ci2 starts bisection 2025-10-25 22:20:54.480970313 +0000 UTC m=+275313.298348294
bisecting fixing commit since 60a9e718726fa7019ae00916e4b1c52498da5b60
building syzkaller on e2beed91937c0ace342f19a2e9afb67adb3a828a
ensuring issue is reproducible on original commit 60a9e718726fa7019ae00916e4b1c52498da5b60
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: cfaa4ed6210b2bbabff62f3f8d8e74ac0c3c3a870802a3b3720c16b3edffabac
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 13a527087f997d9bff22dc2b746e28a60bff6d1551aa0415fc7fcbbcc745fd8e
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
kconfig minimization: base=3913 full=7800 leaves diff=2160
split chunks (needed=false): <2160>
split chunk #0 of len 2160 into 5 parts
testing without sub-chunk 1/5
disabling configs for [bug_or_warning kasan locking atomic_sleep memleak ubsan], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 72a693fb75d2b2b1aec4ebc1a15a16425b74b9207d2e3fadcbaaebcf5d725569
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [kasan locking atomic_sleep memleak ubsan bug_or_warning], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 845fe2bbed96de4ff799b3de0e82545dab71e61ef3e2d189784ad0e7136b09fe
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 957afc007db9a137875e23175d3e6f9b20e43be714ea6f09b225f5c9c172d0bd
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: bc0fce8bdc8852cce413d39363e7a2d00d15fd272a050744a8db9123fcabcd59
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [kasan locking atomic_sleep memleak ubsan bug_or_warning], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 1666af038ff156afb745e83c3ab558e8c6deb55f1c6511227007a87c15e30a94
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed
testing current HEAD 4a243110dc884d8e1fe69eecbc2daef10d8e75d7
testing commit 4a243110dc884d8e1fe69eecbc2daef10d8e75d7 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 5ed044a623997d7e71cc9be6c12a2216e59a7a425d319e35060b04c167142773
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 2h2m8.009263438s (build: 1h3m2.953644908s, test: 54m24.75716929s)
crash still not fixed or there were kernel test errors
commit msg: Linux 6.6.114
crash: INFO: task hung in do_coredump
INFO: task syz.3.17:2923 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:13360 pid:2923 ppid:2469 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x696/0x950 kernel/sched/core.c:6699
schedule+0x54/0xc0 kernel/sched/core.c:6773
schedule_timeout+0x2d/0x190 kernel/time/timer.c:2143
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common+0xf8/0x1b0 kernel/sched/completion.c:127
wait_for_completion_state+0x15/0x30 kernel/sched/completion.c:264
coredump_wait fs/coredump.c:443 [inline]
do_coredump+0x387/0xe80 fs/coredump.c:640
get_signal+0x63e/0x7a0 kernel/signal.c:2888
arch_do_signal_or_restart+0x89/0x260 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x6b/0xd0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x9c/0xe0 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:315
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f0a81eef927
RSP: 002b:00007fffa3be22a0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 000000000000000b RCX: 000000000000f230
RDX: 00007fffa3be22c0 RSI: 00007fffa3be23f0 RDI: 000000000000000b
RBP: 00007f0a82277da0 R08: 000000000000003e R09: 0000000000745d1e
R10: 00000020b89eebec R11: 00000000000011be R12: 000000000000f855
R13: 00007f0a82276090 R14: ffffffffffffffff R15: 00007fffa3ce0520
INFO: task syz.3.17:2925 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:13344 pid:2925 ppid:2469 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x696/0x950 kernel/sched/core.c:6699
schedule+0x54/0xc0 kernel/sched/core.c:6773
coredump_task_exit kernel/exit.c:436 [inline]
do_exit+0x10b/0xa00 kernel/exit.c:825
do_group_exit+0x87/0xa0 kernel/exit.c:1024
get_signal+0x6f1/0x7a0 kernel/signal.c:2902
arch_do_signal_or_restart+0x89/0x260 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x6b/0xd0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x9c/0xe0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x40 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0a8202eba9
RSP: 002b:00007f0a81e7e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f0a82276098 RCX: 00007f0a8202eba9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0a82276098
RBP: 00007f0a82276090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0a82276128 R14: 00007fffa3ce01c0 R15: 00007fffa3ce02a8
Showing all locks held in the system:
1 lock held by khungtaskd/28:
#0: ffffffff82572448 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff82572448 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff82572448 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x2e/0x100 kernel/locking/lockdep.c:6633
2 locks held by getty/848:
#0: ffff8881012798a0 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x20/0x40 drivers/tty/tty_ldisc.c:243
#1: ffffc900001fb2f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x1a8/0x6d0 drivers/tty/n_tty.c:2217
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
dump_stack_lvl+0x78/0xc0 lib/dump_stack.c:106
nmi_cpu_backtrace+0x106/0x160 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x8e/0x130 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0x5dc/0x600 kernel/hung_task.c:379
kthread+0xe3/0x100 kernel/kthread.c:388
ret_from_fork+0x2f/0x40 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:148
Code: cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 51 bd 26 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 66 0f 1f 00 50 8b 37 83 e6
RSP: 0018:ffffc9000009bee0 EFLAGS: 000002c6
RAX: 37ca8414014f1800 RBX: 0000000000000001 RCX: 37ca8414014f1800
RDX: 3eb26d79c4509b53 RSI: ffffffff820f7c8e RDI: ffffffff821a34b9
RBP: ffffc9000009bef8 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888102271b40 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556c49f4a8 CR3: 0000000108af8000 CR4: 00000000003506e0
Call Trace:
arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:753
default_idle_call+0x35/0x50 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:170 [inline]
do_idle+0xda/0x250 kernel/sched/idle.c:282
cpu_startup_entry+0x24/0x30 kernel/sched/idle.c:380
start_secondary+0x82/0x90 arch/x86/kernel/smpboot.c:323
secondary_startup_64_no_verify+0x167/0x16b