INFO: task hung in lo_open

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 47350a9f ANDROID: x86_64_cuttlefish_defconfig: Enable lz4 ..
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=146b2d1e400000
kernel config: https://syzkaller.appspot.com/x/.config?x=10d236078f3378a3
dashboard link: https://syzkaller.appspot.com/bug?extid=40a29aedacb650561903
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1527ca7a400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1545de3e400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+40a29a...@syzkaller.appspotmail.com

INFO: task syz-executor071:2056 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D27816 2056 2054 0x00000000
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
lo_open+0x17/0xa0 drivers/block/loop.c:1592
__blkdev_get+0x267/0xe50 fs/block_dev.c:1467
blkdev_get+0x97/0x8c0 fs/block_dev.c:1604
blkdev_open+0x1bd/0x240 fs/block_dev.c:1762
do_dentry_open+0x426/0xda0 fs/open.c:764
vfs_open+0x11c/0x210 fs/open.c:878
do_last fs/namei.c:3408 [inline]
path_openat+0x4eb/0x23a0 fs/namei.c:3550
do_filp_open+0x197/0x270 fs/namei.c:3584
do_sys_open+0x2ef/0x580 fs/open.c:1071
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x401260
RSP: 002b:00007ffe2817f8a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000401260
RDX: 00007ffe2817f8ca RSI: 0000000000000002 RDI: 00007ffe2817f8c0
RBP: 00000000006cc018 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000402190
R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor071:2058 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D29656 2058 2055 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
loop_control_ioctl+0x180/0x310 drivers/block/loop.c:1965
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441359
RSP: 002b:00007ffe2817f8a8 EFLAGS: 00000217 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441359
RDX: 0000000000000002 RSI: 0000000000004c81 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000217 R12: 0000000000402190
R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor071:2059 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D28376 2059 2057 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
blkdev_reread_part+0x18/0x30 block/ioctl.c:192
loop_reread_partitions+0x72/0x80 drivers/block/loop.c:614
loop_set_status+0xa84/0xf40 drivers/block/loop.c:1169
loop_set_status64+0x8d/0xe0 drivers/block/loop.c:1287
lo_ioctl+0x3cd/0x17d0 drivers/block/loop.c:1400
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x57d/0x18c0 block/ioctl.c:594
block_ioctl+0xd9/0x120 fs/block_dev.c:1873
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441267
RSP: 002b:00007ffe2817f668 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000441267
RDX: 00007ffe2817f700 RSI: 0000000000004c04 RDI: 0000000000000005
RBP: 0000000020000228 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000202 R12: 0000000000000005
R13: 0000000000000004 R14: 0000000000000004 R15: 0000000000000000
INFO: task blkid:2060 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
blkid D29000 2060 455 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
lo_open+0x17/0xa0 drivers/block/loop.c:1592
__blkdev_get+0x267/0xe50 fs/block_dev.c:1467
blkdev_get+0x97/0x8c0 fs/block_dev.c:1604
blkdev_open+0x1bd/0x240 fs/block_dev.c:1762
do_dentry_open+0x426/0xda0 fs/open.c:764
vfs_open+0x11c/0x210 fs/open.c:878
do_last fs/namei.c:3408 [inline]
path_openat+0x4eb/0x23a0 fs/namei.c:3550
do_filp_open+0x197/0x270 fs/namei.c:3584
do_sys_open+0x2ef/0x580 fs/open.c:1071
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7fae6af4f120
RSP: 002b:00007ffe8acd6588 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fae6af4f120
RDX: 00007ffe8acd7f34 RSI: 0000000000000000 RDI: 00007ffe8acd7f34
RBP: 0000000000000000 R08: 0000000000000078 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000001c8e030
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005
INFO: task syz-executor071:2068 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D29656 2068 2062 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441359
RSP: 002b:00007ffe2817f8a8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441359
RDX: 0000000000441359 RSI: 0000000000004c82 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000002066880 R11: 0000000000000213 R12: 0000000000402190
R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor071:2069 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D29064 2069 2063 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
blkdev_get+0x97/0x8c0 fs/block_dev.c:1604
blkdev_open+0x1bd/0x240 fs/block_dev.c:1762
do_dentry_open+0x426/0xda0 fs/open.c:764
vfs_open+0x11c/0x210 fs/open.c:878
do_last fs/namei.c:3408 [inline]
path_openat+0x4eb/0x23a0 fs/namei.c:3550
do_filp_open+0x197/0x270 fs/namei.c:3584
do_sys_open+0x2ef/0x580 fs/open.c:1071
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x401260
RSP: 002b:00007ffe2817f668 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000401260
RDX: 00007ffe2817f7fa RSI: 0000000000000002 RDI: 00007ffe2817f7f0
RBP: 0000000020000228 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000004 R14: 0000000000000004 R15: 0000000000000000
INFO: task syz-executor071:2070 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D29656 2070 2064 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441359
RSP: 002b:00007ffe2817f8a8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441359
RDX: 0000000000441359 RSI: 0000000000004c82 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000002066880 R11: 0000000000000213 R12: 0000000000402190
R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor071:2071 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D29656 2071 2066 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441359
RSP: 002b:00007ffe2817f8a8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441359
RDX: 0000000000441359 RSI: 0000000000004c82 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000002066880 R11: 0000000000000213 R12: 0000000000402190
R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor071:2072 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor071 D29120 2072 2065 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441359
RSP: 002b:00007ffe2817f8a8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441359
RDX: 0000000000441359 RSI: 0000000000004c82 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000002066880 R11: 0000000000000213 R12: 0000000000402190
R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000
INFO: task blkid:2077 blocked for more than 140 seconds.
Not tainted 4.14.67+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
blkid D28280 2077 2073 0x00000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
lo_open+0x17/0xa0 drivers/block/loop.c:1592
__blkdev_get+0x267/0xe50 fs/block_dev.c:1467
blkdev_get+0x97/0x8c0 fs/block_dev.c:1604
blkdev_open+0x1bd/0x240 fs/block_dev.c:1762
do_dentry_open+0x426/0xda0 fs/open.c:764
vfs_open+0x11c/0x210 fs/open.c:878
do_last fs/namei.c:3408 [inline]
path_openat+0x4eb/0x23a0 fs/namei.c:3550
do_filp_open+0x197/0x270 fs/namei.c:3584
do_sys_open+0x2ef/0x580 fs/open.c:1071
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f9a3e302120
RSP: 002b:00007fffa8496548 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9a3e302120
RDX: 00007fffa8496f34 RSI: 0000000000000000 RDI: 00007fffa8496f34
RBP: 0000000000000000 R08: 0000000000000078 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000024fd030
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005

Showing all locks held in the system:
1 lock held by khungtaskd/23:
#0: (tasklist_lock){.+.+}, at: [<ffffffff89c01847>]
debug_show_all_locks+0x74/0x20f kernel/locking/lockdep.c:4541
1 lock held by rsyslogd/1799:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff89fbcab2>]
__fdget_pos+0xa2/0xc0 fs/file.c:768
2 locks held by getty/1895:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff8a71c500>]
tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8a717a7f>]
n_tty_read+0x1ff/0x15e0 drivers/tty/n_tty.c:2142
2 locks held by syz-executor071/2056:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592
2 locks held by syz-executor071/2058:
#0: (loop_index_mutex){+.+.}, at: [<ffffffff8a7ce641>]
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
#1: (&lo->lo_ctl_mutex#2){+.+.}, at: [<ffffffff8a7ce750>]
loop_control_ioctl+0x180/0x310 drivers/block/loop.c:1965
2 locks held by syz-executor071/2059:
#0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff8a7cb8d5>]
lo_ioctl+0x85/0x17d0 drivers/block/loop.c:1373
#1: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a4fd838>]
blkdev_reread_part+0x18/0x30 block/ioctl.c:192
2 locks held by blkid/2060:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592
1 lock held by syz-executor071/2068:
#0: (loop_index_mutex){+.+.}, at: [<ffffffff8a7ce641>]
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
1 lock held by syz-executor071/2069:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
1 lock held by syz-executor071/2070:
#0: (loop_index_mutex){+.+.}, at: [<ffffffff8a7ce641>]
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
1 lock held by syz-executor071/2071:
#0: (loop_index_mutex){+.+.}, at: [<ffffffff8a7ce641>]
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
1 lock held by syz-executor071/2072:
#0: (loop_index_mutex){+.+.}, at: [<ffffffff8a7ce641>]
loop_control_ioctl+0x71/0x310 drivers/block/loop.c:1951
2 locks held by blkid/2077:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592
2 locks held by blkid/2078:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592
2 locks held by blkid/2079:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592
2 locks held by blkid/2080:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592
2 locks held by blkid/2081:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592
2 locks held by blkid/2085:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff8a0188c3>]
__blkdev_get+0xf3/0xe50 fs/block_dev.c:1452
#1: (loop_index_mutex){+.+.}, at: [<ffffffff8a7c7107>] lo_open+0x17/0xa0
drivers/block/loop.c:1592

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 23 Comm: khungtaskd Not tainted 4.14.67+ #1
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x11b lib/dump_stack.c:53
nmi_cpu_backtrace.cold.0+0x18/0x8e lib/nmi_backtrace.c:103
nmi_trigger_cpumask_backtrace+0x121/0x146 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
watchdog+0x574/0xa70 kernel/hung_task.c:252
kthread+0x348/0x420 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at pc 0xffffffff8b240572


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 62872f95 Merge 4.4.174 into android-4.4
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1640c9b0c00000
kernel config: https://syzkaller.appspot.com/x/.config?x=47bc4dd423780c4a
dashboard link: https://syzkaller.appspot.com/bug?extid=182aac5a89b85fd7ed4c
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16153a20c00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+182aac...@syzkaller.appspotmail.com

INFO: task syz-executor.0:2196 blocked for more than 140 seconds.
Not tainted 4.4.174+ #4

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

syz-executor.0 D ffff8800b60df648 25408 2196 1 0x00000004
ffff8800b60df648 ffff8800b56e0000 f7ab62caf3163329 ffff8800b56e0000
0000000000000001 ffff8800b56e0800 ffff8801db61f180 ffff8801db61f1a8
ffff8801db61e898 ffff8800b8f90000 ffff8800b56e0000 ffffed0016c1b001
Call Trace:
[<ffffffff82709b79>] schedule+0x99/0x1d0 kernel/sched/core.c:3355
[<ffffffff8270a333>] schedule_preempt_disabled+0x13/0x20
kernel/sched/core.c:3388
[<ffffffff8270c492>] __mutex_lock_common kernel/locking/mutex.c:582
[inline]
[<ffffffff8270c492>] mutex_lock_nested+0x3c2/0xb80
kernel/locking/mutex.c:621
[<ffffffff81d3d70d>] lo_open+0x1d/0xb0 drivers/block/loop.c:1633
[<ffffffff8154f171>] __blkdev_get+0x8b1/0xdf0 fs/block_dev.c:1278
[<ffffffff81551938>] blkdev_get+0x2e8/0x920 fs/block_dev.c:1353
[<ffffffff8155219a>] blkdev_open+0x1aa/0x250 fs/block_dev.c:1508
[<ffffffff8149154f>] do_dentry_open+0x38f/0xbd0 fs/open.c:749
[<ffffffff81494d3b>] vfs_open+0x10b/0x210 fs/open.c:862
[<ffffffff814c5ddf>] do_last fs/namei.c:3269 [inline]
[<ffffffff814c5ddf>] path_openat+0x136f/0x4470 fs/namei.c:3406
[<ffffffff814ccab1>] do_filp_open+0x1a1/0x270 fs/namei.c:3440
[<ffffffff81495668>] do_sys_open+0x2f8/0x600 fs/open.c:1038
[<ffffffff8149599d>] SYSC_open fs/open.c:1056 [inline]
[<ffffffff8149599d>] SyS_open+0x2d/0x40 fs/open.c:1051
[<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
2 locks held by syz-executor.0/2196:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<ffffffff8154e9cc>]
__blkdev_get+0x10c/0xdf0 fs/block_dev.c:1199
#1: (loop_index_mutex){+.+.+.}, at: [<ffffffff81d3d70d>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1633
Sending NMI to all CPUs:

NMI backtrace for cpu 0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.174+ #4
task: ffffffff82e151c0 task.stack: ffffffff82e00000
RIP: 0010:[<ffffffff810a1dc2>] [<ffffffff810a1dc2>]
native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:53
RSP: 0018:ffffffff82e07db0 EFLAGS: 00000246
RAX: 0000000000000007 RBX: ffffffff8319bf68 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff82e15a84
RBP: ffffffff82e07de0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff82e08000 R14: dffffc0000000000 R15: ffffffff82e00000
FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f496aac0000 CR3: 00000001d7679000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffffffff81020b16 ffffffff82e00000 0000000000000000 ffffffff82e08000
dffffc0000000000 ffffffff82e00000 ffffffff82e07df0 ffffffff81022d50
ffffffff82e07e08 ffffffff811eb4c8 0000000000000000 ffffffff82e07ed0
Call Trace:
[<ffffffff81022d50>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:423
[<ffffffff811eb4c8>] default_idle_call+0x48/0x70 kernel/sched/idle.c:93
[<ffffffff811ebca1>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
[<ffffffff811ebca1>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
[<ffffffff811ebca1>] cpu_startup_entry+0x6d1/0x810 kernel/sched/idle.c:301
[<ffffffff827055f9>] rest_init+0x190/0x199 init/main.c:410
[<ffffffff831d58a0>] start_kernel+0x64a/0x67e init/main.c:682
[<ffffffff831d430a>] x86_64_start_reservations+0x29/0x2b
arch/x86/kernel/head64.c:196
[<ffffffff831d4443>] x86_64_start_kernel+0x137/0x15a
arch/x86/kernel/head64.c:185
Code: 2e 0f 1f 84 00 00 00 00 00 fa c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00
00 00 fb c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 fb f4 <c3> 0f 1f 00
66 2e 0f 1f 84 00 00 00 00 00 f4 c3 0f 1f 40 00 66

NMI backtrace for cpu 1

CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4
task: ffff8801da6f2f80 task.stack: ffff8801d9ed8000
RIP: 0010:[<ffffffff8109b617>] [<ffffffff8109b617>] _flat_send_IPI_mask
arch/x86/kernel/apic/apic_flat_64.c:62 [inline]
RIP: 0010:[<ffffffff8109b617>] [<ffffffff8109b617>]
flat_send_IPI_mask+0xf7/0x1b0 arch/x86/kernel/apic/apic_flat_64.c:69
RSP: 0018:ffff8801d9edfc88 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000
RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300
RBP: ffff8801d9edfcb8 R08: 0000000000000018 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246
R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f98de4f1000 CR3: 00000000b7439000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
0000000000000001 ffffffff82e5f2e0 ffffffff831a6ac0 fffffbfff0634c34
000000000001b6c0 0000000000000008 ffff8801d9edfcd8 ffffffff81092bee
0000000000000008 ffffffff82924260 ffff8801d9edfd30 ffffffff81ab8252
Call Trace:
[<ffffffff81092bee>] nmi_raise_cpu_backtrace+0x5e/0x80
arch/x86/kernel/apic/hw_nmi.c:33
[<ffffffff81ab8252>] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae
lib/nmi_backtrace.c:85
[<ffffffff81092ca4>] arch_trigger_all_cpu_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:38
[<ffffffff813b4762>] trigger_all_cpu_backtrace include/linux/nmi.h:44
[inline]
[<ffffffff813b4762>] check_hung_task kernel/hung_task.c:125 [inline]
[<ffffffff813b4762>] check_hung_uninterruptible_tasks
kernel/hung_task.c:182 [inline]
[<ffffffff813b4762>] watchdog.cold+0xd3/0xee kernel/hung_task.c:238
[<ffffffff811342c3>] kthread+0x273/0x310 kernel/kthread.c:211
[<ffffffff82718fc5>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537
Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89
fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00
02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 f1

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: fc67a895 ANDROID: Makefile: Add '-fsplit-lto-unit' to cfi-..
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=162e4ad3200000
kernel config: https://syzkaller.appspot.com/x/.config?x=416e7ad1468db859
dashboard link: https://syzkaller.appspot.com/bug?extid=63695e2a217155600cd2

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+63695e...@syzkaller.appspotmail.com

INFO: task syz-executor.1:2115 blocked for more than 140 seconds.
Not tainted 4.9.168+ #40

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

syz-executor.1 D25272 2115 1 0x00000004
ffff8801d1cd8000 0000000000000000 ffff8801db621000 ffffffff83031180
ffff8801db621018 ffff8801ad85f688 ffffffff8280028e ffff8801d1cd8000
ffffffff841f18c0 00ff8801ad85f5e8 ffff8801db6218f0 1ffff10035b0bec0
Call Trace:
[<000000004a04f7b8>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
[<0000000046a43754>] schedule_preempt_disabled+0x13/0x20
kernel/sched/core.c:3579
[<000000005a073bba>] __mutex_lock_common kernel/locking/mutex.c:582
[inline]
[<000000005a073bba>] mutex_lock_nested+0x38d/0x920
kernel/locking/mutex.c:621
[<00000000d017b8c3>] lo_open+0x1d/0xb0 drivers/block/loop.c:1622
[<00000000edadce5e>] __blkdev_get+0x268/0xeb0 fs/block_dev.c:1287
[<000000008ada6357>] blkdev_get+0x2e8/0x920 fs/block_dev.c:1424
[<00000000168b4641>] blkdev_open+0x1aa/0x250 fs/block_dev.c:1579
[<00000000d32ee3bc>] do_dentry_open+0x422/0xd20 fs/open.c:772
[<00000000be054912>] vfs_open+0x105/0x230 fs/open.c:885
[<000000004964cc2a>] do_last fs/namei.c:3457 [inline]
[<000000004964cc2a>] path_openat+0xbf5/0x2f60 fs/namei.c:3581
[<00000000f83d306d>] do_filp_open+0x1a1/0x280 fs/namei.c:3615
[<00000000290453a1>] do_sys_open+0x2f0/0x610 fs/open.c:1078
[<00000000df6e2f10>] SYSC_open fs/open.c:1096 [inline]
[<00000000df6e2f10>] SyS_open+0x2d/0x40 fs/open.c:1091
[<00000000731adf32>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
[<00000000fb989066>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:

2 locks held by khungtaskd/24:
#0: (rcu_read_lock){......}, at: [<00000000be4d89f1>]
check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
#0: (rcu_read_lock){......}, at: [<00000000be4d89f1>]
watchdog+0x13c/0xae0 kernel/hung_task.c:239
#1: (tasklist_lock){.+.+..}, at: [<000000007b66bb9a>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4339
2 locks held by getty/2028:
#0: (&tty->ldisc_sem){++++++}, at: [<0000000046f75f3a>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.+.}, at: [<000000002ea6811b>]
n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.1/2115:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000004d8140d3>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000d017b8c3>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
2 locks held by syz-executor.5/2121:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000004d8140d3>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000d017b8c3>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
2 locks held by syz-executor.3/2122:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000004d8140d3>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000d017b8c3>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
2 locks held by syz-executor.2/2126:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000004d8140d3>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000d017b8c3>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
2 locks held by syz-executor.4/3197:
#0: (loop_ctl_mutex/1){+.+.+.}, at: [<0000000082d8778a>]
lo_ioctl+0x85/0x1a10 drivers/block/loop.c:1405
#1: (&bdev->bd_mutex){+.+.+.}, at: [<00000000364b04dc>]
blkdev_reread_part+0x1f/0x40 block/ioctl.c:189
1 lock held by syz-executor.4/3212:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000004d8140d3>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
2 locks held by syz-executor.0/3206:
#0: (loop_index_mutex){+.+.+.}, at: [<0000000054be0577>]
loop_control_ioctl+0x7a/0x2f0 drivers/block/loop.c:1973
#1: (loop_ctl_mutex#2){+.+.+.}, at: [<00000000436304ff>]
loop_control_ioctl+0x177/0x2f0 drivers/block/loop.c:1987
1 lock held by syz-executor.0/3208:
#0: (loop_index_mutex){+.+.+.}, at: [<0000000054be0577>]
loop_control_ioctl+0x7a/0x2f0 drivers/block/loop.c:1973
1 lock held by syz-executor.0/3210:
#0: (loop_index_mutex){+.+.+.}, at: [<0000000054be0577>]
loop_control_ioctl+0x7a/0x2f0 drivers/block/loop.c:1973
1 lock held by syz-executor.0/3213:
#0: (loop_index_mutex){+.+.+.}, at: [<0000000054be0577>]
loop_control_ioctl+0x7a/0x2f0 drivers/block/loop.c:1973
2 locks held by blkid/3207:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000004d8140d3>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000d017b8c3>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622

=============================================

NMI backtrace for cpu 1

CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.168+ #40
ffff8801d98d7cc8 ffffffff81b4f5d1 0000000000000001 0000000000000000
0000000000000001 ffffffff81097401 dffffc0000000000 ffff8801d98d7d00
ffffffff81b5a86c 0000000000000001 0000000000000000 0000000000000001
Call Trace:
[<00000000db9e03e3>] __dump_stack lib/dump_stack.c:15 [inline]
[<00000000db9e03e3>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<00000000970375aa>] nmi_cpu_backtrace.cold+0x47/0x87
lib/nmi_backtrace.c:99
[<00000000bc997432>] nmi_trigger_cpumask_backtrace+0x124/0x155
lib/nmi_backtrace.c:60
[<00000000e8a2c097>] arch_trigger_cpumask_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:37
[<000000006f296f32>] trigger_all_cpu_backtrace include/linux/nmi.h:58
[inline]
[<000000006f296f32>] check_hung_task kernel/hung_task.c:125 [inline]
[<000000006f296f32>] check_hung_uninterruptible_tasks
kernel/hung_task.c:182 [inline]
[<000000006f296f32>] watchdog+0x661/0xae0 kernel/hung_task.c:239
[<00000000b5708189>] kthread+0x278/0x310 kernel/kthread.c:211
[<0000000001c19a6f>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff8280f302

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: fc67a895 ANDROID: Makefile: Add '-fsplit-lto-unit' to cfi-..
git tree: android-4.9

console output: https://syzkaller.appspot.com/x/log.txt?x=16f6107b200000

kernel config: https://syzkaller.appspot.com/x/.config?x=416e7ad1468db859
dashboard link: https://syzkaller.appspot.com/bug?extid=63695e2a217155600cd2
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15bd8eb7200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+63695e...@syzkaller.appspotmail.com

audit: type=1400 audit(1555310166.948:5): avc: denied { associate } for
pid=2561 comm="syz-executor.2" name="syz2"
scontext=unconfined_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
INFO: task syz-executor.3:2562 blocked for more than 140 seconds.

Not tainted 4.9.168+ #40
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

syz-executor.3 D25064 2562 1 0x00000004
ffff8801c6925f00 0000000000000000 ffff8801db721000 ffff8801da6b2f80
ffff8801db721018 ffff8801c6587688 ffffffff8280028e ffff8801c6925f00
ffffffff841f18c0 00ff8801c65875e8 ffff8801db7218f0 1ffff10038cb0ec0
Call Trace:
[<00000000163a8279>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
[<000000006d5f35e0>] schedule_preempt_disabled+0x13/0x20
kernel/sched/core.c:3579
[<000000004f053b42>] __mutex_lock_common kernel/locking/mutex.c:582
[inline]
[<000000004f053b42>] mutex_lock_nested+0x38d/0x920
kernel/locking/mutex.c:621
[<00000000da4cb4f1>] lo_open+0x1d/0xb0 drivers/block/loop.c:1622
[<00000000d7962754>] __blkdev_get+0x268/0xeb0 fs/block_dev.c:1287
[<00000000dee2284f>] blkdev_get+0x2e8/0x920 fs/block_dev.c:1424
[<00000000da953169>] blkdev_open+0x1aa/0x250 fs/block_dev.c:1579
[<00000000dfa8662e>] do_dentry_open+0x422/0xd20 fs/open.c:772
[<00000000abed97fa>] vfs_open+0x105/0x230 fs/open.c:885
[<000000008fb9d267>] do_last fs/namei.c:3457 [inline]
[<000000008fb9d267>] path_openat+0xbf5/0x2f60 fs/namei.c:3581
[<00000000acb1029b>] do_filp_open+0x1a1/0x280 fs/namei.c:3615
[<00000000fd375fbe>] do_sys_open+0x2f0/0x610 fs/open.c:1078
[<00000000e04079c3>] SYSC_open fs/open.c:1096 [inline]
[<00000000e04079c3>] SyS_open+0x2d/0x40 fs/open.c:1091
[<00000000dd3b2d6f>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
[<0000000095dd988c>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:

#0: (rcu_read_lock){......}, at: [<000000004c24ecce>]
check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
#0: (rcu_read_lock){......}, at: [<000000004c24ecce>]
watchdog+0x13c/0xae0 kernel/hung_task.c:239
#1: (tasklist_lock){.+.+..}, at: [<00000000ff72bb46>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4339
2 locks held by getty/2024:
#0: (&tty->ldisc_sem){++++++}, at: [<0000000089846e3e>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+...}, at: [<0000000015499139>]
n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.3/2562:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000da4cb4f1>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
3 locks held by syz-executor.5/2568:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a8883252>]
__blkdev_put+0xbb/0x840 fs/block_dev.c:1587
#1: (loop_index_mutex){+.+.+.}, at: [<00000000835cc924>]
lo_release+0x1e/0x1b0 drivers/block/loop.c:1664
#2: (loop_ctl_mutex#2){+.+.+.}, at: [<000000007064606c>] __lo_release
drivers/block/loop.c:1642 [inline]
#2: (loop_ctl_mutex#2){+.+.+.}, at: [<000000007064606c>]
lo_release+0x84/0x1b0 drivers/block/loop.c:1665
2 locks held by syz-executor.1/2571:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000da4cb4f1>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
2 locks held by syz-executor.4/3463:
#0: (loop_ctl_mutex/1){+.+.+.}, at: [<000000000f4956ef>]
lo_ioctl+0x85/0x1a10 drivers/block/loop.c:1405
#1: (&bdev->bd_mutex){+.+.+.}, at: [<00000000ad627b09>]
blkdev_reread_part+0x1f/0x40 block/ioctl.c:189
2 locks held by blkid/3464:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000da4cb4f1>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
1 lock held by blkid/3465:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
2 locks held by syz-executor.2/3468:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000da4cb4f1>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1622
1 lock held by syz-executor.0/3469:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
1 lock held by blkid/3475:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
2 locks held by blkid/3477:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000a4213bfe>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<00000000da4cb4f1>]

lo_open+0x1d/0xb0 drivers/block/loop.c:1622

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.168+ #40
ffff8801d98d7cc8 ffffffff81b4f5d1 0000000000000001 0000000000000000
0000000000000001 ffffffff81097401 dffffc0000000000 ffff8801d98d7d00
ffffffff81b5a86c 0000000000000001 0000000000000000 0000000000000001
Call Trace:

[<0000000080f03fd8>] __dump_stack lib/dump_stack.c:15 [inline]
[<0000000080f03fd8>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<000000004651452f>] nmi_cpu_backtrace.cold+0x47/0x87
lib/nmi_backtrace.c:99
[<00000000dde36ab9>] nmi_trigger_cpumask_backtrace+0x124/0x155
lib/nmi_backtrace.c:60
[<000000006fb8ea04>] arch_trigger_cpumask_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:37
[<00000000ae92b62c>] trigger_all_cpu_backtrace include/linux/nmi.h:58
[inline]
[<00000000ae92b62c>] check_hung_task kernel/hung_task.c:125 [inline]
[<00000000ae92b62c>] check_hung_uninterruptible_tasks
kernel/hung_task.c:182 [inline]
[<00000000ae92b62c>] watchdog+0x661/0xae0 kernel/hung_task.c:239
[<00000000ab465723>] kthread+0x278/0x310 kernel/kthread.c:211
[<00000000d4c2d420>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 7fe05eed Merge 4.9.194 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=17ab0024e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6d462552c77f021

dashboard link: https://syzkaller.appspot.com/bug?extid=63695e2a217155600cd2
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b5d170e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11241e38e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+63695e...@syzkaller.appspotmail.com

INFO: task syz-executor068:2438 blocked for more than 140 seconds.
Not tainted 4.9.194+ #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

syz-executor068 D29096 2438 2435 0x00000000
0000000000000083 ffff8801c80d97c0 ffff8801c858ac00 ffff8801db721000
ffff8801c9775f00 ffff8801db721018 ffff8801c81d7688 ffffffff8281af8e
ffff8801c80d97c0 ffffffff841f8b40 00ff8801c81d75e8 ffff8801db7218f0
Call Trace:
[<000000000f0a2ed7>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
[<00000000f5acc27b>] schedule_preempt_disabled+0x13/0x20
kernel/sched/core.c:3579
[<00000000924350c3>] __mutex_lock_common kernel/locking/mutex.c:582
[inline]
[<00000000924350c3>] mutex_lock_nested+0x38d/0x920
kernel/locking/mutex.c:621
[<000000001859d03e>] lo_open+0x1d/0xb0 drivers/block/loop.c:1621
[<00000000b249d5d9>] __blkdev_get+0x268/0xeb0 fs/block_dev.c:1287
[<0000000021ddb2ff>] blkdev_get+0x2e8/0x920 fs/block_dev.c:1424
[<00000000f7133286>] blkdev_open+0x1aa/0x250 fs/block_dev.c:1579
[<000000005c73c70a>] do_dentry_open+0x422/0xd20 fs/open.c:791
[<00000000fcb80e78>] vfs_open+0x105/0x230 fs/open.c:904
[<000000002356d63d>] do_last fs/namei.c:3541 [inline]
[<000000002356d63d>] path_openat+0xbf5/0x2f60 fs/namei.c:3665
[<000000003cf8e71c>] do_filp_open+0x1a1/0x280 fs/namei.c:3699
[<00000000535f7b1a>] do_sys_open+0x2f0/0x610 fs/open.c:1097
[<00000000563f4a14>] SYSC_open fs/open.c:1115 [inline]
[<00000000563f4a14>] SyS_open+0x2d/0x40 fs/open.c:1110
[<0000000043927aeb>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
[<000000004d3265b6>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:

#0: (rcu_read_lock){......}, at: [<000000003c48beb4>]
check_hung_uninterruptible_tasks kernel/hung_task.c:169 [inline]
#0: (rcu_read_lock){......}, at: [<000000003c48beb4>]
watchdog+0x14b/0xaf0 kernel/hung_task.c:263
#1: (tasklist_lock){.+.+..}, at: [<000000006c930669>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1897:
#0: (&f->f_pos_lock){+.+.+.}, at: [<00000000c430600a>]
__fdget_pos+0xa8/0xd0 fs/file.c:782
2 locks held by getty/2025:
#0: (&tty->ldisc_sem){++++++}, at: [<00000000e099ab48>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+...}, at: [<00000000201a1b54>]
n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
2 locks held by syz-executor068/2438:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000e6504f3f>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<000000001859d03e>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1621
1 lock held by syz-executor068/2469:
#0: (loop_index_mutex){+.+.+.}, at: [<000000005cca9fb3>]
loop_control_ioctl+0x7a/0x320 drivers/block/loop.c:1973
2 locks held by syz-executor068/2472:
#0: (loop_index_mutex){+.+.+.}, at: [<000000005cca9fb3>]
loop_control_ioctl+0x7a/0x320 drivers/block/loop.c:1973
#1: (&lo->lo_ctl_mutex#2){+.+.+.}, at: [<000000005304b2bd>]
loop_control_ioctl+0x17f/0x320 drivers/block/loop.c:1987
2 locks held by syz-executor068/2473:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000006ee9fa0d>]
__blkdev_put+0xbb/0x840 fs/block_dev.c:1587
#1: (loop_index_mutex){+.+.+.}, at: [<00000000d48edcc7>]
lo_release+0x20/0x1b0 drivers/block/loop.c:1663
1 lock held by blkid/2475:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000c9323e6a>]
blkdev_put+0x2b/0x560 fs/block_dev.c:1629
2 locks held by blkid/2476:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<000000006ee9fa0d>]
__blkdev_put+0xbb/0x840 fs/block_dev.c:1587
#1: (loop_index_mutex){+.+.+.}, at: [<00000000d48edcc7>]
lo_release+0x20/0x1b0 drivers/block/loop.c:1663
2 locks held by syz-executor068/2480:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000e6504f3f>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<000000001859d03e>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1621
1 lock held by blkid/2482:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000e6504f3f>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
1 lock held by blkid/2483:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000e6504f3f>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
2 locks held by blkid/2484:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000e6504f3f>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<000000001859d03e>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1621
2 locks held by syz-executor068/2485:
#0: (&lo->lo_ctl_mutex/1){+.+.+.}, at: [<00000000bfaf2b37>]
lo_ioctl+0x8e/0x1b10 drivers/block/loop.c:1404
#1: (&bdev->bd_mutex){+.+.+.}, at: [<000000006b0b5cf4>]
blkdev_reread_part+0x1f/0x40 block/ioctl.c:189
2 locks held by blkid/2487:
#0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000e6504f3f>]
__blkdev_get+0x10e/0xeb0 fs/block_dev.c:1273
#1: (loop_index_mutex){+.+.+.}, at: [<000000001859d03e>]
lo_open+0x1d/0xb0 drivers/block/loop.c:1621

=============================================

NMI backtrace for cpu 1

CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.194+ #0
ffff8801d98d7cc8 ffffffff81b67001 0000000000000001 0000000000000000
0000000000000001 ffffffff81099d01 dffffc0000000000 ffff8801d98d7d00
ffffffff81b7229c 0000000000000001 0000000000000000 0000000000000001
Call Trace:
[<000000006dae6b7e>] __dump_stack lib/dump_stack.c:15 [inline]
[<000000006dae6b7e>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<00000000cd495e85>] nmi_cpu_backtrace.cold+0x47/0x87
lib/nmi_backtrace.c:99
[<0000000024dda49f>] nmi_trigger_cpumask_backtrace+0x124/0x155
lib/nmi_backtrace.c:60
[<00000000039273c7>] arch_trigger_cpumask_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:37
[<000000007597b42d>] trigger_all_cpu_backtrace include/linux/nmi.h:58
[inline]
[<000000007597b42d>] check_hung_task kernel/hung_task.c:126 [inline]
[<000000007597b42d>] check_hung_uninterruptible_tasks
kernel/hung_task.c:183 [inline]
[<000000007597b42d>] watchdog+0x670/0xaf0 kernel/hung_task.c:263
[<00000000ef32b2f2>] kthread+0x278/0x310 kernel/kthread.c:211
[<00000000840713bf>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375

Sending NMI from CPU 1 to CPUs 0:

NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff8282a0e1