INFO: task hung in unlink_file_vma

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 4ed22187 Revert "ANDROID: Revert "arm64: move ELF_ET_DYN_B..
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=150d2583400000
kernel config: https://syzkaller.appspot.com/x/.config?x=7acec4778e485bac
dashboard link: https://syzkaller.appspot.com/bug?extid=970d2dcfa0db6c36efb9
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+970d2d...@syzkaller.appspotmail.com

ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
INFO: task syz-executor0:1835 blocked for more than 140 seconds.
Not tainted 4.14.78+ #26
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0 D27928 1835 1790 0x80000004
Call Trace:
schedule+0x7f/0x1b0 kernel/sched/core.c:3490
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:565 [inline]
rwsem_down_write_failed+0x390/0x730 kernel/locking/rwsem-xadd.c:594
call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x4f/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:468 [inline]
unlink_file_vma+0x6e/0xa0 mm/mmap.c:157
free_pgtables+0x7c/0x220 mm/memory.c:630
exit_mmap+0x208/0x420 mm/mmap.c:3069
__mmput kernel/fork.c:929 [inline]
mmput+0xc8/0x350 kernel/fork.c:950
exit_mm kernel/exit.c:544 [inline]
do_exit+0x83b/0x2800 kernel/exit.c:852
do_group_exit+0x100/0x2e0 kernel/exit.c:968
get_signal+0x4e5/0x1470 kernel/signal.c:2348
do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x41124a
RSP: 002b:00007fff2298b658 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 0000000000000731 RCX: 000000000041124a
RDX: 0000000040000000 RSI: 00007fff2298b664 RDI: ffffffffffffffff
RBP: 000000000072c988 R08: 000000000000072b R09: 000000000211d940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010
R13: 0000000000412e50 R14: 0000000000000000 R15: 0000000000000000

Showing all locks held in the system:
1 lock held by khungtaskd/23:
#0: (tasklist_lock){.+.+}, at: [<ffffffff91e02047>]
debug_show_all_locks+0x74/0x20f kernel/locking/lockdep.c:4541
2 locks held by getty/1755:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff9292f4c0>]
tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff9292aa3f>]
n_tty_read+0x1ff/0x15e0 drivers/tty/n_tty.c:2142
1 lock held by syz-executor0/1835:
#0: (&mapping->i_mmap_rwsem){++++}, at: [<ffffffff920dcebe>]
i_mmap_lock_write include/linux/fs.h:468 [inline]
#0: (&mapping->i_mmap_rwsem){++++}, at: [<ffffffff920dcebe>]
unlink_file_vma+0x6e/0xa0 mm/mmap.c:157
2 locks held by syz-executor1/6462:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff9292f4c0>]
tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff9292aa3f>]
n_tty_read+0x1ff/0x15e0 drivers/tty/n_tty.c:2142
2 locks held by syz-executor2/10925:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff9292f4c0>]
tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
#1: (&tty->atomic_write_lock){+.+.}, at: [<ffffffff92914ffb>]
tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor2/10928:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff9292f4c0>]
tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
#1: (&tty->atomic_write_lock){+.+.}, at: [<ffffffff92914ffb>]
tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.78+ #26
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x11b lib/dump_stack.c:53
nmi_cpu_backtrace.cold.0+0x47/0x85 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x121/0x146 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
watchdog+0x574/0xa70 kernel/hung_task.c:252
kthread+0x348/0x420 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 31340 Comm: syz-executor5 Not tainted 4.14.78+ #26
task: ffff8801c0a34680 task.stack: ffff880198ad8000
RIP: 0033:0x4015b4
RSP: 002b:00007fb8a4874710 EFLAGS: 00000286
RAX: 000000009ac8f033 RBX: 0000000000000007 RCX: 0000000000457569
RDX: 0000000000457569 RSI: 00007fb8a4874740 RDI: 0000000000000007
RBP: 000000000072bf00 R08: 0000000000000000 R09: 00000000004bd9e6
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c
R13: 00007ffd63d991ff R14: 00007fb8a48759c0 R15: 0000000000000000
FS: 00007fb8a4875700(0000) GS:ffff8801dba00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c423d91010 CR3: 0000000181464001 CR4: 00000000001606b0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: a2f9236e Merge 4.9.147 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=1596c027400000
kernel config: https://syzkaller.appspot.com/x/.config?x=cd889df9a2ecd6
dashboard link: https://syzkaller.appspot.com/bug?extid=2d7f74277c0edd4af8d2

compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+2d7f74...@syzkaller.appspotmail.com

INFO: task syz-executor3:10482 blocked for more than 140 seconds.
Not tainted 4.9.147+ #86

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

syz-executor3 D28912 10482 2047 0x80000004
ffff88019d132f80 0000000000000000 ffff8801d9416e00 ffffffff8302d180
ffff8801db621018 ffff8801d8c475e0 ffffffff8280a232 ffff8801d8c475b8
ffffffff81206ef7 0000000000000000 00ff88019d133828 ffff8801db6218f0
Call Trace:
[<ffffffff8280b75f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
[<ffffffff8281555a>] __rwsem_down_write_failed_common
kernel/locking/rwsem-xadd.c:526 [inline]
[<ffffffff8281555a>] rwsem_down_write_failed+0x39a/0x730
kernel/locking/rwsem-xadd.c:555
[<ffffffff81b761d7>] call_rwsem_down_write_failed+0x17/0x30
arch/x86/lib/rwsem.S:105
[<ffffffff8281437c>] __down_write arch/x86/include/asm/rwsem.h:125 [inline]
[<ffffffff8281437c>] down_write+0x5c/0xa0 kernel/locking/rwsem.c:54
[<ffffffff814abed5>] i_mmap_lock_write include/linux/fs.h:526 [inline]
[<ffffffff814abed5>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156
[<ffffffff8149693f>] free_pgtables+0x7f/0x240 mm/memory.c:544
[<ffffffff814b0f5b>] exit_mmap+0x1db/0x3a0 mm/mmap.c:3023
[<ffffffff810d26ed>] __mmput kernel/fork.c:884 [inline]
[<ffffffff810d26ed>] mmput+0xcd/0x360 kernel/fork.c:906
[<ffffffff810e6c19>] exit_mm kernel/exit.c:514 [inline]
[<ffffffff810e6c19>] do_exit+0x6c9/0x2a50 kernel/exit.c:820
[<ffffffff810ed431>] do_group_exit+0x111/0x300 kernel/exit.c:937
[<ffffffff8110ebe1>] get_signal+0x4e1/0x1460 kernel/signal.c:2321
[<ffffffff81052b35>] do_signal+0x95/0x1b00 arch/x86/kernel/signal.c:807
[<ffffffff81003e2e>] exit_to_usermode_loop+0x10e/0x150
arch/x86/entry/common.c:158
[<ffffffff81005932>] prepare_exit_to_usermode arch/x86/entry/common.c:194
[inline]
[<ffffffff81005932>] syscall_return_slowpath arch/x86/entry/common.c:263
[inline]
[<ffffffff81005932>] do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
[<ffffffff8281a4d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:

2 locks held by khungtaskd/24:
#0: (rcu_read_lock){......}, at: [<ffffffff8131c2ac>]
check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
#0: (rcu_read_lock){......}, at: [<ffffffff8131c2ac>]
watchdog+0x11c/0xa20 kernel/hung_task.c:239
#1: (tasklist_lock){.+.+..}, at: [<ffffffff813fec5f>]
debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1898:
#0: (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156d59c>]
__fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by getty/2025:
#0: (&tty->ldisc_sem){++++++}, at: [<ffffffff828185c2>]
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
#1: (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d38172>]
n_tty_read+0x202/0x1830 drivers/tty/n_tty.c:2156
1 lock held by syz-executor3/10482:
#0: (&mapping->i_mmap_rwsem){++++..}, at: [<ffffffff814abed5>]
i_mmap_lock_write include/linux/fs.h:526 [inline]
#0: (&mapping->i_mmap_rwsem){++++..}, at: [<ffffffff814abed5>]
unlink_file_vma+0x75/0xb0 mm/mmap.c:156
1 lock held by syz-executor3/6681:
#0: (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>]
prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor3/6763:
#0: (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>]
prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor1/14581:
#0: (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>]
prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor0/8985:
#0: (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>]
prepare_bprm_creds+0x53/0x110 fs/exec.c:1369
1 lock held by syz-executor0/9026:
#0: (&sig->cred_guard_mutex){+.+.+.}, at: [<ffffffff81521093>]
prepare_bprm_creds+0x53/0x110 fs/exec.c:1369

=============================================

NMI backtrace for cpu 1

CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.147+ #86
ffff8801d9907d08 ffffffff81b43be9 0000000000000000 0000000000000001
0000000000000001 0000000000000001 ffffffff81098440 ffff8801d9907d40
ffffffff81b4ecf9 0000000000000001 0000000000000000 0000000000000003
Call Trace:
[<ffffffff81b43be9>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81b43be9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff81b4ecf9>] nmi_cpu_backtrace.cold.0+0x48/0x87
lib/nmi_backtrace.c:99
[<ffffffff81b4ec8c>] nmi_trigger_cpumask_backtrace+0x12c/0x151
lib/nmi_backtrace.c:60
[<ffffffff81098544>] arch_trigger_cpumask_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:37
[<ffffffff8131c83d>] trigger_all_cpu_backtrace include/linux/nmi.h:58
[inline]
[<ffffffff8131c83d>] check_hung_task kernel/hung_task.c:125 [inline]
[<ffffffff8131c83d>] check_hung_uninterruptible_tasks
kernel/hung_task.c:182 [inline]
[<ffffffff8131c83d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
[<ffffffff81142cbd>] kthread+0x26d/0x300 kernel/kthread.c:211
[<ffffffff8281a69c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Sending NMI from CPU 1 to CPUs 0:

NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff82819106

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.

[syzbot]