bisecting fixing commit since 768292d053619b2725b846ed2bf556bf40f43de2 building syzkaller on ea2f400664b9a9695d642509056f973b827bae41 testing commit 768292d053619b2725b846ed2bf556bf40f43de2 with gcc (GCC) 8.1.0 kernel signature: 1f6000eceef97f692251bbeef32d8970355e4aa6 all runs: crashed: INFO: task hung in synchronize_rcu testing current HEAD 312017a460d5ea31d646e7148e400e13db799ddc testing commit 312017a460d5ea31d646e7148e400e13db799ddc with gcc (GCC) 8.1.0 kernel signature: 39303b0c0af5c6194d39f51ea01ca9e13e26c0a4 run #0: OK run #1: crashed: INFO: task hung in synchronize_rcu run #2: crashed: INFO: task hung in synchronize_rcu run #3: crashed: INFO: task hung in synchronize_rcu run #4: crashed: INFO: task hung in synchronize_rcu run #5: crashed: INFO: task hung in synchronize_rcu run #6: crashed: INFO: task hung in synchronize_rcu run #7: crashed: INFO: task hung in synchronize_rcu run #8: crashed: INFO: task hung in synchronize_rcu run #9: crashed: INFO: task hung in synchronize_rcu revisions tested: 2, total time: 30m24.036717853s (build: 17m51.171936493s, test: 11m41.255665337s) the crash still happens on HEAD commit msg: Linux 4.19.89 crash: INFO: task hung in synchronize_rcu INFO: task kworker/u4:0:7 blocked for more than 140 seconds. Not tainted 4.19.89-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u4:0 D28088 7 2 0x80000000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:2826 [inline] __schedule+0x78c/0x1c10 kernel/sched/core.c:3515 schedule+0x7f/0x1b0 kernel/sched/core.c:3559 schedule_timeout+0x6d5/0xda0 kernel/time/timer.c:1782 do_wait_for_common kernel/sched/completion.c:83 [inline] __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common kernel/sched/completion.c:115 [inline] wait_for_completion+0x282/0x460 kernel/sched/completion.c:136 __synchronize_srcu+0x121/0x200 kernel/rcu/srcutree.c:936 kobject: 'loop1' (000000007fd0dda7): kobject_uevent_env kobject: 'loop1' (000000007fd0dda7): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop0' (00000000e1022e8a): kobject_uevent_env kobject: 'loop0' (00000000e1022e8a): fill_kobj_path: path = '/devices/virtual/block/loop0' synchronize_srcu+0x2ee/0x3d3 kernel/rcu/srcutree.c:1014 fsnotify_connector_destroy_workfn+0x45/0xa0 fs/notify/mark.c:174 kobject: 'loop2' (00000000e7c8483a): kobject_uevent_env process_one_work+0x830/0x1670 kernel/workqueue.c:2153 kobject: 'loop2' (00000000e7c8483a): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop4' (00000000c8f87733): kobject_uevent_env kobject: 'loop4' (00000000c8f87733): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop3' (00000000127963ff): kobject_uevent_env kobject: 'loop3' (00000000127963ff): fill_kobj_path: path = '/devices/virtual/block/loop3' worker_thread+0x85/0xb60 kernel/workqueue.c:2296 kobject: 'loop2' (00000000e7c8483a): kobject_uevent_env kobject: 'loop2' (00000000e7c8483a): fill_kobj_path: path = '/devices/virtual/block/loop2' kthread+0x324/0x3e0 kernel/kthread.c:246 kobject: 'loop3' (00000000127963ff): kobject_uevent_env kobject: 'loop3' (00000000127963ff): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (00000000c8f87733): kobject_uevent_env kobject: 'loop4' (00000000c8f87733): fill_kobj_path: path = '/devices/virtual/block/loop4' ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 INFO: task kworker/u4:4:2308 blocked for more than 140 seconds. kobject: 'loop2' (00000000e7c8483a): kobject_uevent_env Not tainted 4.19.89-syzkaller #0 kobject: 'loop2' (00000000e7c8483a): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop1' (000000007fd0dda7): kobject_uevent_env "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kobject: 'loop1' (000000007fd0dda7): fill_kobj_path: path = '/devices/virtual/block/loop1' kworker/u4:4 D26024 2308 2 0x80000000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:2826 [inline] __schedule+0x78c/0x1c10 kernel/sched/core.c:3515 schedule+0x7f/0x1b0 kernel/sched/core.c:3559 schedule_timeout+0x6d5/0xda0 kernel/time/timer.c:1782 do_wait_for_common kernel/sched/completion.c:83 [inline] __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common kernel/sched/completion.c:115 [inline] wait_for_completion+0x282/0x460 kernel/sched/completion.c:136 __synchronize_srcu+0x121/0x200 kernel/rcu/srcutree.c:936 synchronize_srcu_expedited kernel/rcu/srcutree.c:961 [inline] synchronize_srcu+0x245/0x3d3 kernel/rcu/srcutree.c:1012 fsnotify_mark_destroy_workfn+0xfc/0x390 fs/notify/mark.c:795 process_one_work+0x830/0x1670 kernel/workqueue.c:2153 worker_thread+0x85/0xb60 kernel/workqueue.c:2296 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Showing all locks held in the system: 2 locks held by kworker/u4:0/7: #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: __write_once_size include/linux/compiler.h:220 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: process_one_work+0x762/0x1670 kernel/workqueue.c:2124 #1: 0000000023b4efa5 (connector_reaper_work){+.+.}, at: process_one_work+0x792/0x1670 kernel/workqueue.c:2128 1 lock held by khungtaskd/1003: #0: 00000000a302c9e6 (rcu_read_lock){....}, at: debug_show_all_locks+0x5b/0x27a kernel/locking/lockdep.c:4438 2 locks held by kworker/u4:4/2308: #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: __write_once_size include/linux/compiler.h:220 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline] #0: 00000000848818e0 ((wq_completion)"events_unbound"){+.+.}, at: process_one_work+0x762/0x1670 kernel/workqueue.c:2124 #1: 0000000054f82a5e ((reaper_work).work){+.+.}, at: process_one_work+0x792/0x1670 kernel/workqueue.c:2128 3 locks held by kworker/0:2/2646: 1 lock held by rsyslogd/6888: #0: 00000000131817ee (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xa7/0xd0 fs/file.c:767 2 locks held by getty/7010: #0: 000000008e22bf2b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x2d/0x40 drivers/tty/tty_ldsem.c:362 #1: 00000000d467a82b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x1ee/0x1910 drivers/tty/n_tty.c:2154 kobject: 'loop5' (000000002fea500f): kobject_uevent_env 2 locks held by getty/7011: kobject: 'loop5' (000000002fea500f): fill_kobj_path: path = '/devices/virtual/block/loop5' #0: 00000000adec61d4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x2d/0x40 drivers/tty/tty_ldsem.c:362 kobject: 'loop2' (00000000e7c8483a): kobject_uevent_env #1: 000000007591b1f4 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x1ee/0x1910 drivers/tty/n_tty.c:2154 kobject: 'loop2' (00000000e7c8483a): fill_kobj_path: path = '/devices/virtual/block/loop2' 2 locks held by getty/7013: #0: 00000000d1c84d12 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x2d/0x40 drivers/tty/tty_ldsem.c:362 kobject: 'loop4' (00000000c8f87733): kobject_uevent_env #1: 00000000547d4891 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x1ee/0x1910 drivers/tty/n_tty.c:2154 kobject: 'loop4' (00000000c8f87733): fill_kobj_path: path = '/devices/virtual/block/loop4' 2 locks held by getty/7014: kobject: 'loop1' (000000007fd0dda7): kobject_uevent_env #0: 000000008a8442e3 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x2d/0x40 drivers/tty/tty_ldsem.c:362 kobject: 'loop1' (000000007fd0dda7): fill_kobj_path: path = '/devices/virtual/block/loop1' #1: 0000000000c5e305 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x1ee/0x1910 drivers/tty/n_tty.c:2154 kobject: 'loop3' (00000000127963ff): kobject_uevent_env 2 locks held by getty/7015: kobject: 'loop3' (00000000127963ff): fill_kobj_path: path = '/devices/virtual/block/loop3' #0: 000000002a4f3a00 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x2d/0x40 drivers/tty/tty_ldsem.c:362 kobject: 'loop4' (00000000c8f87733): kobject_uevent_env #1: 00000000945c470b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x1ee/0x1910 drivers/tty/n_tty.c:2154 kobject: 'loop4' (00000000c8f87733): fill_kobj_path: path = '/devices/virtual/block/loop4' 2 locks held by getty/7016: #0: 000000004db6a048 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x2d/0x40 drivers/tty/tty_ldsem.c:362 kobject: 'loop1' (000000007fd0dda7): kobject_uevent_env #1: 0000000095b1090e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x1ee/0x1910 drivers/tty/n_tty.c:2154 kobject: 'loop1' (000000007fd0dda7): fill_kobj_path: path = '/devices/virtual/block/loop1' 2 locks held by getty/7017: kobject: 'loop3' (00000000127963ff): kobject_uevent_env #0: 00000000d93f361a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x2d/0x40 drivers/tty/tty_ldsem.c:362 kobject: 'loop3' (00000000127963ff): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (00000000c8f87733): kobject_uevent_env #1: 000000004a7e2218 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x1ee/0x1910 drivers/tty/n_tty.c:2154 kobject: 'loop4' (00000000c8f87733): fill_kobj_path: path = '/devices/virtual/block/loop4' 1 lock held by syz-executor.0/17647: kobject: 'loop1' (000000007fd0dda7): kobject_uevent_env #0: 00000000806ee86e (&rtc->ops_lock){+.+.}, at: rtc_dev_ioctl+0xe0/0x6e0 drivers/rtc/rtc-dev.c:219 kobject: 'loop1' (000000007fd0dda7): fill_kobj_path: path = '/devices/virtual/block/loop1' ============================================= kobject: 'loop3' (00000000127963ff): kobject_uevent_env NMI backtrace for cpu 0 kobject: 'loop3' (00000000127963ff): fill_kobj_path: path = '/devices/virtual/block/loop3' CPU: 0 PID: 1003 Comm: khungtaskd Not tainted 4.19.89-syzkaller #0 kobject: 'loop4' (00000000c8f87733): kobject_uevent_env Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 kobject: 'loop4' (00000000c8f87733): fill_kobj_path: path = '/devices/virtual/block/loop4' Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 nmi_cpu_backtrace.cold.4+0x3e/0x76 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xe6/0x11a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x5c3/0xb40 kernel/hung_task.c:287 kthread+0x324/0x3e0 kernel/kthread.c:246 kobject: 'loop5' (000000002fea500f): kobject_uevent_env kobject: 'loop5' (000000002fea500f): fill_kobj_path: path = '/devices/virtual/block/loop5' ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 7154 Comm: udevd Not tainted 4.19.89-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:arch_atomic_inc arch/x86/include/asm/atomic.h:97 [inline] RIP: 0010:atomic_inc include/asm-generic/atomic-instrumented.h:110 [inline] RIP: 0010:__lock_acquire+0x24a/0x4980 kernel/locking/lockdep.c:3303 Code: 31 00 00 49 8b 5c dd 08 48 85 db 0f 84 1d ff ff ff 48 8d bb 38 01 00 00 be 04 00 00 00 44 89 84 24 88 00 00 00 e8 c6 ab 45 00 ff 83 38 01 00 00 49 8d 86 78 08 00 00 44 8b 84 24 88 00 00 00 RSP: 0018:ffff88808f6af450 EFLAGS: 00000046 RAX: fffffbfff12b59d4 RBX: ffffffff895acd60 RCX: ffffffff814b71ba RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff895ace98 RBP: ffff88808f6af638 R08: fffffbfff12b59d4 R09: fffffbfff12b59d3 R10: fffffbfff12b59d3 R11: ffffffff895ace9b R12: 0000000000000001 R13: ffff88808f6af860 R14: ffff888077d021c0 R15: 0000000000000000 FS: 00007f90dc6f27a0(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000693e8d CR3: 000000008f36c000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x173/0x3d0 kernel/locking/lockdep.c:3903 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152 __wake_up_common_lock+0xba/0x180 kernel/sched/wait.c:120 __wake_up+0xe/0x10 kernel/sched/wait.c:145 __d_lookup_done+0x1a2/0x3f0 fs/dcache.c:2551 d_lookup_done include/linux/dcache.h:368 [inline] __lookup_slow+0x34b/0x400 fs/namei.c:1672 lookup_slow+0x51/0x70 fs/namei.c:1688 walk_component+0x694/0x2320 fs/namei.c:1810 lookup_last fs/namei.c:2273 [inline] path_lookupat.isra.44+0x180/0x850 fs/namei.c:2318 filename_lookup.part.58+0x160/0x360 fs/namei.c:2348 filename_lookup fs/namei.c:2341 [inline] user_path_at_empty+0x39/0x40 fs/namei.c:2608 do_readlinkat+0xcc/0x2c0 fs/stat.c:394 __do_sys_readlink fs/stat.c:427 [inline] __se_sys_readlink fs/stat.c:424 [inline] __x64_sys_readlink+0x73/0xb0 fs/stat.c:424 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f90dbdfb577 Code: f0 ff ff 77 02 f3 c3 48 8b 15 bd 38 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 90 90 b8 59 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 38 2b 00 31 d2 48 29 c2 64 RSP: 002b:00007ffe97ee62e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000059 RAX: ffffffffffffffda RBX: 00007ffe97ee6b20 RCX: 00007f90dbdfb577 RDX: 0000000000000400 RSI: 00007ffe97ee66f0 RDI: 00007ffe97ee62f0 RBP: 0000000000000200 R08: 000000000041c733 R09: 00007f90dbe505d0 R10: 7269762f73656369 R11: 0000000000000206 R12: 00000000006d6ab8 R13: 00000000006d6aac R14: 0000000000689030 R15: 00000000006c1a00