bisecting fixing commit since 5b7a52cd2eef952cee8a72512ef370bcdef46636 building syzkaller on a1839e81524f4e427a4b57bca0e4633d459d3d18 testing commit 5b7a52cd2eef952cee8a72512ef370bcdef46636 with gcc (GCC) 8.1.0 kernel signature: b5b295956d0999e4b6269562f2546603428cfec5e68fe85012c30497eb2bd065 run #0: crashed: INFO: task hung in blk_mq_make_request run #1: crashed: INFO: task hung in blk_mq_make_request run #2: crashed: INFO: task hung in blk_mq_make_request run #3: crashed: INFO: task hung in virtscsi_tmf run #4: crashed: INFO: task hung in blk_mq_make_request run #5: crashed: INFO: task hung in virtscsi_tmf run #6: crashed: INFO: task hung in ext4_find_entry run #7: crashed: INFO: task hung in ext4_find_entry run #8: crashed: INFO: task hung in ext4_find_entry run #9: crashed: INFO: task hung in ext4_find_entry testing current HEAD 0df445b0f0daa57b57571edb1386edc622938276 testing commit 0df445b0f0daa57b57571edb1386edc622938276 with gcc (GCC) 8.1.0 kernel signature: f1223d7891ad67caa8dface8b492e7afd4638230d3844f951b84cd6bba69b19d run #0: basic kernel testing failed: BUG: sleeping function called from invalid context in sta_info_move_state run #1: crashed: BUG: sleeping function called from invalid context in sta_info_move_state run #2: crashed: BUG: sleeping function called from invalid context in sta_info_move_state run #3: crashed: INFO: task hung in blk_mq_make_request run #4: crashed: INFO: task hung in virtscsi_tmf run #5: crashed: INFO: task hung in virtscsi_tmf run #6: crashed: INFO: task hung in virtscsi_tmf run #7: crashed: INFO: task hung in ext4_find_entry run #8: crashed: INFO: task hung in ext4_find_entry run #9: OK revisions tested: 2, total time: 36m32.150062096s (build: 16m3.698363525s, test: 19m35.823286979s) the crash still happens on HEAD commit msg: Linux 4.14.208 crash: INFO: task hung in ext4_find_entry sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset sd 0:0:1:0: device reset INFO: task syz-executor.3:8367 blocked for more than 140 seconds. Not tainted 4.14.208-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D24616 8367 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xf80 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007fffccfd8138 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007fffccfd8150 RSI: 00007fffccfd8150 RDI: 00007fffccfd81e0 RBP: 000000000000112c R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007fffccfd9270 R13: 00000000022aca60 R14: 0000000000000000 R15: 00007fffccfd9270 INFO: task syz-executor.5:8370 blocked for more than 140 seconds. Not tainted 4.14.208-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D24616 8370 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xf80 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007ffdc1482f88 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007ffdc1482fa0 RSI: 00007ffdc1482fa0 RDI: 00007ffdc1483030 RBP: 0000000000001136 R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007ffdc14840c0 R13: 0000000002b1da60 R14: 0000000000000000 R15: 00007ffdc14840c0 INFO: task syz-executor.1:8372 blocked for more than 140 seconds. Not tainted 4.14.208-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D24920 8372 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_unlink+0x15a/0xf80 fs/ext4/namei.c:3067 vfs_unlink+0x238/0x430 fs/namei.c:4027 do_unlinkat+0x402/0x640 fs/namei.c:4092 SYSC_unlink fs/namei.c:4139 [inline] SyS_unlink+0x11/0x20 fs/namei.c:4137 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45dba7 RSP: 002b:00007ffd305ce508 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045dba7 RDX: 00007ffd305ce520 RSI: 00007ffd305ce520 RDI: 00007ffd305ce5b0 RBP: 000000000000111e R08: 0000000000000000 R09: 0000000000000011 R10: 000000000000000a R11: 0000000000000246 R12: 00007ffd305cf640 R13: 0000000001dd3a60 R14: 0000000000000000 R15: 00007ffd305cf640 INFO: task syz-executor.4:10904 blocked for more than 140 seconds. Not tainted 4.14.208-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29688 10904 8369 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_lookup+0x10a/0x610 fs/ext4/namei.c:1584 lookup_real fs/namei.c:1555 [inline] __lookup_hash+0xed/0x160 fs/namei.c:1575 filename_create+0x183/0x400 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_symlinkat fs/namei.c:4176 [inline] SyS_symlinkat+0xbd/0x1c0 fs/namei.c:4163 SYSC_symlink fs/namei.c:4196 [inline] SyS_symlink+0x11/0x20 fs/namei.c:4194 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45db87 RSP: 002b:00007fffbb920c68 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87 RDX: 00007fffbb920d07 RSI: 00000000004c3880 RDI: 00007fffbb920cf0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 R10: 0000000000000075 R11: 0000000000000202 R12: 0000000000000001 R13: 00007fffbb920ca0 R14: 0000000000000000 R15: 00007fffbb920cb0 INFO: task syz-executor.2:10907 blocked for more than 140 seconds. Not tainted 4.14.208-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D29688 10907 8364 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_lookup+0x10a/0x610 fs/ext4/namei.c:1584 lookup_real fs/namei.c:1555 [inline] __lookup_hash+0xed/0x160 fs/namei.c:1575 filename_create+0x183/0x400 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_symlinkat fs/namei.c:4176 [inline] SyS_symlinkat+0xbd/0x1c0 fs/namei.c:4163 SYSC_symlink fs/namei.c:4196 [inline] SyS_symlink+0x11/0x20 fs/namei.c:4194 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45db87 RSP: 002b:00007ffeec59a598 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87 RDX: 00007ffeec59a637 RSI: 00000000004c3880 RDI: 00007ffeec59a620 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 R10: 0000000000000075 R11: 0000000000000202 R12: 0000000000000001 R13: 00007ffeec59a5d0 R14: 0000000000000000 R15: 00007ffeec59a5e0 INFO: task syz-executor.0:10908 blocked for more than 140 seconds. Not tainted 4.14.208-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D29688 10908 8373 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 io_schedule+0x1c/0x70 kernel/sched/core.c:5036 bit_wait_io+0xf/0x90 kernel/sched/wait_bit.c:249 __wait_on_bit+0xb0/0x130 kernel/sched/wait_bit.c:51 out_of_line_wait_on_bit+0xbd/0xe0 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:106 [inline] __wait_on_buffer+0x52/0x60 fs/buffer.c:125 wait_on_buffer include/linux/buffer_head.h:362 [inline] ext4_find_entry+0x889/0xdc0 fs/ext4/namei.c:1452 ext4_lookup+0x10a/0x610 fs/ext4/namei.c:1584 lookup_real fs/namei.c:1555 [inline] __lookup_hash+0xed/0x160 fs/namei.c:1575 filename_create+0x183/0x400 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_symlinkat fs/namei.c:4176 [inline] SyS_symlinkat+0xbd/0x1c0 fs/namei.c:4163 SYSC_symlink fs/namei.c:4196 [inline] SyS_symlink+0x11/0x20 fs/namei.c:4194 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45db87 RSP: 002b:00007ffee21f8cd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87 RDX: 00007ffee21f8d77 RSI: 00000000004c3880 RDI: 00007ffee21f8d60 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001 R13: 00007ffee21f8d10 R14: 0000000000000000 R15: 00007ffee21f8d20 Showing all locks held in the system: 1 lock held by khungtaskd/1523: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4548 1 lock held by in:imklog/7673: #0: (&f->f_pos_lock){+.+.}, at: [] __fdget_pos+0x8e/0xc0 fs/file.c:769 3 locks held by syz-executor.3/8367: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 3 locks held by syz-executor.5/8370: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 3 locks held by syz-executor.1/8372: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] do_unlinkat+0x230/0x640 fs/namei.c:4078 #2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [] vfs_unlink+0xb3/0x430 fs/namei.c:4018 2 locks held by syz-executor.4/10904: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] filename_create+0x150/0x400 fs/namei.c:3674 2 locks held by syz-executor.2/10907: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] filename_create+0x150/0x400 fs/namei.c:3674 2 locks held by syz-executor.0/10908: #0: (sb_writers#3){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#3){.+.+}, at: [] mnt_want_write+0x3c/0xa0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#3/1){+.+.}, at: [] filename_create+0x150/0x400 fs/namei.c:3674 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1523 Comm: khungtaskd Not tainted 4.14.208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1f1 lib/dump_stack.c:58 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x11a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x51b/0xa70 kernel/hung_task.c:274 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 282 Comm: kworker/u4:3 Not tainted 4.14.208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker task: ffff8880b4f40100 task.stack: ffff8880b4f48000 RIP: 0010:debug_lockdep_rcu_enabled.part.0+0x1f/0x60 kernel/rcu/update.c:300 RSP: 0018:ffff8880b4f4fc40 EFLAGS: 00000002 RAX: dffffc0000000000 RBX: ffff8880b4f40100 RCX: 1ffffffff11947ac RDX: 0000000000000004 RSI: 0000000000000001 RDI: ffff8880b4f40984 RBP: ffff8880b4f4fc48 R08: ffff8880b4f409f8 R09: 0000000000000000 R10: 0000000000000050 R11: ffff8880b4f40100 R12: ffffffff88f76280 R13: ffff8880b4f40100 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880ba600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd830db1000 CR3: 00000000a18f0000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: debug_lockdep_rcu_enabled+0x77/0x90 kernel/rcu/update.c:299 trace_lock_release include/trace/events/lock.h:58 [inline] lock_release+0x5dc/0x820 kernel/locking/lockdep.c:4016 rcu_lock_release include/linux/rcupdate.h:247 [inline] rcu_read_unlock include/linux/rcupdate.h:685 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:420 [inline] batadv_nc_worker+0x194/0x630 net/batman-adv/network-coding.c:726 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Code: e8 77 80 38 00 e9 95 fd ff ff 66 90 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 53 65 48 8b 1c 25 80 df 01 00 48 8d bb 84 08 00 00 <48> 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38