ci2 starts bisection 2024-03-16 20:33:27.980314947 +0000 UTC m=+165746.103463376
bisecting fixing commit since a507f147e6f06e86b7649b46bc1d3caa34b196d6
building syzkaller on fb427a0782000106c62de76d251e5a02de5406a9
ensuring issue is reproducible on original commit a507f147e6f06e86b7649b46bc1d3caa34b196d6
testing commit a507f147e6f06e86b7649b46bc1d3caa34b196d6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: b41d7d7d7eb3f7e0f34d904989f70a130a7529ad1dda12d0d85ed8cebb1254fe
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed
testing commit a507f147e6f06e86b7649b46bc1d3caa34b196d6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 481e87d9dc44757cc4a5eabe3bc69ce5ecf659fc2ed6b2057b30e419471826c5
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
kconfig minimization: base=3820 full=7526 leaves diff=1994
split chunks (needed=false): <1994>
split chunk #0 of len 1994 into 5 parts
testing without sub-chunk 1/5
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit a507f147e6f06e86b7649b46bc1d3caa34b196d6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ea8c6fc1fae66d9c36a5897cb06a7ac5009eebbf7af0694ed16fd67c322bde26
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed
testing commit a507f147e6f06e86b7649b46bc1d3caa34b196d6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9297ea0ee42912e30b89ca533d08f0732bed4d4bfaaa01bf74f797aab083a648
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [ATOMIC_SLEEP LEAK UBSAN BUG KASAN LOCKDEP], they are not needed
testing commit a507f147e6f06e86b7649b46bc1d3caa34b196d6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: dbe342f77da43d07909b5781c968c1541665a2438acee2d69017b14dd679c615
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed
testing commit a507f147e6f06e86b7649b46bc1d3caa34b196d6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: b9f5a8d2ea93f21786d8cc446296505f9214789d3bcb03cba472481d812167b0
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG KASAN], they are not needed
testing commit a507f147e6f06e86b7649b46bc1d3caa34b196d6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ccd37a5d25e633df95981ad6d2a2452072b71ea346e8109e3c6f42ab37a7ebac
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
the chunk can be dropped
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed
testing current HEAD d7543167affd372819a94879b8b1e8b9b12547d9
testing commit d7543167affd372819a94879b8b1e8b9b12547d9 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: d1d9c4b3da2fb2f4767c4bad1c78bf106b095169692271481aa4f40188f0a9fa
all runs: crashed: INFO: task hung in ext4_quota_write
representative crash: INFO: task hung in ext4_quota_write, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 1h39m42.912782942s (build: 39m44.059427217s, test: 57m0.8259995s)
crash still not fixed or there were kernel test errors
commit msg: Linux 6.1.82
crash: INFO: task hung in ext4_quota_write
INFO: task syz-executor.0:1506 blocked for more than 143 seconds.
Not tainted 6.1.82-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0 state:D stack:11768 pid:1506 ppid:1052 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0x57f/0x850 kernel/sched/core.c:6558
schedule+0x50/0xb0 kernel/sched/core.c:6634
io_schedule+0x3a/0x50 kernel/sched/core.c:8786
bit_wait_io+0x8/0x50 kernel/sched/wait_bit.c:209
__wait_on_bit_lock+0xb6/0x1b0 kernel/sched/wait_bit.c:90
out_of_line_wait_on_bit_lock+0x95/0xb0 kernel/sched/wait_bit.c:117
lock_buffer include/linux/buffer_head.h:397 [inline]
ext4_quota_write+0x176/0x210 fs/ext4/super.c:7150
qtree_write_dquot+0x97/0x180 fs/quota/quota_tree.c:431
v2_write_dquot+0x53/0x80 fs/quota/quota_v2.c:358
dquot_commit+0xce/0x110 fs/quota/dquot.c:512
ext4_write_dquot fs/ext4/super.c:6753 [inline]
ext4_mark_dquot_dirty+0xac/0xe0 fs/ext4/super.c:6801
mark_dquot_dirty fs/quota/dquot.c:372 [inline]
mark_all_dquot_dirty fs/quota/dquot.c:410 [inline]
dquot_alloc_inode+0x2d9/0x320 fs/quota/dquot.c:1838
ext4_xattr_inode_alloc_quota fs/ext4/xattr.c:883 [inline]
ext4_xattr_set_entry+0x22a/0x11b0 fs/ext4/xattr.c:1665
ext4_xattr_block_set+0x204/0xd30 fs/ext4/xattr.c:1920
ext4_xattr_set_handle+0x48c/0x690 fs/ext4/xattr.c:2406
ext4_xattr_set+0xe3/0x170 fs/ext4/xattr.c:2508
__vfs_setxattr+0x105/0x130 fs/xattr.c:182
__vfs_setxattr_noperm+0x8e/0x1f0 fs/xattr.c:216
vfs_setxattr+0xde/0x170 fs/xattr.c:309
do_setxattr fs/xattr.c:594 [inline]
setxattr+0x131/0x170 fs/xattr.c:617
path_setxattr+0xab/0x120 fs/xattr.c:636
__do_sys_setxattr fs/xattr.c:652 [inline]
__se_sys_setxattr fs/xattr.c:648 [inline]
__x64_sys_setxattr+0x22/0x30 fs/xattr.c:648
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f3802dfcce9
RSP: 002b:00007f380297f0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f3802f1bf80 RCX: 00007f3802dfcce9
RDX: 0000000020000380 RSI: 0000000020000340 RDI: 00000000200002c0
RBP: 00007f3802e4947a R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000ffed R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000006 R14: 00007f3802f1bf80 R15: 00007ffcdf5e5a88
Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff82772a88 (rcu_tasks.tasks_gp_mutex){....}-{3:3}, at: rcu_tasks_one_gp kernel/rcu/tasks.h:516 [inline]
#0: ffffffff82772a88 (rcu_tasks.tasks_gp_mutex){....}-{3:3}, at: rcu_tasks_kthread+0x98/0x450 kernel/rcu/tasks.h:561
1 lock held by khungtaskd/27:
#0: ffffffff82772960 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:319 [inline]
#0: ffffffff82772960 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:760 [inline]
#0: ffffffff82772960 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x2c/0x100 kernel/locking/lockdep.c:6494
2 locks held by getty/423:
#0: ffff888108e6c898 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x1c/0x40 drivers/tty/tty_ldisc.c:244
#1: ffffc900012d32f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x20a/0x8e0 drivers/tty/n_tty.c:2188
6 locks held by syz-executor.0/1506:
#0: ffff88810926d438 (sb_writers#4){....}-{0:0}, at: path_setxattr+0x7f/0x120 fs/xattr.c:634
#1: ffff88811431a068 (&type->i_mutex_dir_key#3){....}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
#1: ffff88811431a068 (&type->i_mutex_dir_key#3){....}-{3:3}, at: vfs_setxattr+0xbd/0x170 fs/xattr.c:308
#2: ffff888114319d30 (&ei->xattr_sem){....}-{3:3}, at: ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
#2: ffff888114319d30 (&ei->xattr_sem){....}-{3:3}, at: ext4_xattr_set_handle+0x118/0x690 fs/ext4/xattr.c:2321
#3: ffffffff827ac240 (dquot_srcu){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:319 [inline]
#3: ffffffff827ac240 (dquot_srcu){....}-{0:0}, at: srcu_read_lock include/linux/srcu.h:165 [inline]
#3: ffffffff827ac240 (dquot_srcu){....}-{0:0}, at: dquot_alloc_inode+0xc6/0x320 fs/quota/dquot.c:1816
#4: ffff8881142d60a8 (&dquot->dq_lock){....}-{3:3}, at: dquot_commit+0x25/0x110 fs/quota/dquot.c:505
#5: ffff88810926d1e0 (&s->s_dquot.dqio_sem){....}-{3:3}, at: v2_write_dquot+0x2a/0x80 fs/quota/quota_v2.c:356
2 locks held by syz-executor.0/6139:
#0: ffff888237c2b218 (&rq->__lock){....}-{2:2}, at: raw_spin_rq_lock_nested+0x1b/0x50 kernel/sched/core.c:537
#1: ffffffff82772960 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:319 [inline]
#1: ffffffff82772960 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:760 [inline]
#1: ffffffff82772960 (rcu_read_lock){....}-{1:2}, at: __update_idle_core+0x18/0xe0 kernel/sched/fair.c:6628
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 6.1.82-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x7f/0xc2 lib/dump_stack.c:106
nmi_cpu_backtrace+0x13e/0x160 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x9c/0x150 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0x54d/0x570 kernel/hung_task.c:377
kthread+0xd1/0xe0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1512 Comm: syz-executor.0 Not tainted 6.1.82-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:string_nocheck lib/vsprintf.c:643 [inline]
RIP: 0010:string+0xa0/0xf0 lib/vsprintf.c:725
Code: 4c 8d 14 07 41 0f b6 0c 01 84 c9 74 40 49 39 d2 73 e7 41 88 0a eb e2 85 f6 74 3f 31 c0 eb 07 48 ff c0 39 c6 74 3b 4c 8d 0c 07 <45> 0f b6 14 00 45 84 d2 74 35 49 39 d1 73 e6 45 88 11 eb e1 49 89
RSP: 0018:ffffc900014f3a48 EFLAGS: 00000286
RAX: 000000000000002d RBX: 000000000000000d RCX: ffff0a00ffffff04
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 000000000000000d
RBP: ffffffff8231693b R08: ffff888104fba600 R09: 000000000000003a
R10: 0000000000000061 R11: 0000001000000000 R12: 0000000000000000
R13: 0000000000000002 R14: ffffffff8231693d R15: ffffc900014f3b60
FS: 0000555556d49480(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc174a50fc CR3: 0000000102b41000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
vsnprintf+0x367/0x560 lib/vsprintf.c:2805
tomoyo_supervisor+0xf8/0x730 security/tomoyo/common.c:2060
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_perm+0x264/0x2f0 security/tomoyo/file.c:838
security_inode_getattr+0x2e/0x40 security/security.c:1361
vfs_getattr fs/stat.c:158 [inline]
vfs_statx+0xaf/0x1f0 fs/stat.c:233
vfs_fstatat fs/stat.c:267 [inline]
__do_sys_newfstatat fs/stat.c:437 [inline]
__se_sys_newfstatat+0x7f/0x2d0 fs/stat.c:431
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc1845a378a
Code: 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 0b 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 90 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b0 ff ff ff f7
RSP: 002b:00007ffc174a5028 EFLAGS: 00000206 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc1845a378a
RDX: 00007ffc174a5030 RSI: 00007fc18462af47 RDI: 0000000000000003
RBP: 00007ffc174a5030 R08: 00007ffc175700b0 R09: 0000000000000010
R10: 0000000000001000 R11: 0000000000000206 R12: 00007ffc174a6260
R13: 00007fc1845f03b9 R14: 0000000000032fd0 R15: 0000000000000004