bisecting fixing commit since bfb9e5c03076a446b1f4f6a523ddc8d723c907a6 building syzkaller on 79b211f74b08737aeb4934c6ff69a263b3c38013 testing commit bfb9e5c03076a446b1f4f6a523ddc8d723c907a6 with gcc (GCC) 8.1.0 kernel signature: 0d8129f3a47cdcbaa87e27571ef5cd8926928ac7c32332d203202d8251f8ca21 run #0: crashed: INFO: task hung in pipe_write run #1: crashed: INFO: task hung in pipe_write run #2: crashed: INFO: task hung in pipe_write run #3: crashed: INFO: task hung in pipe_write run #4: crashed: INFO: task hung in pipe_write run #5: crashed: INFO: task hung in pipe_write run #6: crashed: INFO: task hung in pipe_write run #7: crashed: INFO: task hung in pipe_write run #8: crashed: INFO: task hung in pipe_write run #9: OK testing current HEAD ab9dfda232481dcfaf549ce774004d116fc80c13 testing commit ab9dfda232481dcfaf549ce774004d116fc80c13 with gcc (GCC) 8.1.0 kernel signature: cfd9dd460df9fd4af94678ca7126e2670856a9938deef6cdca3be6166237973b run #0: crashed: INFO: task hung in pipe_read run #1: crashed: INFO: task hung in pipe_write run #2: crashed: INFO: task hung in pipe_write run #3: crashed: INFO: task hung in pipe_write run #4: crashed: INFO: task hung in pipe_write run #5: crashed: INFO: task hung in pipe_read run #6: crashed: INFO: task hung in pipe_read run #7: crashed: INFO: task hung in pipe_read run #8: crashed: INFO: task hung in pipe_write run #9: crashed: INFO: task hung in pipe_write revisions tested: 2, total time: 39m15.6337581s (build: 19m9.960353431s, test: 18m49.976129259s) the crash still happens on HEAD commit msg: Linux 4.14.180 crash: INFO: task hung in pipe_write INFO: task syz-executor.0:25574 blocked for more than 140 seconds. Not tainted 4.14.180-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D29608 25574 6421 0x00000000 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x780/0x1d20 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0xabc/0x14c0 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 __pipe_lock fs/pipe.c:88 [inline] pipe_write+0xa6/0xd10 fs/pipe.c:385 call_write_iter include/linux/fs.h:1778 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x413/0x840 fs/read_write.c:482 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45a919 RSP: 002b:00007f821ff78c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919 RDX: 000000010000000d RSI: 0000000020000000 RDI: 0000000000000000 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f821ff796d4 R13: 00000000004cbe11 R14: 00000000004e5be8 R15: 00000000ffffffff Showing all locks held in the system: 1 lock held by khungtaskd/1044: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4548 1 lock held by syz-execprog/6397: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x16c/0x190 fs/pipe.c:123 1 lock held by syz-execprog/6415: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x16c/0x190 fs/pipe.c:123 1 lock held by syz-executor.3/21110: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x16c/0x190 fs/pipe.c:123 1 lock held by syz-executor.0/23453: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x16c/0x190 fs/pipe.c:123 1 lock held by syz-executor.0/25574: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 1 lock held by syz-executor.3/3286: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 1 lock held by syz-executor.4/8454: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x16c/0x190 fs/pipe.c:123 1 lock held by syz-executor.4/9765: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 1 lock held by syz-executor.1/14590: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x16c/0x190 fs/pipe.c:123 1 lock held by syz-executor.4/18144: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 1 lock held by syz-executor.5/21237: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x16c/0x190 fs/pipe.c:123 1 lock held by syz-executor.1/25813: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 1 lock held by syz-executor.5/28380: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 1 lock held by syz-executor.0/32322: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 1 lock held by syz-executor.3/1642: #0: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_write+0xa6/0xd10 fs/pipe.c:385 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1044 Comm: khungtaskd Not tainted 4.14.180-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 nmi_cpu_backtrace.cold.4+0x3e/0x76 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xe5/0x119 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x522/0xb40 kernel/hung_task.c:274 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 17541 Comm: syz-executor.3 Not tainted 4.14.180-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88809f4ec0c0 task.stack: ffff888079ab8000 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline] RIP: 0010:read_seqcount_begin include/linux/seqlock.h:164 [inline] RIP: 0010:read_seqbegin include/linux/seqlock.h:434 [inline] RIP: 0010:zone_span_seqbegin include/linux/memory_hotplug.h:80 [inline] RIP: 0010:page_outside_zone_boundaries mm/page_alloc.c:495 [inline] RIP: 0010:bad_range+0x117/0x3a0 mm/page_alloc.c:524 RSP: 0018:ffff888079abf8a8 EFLAGS: 00000082 RAX: 1ffffffff0fe2d29 RBX: ffff88812fffb6c0 RCX: 1ffff11013e9d927 RDX: 1ffffffff0fe2d29 RSI: 0000000000000004 RDI: 0000000000000082 RBP: ffff888079abf8f8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88809f4ec0c0 R12: 0000000000000082 R13: 00000000000931e2 R14: 0000000000000000 R15: dffffc0000000000 FS: 000000000130c940(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001315978 CR3: 0000000091b2f000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __free_one_page mm/page_alloc.c:827 [inline] free_one_page+0x122/0x1050 mm/page_alloc.c:1173 __free_pages_ok+0x420/0xe90 mm/page_alloc.c:1262 __free_pages+0x5b/0x80 mm/page_alloc.c:4245 kmem_freepages.isra.34+0x12f/0x1c0 mm/slab.c:1466 slab_destroy+0x24/0x60 mm/slab.c:1723 slabs_destroy+0x6b/0x90 mm/slab.c:1739 cache_flusharray mm/slab.c:3483 [inline] ___cache_free+0x205/0x2c0 mm/slab.c:3525 qlink_free mm/kasan/quarantine.c:147 [inline] qlist_free_all+0x85/0x140 mm/kasan/quarantine.c:166 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259 kasan_kmalloc+0x9b/0xe0 mm/kasan/kasan.c:536 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] kmem_cache_alloc_trace+0x13b/0x7a0 mm/slab.c:3616 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] ext4_htree_create_dir_info fs/ext4/dir.c:419 [inline] ext4_dx_readdir fs/ext4/dir.c:538 [inline] ext4_readdir+0x1601/0x3210 fs/ext4/dir.c:124 iterate_dir+0x188/0x660 fs/readdir.c:52 SYSC_getdents fs/readdir.c:269 [inline] SyS_getdents+0x10e/0x1e0 fs/readdir.c:250 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x458c6b RSP: 002b:00007ffd2750f450 EFLAGS: 00000206 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 000000000130d970 RCX: 0000000000458c6b RDX: 0000000000008000 RSI: 000000000130d970 RDI: 0000000000000003 RBP: 000000000130d970 R08: 0000000000000001 R09: 000000000130c940 R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffd4 R13: 0000000000000016 R14: 0000000000000000 R15: 00007ffd275105f0 Code: c7 c7 48 69 f1 87 48 89 f8 48 c1 e8 03 42 80 3c 38 00 0f 85 73 02 00 00 48 83 3d 7c 65 81 06 00 0f 84 c2 01 00 00 4c 89 e7 57 9d <0f> 1f 44 00 00 e8 3f 96 d6 ff 4c 8d a3 90 00 00 00 4c 89 e0 48