_paths+0x1c5/0x2c0 net/batman-adv/network-coding.c:479 batadv_nc_worker+0x228/0x630 net/batman-adv/network-coding.c:729 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Code: 0f b6 14 11 84 d2 74 09 80 fa 03 0f 8e 60 04 00 00 25 ff 1f 00 00 4c 69 e0 50 01 00 00 49 81 ec 50 01 00 00 49 81 c4 80 c9 ab 8a <49> 8d 7c 24 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea