[syzbot] [bcachefs?] INFO: task hung in do_truncate (3)
9 views
Skip to first unread message
syzbot
Dec 4, 2024, 8:29:26 PM12/4/24
to kent.ov...@linux.dev, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: feffde684ac2 Merge tag 'for-6.13-rc1-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=107f48df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=91c852e3d1d7c1a6
dashboard link: https://syzkaller.appspot.com/bug?extid=effe7da6578cd423f98f
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2efea2e60149/disk-feffde68.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f5331b060319/vmlinux-feffde68.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ffe1099c1fd2/bzImage-feffde68.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+effe7d...@syzkaller.appspotmail.com
INFO: task syz.0.32:6097 blocked for more than 143 seconds.
Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.32 state:D stack:18040 pid:6097 tgid:6096 ppid:5826 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176
__down_write_common kernel/locking/rwsem.c:1304 [inline]
__down_write kernel/locking/rwsem.c:1313 [inline]
down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578
inode_lock include/linux/fs.h:818 [inline]
do_truncate+0x20c/0x310 fs/open.c:63
handle_truncate fs/namei.c:3449 [inline]
do_open fs/namei.c:3832 [inline]
path_openat+0x2e1e/0x3590 fs/namei.c:3987
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_open fs/open.c:1425 [inline]
__se_sys_open fs/open.c:1421 [inline]
__x64_sys_open+0x225/0x270 fs/open.c:1421
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6d3397ff19
RSP: 002b:00007f6d3477f058 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f6d33b45fa0 RCX: 00007f6d3397ff19
RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000000020000300
RBP: 00007f6d339f3986 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6d33b45fa0 R15: 00007ffe48f28138
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
2 locks held by kworker/u8:7/3010:
#0: ffff8880b863e758 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
#1: ffffc9000bb87d00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
#1: ffffc9000bb87d00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3310
2 locks held by getty/5580:
#0: ffff88814d0720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
2 locks held by syz.0.32/6097:
#0: ffff8880795aa420 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: do_truncate+0x20c/0x310 fs/open.c:63
5 locks held by syz.0.32/6129:
#0: ffff8880795aa420 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: do_truncate+0x20c/0x310 fs/open.c:63
#2: ffff888052300a38 (&c->snapshot_create_lock){.+.+}-{4:4}, at: bch2_truncate+0x166/0x2d0 fs/bcachefs/io_misc.c:292
#3: ffff888052304398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:158 [inline]
#3: ffff888052304398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:249 [inline]
#3: ffff888052304398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x7e1/0xd30 fs/bcachefs/btree_iter.c:3228
#4: ffff8880523266d0 (&c->gc_lock){++++}-{4:4}, at: bch2_btree_update_start+0x682/0x14e0 fs/bcachefs/btree_update_interior.c:1197
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
watchdog+0xff6/0x1040 kernel/hung_task.c:397
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:1 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: bat_events batadv_purge_orig
RIP: 0010:batadv_purge_orig_ref+0x17f/0x1660 net/batman-adv/originator.c:1295
Code: 98 00 00 00 42 80 3c 30 00 4c 8b 74 24 70 74 0d 4c 89 f7 e8 e3 3d 73 f6 48 8b 54 24 38 48 8b 4c 24 40 48 8d 1c cd 00 00 00 00 <49> 03 1e 49 89 de 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df 41 80
RSP: 0018:ffffc90000117a40 EFLAGS: 00000246
RAX: 1ffff11004ac1e68 RBX: 0000000000001028 RCX: 0000000000000205
RDX: ffff88802560f348 RSI: 0000000000000400 RDI: 0000000000000000
RBP: ffffc90000117ba0 R08: ffffffff8b93ef65 R09: 1ffffffff203036e
R10: dffffc0000000000 R11: ffffffff8b939a10 R12: ffff88805c3a8ec8
R13: ffffffff8168f006 R14: ffff88802560f340 R15: 0000000002000000
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563ee709d680 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
batadv_purge_orig+0x19/0x60 net/batman-adv/originator.c:1329
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: feffde684ac2 Merge tag 'for-6.13-rc1-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=107f48df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=91c852e3d1d7c1a6
dashboard link: https://syzkaller.appspot.com/bug?extid=effe7da6578cd423f98f
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2efea2e60149/disk-feffde68.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f5331b060319/vmlinux-feffde68.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ffe1099c1fd2/bzImage-feffde68.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+effe7d...@syzkaller.appspotmail.com
INFO: task syz.0.32:6097 blocked for more than 143 seconds.
Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.32 state:D stack:18040 pid:6097 tgid:6096 ppid:5826 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176
__down_write_common kernel/locking/rwsem.c:1304 [inline]
__down_write kernel/locking/rwsem.c:1313 [inline]
down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578
inode_lock include/linux/fs.h:818 [inline]
do_truncate+0x20c/0x310 fs/open.c:63
handle_truncate fs/namei.c:3449 [inline]
do_open fs/namei.c:3832 [inline]
path_openat+0x2e1e/0x3590 fs/namei.c:3987
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_open fs/open.c:1425 [inline]
__se_sys_open fs/open.c:1421 [inline]
__x64_sys_open+0x225/0x270 fs/open.c:1421
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6d3397ff19
RSP: 002b:00007f6d3477f058 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f6d33b45fa0 RCX: 00007f6d3397ff19
RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000000020000300
RBP: 00007f6d339f3986 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6d33b45fa0 R15: 00007ffe48f28138
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
2 locks held by kworker/u8:7/3010:
#0: ffff8880b863e758 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
#1: ffffc9000bb87d00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
#1: ffffc9000bb87d00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3310
2 locks held by getty/5580:
#0: ffff88814d0720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
2 locks held by syz.0.32/6097:
#0: ffff8880795aa420 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: do_truncate+0x20c/0x310 fs/open.c:63
5 locks held by syz.0.32/6129:
#0: ffff8880795aa420 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]
#1: ffff8880583808c8 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: do_truncate+0x20c/0x310 fs/open.c:63
#2: ffff888052300a38 (&c->snapshot_create_lock){.+.+}-{4:4}, at: bch2_truncate+0x166/0x2d0 fs/bcachefs/io_misc.c:292
#3: ffff888052304398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:158 [inline]
#3: ffff888052304398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:249 [inline]
#3: ffff888052304398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x7e1/0xd30 fs/bcachefs/btree_iter.c:3228
#4: ffff8880523266d0 (&c->gc_lock){++++}-{4:4}, at: bch2_btree_update_start+0x682/0x14e0 fs/bcachefs/btree_update_interior.c:1197
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
watchdog+0xff6/0x1040 kernel/hung_task.c:397
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:1 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: bat_events batadv_purge_orig
RIP: 0010:batadv_purge_orig_ref+0x17f/0x1660 net/batman-adv/originator.c:1295
Code: 98 00 00 00 42 80 3c 30 00 4c 8b 74 24 70 74 0d 4c 89 f7 e8 e3 3d 73 f6 48 8b 54 24 38 48 8b 4c 24 40 48 8d 1c cd 00 00 00 00 <49> 03 1e 49 89 de 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df 41 80
RSP: 0018:ffffc90000117a40 EFLAGS: 00000246
RAX: 1ffff11004ac1e68 RBX: 0000000000001028 RCX: 0000000000000205
RDX: ffff88802560f348 RSI: 0000000000000400 RDI: 0000000000000000
RBP: ffffc90000117ba0 R08: ffffffff8b93ef65 R09: 1ffffffff203036e
R10: dffffc0000000000 R11: ffffffff8b939a10 R12: ffff88805c3a8ec8
R13: ffffffff8168f006 R14: ffff88802560f340 R15: 0000000002000000
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563ee709d680 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
batadv_purge_orig+0x19/0x60 net/batman-adv/originator.c:1329
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Apr 23, 2025, 3:49:35 AM4/23/25
to bra...@kernel.org, ch...@kernel.org, ja...@suse.cz, jae...@kernel.org, kent.ov...@linux.dev, linux-b...@vger.kernel.org, linux-f2...@lists.sourceforge.net, linux-...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com, vi...@zeniv.linux.org.uk
syzbot has found a reproducer for the following issue on:
HEAD commit: bc3372351d0c Merge tag 'for-6.15-rc3-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=138cdccc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3bbffc3b5b4301e1
dashboard link: https://syzkaller.appspot.com/bug?extid=effe7da6578cd423f98f
compiler: Debian clang version 15.0.6, Debian LLD 15.0.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17c8ac70580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6c893a6bd7cc/disk-bc337235.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6c31d81cbcae/vmlinux-bc337235.xz
kernel image: https://storage.googleapis.com/syzbot-assets/acf5d144656b/bzImage-bc337235.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/53b1b110f131/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=16d4f204580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/3185ba5a394f/mount_4.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=14ebe7ac580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+effe7d...@syzkaller.appspotmail.com
INFO: task syz.9.68:6713 blocked for more than 143 seconds.
Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x1b33/0x51f0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x163/0x360 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
rwsem_down_write_slowpath+0xedd/0x1420 kernel/locking/rwsem.c:1176
inode_lock include/linux/fs.h:867 [inline]
do_truncate+0x20e/0x310 fs/open.c:63
vfs_truncate+0x4a6/0x540 fs/open.c:115
do_sys_truncate+0xd8/0x190 fs/open.c:138
__do_sys_truncate fs/open.c:150 [inline]
__se_sys_truncate fs/open.c:148 [inline]
__x64_sys_truncate+0x5b/0x70 fs/open.c:148
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6c9918e169
RSP: 002b:00007f6c983dd038 EFLAGS: 00000246 ORIG_RAX: 000000000000004c
RAX: ffffffffffffffda RBX: 00007f6c993b6080 RCX: 00007f6c9918e169
RDX: 0000000000000000 RSI: 0000000000008001 RDI: 00002000000000c0
RBP: 00007f6c99210a68 R08: 0000000000000000 R09: 0000000000000000
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: bc3372351d0c Merge tag 'for-6.15-rc3-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=138cdccc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3bbffc3b5b4301e1
dashboard link: https://syzkaller.appspot.com/bug?extid=effe7da6578cd423f98f
compiler: Debian clang version 15.0.6, Debian LLD 15.0.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17c8ac70580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6c893a6bd7cc/disk-bc337235.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6c31d81cbcae/vmlinux-bc337235.xz
kernel image: https://storage.googleapis.com/syzbot-assets/acf5d144656b/bzImage-bc337235.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/53b1b110f131/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=16d4f204580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/3185ba5a394f/mount_4.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=14ebe7ac580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+effe7d...@syzkaller.appspotmail.com
Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.68 state:D stack:27592 pid:6713 tgid:6701 ppid:6519 task_flags:0x400140 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x1b33/0x51f0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x163/0x360 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
rwsem_down_write_slowpath+0xedd/0x1420 kernel/locking/rwsem.c:1176
__down_write_common kernel/locking/rwsem.c:1304 [inline]
__down_write kernel/locking/rwsem.c:1313 [inline]
down_write+0x1da/0x220 kernel/locking/rwsem.c:1578
__down_write kernel/locking/rwsem.c:1313 [inline]
inode_lock include/linux/fs.h:867 [inline]
do_truncate+0x20e/0x310 fs/open.c:63
vfs_truncate+0x4a6/0x540 fs/open.c:115
do_sys_truncate+0xd8/0x190 fs/open.c:138
__do_sys_truncate fs/open.c:150 [inline]
__se_sys_truncate fs/open.c:148 [inline]
__x64_sys_truncate+0x5b/0x70 fs/open.c:148
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6c9918e169
RSP: 002b:00007f6c983dd038 EFLAGS: 00000246 ORIG_RAX: 000000000000004c
RAX: ffffffffffffffda RBX: 00007f6c993b6080 RCX: 00007f6c9918e169
RDX: 0000000000000000 RSI: 0000000000008001 RDI: 00002000000000c0
RBP: 00007f6c99210a68 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f6c993b6080 R15: 00007ffc2675ba78
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Kane York
Apr 24, 2025, 3:07:45 AM4/24/25
to syzbot+effe7d...@syzkaller.appspotmail.com, bra...@kernel.org, ch...@kernel.org, ja...@suse.cz, jae...@kernel.org, kent.ov...@linux.dev, linux-b...@vger.kernel.org, linux-f2...@lists.sourceforge.net, linux-...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com, vi...@zeniv.linux.org.uk
This crash appears to entirely ignore the provided filesystem images and just
does tricky fallocate calls followed by a truncate, so it should be easier than
normal to diagnose.
The cwd is opened with O_DIRECT. (or this is EFAULT because path is nullptr?)
The victim file is created with O_NONBLOCK and O_SYNC; that fd is discarded.
The victim file is opened again with O_SYNC and FALLOC_FL_ZERO_RANGE is called
with a gargantuan size.
The victim file is opened again with O_APPEND (!) and FALLOC_FL_INSERT_RANGE is
called with a modest size.
Truncate is called midway through the just-inserted range.
Annotated calls below.
# https://syzkaller.appspot.com/bug?id=7d29d6d7a773d4f608a33cf6a7593faadb1b5803
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"repeat":true,"procs":5,"slowdown":1,"sandbox":"none","sandbox_arg":0,"tun":true,"netdev":true,"resetnet":true,"cgroups":true,"binfmt_misc":true,"close_fds":true,"usb":true,"vhci":true,"wifi":true,"ieee802154":true,"sysctl":true,"swap":true,"tmpdir":true,"segv":true}
# mount file2
syz_mount_image$f2fs(&(0x7f0000000040),
&(0x7f00000000c0)='./file2\x00', 0x0,
&(0x7f0000000300)={[{@noinline_xattr}, {@noinline_dentry},
{@prjjquota={'prjjquota', 0x3d, 'active_logs=4'}}, {@jqfmt_vfsv1},
{@noinline_data}, {@noheap}, {@checkpoint_diasble}, {@fastboot},
{@fsync_mode_strict}, {@discard_unit_section}]}, 0x21, 0x552d,
&(0x7f000000abc0)="$[removed]")
# EBADF
pread64(0xffffffffffffffff, 0x0, 0x0, 0xfff)
# EBADF
openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0)
# openat(AT_FDCWD, nullptr, O_DIRECT, 0)
# EFAULT?
openat$nullb(0xffffffffffffff9c, 0x0, 0x4000, 0x0)
# mount 'bus'
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00',
&(0x7f00000000c0)='./bus\x00', 0x20081e,
&(0x7f0000000040)={[{@nodelalloc}, {@orlov}, {@auto_da_alloc}]}, 0x1,
0x4ef, &(0x7f00000003c0)="$[removed]")
# open file1
# O_RDWR | O_CREAT | O_NOCTTY | O_NONBLOCK | FASYNC | O_LARGEFILE | O_SYNC
# perm 0500
open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x140)
# open file1
# O_RDWR | O_CREAT | O_LARGEFILE | O_SYNC
# perm 0210
r0 = open(&(0x7f0000000100)='./file1\x00', 0x109042, 0x88)
# fallocate FALLOC_FL_ZERO_RANGE, offset 0, size 0x7000000
fallocate(r0, 0x10, 0x0, 0x7000000)
# openat(AT_FDCWD) file1
# O_WRONLY | O_CREAT | O_APPEND
# perm 0512
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x14a)
# fallocate file1 FALLOC_FL_INSERT_RANGE, offset x4000, size x8000
# EPERM?
fallocate(r1, 0x20, 0x4000, 0x8000)
# truncate file1 size x8001
truncate(&(0x7f00000000c0)='./file1\x00', 0x8001)
does tricky fallocate calls followed by a truncate, so it should be easier than
normal to diagnose.
The cwd is opened with O_DIRECT. (or this is EFAULT because path is nullptr?)
The victim file is created with O_NONBLOCK and O_SYNC; that fd is discarded.
The victim file is opened again with O_SYNC and FALLOC_FL_ZERO_RANGE is called
with a gargantuan size.
The victim file is opened again with O_APPEND (!) and FALLOC_FL_INSERT_RANGE is
called with a modest size.
Truncate is called midway through the just-inserted range.
Annotated calls below.
# https://syzkaller.appspot.com/bug?id=7d29d6d7a773d4f608a33cf6a7593faadb1b5803
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"repeat":true,"procs":5,"slowdown":1,"sandbox":"none","sandbox_arg":0,"tun":true,"netdev":true,"resetnet":true,"cgroups":true,"binfmt_misc":true,"close_fds":true,"usb":true,"vhci":true,"wifi":true,"ieee802154":true,"sysctl":true,"swap":true,"tmpdir":true,"segv":true}
# mount file2
syz_mount_image$f2fs(&(0x7f0000000040),
&(0x7f00000000c0)='./file2\x00', 0x0,
&(0x7f0000000300)={[{@noinline_xattr}, {@noinline_dentry},
{@prjjquota={'prjjquota', 0x3d, 'active_logs=4'}}, {@jqfmt_vfsv1},
{@noinline_data}, {@noheap}, {@checkpoint_diasble}, {@fastboot},
{@fsync_mode_strict}, {@discard_unit_section}]}, 0x21, 0x552d,
&(0x7f000000abc0)="$[removed]")
# EBADF
pread64(0xffffffffffffffff, 0x0, 0x0, 0xfff)
# EBADF
openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0)
# openat(AT_FDCWD, nullptr, O_DIRECT, 0)
# EFAULT?
openat$nullb(0xffffffffffffff9c, 0x0, 0x4000, 0x0)
# mount 'bus'
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00',
&(0x7f00000000c0)='./bus\x00', 0x20081e,
&(0x7f0000000040)={[{@nodelalloc}, {@orlov}, {@auto_da_alloc}]}, 0x1,
0x4ef, &(0x7f00000003c0)="$[removed]")
# open file1
# O_RDWR | O_CREAT | O_NOCTTY | O_NONBLOCK | FASYNC | O_LARGEFILE | O_SYNC
# perm 0500
open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x140)
# open file1
# O_RDWR | O_CREAT | O_LARGEFILE | O_SYNC
# perm 0210
r0 = open(&(0x7f0000000100)='./file1\x00', 0x109042, 0x88)
# fallocate FALLOC_FL_ZERO_RANGE, offset 0, size 0x7000000
fallocate(r0, 0x10, 0x0, 0x7000000)
# openat(AT_FDCWD) file1
# O_WRONLY | O_CREAT | O_APPEND
# perm 0512
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x14a)
# fallocate file1 FALLOC_FL_INSERT_RANGE, offset x4000, size x8000
# EPERM?
fallocate(r1, 0x20, 0x4000, 0x8000)
# truncate file1 size x8001
truncate(&(0x7f00000000c0)='./file1\x00', 0x8001)
syzbot
Aug 1, 2025, 8:14:25 PM8/1/25
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages