ci2 starts bisection 2025-12-28 23:47:50.961218372 +0000 UTC m=+2801883.138341419
bisecting fixing commit since 60a9e718726fa7019ae00916e4b1c52498da5b60
building syzkaller on e2beed91937c0ace342f19a2e9afb67adb3a828a
ensuring issue is reproducible on original commit 60a9e718726fa7019ae00916e4b1c52498da5b60
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 6c9ceb56987ba35d29693df79222b3faec2fc045fc58e10ef39d0e921f56922f
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 492ed8b3e2d4afbf7695a91700abd26b73ffe4403d33306faa85460fbc49bcf4
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed
kconfig minimization: base=3913 full=7800 leaves diff=2160
split chunks (needed=false): <2160>
split chunk #0 of len 2160 into 5 parts
testing without sub-chunk 1/5
disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: a2506dcce3b946f88cb1d16a2d58b1cf1516296f4c5b666e1a5bd09a259fb9ac
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 7e46302abfcccef9ce50185d830d57d0aa93192c8db00ece938edae555ce216d
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 1ecb8122b6a4f5e6518a52412b5e35d653fb3ab92cfe24a2eb3d7505a83b7c07
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 80dfbfad513cc3cba5b7e17f7ad071e4bb054c8d235d94651aa4e24d6005e1ae
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 60a9e718726fa7019ae00916e4b1c52498da5b60 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 030902f084527ad94f4900c854033b9fe15acab68ef6b78928160cb1382c30aa
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
the chunk can be dropped
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing current HEAD 5fa4793a2d2d70ad08b85387b41020f1fcc2d19e
testing commit 5fa4793a2d2d70ad08b85387b41020f1fcc2d19e gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: ea9336e650695f0ee04fe96c5e713508c0dc011465f9eed004cd85fd8f427636
all runs: crashed: INFO: task hung in do_coredump
representative crash: INFO: task hung in do_coredump, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 1h37m14.676874143s (build: 33m31.547624547s, test: 59m55.237957717s)
crash still not fixed or there were kernel test errors
commit msg: Linux 6.6.119
crash: INFO: task hung in do_coredump
INFO: task syz.3.17:2908 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:13360 pid:2908 ppid:2454 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x696/0x950 kernel/sched/core.c:6699
schedule+0x54/0xc0 kernel/sched/core.c:6773
schedule_timeout+0x2d/0x190 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common+0xf8/0x1b0 kernel/sched/completion.c:127
wait_for_completion_state+0x15/0x30 kernel/sched/completion.c:264
coredump_wait fs/coredump.c:443 [inline]
do_coredump+0x387/0xe80 fs/coredump.c:640
get_signal+0x63e/0x7a0 kernel/signal.c:2888
arch_do_signal_or_restart+0x89/0x260 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x6b/0xd0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x9c/0xe0 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:315
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f5db0e5f927
RSP: 002b:00007ffc264d83a0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 000000000000000b RCX: 000000000000e678
RDX: 00007ffc264d83c0 RSI: 00007ffc264d84f0 RDI: 000000000000000b
RBP: 00007f5db11e7da0 R08: 000000000000003b R09: 0000000000745a0f
R10: 0000001ef390ab16 R11: 00000000000010fc R12: 000000000000ea66
R13: 00007f5db11e6090 R14: ffffffffffffffff R15: 00007ffc265d5ab0
INFO: task syz.3.17:2910 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:13344 pid:2910 ppid:2454 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x696/0x950 kernel/sched/core.c:6699
schedule+0x54/0xc0 kernel/sched/core.c:6773
coredump_task_exit kernel/exit.c:436 [inline]
do_exit+0x10b/0xa00 kernel/exit.c:825
do_group_exit+0x87/0xa0 kernel/exit.c:1024
get_signal+0x6f1/0x7a0 kernel/signal.c:2902
arch_do_signal_or_restart+0x89/0x260 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x6b/0xd0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x9c/0xe0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x40 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5db0f9eba9
RSP: 002b:00007f5db0dee0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f5db11e6098 RCX: 00007f5db0f9eba9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5db11e6098
RBP: 00007f5db11e6090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5db11e6128 R14: 00007ffc265d5750 R15: 00007ffc265d5838
Showing all locks held in the system:
1 lock held by khungtaskd/28:
#0: ffffffff82572448 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff82572448 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff82572448 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x2e/0x100 kernel/locking/lockdep.c:6633
2 locks held by getty/835:
#0: ffff88810127f0a0 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x20/0x40 drivers/tty/tty_ldisc.c:243
#1: ffffc90001c532f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x1a8/0x6d0 drivers/tty/n_tty.c:2217
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x78/0xc0 lib/dump_stack.c:106
nmi_cpu_backtrace+0x106/0x160 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x8e/0x130 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0x5dc/0x600 kernel/hung_task.c:379
kthread+0xe3/0x100 kernel/kthread.c:388
ret_from_fork+0x2f/0x40 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:148
Code: cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 51 ad 26 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 66 0f 1f 00 50 8b 37 83 e6
RSP: 0018:ffffffff82403e90 EFLAGS: 000002c6
RAX: 736d680a1213b100 RBX: 0000000000000000 RCX: 736d680a1213b100
RDX: 0000000000d1bc0e RSI: ffffffff820f7f87 RDI: ffffffff821a3854
RBP: ffffffff82403ea8 R08: 0000000000000000 R09: 000000000000004e
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff824218c0 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f206334df98 CR3: 000000010c2de000 CR4: 00000000003506f0
Call Trace:
arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:753
default_idle_call+0x35/0x50 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:170 [inline]
do_idle+0xda/0x250 kernel/sched/idle.c:282
cpu_startup_entry+0x24/0x30 kernel/sched/idle.c:380
rest_init+0xce/0xd0 init/main.c:744
arch_call_rest_init+0x9/0x10 init/main.c:841
start_kernel+0x2dd/0x2f0 init/main.c:1086
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:555
x86_64_start_kernel+0x5b/0x60 arch/x86/kernel/head64.c:536
secondary_startup_64_no_verify+0x167/0x16b