INFO: task hung in ext4_direct_IO
14 views
Skip to first unread message
syzbot
Apr 12, 2019, 8:01:27 PM4/12/19
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 5a76363f ANDROID: mnt: Propagate remount correctly
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=14a58990c00000
kernel config: https://syzkaller.appspot.com/x/.config?x=20694422a3d7714d
dashboard link: https://syzkaller.appspot.com/bug?extid=8276d5dd1fd7d7629adc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8276d5...@syzkaller.appspotmail.com
device lo entered promiscuous mode
Y�4��`Ҙ: renamed from lo
INFO: task syz-executor2:4950 blocked for more than 140 seconds.
Not tainted 4.14.94+ #12
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2 D25568 4950 1831 0x00000004
Call Trace:
schedule+0x92/0x1c0 kernel/sched/core.c:3490
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x21f/0x3c0 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x45/0xa0 kernel/locking/rwsem.c:26
inode_lock_shared include/linux/fs.h:725 [inline]
ext4_direct_IO_read fs/ext4/inode.c:3798 [inline]
ext4_direct_IO+0x546/0x2800 fs/ext4/inode.c:3862
generic_file_read_iter+0x24a/0x1a90 mm/filemap.c:2242
ext4_file_read_iter+0x119/0x180 fs/ext4/file.c:75
call_read_iter include/linux/fs.h:1778 [inline]
generic_file_splice_read+0x30d/0x540 fs/splice.c:307
do_splice_to+0xfd/0x150 fs/splice.c:880
splice_direct_to_actor+0x21a/0x760 fs/splice.c:952
do_splice_direct+0x177/0x240 fs/splice.c:1061
do_sendfile+0x493/0xb20 fs/read_write.c:1438
SYSC_sendfile64 fs/read_write.c:1493 [inline]
SyS_sendfile64+0xab/0x140 fs/read_write.c:1485
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
Showing all locks held in the system:
1 lock held by khungtaskd/23:
#0: (tasklist_lock){.+.?}, at: [<ffffffff8ebffc0c>]
debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4541
2 locks held by getty/1744:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff8f7369d2>]
tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:275
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8f731df7>]
n_tty_read+0x1f7/0x1700 drivers/tty/n_tty.c:2156
2 locks held by syz-executor2/4950:
#0: (sb_writers#4){.+.+}, at: [<ffffffff8ef55eef>] file_start_write
include/linux/fs.h:2726 [inline]
#0: (sb_writers#4){.+.+}, at: [<ffffffff8ef55eef>]
do_sendfile+0x88f/0xb20 fs/read_write.c:1437
#1: (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff8f154d06>]
inode_lock_shared include/linux/fs.h:725 [inline]
#1: (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff8f154d06>]
ext4_direct_IO_read fs/ext4/inode.c:3798 [inline]
#1: (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff8f154d06>]
ext4_direct_IO+0x546/0x2800 fs/ext4/inode.c:3862
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.94+ #12
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x10e lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x47/0x86 lib/nmi_backtrace.c:101
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 9533 Comm: syz-executor5 Not tainted 4.14.94+ #12
task: ffff8881a2564680 task.stack: ffff8881a1ee0000
RIP: 0010:__sanitizer_cov_trace_pc+0x23/0x60 kernel/kcov.c:68
RSP: 0018:ffff8881a1ee7bc8 EFLAGS: 00000246
RAX: ffff8881a2564680 RBX: 0000000033f456a1 RCX: 1ffffffff2202328
RDX: 0000000000000000 RSI: ffffffff9094ffc0 RDI: ffffffff90950000
RBP: ffffffff90950000 R08: 0000000000000002 R09: 0000000000020025
R10: ffff8881a2564eb0 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffff9094ffc0 R14: ffff8881a1ee7ce8 R15: ffffc900000c0030
FS: 00007faf2f9bf700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001d4c678 CR3: 00000001c8a8c001 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
check_preemption_disabled+0x30/0x1f0 lib/smp_processor_id.c:16
rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:360 [inline]
rcu_is_watching+0x11/0xb0 kernel/rcu/tree.c:1130
rcu_read_unlock include/linux/rcupdate.h:683 [inline]
bpf_test_run_one net/bpf/test_run.c:21 [inline]
bpf_test_run+0x1d8/0x340 net/bpf/test_run.c:36
bpf_prog_test_run_xdp+0x169/0x270 net/bpf/test_run.c:167
bpf_prog_test_run kernel/bpf/syscall.c:1343 [inline]
SYSC_bpf kernel/bpf/syscall.c:1615 [inline]
SyS_bpf+0xe9f/0x3690 kernel/bpf/syscall.c:1560
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
Code: 00 00 e9 90 ed ff ff 90 65 48 8b 04 25 c0 de 01 00 48 85 c0 74 1a 65
8b 15 fb 4e 31 71 81 e2 00 01 1f 00 75 0b 8b 90 a8 11 00 00 <83> fa 01 74
01 c3 48 c7 c2 00 00 00 81 48 81 ea 00 00 a0 8e 48
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 5a76363f ANDROID: mnt: Propagate remount correctly
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=14a58990c00000
kernel config: https://syzkaller.appspot.com/x/.config?x=20694422a3d7714d
dashboard link: https://syzkaller.appspot.com/bug?extid=8276d5dd1fd7d7629adc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8276d5...@syzkaller.appspotmail.com
device lo entered promiscuous mode
Y�4��`Ҙ: renamed from lo
INFO: task syz-executor2:4950 blocked for more than 140 seconds.
Not tainted 4.14.94+ #12
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2 D25568 4950 1831 0x00000004
Call Trace:
schedule+0x92/0x1c0 kernel/sched/core.c:3490
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x21f/0x3c0 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x45/0xa0 kernel/locking/rwsem.c:26
inode_lock_shared include/linux/fs.h:725 [inline]
ext4_direct_IO_read fs/ext4/inode.c:3798 [inline]
ext4_direct_IO+0x546/0x2800 fs/ext4/inode.c:3862
generic_file_read_iter+0x24a/0x1a90 mm/filemap.c:2242
ext4_file_read_iter+0x119/0x180 fs/ext4/file.c:75
call_read_iter include/linux/fs.h:1778 [inline]
generic_file_splice_read+0x30d/0x540 fs/splice.c:307
do_splice_to+0xfd/0x150 fs/splice.c:880
splice_direct_to_actor+0x21a/0x760 fs/splice.c:952
do_splice_direct+0x177/0x240 fs/splice.c:1061
do_sendfile+0x493/0xb20 fs/read_write.c:1438
SYSC_sendfile64 fs/read_write.c:1493 [inline]
SyS_sendfile64+0xab/0x140 fs/read_write.c:1485
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
Showing all locks held in the system:
1 lock held by khungtaskd/23:
#0: (tasklist_lock){.+.?}, at: [<ffffffff8ebffc0c>]
debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4541
2 locks held by getty/1744:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff8f7369d2>]
tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:275
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8f731df7>]
n_tty_read+0x1f7/0x1700 drivers/tty/n_tty.c:2156
2 locks held by syz-executor2/4950:
#0: (sb_writers#4){.+.+}, at: [<ffffffff8ef55eef>] file_start_write
include/linux/fs.h:2726 [inline]
#0: (sb_writers#4){.+.+}, at: [<ffffffff8ef55eef>]
do_sendfile+0x88f/0xb20 fs/read_write.c:1437
#1: (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff8f154d06>]
inode_lock_shared include/linux/fs.h:725 [inline]
#1: (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff8f154d06>]
ext4_direct_IO_read fs/ext4/inode.c:3798 [inline]
#1: (&sb->s_type->i_mutex_key#9){++++}, at: [<ffffffff8f154d06>]
ext4_direct_IO+0x546/0x2800 fs/ext4/inode.c:3862
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.94+ #12
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x10e lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x47/0x86 lib/nmi_backtrace.c:101
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 9533 Comm: syz-executor5 Not tainted 4.14.94+ #12
task: ffff8881a2564680 task.stack: ffff8881a1ee0000
RIP: 0010:__sanitizer_cov_trace_pc+0x23/0x60 kernel/kcov.c:68
RSP: 0018:ffff8881a1ee7bc8 EFLAGS: 00000246
RAX: ffff8881a2564680 RBX: 0000000033f456a1 RCX: 1ffffffff2202328
RDX: 0000000000000000 RSI: ffffffff9094ffc0 RDI: ffffffff90950000
RBP: ffffffff90950000 R08: 0000000000000002 R09: 0000000000020025
R10: ffff8881a2564eb0 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffff9094ffc0 R14: ffff8881a1ee7ce8 R15: ffffc900000c0030
FS: 00007faf2f9bf700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001d4c678 CR3: 00000001c8a8c001 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
check_preemption_disabled+0x30/0x1f0 lib/smp_processor_id.c:16
rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:360 [inline]
rcu_is_watching+0x11/0xb0 kernel/rcu/tree.c:1130
rcu_read_unlock include/linux/rcupdate.h:683 [inline]
bpf_test_run_one net/bpf/test_run.c:21 [inline]
bpf_test_run+0x1d8/0x340 net/bpf/test_run.c:36
bpf_prog_test_run_xdp+0x169/0x270 net/bpf/test_run.c:167
bpf_prog_test_run kernel/bpf/syscall.c:1343 [inline]
SYSC_bpf kernel/bpf/syscall.c:1615 [inline]
SyS_bpf+0xe9f/0x3690 kernel/bpf/syscall.c:1560
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
Code: 00 00 e9 90 ed ff ff 90 65 48 8b 04 25 c0 de 01 00 48 85 c0 74 1a 65
8b 15 fb 4e 31 71 81 e2 00 01 1f 00 75 0b 8b 90 a8 11 00 00 <83> fa 01 74
01 c3 48 c7 c2 00 00 00 81 48 81 ea 00 00 a0 8e 48
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 14, 2019, 5:33:14 AM4/14/19
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 1597fdfe ANDROID: arm64: lse: fix LSE atomics with LTO
syzbot found the following crash on:
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=12e0ca2b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=c3aa51a48c31c16b
dashboard link: https://syzkaller.appspot.com/bug?extid=c229be7fd1b011e85b74
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c229be...@syzkaller.appspotmail.com
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
INFO: task syz-executor.4:23629 blocked for more than 140 seconds.
Not tainted 4.9.155+ #27
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D26552 23629 3838 0x00000004
ffff8801d3bbdf00 ffff8801a5e9d800 ffff8801db621000 ffff8801a5e797c0
ffff8801db621018 ffff8801a650f450 ffffffff82806806 dffffc0000000000
ffff8801a650f428 ffffffff81207081 00ffffff8281290b ffff8801db6218f0
Call Trace:
[<ffffffff82807d92>] schedule+0x92/0x1c0 kernel/sched/core.c:3553
[<ffffffff82812aa8>] rwsem_down_read_failed+0x258/0x3e0
kernel/locking/rwsem-xadd.c:260
[<ffffffff81b78ff8>] call_rwsem_down_read_failed+0x18/0x30
arch/x86/lib/rwsem.S:94
[<ffffffff828108a2>] __down_read arch/x86/include/asm/rwsem.h:65 [inline]
[<ffffffff828108a2>] down_read+0x52/0xb0 kernel/locking/rwsem.c:24
[<ffffffff816e26ff>] inode_lock_shared include/linux/fs.h:778 [inline]
[<ffffffff816e26ff>] ext4_direct_IO_read fs/ext4/inode.c:3595 [inline]
[<ffffffff816e26ff>] ext4_direct_IO+0x51f/0x29c0 fs/ext4/inode.c:3662
[<ffffffff814143cf>] generic_file_read_iter+0xaaf/0x1ac0 mm/filemap.c:1964
[<ffffffff815ad69c>] generic_file_splice_read+0x28c/0x4c0 fs/splice.c:309
[<ffffffff815add28>] do_splice_to+0x108/0x170 fs/splice.c:899
[<ffffffff815adfd6>] splice_direct_to_actor+0x246/0x820 fs/splice.c:971
[<ffffffff815ae755>] do_splice_direct+0x1a5/0x260 fs/splice.c:1080
[<ffffffff8150f8f3>] do_sendfile+0x503/0xc00 fs/read_write.c:1395
[<ffffffff815118e5>] SYSC_sendfile64 fs/read_write.c:1456 [inline]
[<ffffffff815118e5>] SyS_sendfile64+0x145/0x160 fs/read_write.c:1442
[<ffffffff810056bd>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
[<ffffffff82816a93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Showing all locks held in the system:
#0: (rcu_read_lock){......}, at: [<ffffffff8131bbab>]
check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
#0: (rcu_read_lock){......}, at: [<ffffffff8131bbab>]
watchdog+0x11b/0xa40 kernel/hung_task.c:239
#1: (tasklist_lock){.+.+..}, at: [<ffffffff813fea8f>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1909:
#0: (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156f2f8>]
__fdget_pos+0xa8/0xd0 fs/file.c:781
2 locks held by getty/2037:
#0: (&tty->ldisc_sem){++++++}, at: [<ffffffff82814b83>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d3982e>]
n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.4/23629:
#0: (sb_writers#4){.+.+.+}, at: [<ffffffff8150fd2a>] file_start_write
include/linux/fs.h:2642 [inline]
#0: (sb_writers#4){.+.+.+}, at: [<ffffffff8150fd2a>]
do_sendfile+0x93a/0xc00 fs/read_write.c:1394
#1: (&sb->s_type->i_mutex_key#9){++++++}, at: [<ffffffff816e26ff>]
inode_lock_shared include/linux/fs.h:778 [inline]
#1: (&sb->s_type->i_mutex_key#9){++++++}, at: [<ffffffff816e26ff>]
ext4_direct_IO_read fs/ext4/inode.c:3595 [inline]
#1: (&sb->s_type->i_mutex_key#9){++++++}, at: [<ffffffff816e26ff>]
ext4_direct_IO+0x51f/0x29c0 fs/ext4/inode.c:3662
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.155+ #27
ffff8801d9907cd0 ffffffff81b47871 0000000000000000 0000000000000000
0000000000000000 ffffffff81097301 00000000003ffd5d ffff8801d9907d08
ffffffff81b52afc 0000000000000000 0000000000000000 0000000000000000
Call Trace:
[<ffffffff81b47871>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81b47871>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<ffffffff81b52afc>] nmi_cpu_backtrace.cold+0x47/0x87
lib/nmi_backtrace.c:99
[<ffffffff81b52a84>] nmi_trigger_cpumask_backtrace+0x124/0x155
lib/nmi_backtrace.c:60
[<ffffffff81097494>] arch_trigger_cpumask_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:37
[<ffffffff8131c087>] trigger_all_cpu_backtrace include/linux/nmi.h:58
[inline]
[<ffffffff8131c087>] check_hung_task kernel/hung_task.c:125 [inline]
[<ffffffff8131c087>] check_hung_uninterruptible_tasks
kernel/hung_task.c:182 [inline]
[<ffffffff8131c087>] watchdog+0x5f7/0xa40 kernel/hung_task.c:239
[<ffffffff81142028>] kthread+0x278/0x310 kernel/kthread.c:211
[<ffffffff82816c5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 13336 Comm: syz-executor.1 Not tainted 4.9.155+ #27
task: ffff8801a5e797c0 task.stack: ffff8801ab898000
RIP: 0033:[<000000000040159b>] c [<000000000040159b>] 0x40159b
RSP: 002b:00007f2ee5672690 EFLAGS: 00000286
RAX: 00000000baeaab3a RBX: 000000000000000b RCX: 0000000000458079
RDX: 0000000100000000 RSI: 00007f2ee56726c0 RDI: 000000000000000b
RBP: 0000000000000000 R08: 0077697275636573 R09: 0000000000000000
R10: 25328dfb00000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f2ee5673700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c42b50c000 CR3: 00000001a673e000 CR4: 00000000001606b0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
syzbot
Sep 14, 2019, 4:30:05 PM9/14/19
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
syzbot
Sep 23, 2019, 8:02:05 AM9/23/19
to syzkaller-a...@googlegroups.com
Reply all
Reply to author
Forward
0 new messages