bisecting fixing commit since cbfa1702aaf69b2311ea1b35e04f113c48368c67 building syzkaller on 1b88c6d5c8477f1d4fb3b389443b200acc32e9a8 testing commit cbfa1702aaf69b2311ea1b35e04f113c48368c67 with gcc (GCC) 8.1.0 kernel signature: aec9831e3e0027cd2fe9b032a5d4728db45f6508785364aa4a69ebeb561c7ded all runs: crashed: INFO: task hung in __sync_dirty_buffer testing current HEAD 5b7a52cd2eef952cee8a72512ef370bcdef46636 testing commit 5b7a52cd2eef952cee8a72512ef370bcdef46636 with gcc (GCC) 8.1.0 kernel signature: 868011048506b0e6b8a21935062a84d146c337b6e58f3b1a704c42bb90c2f759 all runs: crashed: INFO: task hung in __sync_dirty_buffer revisions tested: 2, total time: 30m31.241699068s (build: 16m12.387408459s, test: 13m46.093895843s) the crash still happens on HEAD commit msg: Linux 4.14.202 crash: INFO: task hung in __sync_dirty_buffer Bluetooth: hci5 command 0x0406 tx timeout Bluetooth: hci0 command 0x0406 tx timeout Bluetooth: hci2 command 0x0406 tx timeout random: crng init done random: 7 urandom warning(s) missed due to ratelimiting INFO: task syz-executor.1:7973 blocked for more than 140 seconds. Not tainted 4.14.202-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D25520 7973 6498 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit_lock+0xcb/0x1c0 kernel/sched/wait_bit.c:89 out_of_line_wait_on_bit_lock+0xbd/0xe0 kernel/sched/wait_bit.c:116 wait_on_bit_lock_io include/linux/wait_bit.h:213 [inline] __lock_buffer+0x3c/0x40 fs/buffer.c:72 lock_buffer include/linux/buffer_head.h:374 [inline] __sync_dirty_buffer+0x16f/0x1d0 fs/buffer.c:3251 sync_dirty_buffer+0xe/0x10 fs/buffer.c:3277 __ext4_handle_dirty_metadata+0x134/0x4c0 fs/ext4/ext4_jbd2.c:300 ext4_convert_inline_data_nolock+0x4b7/0xb70 fs/ext4/inline.c:1246 ext4_convert_inline_data+0x296/0x3ab fs/ext4/inline.c:2000 ext4_fallocate+0xdd/0x1a00 fs/ext4/extents.c:4968 vfs_fallocate+0x2ba/0x770 fs/open.c:319 SYSC_fallocate fs/open.c:342 [inline] SyS_fallocate+0x3f/0x60 fs/open.c:336 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dd99 RSP: 002b:00007f2cee8a2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 0000000000002ec0 RCX: 000000000045dd99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ffe0 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffc8508eeef R14: 00007f2cee8a39c0 R15: 000000000118bf2c INFO: task syz-executor.5:7975 blocked for more than 140 seconds. Not tainted 4.14.202-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D26456 7975 6505 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit_lock+0xcb/0x1c0 kernel/sched/wait_bit.c:89 out_of_line_wait_on_bit_lock+0xbd/0xe0 kernel/sched/wait_bit.c:116 wait_on_bit_lock_io include/linux/wait_bit.h:213 [inline] __lock_buffer+0x3c/0x40 fs/buffer.c:72 lock_buffer include/linux/buffer_head.h:374 [inline] __sync_dirty_buffer+0x16f/0x1d0 fs/buffer.c:3251 sync_dirty_buffer+0xe/0x10 fs/buffer.c:3277 __ext4_handle_dirty_metadata+0x134/0x4c0 fs/ext4/ext4_jbd2.c:300 ext4_convert_inline_data_nolock+0x4b7/0xb70 fs/ext4/inline.c:1246 ext4_convert_inline_data+0x296/0x3ab fs/ext4/inline.c:2000 ext4_fallocate+0xdd/0x1a00 fs/ext4/extents.c:4968 vfs_fallocate+0x2ba/0x770 fs/open.c:319 SYSC_fallocate fs/open.c:342 [inline] SyS_fallocate+0x3f/0x60 fs/open.c:336 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dd99 RSP: 002b:00007fe4e1986c78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 0000000000002ec0 RCX: 000000000045dd99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ffe0 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffef20799bf R14: 00007fe4e19879c0 R15: 000000000118bf2c INFO: task syz-executor.0:7992 blocked for more than 140 seconds. Not tainted 4.14.202-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D26456 7992 6506 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit_lock+0xcb/0x1c0 kernel/sched/wait_bit.c:89 out_of_line_wait_on_bit_lock+0xbd/0xe0 kernel/sched/wait_bit.c:116 wait_on_bit_lock_io include/linux/wait_bit.h:213 [inline] __lock_buffer+0x3c/0x40 fs/buffer.c:72 lock_buffer include/linux/buffer_head.h:374 [inline] __sync_dirty_buffer+0x16f/0x1d0 fs/buffer.c:3251 sync_dirty_buffer+0xe/0x10 fs/buffer.c:3277 __ext4_handle_dirty_metadata+0x134/0x4c0 fs/ext4/ext4_jbd2.c:300 ext4_convert_inline_data_nolock+0x4b7/0xb70 fs/ext4/inline.c:1246 ext4_convert_inline_data+0x296/0x3ab fs/ext4/inline.c:2000 ext4_fallocate+0xdd/0x1a00 fs/ext4/extents.c:4968 vfs_fallocate+0x2ba/0x770 fs/open.c:319 SYSC_fallocate fs/open.c:342 [inline] SyS_fallocate+0x3f/0x60 fs/open.c:336 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dd99 RSP: 002b:00007fa02d794c78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 0000000000002ec0 RCX: 000000000045dd99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ffe0 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffc04dbe7ff R14: 00007fa02d7959c0 R15: 000000000118bf2c INFO: task syz-executor.3:8038 blocked for more than 140 seconds. Not tainted 4.14.202-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D26456 8038 6500 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit_lock+0xcb/0x1c0 kernel/sched/wait_bit.c:89 out_of_line_wait_on_bit_lock+0xbd/0xe0 kernel/sched/wait_bit.c:116 wait_on_bit_lock_io include/linux/wait_bit.h:213 [inline] __lock_buffer+0x3c/0x40 fs/buffer.c:72 lock_buffer include/linux/buffer_head.h:374 [inline] __sync_dirty_buffer+0x16f/0x1d0 fs/buffer.c:3251 sync_dirty_buffer+0xe/0x10 fs/buffer.c:3277 __ext4_handle_dirty_metadata+0x134/0x4c0 fs/ext4/ext4_jbd2.c:300 ext4_convert_inline_data_nolock+0x4b7/0xb70 fs/ext4/inline.c:1246 ext4_convert_inline_data+0x296/0x3ab fs/ext4/inline.c:2000 ext4_fallocate+0xdd/0x1a00 fs/ext4/extents.c:4968 vfs_fallocate+0x2ba/0x770 fs/open.c:319 SYSC_fallocate fs/open.c:342 [inline] SyS_fallocate+0x3f/0x60 fs/open.c:336 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dd99 RSP: 002b:00007f2dab9dec78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 0000000000002ec0 RCX: 000000000045dd99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ffe0 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffe118ed50f R14: 00007f2dab9df9c0 R15: 000000000118bf2c INFO: task syz-executor.4:8056 blocked for more than 140 seconds. Not tainted 4.14.202-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D26456 8056 6504 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit_lock+0xcb/0x1c0 kernel/sched/wait_bit.c:89 out_of_line_wait_on_bit_lock+0xbd/0xe0 kernel/sched/wait_bit.c:116 wait_on_bit_lock_io include/linux/wait_bit.h:213 [inline] __lock_buffer+0x3c/0x40 fs/buffer.c:72 lock_buffer include/linux/buffer_head.h:374 [inline] __sync_dirty_buffer+0x16f/0x1d0 fs/buffer.c:3251 sync_dirty_buffer+0xe/0x10 fs/buffer.c:3277 __ext4_handle_dirty_metadata+0x134/0x4c0 fs/ext4/ext4_jbd2.c:300 ext4_convert_inline_data_nolock+0x4b7/0xb70 fs/ext4/inline.c:1246 ext4_convert_inline_data+0x296/0x3ab fs/ext4/inline.c:2000 ext4_fallocate+0xdd/0x1a00 fs/ext4/extents.c:4968 vfs_fallocate+0x2ba/0x770 fs/open.c:319 SYSC_fallocate fs/open.c:342 [inline] SyS_fallocate+0x3f/0x60 fs/open.c:336 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dd99 RSP: 002b:00007fe3406dac78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 0000000000002ec0 RCX: 000000000045dd99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ffe0 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffc03842c1f R14: 00007fe3406db9c0 R15: 000000000118bf2c INFO: task syz-executor.2:8082 blocked for more than 140 seconds. Not tainted 4.14.202-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D26456 8082 6502 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit_lock+0xcb/0x1c0 kernel/sched/wait_bit.c:89 out_of_line_wait_on_bit_lock+0xbd/0xe0 kernel/sched/wait_bit.c:116 wait_on_bit_lock_io include/linux/wait_bit.h:213 [inline] __lock_buffer+0x3c/0x40 fs/buffer.c:72 lock_buffer include/linux/buffer_head.h:374 [inline] __sync_dirty_buffer+0x16f/0x1d0 fs/buffer.c:3251 sync_dirty_buffer+0xe/0x10 fs/buffer.c:3277 __ext4_handle_dirty_metadata+0x134/0x4c0 fs/ext4/ext4_jbd2.c:300 ext4_convert_inline_data_nolock+0x4b7/0xb70 fs/ext4/inline.c:1246 ext4_convert_inline_data+0x296/0x3ab fs/ext4/inline.c:2000 ext4_fallocate+0xdd/0x1a00 fs/ext4/extents.c:4968 vfs_fallocate+0x2ba/0x770 fs/open.c:319 SYSC_fallocate fs/open.c:342 [inline] SyS_fallocate+0x3f/0x60 fs/open.c:336 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dd99 RSP: 002b:00007f715f831c78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 0000000000002ec0 RCX: 000000000045dd99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ffe0 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffd947e5a7f R14: 00007f715f8329c0 R15: 000000000118bf2c Showing all locks held in the system: 1 lock held by khungtaskd/1066: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4548 1 lock held by in:imklog/6007: #0: (&f->f_pos_lock){+.+.}, at: [] __fdget_pos+0x8e/0xc0 fs/file.c:769 2 locks held by syz-executor.1/7973: #0: (sb_writers#3){.+.+}, at: [] file_start_write include/linux/fs.h:2712 [inline] #0: (sb_writers#3){.+.+}, at: [] vfs_fallocate+0x42c/0x770 fs/open.c:318 #1: (&ei->xattr_sem){++++}, at: [] ext4_write_lock_xattr fs/ext4/xattr.h:141 [inline] #1: (&ei->xattr_sem){++++}, at: [] ext4_convert_inline_data+0x1d3/0x3ab fs/ext4/inline.c:1998 2 locks held by syz-executor.5/7975: #0: (sb_writers#3){.+.+}, at: [] file_start_write include/linux/fs.h:2712 [inline] #0: (sb_writers#3){.+.+}, at: [] vfs_fallocate+0x42c/0x770 fs/open.c:318 #1: (&ei->xattr_sem){++++}, at: [] ext4_write_lock_xattr fs/ext4/xattr.h:141 [inline] #1: (&ei->xattr_sem){++++}, at: [] ext4_convert_inline_data+0x1d3/0x3ab fs/ext4/inline.c:1998 2 locks held by syz-executor.0/7992: #0: (sb_writers#3){.+.+}, at: [] file_start_write include/linux/fs.h:2712 [inline] #0: (sb_writers#3){.+.+}, at: [] vfs_fallocate+0x42c/0x770 fs/open.c:318 #1: (&ei->xattr_sem){++++}, at: [] ext4_write_lock_xattr fs/ext4/xattr.h:141 [inline] #1: (&ei->xattr_sem){++++}, at: [] ext4_convert_inline_data+0x1d3/0x3ab fs/ext4/inline.c:1998 2 locks held by syz-executor.3/8038: #0: (sb_writers#3){.+.+}, at: [] file_start_write include/linux/fs.h:2712 [inline] #0: (sb_writers#3){.+.+}, at: [] vfs_fallocate+0x42c/0x770 fs/open.c:318 #1: (&ei->xattr_sem){++++}, at: [] ext4_write_lock_xattr fs/ext4/xattr.h:141 [inline] #1: (&ei->xattr_sem){++++}, at: [] ext4_convert_inline_data+0x1d3/0x3ab fs/ext4/inline.c:1998 2 locks held by syz-executor.4/8056: #0: (sb_writers#3){.+.+}, at: [] file_start_write include/linux/fs.h:2712 [inline] #0: (sb_writers#3){.+.+}, at: [] vfs_fallocate+0x42c/0x770 fs/open.c:318 #1: (&ei->xattr_sem){++++}, at: [] ext4_write_lock_xattr fs/ext4/xattr.h:141 [inline] #1: (&ei->xattr_sem){++++}, at: [] ext4_convert_inline_data+0x1d3/0x3ab fs/ext4/inline.c:1998 2 locks held by syz-executor.2/8082: #0: (sb_writers#3){.+.+}, at: [] file_start_write include/linux/fs.h:2712 [inline] #0: (sb_writers#3){.+.+}, at: [] vfs_fallocate+0x42c/0x770 fs/open.c:318 #1: (&ei->xattr_sem){++++}, at: [] ext4_write_lock_xattr fs/ext4/xattr.h:141 [inline] #1: (&ei->xattr_sem){++++}, at: [] ext4_convert_inline_data+0x1d3/0x3ab fs/ext4/inline.c:1998 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1066 Comm: khungtaskd Not tainted 4.14.202-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1f1 lib/dump_stack.c:58 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf5/0x119 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x51b/0xa70 kernel/hung_task.c:274 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 skipped: idling at pc 0xffffffff866af9d2