INFO: task hung in fb_release
13 views
Skip to first unread message
syzbot
Jan 13, 2020, 3:38:10 PM1/13/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: dcd88898 Linux 4.19.95
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=100f0c21e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=1f7fa7375205a3ab
dashboard link: https://syzkaller.appspot.com/bug?extid=9643afdc01eac6585374
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+9643af...@syzkaller.appspotmail.com
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves
INFO: task syz-executor.1:6599 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1 D28440 6599 8110 0x80000002
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_release+0x55/0x150 drivers/video/fbdev/core/fbmem.c:1486
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xc1f/0x30d0 kernel/exit.c:880
do_group_exit+0x135/0x370 kernel/exit.c:983
get_signal+0x3ec/0x1fc0 kernel/signal.c:2578
do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f44c397ecf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 000000000075bf28 RCX: 000000000045af49
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000075bf2c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000000 R11: 0000000000000246 R12: 000000000075bf2c
R13: 00007ffdcebdaeaf R14: 00007f44c397f9c0 R15: 000000000075bf2c
INFO: task syz-executor.3:6606 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.3 D28224 6606 8117 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_open+0xd7/0x450 drivers/video/fbdev/core/fbmem.c:1457
chrdev_open+0x245/0x6b0 fs/char_dev.c:423
do_dentry_open+0x4c3/0x1210 fs/open.c:796
vfs_open+0xa0/0xd0 fs/open.c:905
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x45e0 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_openat fs/open.c:1115 [inline]
__se_sys_openat fs/open.c:1109 [inline]
__x64_sys_openat+0x9d/0x100 fs/open.c:1109
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff2422d3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff2422d46d4
R13: 00000000004c88ce R14: 00000000004e0ef0 R15: 00000000ffffffff
INFO: task syz-executor.4:6615 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D28632 6615 8121 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_open+0xd7/0x450 drivers/video/fbdev/core/fbmem.c:1457
chrdev_open+0x245/0x6b0 fs/char_dev.c:423
do_dentry_open+0x4c3/0x1210 fs/open.c:796
vfs_open+0xa0/0xd0 fs/open.c:905
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x45e0 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_openat fs/open.c:1115 [inline]
__se_sys_openat fs/open.c:1109 [inline]
__x64_sys_openat+0x9d/0x100 fs/open.c:1109
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f470cadac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f470cadb6d4
R13: 00000000004c88ce R14: 00000000004e0ef0 R15: 00000000ffffffff
INFO: task syz-executor.2:6616 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D29224 6616 8113 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_open+0xd7/0x450 drivers/video/fbdev/core/fbmem.c:1457
chrdev_open+0x245/0x6b0 fs/char_dev.c:423
do_dentry_open+0x4c3/0x1210 fs/open.c:796
vfs_open+0xa0/0xd0 fs/open.c:905
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x45e0 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_openat fs/open.c:1115 [inline]
__se_sys_openat fs/open.c:1109 [inline]
__x64_sys_openat+0x9d/0x100 fs/open.c:1109
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f17a8e5dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f17a8e5e6d4
R13: 00000000004c88ce R14: 00000000004e0ef0 R15: 00000000ffffffff
Showing all locks held in the system:
2 locks held by kworker/u4:3/182:
1 lock held by khungtaskd/1082:
#0: 0000000081569172 (rcu_read_lock){....}, at:
debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4438
1 lock held by rsyslogd/7943:
#0: 000000001be69ee3 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
fs/file.c:767
2 locks held by getty/8065:
#0: 000000001d6ed4e5 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 000000006902d516 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8066:
#0: 00000000b39b0271 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 0000000054a82368 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8067:
#0: 00000000730a4bf1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 00000000b3861a52 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8068:
#0: 0000000019014f1b (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 000000004a8991d0 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8069:
#0: 0000000055c014cc (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 00000000c485b3c6 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8070:
#0: 0000000002f6a5b1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 0000000099c911a9 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8071:
#0: 000000006704de16 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 0000000074ededff (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
1 lock held by syz-executor.1/6599:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_release+0x55/0x150
drivers/video/fbdev/core/fbmem.c:1486
3 locks held by syz-executor.5/6596:
1 lock held by syz-executor.3/6606:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
1 lock held by syz-executor.4/6615:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
1 lock held by syz-executor.2/6616:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
1 lock held by syz-executor.1/6688:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 1082 Comm: khungtaskd Not tainted 4.19.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
watchdog+0x9df/0xee0 kernel/hung_task.c:287
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 182 Comm: kworker/u4:3 Not tainted 4.19.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: (null) (bat_events)
RIP: 0010:__sanitizer_cov_trace_pc+0x4b/0x50 kernel/kcov.c:111
Code: 90 d0 12 00 00 83 fa 02 75 20 48 8b 88 d8 12 00 00 8b 80 d4 12 00 00
48 8b 11 48 83 c2 01 48 39 d0 76 07 48 89 34 d1 48 89 11 <5d> c3 0f 1f 00
65 4c 8b 04 25 40 ee 01 00 65 8b 05 b0 d7 96 7e a9
RSP: 0018:ffff8880a95f7c48 EFLAGS: 00000093
RAX: ffff8880a95de280 RBX: 0000000000000000 RCX: 1ffffffff1279058
RDX: 0000000000000000 RSI: ffffffff836a1bbc RDI: ffffffff87eb2980
RBP: ffff8880a95f7c48 R08: ffff8880a95de280 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffffffff87eb2980
R13: 000000000002c240 R14: ffffffff87abe4e0 R15: ffff8880ae82c240
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000130 CR3: 0000000095c2b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
check_preemption_disabled+0x1c/0x290 lib/smp_processor_id.c:13
__this_cpu_preempt_check+0x1d/0x30 lib/smp_processor_id.c:62
rcu_sched_qs+0x27/0x1b0 kernel/rcu/tree.c:234
rcu_note_context_switch+0x3d/0x1720 kernel/rcu/tree.c:436
__schedule+0x1f0/0x1dc0 kernel/sched/core.c:3443
schedule+0x92/0x1c0 kernel/sched/core.c:3559
worker_thread+0x248/0xe40 kernel/workqueue.c:2317
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: dcd88898 Linux 4.19.95
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=100f0c21e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=1f7fa7375205a3ab
dashboard link: https://syzkaller.appspot.com/bug?extid=9643afdc01eac6585374
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+9643af...@syzkaller.appspotmail.com
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves
INFO: task syz-executor.1:6599 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1 D28440 6599 8110 0x80000002
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_release+0x55/0x150 drivers/video/fbdev/core/fbmem.c:1486
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xc1f/0x30d0 kernel/exit.c:880
do_group_exit+0x135/0x370 kernel/exit.c:983
get_signal+0x3ec/0x1fc0 kernel/signal.c:2578
do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f44c397ecf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 000000000075bf28 RCX: 000000000045af49
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000075bf2c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000000 R11: 0000000000000246 R12: 000000000075bf2c
R13: 00007ffdcebdaeaf R14: 00007f44c397f9c0 R15: 000000000075bf2c
INFO: task syz-executor.3:6606 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.3 D28224 6606 8117 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_open+0xd7/0x450 drivers/video/fbdev/core/fbmem.c:1457
chrdev_open+0x245/0x6b0 fs/char_dev.c:423
do_dentry_open+0x4c3/0x1210 fs/open.c:796
vfs_open+0xa0/0xd0 fs/open.c:905
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x45e0 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_openat fs/open.c:1115 [inline]
__se_sys_openat fs/open.c:1109 [inline]
__x64_sys_openat+0x9d/0x100 fs/open.c:1109
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff2422d3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff2422d46d4
R13: 00000000004c88ce R14: 00000000004e0ef0 R15: 00000000ffffffff
INFO: task syz-executor.4:6615 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D28632 6615 8121 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_open+0xd7/0x450 drivers/video/fbdev/core/fbmem.c:1457
chrdev_open+0x245/0x6b0 fs/char_dev.c:423
do_dentry_open+0x4c3/0x1210 fs/open.c:796
vfs_open+0xa0/0xd0 fs/open.c:905
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x45e0 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_openat fs/open.c:1115 [inline]
__se_sys_openat fs/open.c:1109 [inline]
__x64_sys_openat+0x9d/0x100 fs/open.c:1109
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f470cadac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f470cadb6d4
R13: 00000000004c88ce R14: 00000000004e0ef0 R15: 00000000ffffffff
INFO: task syz-executor.2:6616 blocked for more than 140 seconds.
Not tainted 4.19.95-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D29224 6616 8113 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
schedule+0x92/0x1c0 kernel/sched/core.c:3559
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3617
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
fb_open+0xd7/0x450 drivers/video/fbdev/core/fbmem.c:1457
chrdev_open+0x245/0x6b0 fs/char_dev.c:423
do_dentry_open+0x4c3/0x1210 fs/open.c:796
vfs_open+0xa0/0xd0 fs/open.c:905
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x45e0 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_openat fs/open.c:1115 [inline]
__se_sys_openat fs/open.c:1109 [inline]
__x64_sys_openat+0x9d/0x100 fs/open.c:1109
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f17a8e5dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f17a8e5e6d4
R13: 00000000004c88ce R14: 00000000004e0ef0 R15: 00000000ffffffff
Showing all locks held in the system:
2 locks held by kworker/u4:3/182:
1 lock held by khungtaskd/1082:
#0: 0000000081569172 (rcu_read_lock){....}, at:
debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4438
1 lock held by rsyslogd/7943:
#0: 000000001be69ee3 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
fs/file.c:767
2 locks held by getty/8065:
#0: 000000001d6ed4e5 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 000000006902d516 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8066:
#0: 00000000b39b0271 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 0000000054a82368 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8067:
#0: 00000000730a4bf1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 00000000b3861a52 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8068:
#0: 0000000019014f1b (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 000000004a8991d0 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8069:
#0: 0000000055c014cc (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 00000000c485b3c6 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8070:
#0: 0000000002f6a5b1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 0000000099c911a9 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
2 locks held by getty/8071:
#0: 000000006704de16 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 0000000074ededff (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154
1 lock held by syz-executor.1/6599:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_release+0x55/0x150
drivers/video/fbdev/core/fbmem.c:1486
3 locks held by syz-executor.5/6596:
1 lock held by syz-executor.3/6606:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
1 lock held by syz-executor.4/6615:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
1 lock held by syz-executor.2/6616:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
1 lock held by syz-executor.1/6688:
#0: 00000000fd7fe897 (&fb_info->lock){+.+.}, at: fb_open+0xd7/0x450
drivers/video/fbdev/core/fbmem.c:1457
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 1082 Comm: khungtaskd Not tainted 4.19.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
watchdog+0x9df/0xee0 kernel/hung_task.c:287
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 182 Comm: kworker/u4:3 Not tainted 4.19.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: (null) (bat_events)
RIP: 0010:__sanitizer_cov_trace_pc+0x4b/0x50 kernel/kcov.c:111
Code: 90 d0 12 00 00 83 fa 02 75 20 48 8b 88 d8 12 00 00 8b 80 d4 12 00 00
48 8b 11 48 83 c2 01 48 39 d0 76 07 48 89 34 d1 48 89 11 <5d> c3 0f 1f 00
65 4c 8b 04 25 40 ee 01 00 65 8b 05 b0 d7 96 7e a9
RSP: 0018:ffff8880a95f7c48 EFLAGS: 00000093
RAX: ffff8880a95de280 RBX: 0000000000000000 RCX: 1ffffffff1279058
RDX: 0000000000000000 RSI: ffffffff836a1bbc RDI: ffffffff87eb2980
RBP: ffff8880a95f7c48 R08: ffff8880a95de280 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffffffff87eb2980
R13: 000000000002c240 R14: ffffffff87abe4e0 R15: ffff8880ae82c240
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000130 CR3: 0000000095c2b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
check_preemption_disabled+0x1c/0x290 lib/smp_processor_id.c:13
__this_cpu_preempt_check+0x1d/0x30 lib/smp_processor_id.c:62
rcu_sched_qs+0x27/0x1b0 kernel/rcu/tree.c:234
rcu_note_context_switch+0x3d/0x1720 kernel/rcu/tree.c:436
__schedule+0x1f0/0x1dc0 kernel/sched/core.c:3443
schedule+0x92/0x1c0 kernel/sched/core.c:3559
worker_thread+0x248/0xe40 kernel/workqueue.c:2317
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Nov 15, 2020, 9:18:19 AM11/15/20
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages