[syzbot] [jfs?] INFO: task hung in txBegin

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 50736169ecc8 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=172777ee980000
kernel config: https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17dccdda980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1644d08e980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5cd6a6f1e8a6/disk-50736169.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2fb1a68197bc/vmlinux-50736169.xz
kernel image: https://storage.googleapis.com/syzbot-assets/783059c8c714/bzImage-50736169.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/95d758e45724/mount_0.gz

Bisection is inconclusive: the issue happens on the oldest tested release.

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13861201980000
final oops: https://syzkaller.appspot.com/x/report.txt?x=10461201980000
console output: https://syzkaller.appspot.com/x/log.txt?x=17861201980000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eda89a...@syzkaller.appspotmail.com

INFO: task kworker/u8:11:2848 blocked for more than 143 seconds.
Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:11 state:D stack:23552 pid:2848 tgid:2848 ppid:2 flags:0x00004000
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0x1796/0x49d0 kernel/sched/core.c:6745
__schedule_loop kernel/sched/core.c:6822 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6837
io_schedule+0x8d/0x110 kernel/sched/core.c:9043
TXN_SLEEP_DROP_LOCK fs/jfs/jfs_txnmgr.c:125 [inline]
txBegin+0x260/0xce0 fs/jfs/jfs_txnmgr.c:374
jfs_commit_inode+0x223/0x590 fs/jfs/inode.c:101
jfs_write_inode+0x143/0x220 fs/jfs/inode.c:132
write_inode fs/fs-writeback.c:1497 [inline]
__writeback_single_inode+0x6b9/0x10b0 fs/fs-writeback.c:1716
writeback_sb_inodes+0x99c/0x1380 fs/fs-writeback.c:1947
wb_writeback+0x481/0xd40 fs/fs-writeback.c:2127
wb_do_writeback fs/fs-writeback.c:2274 [inline]
wb_workfn+0x410/0x1090 fs/fs-writeback.c:2314
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
INFO: task syz-executor117:5099 blocked for more than 143 seconds.
Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor117 state:D stack:19408 pid:5099 tgid:5099 ppid:5098 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0x1796/0x49d0 kernel/sched/core.c:6745
__schedule_loop kernel/sched/core.c:6822 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6837
wb_wait_for_completion+0x166/0x290 fs/fs-writeback.c:216
__writeback_inodes_sb_nr+0x2d2/0x380 fs/fs-writeback.c:2706
sync_filesystem+0xa4/0x230 fs/sync.c:54
generic_shutdown_super+0x72/0x2d0 fs/super.c:621
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe052acc017
RSP: 002b:00007ffd7811a4d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe052acc017
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd7811a590
RBP: 00007ffd7811a590 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffd7811b5f0
R13: 00005555816966c0 R14: 000000000000000f R15: 431bde82d7b634db
</TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614
2 locks held by kworker/u8:11/2848:
#0: ffff88801ae86148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff88801ae86148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc900098b7d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc900098b7d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
2 locks held by getty/4845:
#0: ffff88802a5ab0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002f162f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2211
1 lock held by syz-executor117/5099:
#0: ffff88802c5e00e0 (&type->s_umount_key#46){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88802c5e00e0 (&type->s_umount_key#46){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88802c5e00e0 (&type->s_umount_key#46){+.+.}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 30 Comm: khungtaskd Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xfde/0x1020 kernel/hung_task.c:379
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 51 Comm: kworker/u8:3 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x0/0x90 kernel/kcov.c:310
Code: 10 48 89 74 0a 18 4c 89 44 0a 20 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 4c 8b 04 24 65 48 8b 0c 25 80 d4 03 00 65 8b 05 f0 aa
RSP: 0018:ffffc90000bb7638 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 000ffffffffff000 RCX: ffff888015193c00
RDX: 000000001507c558 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000bb7730 R08: ffffffff81e6dded R09: 1ffffffff25edcb0
R10: dffffc0000000000 R11: fffffbfff25edcb1 R12: 1ffff92000176ed0
R13: 000000001507c067 R14: 0000000000000000 R15: 1ffff92000176ed8
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005617e0440680 CR3: 000000000e132000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
pmd_pfn_mask arch/x86/include/asm/pgtable_types.h:453 [inline]
pmd_pfn arch/x86/include/asm/pgtable.h:234 [inline]
pte_lockptr include/linux/mm.h:2955 [inline]
__pte_offset_map_lock+0x17b/0x300 mm/pgtable-generic.c:374
get_locked_pte include/linux/mm.h:2744 [inline]
__text_poke+0x2c5/0xd30 arch/x86/kernel/alternative.c:1883
text_poke arch/x86/kernel/alternative.c:1968 [inline]
text_poke_bp_batch+0x8cd/0xb30 arch/x86/kernel/alternative.c:2357
text_poke_flush arch/x86/kernel/alternative.c:2470 [inline]
text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2477
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
static_key_enable_cpuslocked+0x136/0x260 kernel/jump_label.c:205
static_key_enable+0x1a/0x20 kernel/jump_label.c:218
toggle_allocation_gate+0xb5/0x250 mm/kfence/core.c:826
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.555 msecs


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Lizhi Xu]

#syz test: upstream 50736169ecc8

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 92a5b8283528..0209ebe97e7f 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2123,10 +2123,12 @@ static long wb_writeback(struct bdi_writeback *wb,
queue_io(wb, work, dirtied_before);
queued = true;
}
+ down_write(&work->sb->s_umount);
if (work->sb)
progress = writeback_sb_inodes(work->sb, wb, work);
else
progress = __writeback_inodes_wb(wb, work);
+ up_write(&work->sb->s_umount);
trace_writeback_written(wb, work);

/*

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

] sched_clock: Marking stable (15250029932, 36185301)->(15287226125, -1010892)
[ 15.298765][ T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[ 15.310198][ T1] registered taskstats version 1
[ 15.329828][ T1] Loading compiled-in X.509 certificates
[ 15.340885][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: d166f013ab7b5f705951ab1c608c6a6dfb658aa3'
[ 15.661847][ T1] zswap: loaded using pool lzo/zsmalloc
[ 15.670437][ T1] Demotion targets for Node 0: null
[ 15.675655][ T1] Demotion targets for Node 1: null
[ 15.681002][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 18.073034][ T1] Key type .fscrypt registered
[ 18.077881][ T1] Key type fscrypt-provisioning registered
[ 18.091455][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 18.115633][ T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[ 18.124399][ T1] Key type big_key registered
[ 18.138791][ T1] Key type encrypted registered
[ 18.143916][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 18.150666][ T1] Loading compiled-in module X.509 certificates
[ 18.160083][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: d166f013ab7b5f705951ab1c608c6a6dfb658aa3'
[ 18.171536][ T1] ima: Allocated hash algorithm: sha256
[ 18.177605][ T1] ima: No architecture policies found
[ 18.183789][ T1] evm: Initialising EVM extended attributes:
[ 18.189828][ T1] evm: security.selinux (disabled)
[ 18.194960][ T1] evm: security.SMACK64
[ 18.199198][ T1] evm: security.SMACK64EXEC
[ 18.203935][ T1] evm: security.SMACK64TRANSMUTE
[ 18.209359][ T1] evm: security.SMACK64MMAP
[ 18.213937][ T1] evm: security.apparmor (disabled)
[ 18.219172][ T1] evm: security.ima
[ 18.223027][ T1] evm: security.capability
[ 18.227718][ T1] evm: HMAC attrs: 0x1
[ 18.234253][ T1] PM: Magic number: 12:850:256
[ 18.239435][ T1] sound controlC0: hash matches
[ 18.244901][ T1] vhci_hcd vhci_hcd.3: hash matches
[ 18.250600][ T1] tty ttytf: hash matches
[ 18.255802][ T1] printk: legacy console [netcon0] enabled
[ 18.261717][ T1] netconsole: network logging started
[ 18.267921][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 18.275848][ T1] rdma_rxe: loaded
[ 18.280657][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 18.291523][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 18.299806][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 18.310214][ T1] clk: Disabling unused clocks
[ 18.315369][ T1] ALSA device list:
[ 18.320941][ T45] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 18.326362][ T1] #0: Dummy 1
[ 18.330739][ T45] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 18.334034][ T1] #1: Loopback 1
[ 18.346869][ T1] #2: Virtual MIDI Card 1
[ 18.354968][ T1] md: Waiting for all devices to be available before autodetect
[ 18.362861][ T1] md: If you don't use raid, use raid=noautodetect
[ 18.369494][ T1] md: Autodetecting RAID arrays.
[ 18.374524][ T1] md: autorun ...
[ 18.378180][ T1] md: ... autorun DONE.
[ 18.453031][ T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[ 18.466879][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 18.563174][ T1] devtmpfs: mounted
[ 18.648281][ T1] Freeing unused kernel image (initmem) memory: 25888K
[ 18.659532][ T1] Write protecting the kernel read-only data: 212992k
[ 18.676292][ T1] Freeing unused kernel image (rodata/data gap) memory: 756K
[ 18.782315][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 18.790468][ T1] x86/mm: Checking user space page tables
[ 18.882494][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 18.896143][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 18.906366][ T1] Run /sbin/init as init process
[ 19.536334][ T4501] mount (4501) used greatest stack depth: 23680 bytes left
[ 19.574177][ T4502] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 19.682917][ T4505] mount (4505) used greatest stack depth: 20432 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 20.560303][ T4535] udevd[4535]: starting version 3.2.11
[ 20.864707][ T4536] udevd[4536]: starting eudev-3.2.11
[ 20.867564][ T4535] udevd (4535) used greatest stack depth: 18776 bytes left
[ 24.630142][ T35] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1578
[ 24.640074][ T35] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 35, name: kworker/u8:2
[ 24.649231][ T35] preempt_count: 1, expected: 0
[ 24.654121][ T35] RCU nest depth: 0, expected: 0
[ 24.659688][ T35] 3 locks held by kworker/u8:2/35:
[ 24.665009][ T35] #0: ffff88801aef1148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[ 24.676546][ T35] #1: ffffc90000ab7d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[ 24.689351][ T35] #2: ffff888022f160d8 (&wb->list_lock){+.+.}-{2:2}, at: wb_writeback+0x29f/0xd90
[ 24.699132][ T35] Preemption disabled at:
[ 24.699147][ T35] [<0000000000000000>] 0x0
[ 24.708275][ T35] CPU: 1 PID: 35 Comm: kworker/u8:2 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
[ 24.719246][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 24.729422][ T35] Workqueue: writeback wb_workfn (flush-8:0)
[ 24.735469][ T35] Call Trace:
[ 24.738795][ T35] <TASK>
[ 24.741764][ T35] dump_stack_lvl+0x241/0x360
[ 24.746593][ T35] ? __pfx_dump_stack_lvl+0x10/0x10
[ 24.751997][ T35] ? __pfx__printk+0x10/0x10
[ 24.756629][ T35] __might_resched+0x5d4/0x780
[ 24.761435][ T35] ? __pfx___might_resched+0x10/0x10
[ 24.766849][ T35] ? do_raw_spin_lock+0x14f/0x370
[ 24.771922][ T35] ? rcu_is_watching+0x15/0xb0
[ 24.776730][ T35] down_write+0x19/0x50
[ 24.780962][ T35] wb_writeback+0x46d/0xd90
[ 24.785615][ T35] ? queue_io+0x3b1/0x5a0
[ 24.790076][ T35] ? __pfx_wb_writeback+0x10/0x10
[ 24.795277][ T35] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 24.801400][ T35] wb_workfn+0xba1/0x1090
[ 24.805787][ T35] ? __pfx_wb_workfn+0x10/0x10
[ 24.810612][ T35] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 24.816631][ T35] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 24.823192][ T35] ? process_scheduled_works+0x945/0x1830
[ 24.829118][ T35] process_scheduled_works+0xa2c/0x1830
[ 24.834746][ T35] ? __pfx_process_scheduled_works+0x10/0x10
[ 24.840783][ T35] ? assign_work+0x364/0x3d0
[ 24.845504][ T35] worker_thread+0x86d/0xd70
[ 24.850226][ T35] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 24.856176][ T35] ? __kthread_parkme+0x169/0x1d0
[ 24.861349][ T35] ? __pfx_worker_thread+0x10/0x10
[ 24.866766][ T35] kthread+0x2f0/0x390
[ 24.871147][ T35] ? __pfx_worker_thread+0x10/0x10
[ 24.876294][ T35] ? __pfx_kthread+0x10/0x10
[ 24.881000][ T35] ret_from_fork+0x4b/0x80
[ 24.885712][ T35] ? __pfx_kthread+0x10/0x10
[ 24.890344][ T35] ret_from_fork_asm+0x1a/0x30
[ 24.895164][ T35] </TASK>
[ 24.898489][ T35] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001c: 0000 [#1] PREEMPT SMP KASAN PTI
[ 24.911278][ T35] KASAN: null-ptr-deref in range [0x00000000000000e0-0x00000000000000e7]
[ 24.919719][ T35] CPU: 1 PID: 35 Comm: kworker/u8:2 Tainted: G W 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
[ 24.932070][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 24.942545][ T35] Workqueue: writeback wb_workfn (flush-8:0)
[ 24.948754][ T35] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[ 24.954267][ T35] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[ 24.974168][ T35] RSP: 0018:ffffc90000ab74f0 EFLAGS: 00010002
[ 24.980269][ T35] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[ 24.988696][ T35] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[ 24.996955][ T35] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 25.004950][ T35] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[ 25.013039][ T35] R13: 0000000000000000 R14: ffff88801b681e00 R15: 0000000000000000
[ 25.021122][ T35] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
[ 25.030088][ T35] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 25.036701][ T35] CR2: 0000556986fc54d0 CR3: 00000000182a6000 CR4: 00000000003506f0
[ 25.044884][ T35] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 25.053744][ T35] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 25.061994][ T35] Call Trace:
[ 25.065274][ T35] <TASK>
[ 25.068217][ T35] ? __die_body+0x88/0xe0
[ 25.072557][ T35] ? die_addr+0x108/0x140
[ 25.076910][ T35] ? exc_general_protection+0x3dd/0x5d0
[ 25.082477][ T35] ? asm_exc_general_protection+0x26/0x30
[ 25.088247][ T35] ? __lock_acquire+0x6a/0x1fd0
[ 25.093088][ T35] ? dump_stack_lvl+0x301/0x360
[ 25.097954][ T35] ? __pfx_dump_stack_lvl+0x10/0x10
[ 25.103247][ T35] ? __pfx__printk+0x10/0x10
[ 25.107831][ T35] lock_acquire+0x1ed/0x550
[ 25.112421][ T35] ? wb_writeback+0x46d/0xd90
[ 25.117117][ T35] ? __pfx_lock_acquire+0x10/0x10
[ 25.122288][ T35] ? __pfx___might_resched+0x10/0x10
[ 25.127589][ T35] ? do_raw_spin_lock+0x14f/0x370
[ 25.132730][ T35] ? rcu_is_watching+0x15/0xb0
[ 25.137508][ T35] down_write+0x3a/0x50
[ 25.141748][ T35] ? wb_writeback+0x46d/0xd90
[ 25.146528][ T35] wb_writeback+0x46d/0xd90
[ 25.151051][ T35] ? queue_io+0x3b1/0x5a0
[ 25.155403][ T35] ? __pfx_wb_writeback+0x10/0x10
[ 25.160438][ T35] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 25.166596][ T35] wb_workfn+0xba1/0x1090
[ 25.170929][ T35] ? __pfx_wb_workfn+0x10/0x10
[ 25.175866][ T35] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 25.181870][ T35] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 25.188738][ T35] ? process_scheduled_works+0x945/0x1830
[ 25.194447][ T35] process_scheduled_works+0xa2c/0x1830
[ 25.200280][ T35] ? __pfx_process_scheduled_works+0x10/0x10
[ 25.206513][ T35] ? assign_work+0x364/0x3d0
[ 25.212499][ T35] worker_thread+0x86d/0xd70
[ 25.217342][ T35] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 25.223233][ T35] ? __kthread_parkme+0x169/0x1d0
[ 25.228357][ T35] ? __pfx_worker_thread+0x10/0x10
[ 25.233743][ T35] kthread+0x2f0/0x390
[ 25.237985][ T35] ? __pfx_worker_thread+0x10/0x10
[ 25.243209][ T35] ? __pfx_kthread+0x10/0x10
[ 25.247808][ T35] ret_from_fork+0x4b/0x80
[ 25.252226][ T35] ? __pfx_kthread+0x10/0x10
[ 25.257349][ T35] ret_from_fork_asm+0x1a/0x30
[ 25.262136][ T35] </TASK>
[ 25.265145][ T35] Modules linked in:
[ 25.269128][ T35] ---[ end trace 0000000000000000 ]---
[ 25.274926][ T35] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[ 25.280593][ T35] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[ 25.300315][ T35] RSP: 0018:ffffc90000ab74f0 EFLAGS: 00010002
[ 25.306627][ T35] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[ 25.314710][ T35] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[ 25.322714][ T35] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 25.331044][ T35] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[ 25.339723][ T35] R13: 0000000000000000 R14: ffff88801b681e00 R15: 0000000000000000
[ 25.347961][ T35] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
[ 25.357437][ T35] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 25.364092][ T35] CR2: 0000556986fc54d0 CR3: 00000000182a6000 CR4: 00000000003506f0
[ 25.372259][ T35] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 25.380762][ T35] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 25.388774][ T35] Kernel panic - not syncing: Fatal exception
[ 25.395138][ T35] Kernel Offset: disabled
[ 25.399763][ T35] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2587984659=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at dac2aa43b4
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"dac2aa43b4dbdbffa2c5e24a736096a6d928f633\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15d203a6980000


Tested on:

commit: 50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1423533e980000

[Lizhi Xu]

#syz test: upstream 50736169ecc8

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c

index 92a5b8283528..965bd3f109cc 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2078,6 +2078,7 @@ static long wb_writeback(struct bdi_writeback *wb,
bool queued = false;

blk_start_plug(&plug);
+ down_write(&work->sb->s_umount);
for (;;) {
/*
* Stop writeback when nr_pages has been consumed
@@ -2162,6 +2163,7 @@ static long wb_writeback(struct bdi_writeback *wb,
/* This function drops i_lock... */
inode_sleep_on_writeback(inode);
}
+ up_write(&work->sb->s_umount);
blk_finish_plug(&plug);

return nr_pages - work->nr_pages;

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

itialized
[ 12.450194][ T1] Bluetooth: RFCOMM socket layer initialized
[ 12.456398][ T1] Bluetooth: RFCOMM ver 1.11
[ 12.461045][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 12.467274][ T1] Bluetooth: BNEP filters: protocol multicast
[ 12.473507][ T1] Bluetooth: BNEP socket layer initialized
[ 12.479400][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[ 12.485274][ T1] Bluetooth: CMTP socket layer initialized
[ 12.491147][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 12.498194][ T1] Bluetooth: HIDP socket layer initialized
[ 12.507632][ T1] NET: Registered PF_RXRPC protocol family
[ 12.513531][ T1] Key type rxrpc registered
[ 12.518063][ T1] Key type rxrpc_s registered
[ 12.523550][ T1] NET: Registered PF_KCM protocol family
[ 12.530117][ T1] lec:lane_module_init: lec.c: initialized
[ 12.536001][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 12.541990][ T1] l2tp_core: L2TP core driver, V2.0
[ 12.547437][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 12.553068][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 12.559736][ T1] l2tp_netlink: L2TP netlink interface
[ 12.565426][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 12.572210][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 12.579806][ T1] NET: Registered PF_PHONET protocol family
[ 12.586291][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 12.605218][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 12.610742][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 12.617954][ T1] DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 12.629617][ T1] sctp: Hash tables configured (bind 32/56)
[ 12.637290][ T1] NET: Registered PF_RDS protocol family
[ 12.643689][ T1] Registered RDS/infiniband transport
[ 12.650504][ T1] Registered RDS/tcp transport
[ 12.655260][ T1] tipc: Activated (version 2.0.0)
[ 12.661683][ T1] NET: Registered PF_TIPC protocol family
[ 12.668462][ T1] tipc: Started in single node mode
[ 12.674475][ T1] NET: Registered PF_SMC protocol family
[ 12.680577][ T1] 9pnet: Installing 9P2000 support
[ 12.686466][ T1] NET: Registered PF_CAIF protocol family
[ 12.696408][ T1] NET: Registered PF_IEEE802154 protocol family
[ 12.702904][ T1] Key type dns_resolver registered
[ 12.708146][ T1] Key type ceph registered
[ 12.713281][ T1] libceph: loaded (mon/osd proto 15/24)
[ 12.720605][ T1] batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
[ 12.730351][ T1] openvswitch: Open vSwitch switching datapath
[ 12.739867][ T1] NET: Registered PF_VSOCK protocol family
[ 12.746313][ T1] mpls_gso: MPLS GSO support
[ 12.768127][ T1] IPI shorthand broadcast: enabled
[ 12.773633][ T1] AVX2 version of gcm_enc/dec engaged.
[ 12.779675][ T1] AES CTR mode by8 optimization enabled
[ 14.227701][ T1] sched_clock: Marking stable (14190061000, 35522337)->(14229701277, -4117940)
[ 14.241866][ T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[ 14.253943][ T1] registered taskstats version 1
[ 14.270550][ T1] Loading compiled-in X.509 certificates
[ 14.280599][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 4d8a14ab1354649e588ef893344f8a054513da14'
[ 14.601155][ T1] zswap: loaded using pool lzo/zsmalloc
[ 14.608936][ T1] Demotion targets for Node 0: null
[ 14.614169][ T1] Demotion targets for Node 1: null
[ 14.628617][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 17.258079][ T1] Key type .fscrypt registered
[ 17.263049][ T1] Key type fscrypt-provisioning registered
[ 17.276013][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 17.300345][ T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[ 17.309004][ T1] Key type big_key registered
[ 17.323034][ T1] Key type encrypted registered
[ 17.328323][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 17.334853][ T1] Loading compiled-in module X.509 certificates
[ 17.344084][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 4d8a14ab1354649e588ef893344f8a054513da14'
[ 17.354904][ T1] ima: Allocated hash algorithm: sha256
[ 17.360822][ T1] ima: No architecture policies found
[ 17.366993][ T1] evm: Initialising EVM extended attributes:
[ 17.372956][ T1] evm: security.selinux (disabled)
[ 17.378069][ T1] evm: security.SMACK64
[ 17.382213][ T1] evm: security.SMACK64EXEC
[ 17.386715][ T1] evm: security.SMACK64TRANSMUTE
[ 17.391638][ T1] evm: security.SMACK64MMAP
[ 17.396145][ T1] evm: security.apparmor (disabled)
[ 17.401333][ T1] evm: security.ima
[ 17.405130][ T1] evm: security.capability
[ 17.409889][ T1] evm: HMAC attrs: 0x1
[ 17.416387][ T1] PM: Magic number: 12:853:157
[ 17.421445][ T1] usb usb36-port8: hash matches
[ 17.426621][ T1] bdi 1:9: hash matches
[ 17.431495][ T1] printk: legacy console [netcon0] enabled
[ 17.437427][ T1] netconsole: network logging started
[ 17.443443][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 17.451315][ T1] rdma_rxe: loaded
[ 17.455890][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 17.468001][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 17.477349][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 17.487009][ T786] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 17.499048][ T1] clk: Disabling unused clocks
[ 17.503984][ T1] ALSA device list:
[ 17.507873][ T786] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 17.515939][ T1] #0: Dummy 1
[ 17.520114][ T1] #1: Loopback 1
[ 17.523819][ T1] #2: Virtual MIDI Card 1
[ 17.531956][ T1] md: Waiting for all devices to be available before autodetect
[ 17.539623][ T1] md: If you don't use raid, use raid=noautodetect
[ 17.546155][ T1] md: Autodetecting RAID arrays.
[ 17.551160][ T1] md: autorun ...
[ 17.554815][ T1] md: ... autorun DONE.
[ 17.623375][ T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[ 17.636264][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 17.649480][ T1] devtmpfs: mounted
[ 17.737799][ T1] Freeing unused kernel image (initmem) memory: 25888K
[ 17.748732][ T1] Write protecting the kernel read-only data: 212992k
[ 17.766778][ T1] Freeing unused kernel image (rodata/data gap) memory: 756K
[ 17.872267][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 17.880469][ T1] x86/mm: Checking user space page tables
[ 17.972322][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 17.985697][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 17.995475][ T1] Run /sbin/init as init process
[ 18.362152][ T4502] mount (4502) used greatest stack depth: 23680 bytes left
[ 18.417722][ T4503] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
[ 18.432004][ T4503] mount (4503) used greatest stack depth: 23608 bytes left

mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory

[ 18.598864][ T4506] mount (4506) used greatest stack depth: 20672 bytes left

Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK

Populating /dev using udev: [ 19.589483][ T4536] udevd[4536]: starting version 3.2.11
[ 19.881043][ T4537] udevd[4537]: starting eudev-3.2.11
[ 19.883595][ T4536] udevd (4536) used greatest stack depth: 18776 bytes left
[ 23.456570][ T2487] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001c: 0000 [#1] PREEMPT SMP KASAN PTI
[ 23.469312][ T2487] KASAN: null-ptr-deref in range [0x00000000000000e0-0x00000000000000e7]
[ 23.477745][ T2487] CPU: 0 PID: 2487 Comm: kworker/u8:9 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
[ 23.488606][ T2487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 23.498891][ T2487] Workqueue: writeback wb_workfn (flush-8:0)
[ 23.504940][ T2487] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[ 23.510524][ T2487] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[ 23.530239][ T2487] RSP: 0018:ffffc900097874f0 EFLAGS: 00010002
[ 23.536424][ T2487] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[ 23.544419][ T2487] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[ 23.552415][ T2487] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 23.560670][ T2487] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[ 23.568661][ T2487] R13: 0000000000000000 R14: ffff88802a7a3c00 R15: 0000000000000000
[ 23.576662][ T2487] FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
[ 23.585609][ T2487] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.592299][ T2487] CR2: 00007f77ff6ed907 CR3: 000000001f0a4000 CR4: 00000000003506f0
[ 23.600343][ T2487] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 23.608338][ T2487] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 23.616341][ T2487] Call Trace:
[ 23.619811][ T2487] <TASK>
[ 23.622841][ T2487] ? __die_body+0x88/0xe0
[ 23.627291][ T2487] ? die_addr+0x108/0x140
[ 23.631844][ T2487] ? exc_general_protection+0x3dd/0x5d0
[ 23.637448][ T2487] ? asm_exc_general_protection+0x26/0x30
[ 23.643205][ T2487] ? __lock_acquire+0x6a/0x1fd0
[ 23.648379][ T2487] lock_acquire+0x1ed/0x550
[ 23.653004][ T2487] ? wb_writeback+0x13a/0xd80
[ 23.657730][ T2487] ? __pfx_lock_acquire+0x10/0x10
[ 23.662789][ T2487] ? __lock_acquire+0x1346/0x1fd0
[ 23.667840][ T2487] ? __pfx___might_resched+0x10/0x10
[ 23.673653][ T2487] ? __asan_memset+0x23/0x50
[ 23.678272][ T2487] down_write+0x3a/0x50
[ 23.682535][ T2487] ? wb_writeback+0x13a/0xd80
[ 23.687231][ T2487] wb_writeback+0x13a/0xd80
[ 23.691774][ T2487] ? mark_lock+0x9a/0x350
[ 23.696126][ T2487] ? __pfx_wb_writeback+0x10/0x10
[ 23.701173][ T2487] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 23.707179][ T2487] wb_workfn+0xba1/0x1090
[ 23.711621][ T2487] ? __pfx_wb_workfn+0x10/0x10
[ 23.716432][ T2487] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 23.722440][ T2487] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 23.728884][ T2487] ? process_scheduled_works+0x945/0x1830
[ 23.734721][ T2487] process_scheduled_works+0xa2c/0x1830
[ 23.740393][ T2487] ? __pfx_process_scheduled_works+0x10/0x10
[ 23.746411][ T2487] ? assign_work+0x364/0x3d0
[ 23.751113][ T2487] worker_thread+0x86d/0xd70
[ 23.755744][ T2487] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 23.761710][ T2487] ? __kthread_parkme+0x169/0x1d0
[ 23.766764][ T2487] ? __pfx_worker_thread+0x10/0x10
[ 23.772004][ T2487] kthread+0x2f0/0x390
[ 23.776101][ T2487] ? __pfx_worker_thread+0x10/0x10
[ 23.781334][ T2487] ? __pfx_kthread+0x10/0x10
[ 23.786212][ T2487] ret_from_fork+0x4b/0x80
[ 23.790664][ T2487] ? __pfx_kthread+0x10/0x10
[ 23.795373][ T2487] ret_from_fork_asm+0x1a/0x30
[ 23.800262][ T2487] </TASK>
[ 23.803312][ T2487] Modules linked in:
[ 23.807246][ T2487] ---[ end trace 0000000000000000 ]---
[ 23.812972][ T2487] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[ 23.818459][ T2487] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[ 23.838435][ T2487] RSP: 0018:ffffc900097874f0 EFLAGS: 00010002
[ 23.844527][ T2487] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[ 23.852515][ T2487] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[ 23.860505][ T2487] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 23.868584][ T2487] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[ 23.876574][ T2487] R13: 0000000000000000 R14: ffff88802a7a3c00 R15: 0000000000000000
[ 23.884566][ T2487] FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
[ 23.893785][ T2487] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.900586][ T2487] CR2: 00007f77ff6ed907 CR3: 000000001f0a4000 CR4: 00000000003506f0
[ 23.908579][ T2487] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 23.916664][ T2487] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 23.924658][ T2487] Kernel panic - not syncing: Fatal exception
[ 23.931104][ T2487] Kernel Offset: disabled
[ 23.935520][ T2487] Rebooting in 86400 seconds..

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1113195296=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at dac2aa43b4
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"dac2aa43b4dbdbffa2c5e24a736096a6d928f633\"


Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=15ee7dfa980000

Tested on:

commit: 50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=12ee231e980000

[Lizhi Xu]

#syz test: upstream 50736169ecc8

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c

index 92a5b8283528..04ccc85c80b4 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2076,8 +2076,11 @@ static long wb_writeback(struct bdi_writeback *wb,
long progress;
struct blk_plug plug;
bool queued = false;
+ struct super_block *sb = work->sb;

blk_start_plug(&plug);
+ if (sb)
+ down_write(&sb->s_umount);

for (;;) {
/*
* Stop writeback when nr_pages has been consumed

@@ -2162,6 +2165,8 @@ static long wb_writeback(struct bdi_writeback *wb,

/* This function drops i_lock... */
inode_sleep_on_writeback(inode);
}

+ if (sb)
+ up_write(&sb->s_umount);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in wb_writeback

INFO: task kworker/u8:6:1105 blocked for more than 143 seconds.
Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/u8:6 state:D stack:22288 pid:1105 tgid:1105 ppid:2 flags:0x00004000

Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0x1796/0x49d0 kernel/sched/core.c:6745
__schedule_loop kernel/sched/core.c:6822 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6837

schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6894
rwsem_down_write_slowpath+0xeeb/0x13b0 kernel/locking/rwsem.c:1178
__down_write_common+0x1af/0x200 kernel/locking/rwsem.c:1306
wb_writeback+0x143/0xda0 fs/fs-writeback.c:2083
wb_do_writeback fs/fs-writeback.c:2279 [inline]
wb_workfn+0x410/0x1090 fs/fs-writeback.c:2319

process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

INFO: task syz-executor:5687 blocked for more than 143 seconds.
Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz-executor state:D stack:20288 pid:5687 tgid:5687 ppid:1 flags:0x00004006

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0x1796/0x49d0 kernel/sched/core.c:6745
__schedule_loop kernel/sched/core.c:6822 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6837
wb_wait_for_completion+0x166/0x290 fs/fs-writeback.c:216

__writeback_inodes_sb_nr+0x2d2/0x380 fs/fs-writeback.c:2711

sync_filesystem+0xa4/0x230 fs/sync.c:54
generic_shutdown_super+0x72/0x2d0 fs/super.c:621
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f6f9d87e257
RSP: 002b:00007fff1d6cb318 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6f9d87e257
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff1d6cb3d0
RBP: 00007fff1d6cb3d0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff1d6cc480
R13: 00007f6f9d8d96c6 R14: 000000000001846f R15: 0000000000000001

</TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614

3 locks held by kworker/u8:6/1105:
#0: ffff88801aef9148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff88801aef9148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc90004117d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc90004117d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
#2: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: wb_writeback+0x143/0xda0 fs/fs-writeback.c:2083
2 locks held by getty/4837:
#0: ffff88802b0160a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2211
1 lock held by syz-executor/5687:
#0: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 30 Comm: khungtaskd Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xfde/0x1020 kernel/hung_task.c:379
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Sending NMI from CPU 1 to CPUs 0:

NMI backtrace for cpu 0

CPU: 0 PID: 3962 Comm: kworker/u8:10 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024

Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:236 [inline]
RIP: 0010:__sanitizer_cov_trace_switch+0x9d/0x120 kernel/kcov.c:341
Code: 00 00 4d 85 d2 0f 84 8b 00 00 00 4c 8b 4c 24 20 65 4c 8b 1c 25 80 d4 03 00 31 d2 eb 08 48 ff c2 49 39 d2 74 71 4c 8b 74 d6 10 <65> 8b 05 c4 a9 6d 7e a9 00 01 ff 00 74 11 a9 00 01 00 00 74 de 41
RSP: 0018:ffffc9000c266798 EFLAGS: 00000212
RAX: 0000000000000000 RBX: 0000000000000016 RCX: ffff88802e735a00
RDX: 000000000000001b RSI: ffffffff8f8548d0 RDI: 0000000000000003
RBP: ffffc9000c266bb0 R08: 0000000000000001 R09: ffffffff8afbe03a
R10: 0000000000000028 R11: ffff88802e735a00 R12: ffff888021f2e02f
R13: dffffc0000000000 R14: 000000000000007f R15: 0000000000000001

FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000556005801600 CR3: 000000000e132000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Call Trace:
<NMI>
</NMI>
<TASK>

_ieee802_11_parse_elems_full+0x6da/0x49f0 net/mac80211/parse.c:215
ieee802_11_parse_elems_full+0xde7/0x2870 net/mac80211/parse.c:902
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2332 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2339 [inline]
ieee80211_inform_bss+0x15f/0x1080 net/mac80211/scan.c:79
rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
cfg80211_inform_single_bss_data+0x1121/0x2360 net/wireless/scan.c:2293
cfg80211_inform_bss_data+0x3dd/0x5a70 net/wireless/scan.c:3117
cfg80211_inform_bss_frame_data+0x3bc/0x720 net/wireless/scan.c:3207
ieee80211_bss_info_update+0x8a7/0xbc0 net/mac80211/scan.c:226
ieee80211_rx_bss_info net/mac80211/ibss.c:1099 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1578 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1962/0x2d70 net/mac80211/ibss.c:1605
ieee80211_iface_process_skb net/mac80211/iface.c:1603 [inline]
ieee80211_iface_work+0x8a3/0xf10 net/mac80211/iface.c:1657
cfg80211_wiphy_work+0x221/0x260 net/wireless/core.c:437

process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Tested on:

commit: 50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=11f12b3e980000

kernel config: https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=148dfb01980000