bisecting fixing commit since d45331b00ddb179e291766617259261c112db872 building syzkaller on 8620c2c2581732b54045bd75ae1220982fbb650f testing commit d45331b00ddb179e291766617259261c112db872 with gcc (GCC) 8.1.0 kernel signature: 18e39a1c92d13197b825c16d08979dcbfb5bed7c96c70ec4b1ff4285c3eff13b all runs: crashed: INFO: task hung in do_exit testing current HEAD 16fbf79b0f83bc752cee8589279f1ebfe57b3b6e testing commit 16fbf79b0f83bc752cee8589279f1ebfe57b3b6e with gcc (GCC) 8.1.0 kernel signature: 39578d5c3840a6839a34327d891fb80ff4b01beb8755ff3b027fe888ea72a30d all runs: crashed: INFO: task hung in do_exit revisions tested: 2, total time: 24m36.389490649s (build: 11m59.994287216s, test: 11m50.359184107s) the crash still happens on HEAD commit msg: Linux 5.6-rc7 crash: INFO: task hung in do_exit INFO: task syz-executor.3:8143 blocked for more than 143 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D27800 8143 8116 0x80004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 exit_mm kernel/exit.c:451 [inline] do_exit+0x5e9/0x2bf0 kernel/exit.c:788 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 get_signal+0x36c/0x1d40 kernel/signal.c:2739 do_signal+0x87/0x1710 arch/x86/kernel/signal.c:813 exit_to_usermode_loop+0x114/0x2e0 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x531/0x630 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45987a Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d 89 f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4e 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00 RSP: 002b:00007ffca57ec138 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 000000000045987a RDX: 0000000000000003 RSI: 0000000000021000 RDI: 0000000000000000 RBP: ffffffffffffffff R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000020022 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000021000 R14: 0000000000020022 R15: 0000000000000000 INFO: task syz-executor.3:8144 blocked for more than 144 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28720 8144 8116 0x80004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 exit_mm kernel/exit.c:451 [inline] do_exit+0x5e9/0x2bf0 kernel/exit.c:788 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 get_signal+0x36c/0x1d40 kernel/signal.c:2739 do_signal+0x87/0x1710 arch/x86/kernel/signal.c:813 exit_to_usermode_loop+0x114/0x2e0 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x531/0x630 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459829 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff662d9bcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000075bf28 RCX: 0000000000459829 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bf28 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bf2c R13: 00007ffca57ec1df R14: 00007ff662d9c9c0 R15: 000000000075bf2c INFO: task syz-executor.3:8146 blocked for more than 145 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28720 8146 8116 0x80004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 acct_collect+0xd3/0x7b0 kernel/acct.c:544 do_exit+0x507/0x2bf0 kernel/exit.c:780 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 get_signal+0x36c/0x1d40 kernel/signal.c:2739 do_signal+0x87/0x1710 arch/x86/kernel/signal.c:813 exit_to_usermode_loop+0x114/0x2e0 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x531/0x630 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459829 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff662d7acf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000075bfd0 RCX: 0000000000459829 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bfd0 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bfd4 R13: 00007ffca57ec1df R14: 00007ff662d7b9c0 R15: 000000000075bfd4 INFO: task syz-executor.3:8147 blocked for more than 147 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28680 8147 8146 0x80000000 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 acct_collect+0xd3/0x7b0 kernel/acct.c:544 do_exit+0x507/0x2bf0 kernel/exit.c:780 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 __do_sys_exit_group kernel/exit.c:910 [inline] __se_sys_exit_group kernel/exit.c:908 [inline] __x64_sys_exit_group+0x39/0x40 kernel/exit.c:908 do_syscall_64+0xca/0x630 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459829 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff662d7a688 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000000459829 RDX: 0000000000459829 RSI: 00007ff662d7a6c0 RDI: 000000000000000b RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 00007ff662d7b6d4 R13: 00000000004bfce6 R14: 00000000004d1a38 R15: 00000000ffffffff INFO: task syz-executor.4:8161 blocked for more than 148 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D27320 8161 8124 0x80004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 exit_mm kernel/exit.c:451 [inline] do_exit+0x5e9/0x2bf0 kernel/exit.c:788 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 get_signal+0x36c/0x1d40 kernel/signal.c:2739 do_signal+0x87/0x1710 arch/x86/kernel/signal.c:813 exit_to_usermode_loop+0x114/0x2e0 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x531/0x630 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45987a Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d 89 f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4e 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00 RSP: 002b:00007ffd4991c738 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 000000000045987a RDX: 0000000000000003 RSI: 0000000000021000 RDI: 0000000000000000 RBP: ffffffffffffffff R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000020022 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000021000 R14: 0000000000020022 R15: 0000000000000000 INFO: task syz-executor.4:8163 blocked for more than 149 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28024 8163 8124 0x80004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 exit_mm kernel/exit.c:451 [inline] do_exit+0x5e9/0x2bf0 kernel/exit.c:788 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 get_signal+0x36c/0x1d40 kernel/signal.c:2739 do_signal+0x87/0x1710 arch/x86/kernel/signal.c:813 exit_to_usermode_loop+0x114/0x2e0 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x531/0x630 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459829 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f113fca9cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000075bf28 RCX: 0000000000459829 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bf28 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bf2c R13: 00007ffd4991c7df R14: 00007f113fcaa9c0 R15: 000000000075bf2c INFO: task syz-executor.4:8168 blocked for more than 150 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28720 8168 8124 0x80004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 acct_collect+0xd3/0x7b0 kernel/acct.c:544 do_exit+0x507/0x2bf0 kernel/exit.c:780 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 get_signal+0x36c/0x1d40 kernel/signal.c:2739 do_signal+0x87/0x1710 arch/x86/kernel/signal.c:813 exit_to_usermode_loop+0x114/0x2e0 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x531/0x630 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459829 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f113fc88cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000075bfd0 RCX: 0000000000459829 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bfd0 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bfd4 R13: 00007ffd4991c7df R14: 00007f113fc899c0 R15: 000000000075bfd4 INFO: task syz-executor.4:8169 blocked for more than 152 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D30016 8169 8168 0x80000000 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x856/0x1900 kernel/sched/core.c:4080 schedule+0xc3/0x2b0 kernel/sched/core.c:4154 rwsem_down_read_slowpath+0x568/0xfd0 kernel/locking/rwsem.c:1102 __down_read kernel/locking/rwsem.c:1344 [inline] down_read+0x1f5/0x430 kernel/locking/rwsem.c:1497 acct_collect+0xd3/0x7b0 kernel/acct.c:544 do_exit+0x507/0x2bf0 kernel/exit.c:780 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 __do_sys_exit_group kernel/exit.c:910 [inline] __se_sys_exit_group kernel/exit.c:908 [inline] __x64_sys_exit_group+0x39/0x40 kernel/exit.c:908 do_syscall_64+0xca/0x630 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459829 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f113fc88688 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000000459829 RDX: 0000000000459829 RSI: 00007f113fc886c0 RDI: 000000000000000b RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f113fc896d4 R13: 00000000004bfce6 R14: 00000000004d1a38 R15: 00000000ffffffff INFO: task syz-executor.2:8176 blocked for more than 153 seconds. Not tainted 5.6.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D27320 8176 8120 0x80004004