BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:LINE

7 views
Skip to first unread message

syzbot

unread,
Apr 12, 2019, 8:00:48 PM4/12/19
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 8fe42840 Merge 4.9.141 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=15f11ebb400000
kernel config: https://syzkaller.appspot.com/x/.config?x=22a5ba9f73b6da1d
dashboard link: https://syzkaller.appspot.com/bug?extid=e4868b0405fec2bc392d
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b9cae3400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=136f014b400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e4868b...@syzkaller.appspotmail.com

audit: type=1400 audit(1546649660.141:5): avc: denied { associate } for
pid=2096 comm="syz-executor325" name="syz0"
scontext=unconfined_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
BUG: sleeping function called from invalid context
at ./include/linux/percpu-rwsem.h:33
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1
no locks held by swapper/1/0.
Preemption disabled at:[ 393.264008] [<ffffffff828094ad>]
schedule_preempt_disabled+0x1d/0x20 kernel/sched/core.c:3587
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.141+ #1
ffff8801db707660 ffffffff81b42e79 ffffffff828094ad 0000000000000000
0000000000000101 ffff8801da6b2f80 ffff8801da6b2f80 ffff8801db707698
ffffffff813f9ecf ffff8801da6b2f80 ffffffff82ad6720 0000000000000021
Call Trace:
<IRQ> [ 393.305937] [<ffffffff81b42e79>] __dump_stack
lib/dump_stack.c:15 [inline]
<IRQ> [ 393.305937] [<ffffffff81b42e79>] dump_stack+0xc1/0x128
lib/dump_stack.c:51
[<ffffffff813f9ecf>] ___might_sleep.cold.31+0x18a/0x1fc
kernel/sched/core.c:7988
[<ffffffff81167c85>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7945
[<ffffffff816d4b6d>] percpu_down_read_preempt_disable
include/linux/percpu-rwsem.h:33 [inline]
[<ffffffff816d4b6d>] percpu_down_read include/linux/percpu-rwsem.h:58
[inline]
[<ffffffff816d4b6d>] ext4_writepages+0x16d/0x2e00 fs/ext4/inode.c:2659
[<ffffffff81433d3f>] do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
[<ffffffff814119b9>] __filemap_fdatawrite_range+0x1a9/0x250
mm/filemap.c:390
[<ffffffff81411c89>] filemap_write_and_wait_range+0x59/0xb0
mm/filemap.c:578
[<ffffffff8158b803>] __generic_file_fsync+0x93/0x1a0 fs/libfs.c:974
[<ffffffff816b5209>] ext4_sync_file+0x659/0x10a0 fs/ext4/fsync.c:116
[<ffffffff815b195c>] vfs_fsync_range+0x10c/0x260 fs/sync.c:195
[<ffffffff815cd622>] generic_write_sync include/linux/fs.h:2607 [inline]
[<ffffffff815cd622>] dio_complete+0x512/0x6c0 fs/direct-io.c:282
[<ffffffff815cd8ec>] dio_bio_end_aio+0x11c/0x370 fs/direct-io.c:323
[<ffffffff81ab5f75>] bio_endio+0x1a5/0x1f0 block/bio.c:1781
[<ffffffff81ad65d8>] req_bio_endio block/blk-core.c:157 [inline]
[<ffffffff81ad65d8>] blk_update_request+0x248/0x9b0 block/blk-core.c:2628
[<ffffffff81e1c7ed>] scsi_end_request+0x9d/0x5c0
drivers/scsi/scsi_lib.c:606
[<ffffffff81e257f3>] scsi_io_completion+0x273/0x17a0
drivers/scsi/scsi_lib.c:829
[<ffffffff81e0871a>] scsi_finish_command+0x3ba/0x530
drivers/scsi/scsi.c:607
[<ffffffff81e23d20>] scsi_softirq_done+0x250/0x360
drivers/scsi/scsi_lib.c:1567
[<ffffffff81af449d>] blk_done_softirq+0x27d/0x3e0 block/blk-softirq.c:35
[<ffffffff8281cb9e>] __do_softirq+0x20e/0x964 kernel/softirq.c:288
[<ffffffff810efdbc>] invoke_softirq kernel/softirq.c:368 [inline]
[<ffffffff810efdbc>] irq_exit+0x11c/0x150 kernel/softirq.c:409
[<ffffffff82819b9d>] exiting_irq arch/x86/include/asm/apic.h:669 [inline]
[<ffffffff82819b9d>] do_IRQ+0x10d/0x1c0 arch/x86/kernel/irq.c:252
[<ffffffff8281819d>] common_interrupt+0x9d/0x9d
arch/x86/entry/entry_64.S:461
<EOI> [ 393.696154] [<ffffffff82816496>] ? native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:56
[<ffffffff828159f5>] arch_safe_halt arch/x86/include/asm/paravirt.h:104
[inline]
[<ffffffff828159f5>] default_idle+0x55/0x360 arch/x86/kernel/process.c:437
[<ffffffff81068a40>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:428
[<ffffffff828168f5>] default_idle_call+0x45/0x60 kernel/sched/idle.c:97
[<ffffffff811f0a85>] cpuidle_idle_call kernel/sched/idle.c:155 [inline]
[<ffffffff811f0a85>] cpu_idle_loop kernel/sched/idle.c:248 [inline]
[<ffffffff811f0a85>] cpu_startup_entry+0x2b5/0x380 kernel/sched/idle.c:303
[<ffffffff8108dc08>] start_secondary+0x328/0x400
arch/x86/kernel/smpboot.c:251

=========================================================
[ INFO: possible irq lock inversion dependency detected ]
4.9.141+ #1 Tainted: G W
---------------------------------------------------------
swapper/1/0 just changed the state of lock:
(&sbi->s_journal_flag_rwsem){.+.?.+}, at: [<ffffffff81433d3f>]
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
(&ei->i_data_sem){++++..}

and interrupts could create inverse lock ordering between them.


other info that might help us debug this:
Possible interrupt unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&ei->i_data_sem);
local_irq_disable();
lock(&sbi->s_journal_flag_rwsem);
lock(&ei->i_data_sem);
<Interrupt>
lock(&sbi->s_journal_flag_rwsem);

*** DEADLOCK ***

no locks held by swapper/1/0.

the shortest dependencies between 2nd lock and 1st lock:
-> (&ei->i_data_sem){++++..} ops: 46364 {
HARDIRQ-ON-W at:
mark_irqflags kernel/locking/lockdep.c:2937 [inline]
__lock_acquire+0x10b0/0x4a10
kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
down_write+0x41/0xa0 kernel/locking/rwsem.c:52
ext4_release_file+0x25b/0x2e0 fs/ext4/file.c:50
__fput+0x263/0x700 fs/file_table.c:208
____fput+0x15/0x20 fs/file_table.c:244
task_work_run+0x10c/0x180 kernel/task_work.c:116
tracehook_notify_resume include/linux/tracehook.h:191
[inline]
exit_to_usermode_loop+0x129/0x150
arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:194
[inline]
syscall_return_slowpath arch/x86/entry/common.c:263
[inline]
do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_swapgs+0x5d/0xdb
HARDIRQ-ON-R at:
mark_irqflags kernel/locking/lockdep.c:2929 [inline]
__lock_acquire+0xb79/0x4a10
kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
down_read+0x44/0xb0 kernel/locking/rwsem.c:22
ext4_map_blocks+0x361/0x16d0 fs/ext4/inode.c:533
ext4_getblk+0x2cc/0x450 fs/ext4/inode.c:943
ext4_find_entry+0xa94/0x12c0 fs/ext4/namei.c:1420
ext4_lookup+0x139/0x5e0 fs/ext4/namei.c:1559
lookup_slow+0x24a/0x470 fs/namei.c:1668
walk_component+0x822/0xcf0 fs/namei.c:1784
lookup_last fs/namei.c:2266 [inline]
path_lookupat.isra.10+0x186/0x410 fs/namei.c:2283
filename_lookup.part.18+0x177/0x370 fs/namei.c:2317
filename_lookup fs/namei.c:2310 [inline]
user_path_at_empty+0x53/0x70 fs/namei.c:2578
user_path include/linux/namei.h:60 [inline]
do_mount+0x134/0x28a0 fs/namespace.c:2816
SYSC_mount fs/namespace.c:3087 [inline]
SyS_mount+0xea/0x100 fs/namespace.c:3064
devtmpfs_mount+0x49/0x70 drivers/base/devtmpfs.c:357
prepare_namespace+0x1e4/0x210 init/do_mounts.c:603
kernel_init_freeable+0x38e/0x3ac init/main.c:1036
kernel_init+0x11/0x15e init/main.c:946
ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
SOFTIRQ-ON-W at:
mark_irqflags kernel/locking/lockdep.c:2941 [inline]
__lock_acquire+0xbdd/0x4a10
kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
down_write+0x41/0xa0 kernel/locking/rwsem.c:52
ext4_release_file+0x25b/0x2e0 fs/ext4/file.c:50
__fput+0x263/0x700 fs/file_table.c:208
____fput+0x15/0x20 fs/file_table.c:244
task_work_run+0x10c/0x180 kernel/task_work.c:116
tracehook_notify_resume include/linux/tracehook.h:191
[inline]
exit_to_usermode_loop+0x129/0x150
arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:194
[inline]
syscall_return_slowpath arch/x86/entry/common.c:263
[inline]
do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_swapgs+0x5d/0xdb
SOFTIRQ-ON-R at:
mark_irqflags kernel/locking/lockdep.c:2941 [inline]
__lock_acquire+0xbdd/0x4a10
kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
down_read+0x44/0xb0 kernel/locking/rwsem.c:22
ext4_map_blocks+0x361/0x16d0 fs/ext4/inode.c:533
ext4_getblk+0x2cc/0x450 fs/ext4/inode.c:943
ext4_find_entry+0xa94/0x12c0 fs/ext4/namei.c:1420
ext4_lookup+0x139/0x5e0 fs/ext4/namei.c:1559
lookup_slow+0x24a/0x470 fs/namei.c:1668
walk_component+0x822/0xcf0 fs/namei.c:1784
lookup_last fs/namei.c:2266 [inline]
path_lookupat.isra.10+0x186/0x410 fs/namei.c:2283
filename_lookup.part.18+0x177/0x370 fs/namei.c:2317
filename_lookup fs/namei.c:2310 [inline]
user_path_at_empty+0x53/0x70 fs/namei.c:2578
user_path include/linux/namei.h:60 [inline]
do_mount+0x134/0x28a0 fs/namespace.c:2816
SYSC_mount fs/namespace.c:3087 [inline]
SyS_mount+0xea/0x100 fs/namespace.c:3064
devtmpfs_mount+0x49/0x70 drivers/base/devtmpfs.c:357
prepare_namespace+0x1e4/0x210 init/do_mounts.c:603
kernel_init_freeable+0x38e/0x3ac init/main.c:1036
kernel_init+0x11/0x15e init/main.c:946
ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
INITIAL USE at:
__lock_acquire+0x654/0x4a10
kernel/locking/lockdep.c:3306
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
down_read+0x44/0xb0 kernel/locking/rwsem.c:22
ext4_map_blocks+0x361/0x16d0 fs/ext4/inode.c:533
ext4_getblk+0x2cc/0x450 fs/ext4/inode.c:943
ext4_find_entry+0xa94/0x12c0 fs/ext4/namei.c:1420
ext4_lookup+0x139/0x5e0 fs/ext4/namei.c:1559
lookup_slow+0x24a/0x470 fs/namei.c:1668
walk_component+0x822/0xcf0 fs/namei.c:1784
lookup_last fs/namei.c:2266 [inline]
path_lookupat.isra.10+0x186/0x410 fs/namei.c:2283
filename_lookup.part.18+0x177/0x370 fs/namei.c:2317
filename_lookup fs/namei.c:2310 [inline]
user_path_at_empty+0x53/0x70 fs/namei.c:2578
user_path include/linux/namei.h:60 [inline]
do_mount+0x134/0x28a0 fs/namespace.c:2816
SYSC_mount fs/namespace.c:3087 [inline]
SyS_mount+0xea/0x100 fs/namespace.c:3064
devtmpfs_mount+0x49/0x70 drivers/base/devtmpfs.c:357
prepare_namespace+0x1e4/0x210 init/do_mounts.c:603
kernel_init_freeable+0x38e/0x3ac init/main.c:1036
kernel_init+0x11/0x15e init/main.c:946
ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
}
... key at: [<ffffffff8422f380>] __key.74437+0x0/0x40
... acquired at:
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
down_write+0x41/0xa0 kernel/locking/rwsem.c:52
ext4_map_blocks+0x6d3/0x16d0 fs/ext4/inode.c:605
mpage_map_one_extent fs/ext4/inode.c:2387 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2443 [inline]
ext4_writepages+0x1551/0x2e00 fs/ext4/inode.c:2783
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
__filemap_fdatawrite_range+0x1a9/0x250 mm/filemap.c:390
__filemap_fdatawrite mm/filemap.c:398 [inline]
filemap_flush+0x23/0x30 mm/filemap.c:423
ext4_alloc_da_blocks+0xd9/0x330 fs/ext4/inode.c:3157
ext4_release_file+0x1ff/0x2e0 fs/ext4/file.c:42
__fput+0x263/0x700 fs/file_table.c:208
____fput+0x15/0x20 fs/file_table.c:244
task_work_run+0x10c/0x180 kernel/task_work.c:116
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x129/0x150 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:263 [inline]
do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_swapgs+0x5d/0xdb

-> (&sbi->s_journal_flag_rwsem){.+.?.+} ops: 304 {
HARDIRQ-ON-R at:
mark_irqflags kernel/locking/lockdep.c:2929 [inline]
__lock_acquire+0xb79/0x4a10
kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
percpu_down_read_preempt_disable
include/linux/percpu-rwsem.h:35 [inline]
percpu_down_read include/linux/percpu-rwsem.h:58
[inline]
ext4_writepages+0x19e/0x2e00 fs/ext4/inode.c:2659
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
__filemap_fdatawrite_range+0x1a9/0x250 mm/filemap.c:390
SyS_fadvise64_64+0x6db/0x7d0 mm/fadvise.c:123
SYSC_fadvise64 mm/fadvise.c:182 [inline]
SyS_fadvise64+0x2c/0x40 mm/fadvise.c:180
do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
entry_SYSCALL_64_after_swapgs+0x5d/0xdb
IN-SOFTIRQ-R at:
mark_irqflags kernel/locking/lockdep.c:2923 [inline]
__lock_acquire+0x1084/0x4a10
kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
percpu_down_read_preempt_disable
include/linux/percpu-rwsem.h:35 [inline]
percpu_down_read include/linux/percpu-rwsem.h:58
[inline]
ext4_writepages+0x19e/0x2e00 fs/ext4/inode.c:2659
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
__filemap_fdatawrite_range+0x1a9/0x250 mm/filemap.c:390
filemap_write_and_wait_range+0x59/0xb0 mm/filemap.c:578
__generic_file_fsync+0x93/0x1a0 fs/libfs.c:974
ext4_sync_file+0x659/0x10a0 fs/ext4/fsync.c:116
vfs_fsync_range+0x10c/0x260 fs/sync.c:195
generic_write_sync include/linux/fs.h:2607 [inline]
dio_complete+0x512/0x6c0 fs/direct-io.c:282
dio_bio_end_aio+0x11c/0x370 fs/direct-io.c:323
bio_endio+0x1a5/0x1f0 block/bio.c:1781
req_bio_endio block/blk-core.c:157 [inline]
blk_update_request+0x248/0x9b0 block/blk-core.c:2628
scsi_end_request+0x9d/0x5c0 drivers/scsi/scsi_lib.c:606
scsi_io_completion+0x273/0x17a0
drivers/scsi/scsi_lib.c:829
scsi_finish_command+0x3ba/0x530 drivers/scsi/scsi.c:607
scsi_softirq_done+0x250/0x360
drivers/scsi/scsi_lib.c:1567
blk_done_softirq+0x27d/0x3e0 block/blk-softirq.c:35
__do_softirq+0x20e/0x964 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x11c/0x150 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:669 [inline]
do_IRQ+0x10d/0x1c0 arch/x86/kernel/irq.c:252
ret_from_intr+0x0/0x20
arch_safe_halt arch/x86/include/asm/paravirt.h:104
[inline]
default_idle+0x55/0x360 arch/x86/kernel/process.c:437
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:428
default_idle_call+0x45/0x60 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:155 [inline]
cpu_idle_loop kernel/sched/idle.c:248 [inline]
cpu_startup_entry+0x2b5/0x380 kernel/sched/idle.c:303
start_secondary+0x328/0x400
arch/x86/kernel/smpboot.c:251
SOFTIRQ-ON-R at:
mark_irqflags kernel/locking/lockdep.c:2941 [inline]
__lock_acquire+0xbdd/0x4a10
kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
percpu_down_read_preempt_disable
include/linux/percpu-rwsem.h:35 [inline]
percpu_down_read include/linux/percpu-rwsem.h:58
[inline]
ext4_writepages+0x19e/0x2e00 fs/ext4/inode.c:2659
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
__filemap_fdatawrite_range+0x1a9/0x250 mm/filemap.c:390
SyS_fadvise64_64+0x6db/0x7d0 mm/fadvise.c:123
SYSC_fadvise64 mm/fadvise.c:182 [inline]
SyS_fadvise64+0x2c/0x40 mm/fadvise.c:180
do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
entry_SYSCALL_64_after_swapgs+0x5d/0xdb
RECLAIM_FS-ON-R at:
mark_held_locks+0xc7/0x130
kernel/locking/lockdep.c:2660
__lockdep_trace_alloc kernel/locking/lockdep.c:2882
[inline]
lockdep_trace_alloc+0x18e/0x2a0
kernel/locking/lockdep.c:2897
slab_pre_alloc_hook mm/slab.h:392 [inline]
slab_alloc_node mm/slub.c:2641 [inline]
slab_alloc mm/slub.c:2723 [inline]
kmem_cache_alloc+0x2d/0x2b0 mm/slub.c:2728
kmem_cache_zalloc include/linux/slab.h:626 [inline]
ext4_init_io_end+0x25/0x100 fs/ext4/page-io.c:252
ext4_writepages+0xcd0/0x2e00 fs/ext4/inode.c:2750
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
__filemap_fdatawrite_range+0x1a9/0x250
mm/filemap.c:390
__filemap_fdatawrite mm/filemap.c:398 [inline]
filemap_flush+0x23/0x30 mm/filemap.c:423
ext4_alloc_da_blocks+0xd9/0x330 fs/ext4/inode.c:3157
ext4_release_file+0x1ff/0x2e0 fs/ext4/file.c:42
__fput+0x263/0x700 fs/file_table.c:208
____fput+0x15/0x20 fs/file_table.c:244
task_work_run+0x10c/0x180 kernel/task_work.c:116
tracehook_notify_resume
include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x129/0x150
arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:194
[inline]
syscall_return_slowpath arch/x86/entry/common.c:263
[inline]
do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_swapgs+0x5d/0xdb
INITIAL USE at:
__lock_acquire+0x654/0x4a10 kernel/locking/lockdep.c:3306
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
percpu_down_read_preempt_disable
include/linux/percpu-rwsem.h:35 [inline]
percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
ext4_writepages+0x19e/0x2e00 fs/ext4/inode.c:2659
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
__filemap_fdatawrite_range+0x1a9/0x250 mm/filemap.c:390
SyS_fadvise64_64+0x6db/0x7d0 mm/fadvise.c:123
SYSC_fadvise64 mm/fadvise.c:182 [inline]
SyS_fadvise64+0x2c/0x40 mm/fadvise.c:180
do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
entry_SYSCALL_64_after_swapgs+0x5d/0xdb
}
... key at: [<ffffffff8422f680>] rwsem_key.75130+0x0/0x40
... acquired at:
check_usage_forwards+0x14e/0x290 kernel/locking/lockdep.c:2493
mark_lock_irq kernel/locking/lockdep.c:2610 [inline]
mark_lock+0x6ec/0x1290 kernel/locking/lockdep.c:3065
mark_irqflags kernel/locking/lockdep.c:2923 [inline]
__lock_acquire+0x1084/0x4a10 kernel/locking/lockdep.c:3302
lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35 [inline]
percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
ext4_writepages+0x19e/0x2e00 fs/ext4/inode.c:2659
do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
__filemap_fdatawrite_range+0x1a9/0x250 mm/filemap.c:390
filemap_write_and_wait_range+0x59/0xb0 mm/filemap.c:578
__generic_file_fsync+0x93/0x1a0 fs/libfs.c:974
ext4_sync_file+0x659/0x10a0 fs/ext4/fsync.c:116
vfs_fsync_range+0x10c/0x260 fs/sync.c:195
generic_write_sync include/linux/fs.h:2607 [inline]
dio_complete+0x512/0x6c0 fs/direct-io.c:282
dio_bio_end_aio+0x11c/0x370 fs/direct-io.c:323
bio_endio+0x1a5/0x1f0 block/bio.c:1781
req_bio_endio block/blk-core.c:157 [inline]
blk_update_request+0x248/0x9b0 block/blk-core.c:2628
scsi_end_request+0x9d/0x5c0 drivers/scsi/scsi_lib.c:606
scsi_io_completion+0x273/0x17a0 drivers/scsi/scsi_lib.c:829
scsi_finish_command+0x3ba/0x530 drivers/scsi/scsi.c:607
scsi_softirq_done+0x250/0x360 drivers/scsi/scsi_lib.c:1567
blk_done_softirq+0x27d/0x3e0 block/blk-softirq.c:35
__do_softirq+0x20e/0x964 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x11c/0x150 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:669 [inline]
do_IRQ+0x10d/0x1c0 arch/x86/kernel/irq.c:252
ret_from_intr+0x0/0x20
arch_safe_halt arch/x86/include/asm/paravirt.h:104 [inline]
default_idle+0x55/0x360 arch/x86/kernel/process.c:437
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:428
default_idle_call+0x45/0x60 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:155 [inline]
cpu_idle_loop kernel/sched/idle.c:248 [inline]
cpu_startup_entry+0x2b5/0x380 kernel/sched/idle.c:303
start_secondary+0x328/0x400 arch/x86/kernel/smpboot.c:251


stack backtrace:
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 4.9.141+ #1
ffff8801db7072d0 ffffffff81b42e79 ffffffff84011300 ffff8801db7073a0
ffff8801da6b2f80 0000000000000001 ffffffff84011300 ffff8801db707320
ffffffff813ff4da 0000000100000000 ffffffff83cab520 ffffffff83ca2910
Call Trace:
<IRQ> [ 395.037929] [<ffffffff81b42e79>] __dump_stack
lib/dump_stack.c:15 [inline]
<IRQ> [ 395.037929] [<ffffffff81b42e79>] dump_stack+0xc1/0x128
lib/dump_stack.c:51
[<ffffffff813ff4da>] print_irq_inversion_bug.cold.38+0x319/0x32d
kernel/locking/lockdep.c:2468
[<ffffffff81204efe>] check_usage_forwards+0x14e/0x290
kernel/locking/lockdep.c:2493
[<ffffffff8120613c>] mark_lock_irq kernel/locking/lockdep.c:2610 [inline]
[<ffffffff8120613c>] mark_lock+0x6ec/0x1290 kernel/locking/lockdep.c:3065
[<ffffffff81208434>] mark_irqflags kernel/locking/lockdep.c:2923 [inline]
[<ffffffff81208434>] __lock_acquire+0x1084/0x4a10
kernel/locking/lockdep.c:3302
[<ffffffff8120c8d0>] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
[<ffffffff816d4b9e>] percpu_down_read_preempt_disable
include/linux/percpu-rwsem.h:35 [inline]
[<ffffffff816d4b9e>] percpu_down_read include/linux/percpu-rwsem.h:58
[inline]
[<ffffffff816d4b9e>] ext4_writepages+0x19e/0x2e00 fs/ext4/inode.c:2659
[<ffffffff81433d3f>] do_writepages+0xef/0x1d0 mm/page-writeback.c:2331
[<ffffffff814119b9>] __filemap_fdatawrite_range+0x1a9/0x250
mm/filemap.c:390
[<ffffffff81411c89>] filemap_write_and_wait_range+0x59/0xb0
mm/filemap.c:578
[<ffffffff8158b803>] __generic_file_fsync+0x93/0x1a0 fs/libfs.c:974
[<ffffffff816b5209>] ext4_sync_file+0x659/0x10a0 fs/ext4/fsync.c:116
[<ffffffff815b195c>] vfs_fsync_range+0x10c/0x260 fs/sync.c:195
[<ffffffff815cd622>] generic_write_sync include/linux/fs.h:2607 [inline]
[<ffffffff815cd622>] dio_complete+0x512/0x6c0 fs/direct-io.c:282
[<ffffffff815cd8ec>] dio_bio_end_aio+0x11c/0x370 fs/direct-io.c:323
[<ffffffff81ab5f75>] bio_endio+0x1a5/0x1f0 block/bio.c:1781
[<ffffffff81ad65d8>] req_bio_endio block/blk-core.c:157 [inline]
[<ffffffff81ad65d8>] blk_update_request+0x248/0x9b0 block/blk-core.c:2628
[<ffffffff81e1c7ed>] scsi_end_request+0x9d/0x5c0
drivers/scsi/scsi_lib.c:606
[<ffffffff81e257f3>] scsi_io_completion+0x273/0x17a0
drivers/scsi/scsi_lib.c:829
[<ffffffff81e0871a>] scsi_finish_command+0x3ba/0x530
drivers/scsi/scsi.c:607
[<ffffffff81e23d20>] scsi_softirq_done+0x250/0x360
drivers/scsi/scsi_lib.c:1567
[<ffffffff81af449d>] blk_done_softirq+0x27d/0x3e0 block/blk-softirq.c:35
[<ffffffff8281cb9e>] __do_softirq+0x20e/0x964 kernel/softirq.c:288
[<ffffffff810efdbc>] invoke_softirq kernel/softirq.c:368 [inline]
[<ffffffff810efdbc>] irq_exit+0x11c/0x150 kernel/softirq.c:409
[<ffffffff82819b9d>] exiting_irq arch/x86/include/asm/apic.h:669 [inline]
[<ffffffff82819b9d>] do_IRQ+0x10d/0x1c0 arch/x86/kernel/irq.c:252
[<ffffffff8281819d>] common_interrupt+0x9d/0x9d
arch/x86/entry/entry_64.S:461
<EOI> [ 395.549492] [<ffffffff82816496>] ? native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:56
[<ffffffff828159f5>] arch_safe_halt arch/x86/include/asm/paravirt.h:104
[inline]
[<ffffffff828159f5>] default_idle+0x55/0x360 arch/x86/kernel/process.c:437
[<ffffffff81068a40>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:428
[<ffffffff828168f5>] default_idle_call+0x45/0x60 kernel/sched/idle.c:97
[<ffffffff811f0a85>] cpuidle_idle_call kernel/sched/idle.c:155 [inline]
[<ffffffff811f0a85>] cpu_idle_loop kernel/sched/idle.c:248 [inline]
[<ffffffff811f0a85>] cpu_startup_entry+0x2b5/0x380 kernel/sched/idle.c:303
[<ffffffff8108dc08>] start_secondary+0x328/0x400
arch/x86/kernel/smpboot.c:251
BUG: sleeping function called from invalid context at
kernel/locking/rwsem.c:51
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1
INFO: lockdep is turned off.
Preemption disabled at:[ 395.631861] [<ffffffff828094ad>]
schedule_preempt_disabled+0x1d/0x20 kernel/sched/core.c:3587
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 4.9.141+ #1
ffff8801db707a20 ffffffff81b42e79 ffffffff828094ad 0000000000000000
0000000000000101 ffff8801da6b2f80 ffff8801da6b2f80 ffff8801db707a58
ffffffff813f9ecf ffff8801da6b2f80 ffffffff82a4fa80 0000000000000033
Call Trace:
<IRQ> [ 395.674400] [<ffffffff81b42e79>] __dump_stack
lib/dump_stack.c:15 [inline]
<IRQ> [ 395.674400] [<ffffffff81b42e79>] dump_stack+0xc1/0x128
lib/dump_stack.c:51
[<ffffffff813f9ecf>] ___might_sleep.cold.31+0x18a/0x1fc
kernel/sched/core.c:7988
[<ffffffff81167c85>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7945
[<ffffffff828116d1>] down_write+0x21/0xa0 kernel/locking/rwsem.c:51
[<ffffffff8158b831>] inode_lock include/linux/fs.h:766 [inline]
[<ffffffff8158b831>] __generic_file_fsync+0xc1/0x1a0 fs/libfs.c:978
[<ffffffff816b5209>] ext4_sync_file+0x659/0x10a0 fs/ext4/fsync.c:116
[<ffffffff815b195c>] vfs_fsync_range+0x10c/0x260 fs/sync.c:195
[<ffffffff815cd622>] generic_write_sync include/linux/fs.h:2607 [inline]
[<ffffffff815cd622>] dio_complete+0x512/0x6c0 fs/direct-io.c:282
[<ffffffff815cd8ec>] dio_bio_end_aio+0x11c/0x370 fs/direct-io.c:323
[<ffffffff81ab5f75>] bio_endio+0x1a5/0x1f0 block/bio.c:1781
[<ffffffff81ad65d8>] req_bio_endio block/blk-core.c:157 [inline]
[<ffffffff81ad65d8>] blk_update_request+0x248/0x9b0 block/blk-core.c:2628
[<ffffffff81e1c7ed>] scsi_end_request+0x9d/0x5c0
drivers/scsi/scsi_lib.c:606
[<ffffffff81e257f3>] scsi_io_completion+0x273/0x17a0
drivers/scsi/scsi_lib.c:829
[<ffffffff81e0871a>] scsi_finish_command+0x3ba/0x530
drivers/scsi/scsi.c:607
[<ffffffff81e23d20>] scsi_softirq_done+0x250/0x360
drivers/scsi/scsi_lib.c:1567
[<ffffffff81af449d>] blk_done_softirq+0x27d/0x3e0 block/blk-softirq.c:35
[<ffffffff8281cb9e>] __do_softirq+0x20e/0x964 kernel/softirq.c:288
[<ffffffff810efdbc>] invoke_softirq kernel/softirq.c:368 [inline]
[<ffffffff810efdbc>] irq_exit+0x11c/0x150 kernel/softirq.c:409
[<ffffffff82819b9d>] exiting_irq arch/x86/include/asm/apic.h:669 [inline]
[<ffffffff82819b9d>] do_IRQ+0x10d/0x1c0 arch/x86/kernel/irq.c:252
[<ffffffff8281819d>] common_interrupt+0x9d/0x9d
arch/x86/entry/entry_64.S:461
<EOI> [ 395.882097] [<ffffffff82816496>] ? native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:56
[<ffffffff828159f5>] arch_safe_halt arch/x86/include/asm/paravirt.h:104
[inline]
[<ffffffff828159f5>] default_idle+0x55/0x360 arch/x86/kernel/process.c:437
[<ffffffff81068a40>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:428
[<ffffffff828168f5>] default_idle_call+0x45/0x60 kernel/sched/idle.c:97
[<ffffffff811f0a85>] cpuidle_idle_call kernel/sched/idle.c:155 [inline]
[<ffffffff811f0a85>] cpu_idle_loop kernel/sched/idle.c:248 [inline]
[<ffffffff811f0a85>] cpu_startup_entry+0x2b5/0x380 kernel/sched/idle.c:303
[<ffffffff8108dc08>] start_secondary+0x328/0x400
arch/x86/kernel/smpboot.c:251
BUG: scheduling while atomic: swapper/1/0/0x00000102
INFO: lockdep is turned off.
Modules linked in:
Preemption disabled at:[ 395.958646] [<ffffffff828094ad>]
schedule_preempt_disabled+0x1d/0x20 kernel/sched/core.c:3587


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages