ci starts bisection 2023-04-02 14:00:18.428743257 +0000 UTC m=+351358.875091240
bisecting fixing commit since a689b938df39ab513026c53fb7011fd7cd594943
building syzkaller on 1dac8c7a01e2bdd35cb04eb4901ddb157291ac2d
ensuring issue is reproducible on original commit a689b938df39ab513026c53fb7011fd7cd594943
testing commit a689b938df39ab513026c53fb7011fd7cd594943 gcc
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 419f6f13c583e2d511c707d5dd435a4eb6a70c6a4a5f7f29212da340d73c2d62
run #0: crashed: INFO: rcu detected stall in corrupted
run #1: crashed: INFO: rcu detected stall in corrupted
run #2: crashed: INFO: rcu detected stall in corrupted
run #3: crashed: INFO: rcu detected stall in corrupted
run #4: crashed: INFO: rcu detected stall in corrupted
run #5: crashed: INFO: rcu detected stall in corrupted
run #6: crashed: INFO: rcu detected stall in corrupted
run #7: crashed: INFO: rcu detected stall in corrupted
run #8: crashed: INFO: rcu detected stall in corrupted
run #9: crashed: INFO: task hung in ext4_evict_ea_inode
run #10: crashed: INFO: task hung in ext4_evict_ea_inode
run #11: crashed: INFO: task hung in ext4_evict_ea_inode
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
testing current HEAD 00c7b5f4ddc5b346df62b757ec73f9357bb452af
testing commit 00c7b5f4ddc5b346df62b757ec73f9357bb452af gcc
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 05bddbb72e90afa2724b0d2c57f235e181ee5b5bef52077d7f3e750318796988
run #0: crashed: INFO: task hung in ext4_evict_ea_inode
run #1: OK
run #2: crashed: INFO: task hung in ext4_evict_ea_inode
run #3: crashed: INFO: task hung in find_inode_fast
run #4: crashed: INFO: task hung in find_inode_fast
run #5: crashed: INFO: task hung in find_inode_fast
run #6: OK
run #7: OK
run #8: OK
run #9: OK
revisions tested: 2, total time: 37m36.248206622s (build: 18m55.908943719s, test: 17m35.635763097s)
the crash still happens on HEAD
commit msg: Merge tag 'input-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
crash: INFO: task hung in find_inode_fast
INFO: task syz-executor.3:12080 blocked for more than 143 seconds.
Not tainted 6.3.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:25704 pid:12080 ppid:5519 flags:0x00004004
Call Trace:
__schedule+0x1717/0x45f0
schedule+0xc3/0x180
find_inode_fast+0x2e8/0x3d0
iget_locked+0x9b/0x720
__ext4_iget+0x2f2/0x3e30
ext4_xattr_set_entry+0x130e/0x39b0
ext4_xattr_block_set+0xbeb/0x3380
ext4_xattr_set_handle+0xb07/0x12d0
ext4_xattr_set+0x218/0x370
__vfs_setxattr+0x334/0x380
__vfs_setxattr_noperm+0x106/0x4c0
vfs_setxattr+0x1d3/0x350
setxattr+0x182/0x1f0
path_setxattr+0x17d/0x230
__x64_sys_setxattr+0xb6/0xd0
do_syscall_64+0x41/0xc0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f6215a8c0c9
RSP: 002b:00007f62167e9168 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f6215bac050 RCX: 00007f6215a8c0c9
RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 00000000200000c0
RBP: 00007f6215ae7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc64bb59af R14: 00007f62167e9300 R15: 0000000000022000
INFO: task syz-executor.3:12082 blocked for more than 144 seconds.
Not tainted 6.3.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:24920 pid:12082 ppid:5519 flags:0x00004004
Call Trace:
__schedule+0x1717/0x45f0
schedule+0xc3/0x180
mb_cache_entry_wait_unused+0x16e/0x200
ext4_evict_ea_inode+0x169/0x2b0
ext4_evict_inode+0x117/0xda0
evict+0x262/0x550
ext4_xattr_set_entry+0x27d7/0x39b0
ext4_xattr_block_set+0x669/0x3380
ext4_xattr_set_handle+0xb07/0x12d0
ext4_xattr_set+0x218/0x370
__vfs_setxattr+0x334/0x380
__vfs_setxattr_noperm+0x106/0x4c0
vfs_setxattr+0x1d3/0x350
setxattr+0x182/0x1f0
path_setxattr+0x17d/0x230
__x64_sys_setxattr+0xb6/0xd0
do_syscall_64+0x41/0xc0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f6215a8c0c9
RSP: 002b:00007f62167c8168 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f6215bac120 RCX: 00007f6215a8c0c9
RDX: 0000000000000000 RSI: 0000000020000200 RDI: 00000000200001c0
RBP: 00007f6215ae7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc64bb59af R14: 00007f62167c8300 R15: 0000000000022000
Showing all locks held in the system:
2 locks held by kworker/0:0/7:
#0: ffff888011072538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x6be/0xe20
#1:
ffff88807ed8ecb0
(
&mm->cid_lock#2){....}-{2:2}, at: __schedule+0x12c0/0x45f0
2 locks held by kworker/u4:1/11:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8bf16f10 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20
1 lock held by rcu_tasks_trace/13:
#0: ffffffff8bf17710 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20
3 locks held by kworker/0:1/14:
#0: ffff888011070d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x6be/0xe20
#1: ffffc90000137d20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x708/0xe20
#2: ffffffff8bf1c238 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x46c/0x890
1 lock held by khungtaskd/28:
#0: ffffffff8bf16d40 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by kworker/u4:5/1015:
#0: ffff8880b9c3be18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140
#1: ffff8880b9c28788 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x441/0x770
2 locks held by kworker/0:2/1116:
#0: ffff888011070d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x6be/0xe20
#1: ffffc90004adfd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x708/0xe20
1 lock held by udevd/4429:
2 locks held by getty/4740:
#0: ffff888149e39098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x20/0x60
#1: ffffc900015802f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5ed/0x1880
2 locks held by kworker/0:5/5084:
#0: ffff888011072538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x6be/0xe20
#1: ffffc900039cfd20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x708/0xe20
1 lock held by syz-executor.1/5531:
#0: ffffffff8bf1c238 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x46c/0x890
2 locks held by kworker/0:6/5667:
#0: ffff888011070d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x6be/0xe20
#1: ffffc90005137d20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x708/0xe20
3 locks held by syz-executor.3/12080:
#0: ffff888028318460 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x3a/0x70
#1: ffff888069d0c030 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: vfs_setxattr+0x192/0x350
#2: ffff888069d0bcf8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_xattr_set_handle+0x23b/0x12d0
3 locks held by syz-executor.3/12082:
#0: ffff888028318460 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x3a/0x70
#1: ffff888069d72218 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: vfs_setxattr+0x192/0x350
#2: ffff888069d71ee0 (&ei->xattr_sem){++++}-{3:3}, at: ext4_xattr_set_handle+0x23b/0x12d0
2 locks held by syz-executor.3/17411:
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.3.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
dump_stack_lvl+0x167/0x220
nmi_cpu_backtrace+0x34f/0x380
nmi_trigger_cpumask_backtrace+0x103/0x1f0
watchdog+0xa7c/0xac0
kthread+0x232/0x2b0
ret_from_fork+0x1f/0x30
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 5756 Comm: kworker/u4:7 Not tainted 6.3.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:x2apic_send_IPI+0x7b/0xd0
Code: 48 c1 e8 03 42 0f b6 04 38 84 c0 75 26 0f b7 13 0f ae f0 0f ae e8 41 83 fe 02 b8 00 04 00 00 41 0f 45 c6 b9 30 08 00 00 0f 30 <66> 90 5b 41 5e 41 5f 5d c3 89 d9 80 e1 07 fe c1 38 c1 7c cf 48 89
RSP: 0018:ffffc900053d74d8 EFLAGS: 00000206
RAX: 00000000000000fb RBX: ffff8880b9d219c0 RCX: 0000000000000830
RDX: 0000000000000001 RSI: 00000000000000fb RDI: 0000000000000001
RBP: ffffffff8b9ac8a8 R08: dffffc0000000000 R09: ffffed10173879eb
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff92000a7aea4 R14: 00000000000000fb R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa51e185058 CR3: 000000000bd26000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
send_call_function_single_ipi+0x18c/0x260
smp_call_function_many_cond+0x1a18/0x2e30
on_each_cpu_cond_mask+0x3a/0x60
text_poke_bp_batch+0x5fd/0x950
text_poke_finish+0x1a/0x30
arch_jump_label_transform_apply+0x17/0x30
static_key_enable_cpuslocked+0xea/0x200
static_key_enable+0x15/0x20
toggle_allocation_gate+0xa7/0x1e0
process_one_work+0x797/0xe20
worker_thread+0x8c9/0xfd0
kthread+0x232/0x2b0
ret_from_fork+0x1f/0x30