ci starts bisection 2025-09-25 19:50:06.05647047 +0000 UTC m=+172023.869478034
bisecting fixing commit since 05df91921da664ebba2752a7e45b63e3dddb85de
building syzkaller on 4f67c4aece4f5794be20c6bc99c177e44b1320e8
ensuring issue is reproducible on original commit 05df91921da664ebba2752a7e45b63e3dddb85de
testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9f58b393656886704d88f2a171753ff3bcd2358ed2da3ced96d13a743f4f9fe6
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [kasan locking atomic_sleep memleak ubsan bug_or_warning], they are not needed
testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 7c91c448424cdd66814d1a12acb01622fbf099140e7565de896ad805b4195bf0
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [locking atomic_sleep memleak ubsan bug_or_warning kasan], they are not needed
kconfig minimization: base=4093 full=8470 leaves diff=2178
split chunks (needed=false): <2178>
split chunk #0 of len 2178 into 5 parts
testing without sub-chunk 1/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e7e1b0eec3766946e1b8796d3d57abebc5772a1aa1e22b037177ca308f352ebe
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [atomic_sleep memleak ubsan bug_or_warning kasan locking], they are not needed
testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 14633e558bb1fda8526c706ecb78b614d6701d3388a9bc13d53f49bb7482427a
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [kasan locking atomic_sleep memleak ubsan bug_or_warning], they are not needed
testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 13b70478046e1c0e1cfd301f242fd5376031ea3045aef3588176e859b984b293
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 2dcf457184568a8a4924d0874144c8c0dedc3dccd2f9f945b326f5eefa17197e
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f72847b33dc67229ee7af194909ebe66ef1b895a377545609c3c4efbd34de6cc
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed
testing current HEAD 4ff71af020ae59ae2d83b174646fc2ad9fcd4dc4
testing commit 4ff71af020ae59ae2d83b174646fc2ad9fcd4dc4 gcc
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a577d0a71af40b3e03d02dcb14acfe1ae003028dfc09c6c2dd306a2e63fea041
all runs: crashed: INFO: task hung in vfs_coredump
representative crash: INFO: task hung in vfs_coredump, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 1h59m52.5845511s (build: 54m14.140908085s, test: 46m0.892098323s)
crash still not fixed or there were kernel test errors
commit msg: Merge tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
crash: INFO: task hung in vfs_coredump
INFO: task syz.3.16:2839 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.16 state:D stack:13424 pid:2839 tgid:2837 ppid:2388 task_flags:0x400740 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x5a2/0xd10 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0x25/0x110 kernel/sched/core.c:7058
schedule_timeout+0x109/0x120 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x96/0x1b0 kernel/sched/completion.c:121
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion_state+0x1c/0x40 kernel/sched/completion.c:269
coredump_wait fs/coredump.c:534 [inline]
vfs_coredump+0x2b9/0x2230 fs/coredump.c:1129
get_signal+0x849/0xa00 kernel/signal.c:3019
arch_do_signal_or_restart+0x38/0x250 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x70/0xc0 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x297/0x2f0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa6004be929
RSP: 002b:00007fa5ffd8d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 00000000000000ca RBX: 00007fa6006e6088 RCX: 00007fa6004be929
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fa6006e608c
RBP: 00007fa6006e6080 R08: 00007fa60121e000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa6006e608c
R13: 0000000000000000 R14: 00007ffe66376c50 R15: 00007ffe66376d38
Showing all locks held in the system:
2 locks held by kworker/u8:0/12:
#0: ffff888100074948 ((wq_completion)events_unbound){....}-{0:0}, at: process_one_work+0x42d/0x660 kernel/workqueue.c:3211
#1: ffffc9000006be38 ((work_completion)(&(&kfence_timer)->work)){....}-{0:0}, at: process_one_work+0x1ed/0x660 kernel/workqueue.c:3212
1 lock held by khungtaskd/31:
#0: ffffffff82981c20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff82981c20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff82981c20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x36/0x120 kernel/locking/lockdep.c:6775
2 locks held by getty/851:
#0: ffff888100a918a0 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x23/0x60 drivers/tty/tty_ldisc.c:243
#1: ffffc90001c972f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x17a/0x660 drivers/tty/n_tty.c:2222
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x5a/0x90 lib/dump_stack.c:120
nmi_cpu_backtrace+0xd4/0x110 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0xd5/0x140 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0x5f3/0x630 kernel/hung_task.c:491
kthread+0x107/0x200 kernel/kthread.c:463
ret_from_fork+0x192/0x1b0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 4201 Comm: syz.6.19 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:__preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline]
RIP: 0010:rcu_is_watching+0x2a/0x50 kernel/rcu/tree.c:752
Code: f3 0f 1e fa 53 65 ff 05 24 35 f0 01 e8 cf 2d bc 00 48 c7 c3 e8 2f 25 83 89 c0 48 03 1c c5 00 0c 56 82 8b 03 c1 e8 02 83 e0 01 <65> ff 0d ff 34 f0 01 74 06 5b c3 cc cc cc cc 0f 1f 44 00 00 5b c3
RSP: 0018:ffffc90001d2fc80 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffff888237c24fe8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff82542db3 RDI: ffffffff825127d2
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90001d2fd10
FS: 00007f97266af6c0(0000) GS:ffff8882b49d2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c005050000 CR3: 000000010a7f6000 CR4: 00000000003506f0
Call Trace:
trace_lock_acquire include/trace/events/lock.h:24 [inline]
lock_acquire+0x14c/0x180 kernel/locking/lockdep.c:5831
__mutex_lock_common kernel/locking/mutex.c:598 [inline]
__mutex_lock+0xc7/0xd10 kernel/locking/mutex.c:760
io_cqring_do_overflow_flush io_uring/io_uring.c:656 [inline]
io_cqring_wait+0x62b/0x6c0 io_uring/io_uring.c:2695
__do_sys_io_uring_enter+0x4e0/0x7a0 io_uring/io_uring.c:3502
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x6d/0x2f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9726c3e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f97266af038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 00007f9726e65fa0 RCX: 00007f9726c3e929
RDX: 000000000000235c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f9726cc0b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9726e65fa0 R15: 00007ffc5eee0e08