INFO: task hung in __get_super
14 views
Skip to first unread message
syzbot
Apr 14, 2019, 6:41:05 AM4/14/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10ee7987200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=a30b1409be431c5b4fe4
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a30b14...@syzkaller.appspotmail.com
net_ratelimit: 20 callbacks suppressed
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
INFO: task syz-executor.1:17317 blocked for more than 140 seconds.
Not tainted 4.14.111 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1 D29912 17317 7008 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:276 [inline]
rwsem_down_read_failed+0x1f4/0x380 kernel/locking/rwsem-xadd.c:293
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x49/0xb0 kernel/locking/rwsem.c:26
__get_super.part.0+0x1cb/0x280 fs/super.c:678
__get_super include/linux/spinlock.h:317 [inline]
get_super+0x2e/0x50 fs/super.c:707
fsync_bdev+0x19/0xd0 fs/block_dev.c:495
blkdev_flushbuf block/ioctl.c:430 [inline]
blkdev_ioctl+0x705/0x1880 block/ioctl.c:514
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7b9/0x1070 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f3035073c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29
RDX: 0000000000000000 RSI: 0000000000001261 RDI: 0000000000000003
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f30350746d4
R13: 00000000004bffd6 R14: 00000000004d2360 R15: 00000000ffffffff
Showing all locks held in the system:
1 lock held by khungtaskd/1009:
#0: (tasklist_lock){.+.+}, at: [<ffffffff81486028>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4544
2 locks held by getty/6960:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6961:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6962:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6963:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6964:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6965:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6966:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
1 lock held by syz-executor.1/17317:
#0: (&type->s_umount_key#75){.+.+}, at: [<ffffffff818da44b>]
__get_super.part.0+0x1cb/0x280 fs/super.c:678
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 1009 Comm: khungtaskd Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:194 [inline]
watchdog+0x5d8/0xb80 kernel/hung_task.c:250
kthread+0x31c/0x430 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 17312 Comm: syz-executor.1 Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff88809c324140 task.stack: ffff888063a40000
RIP: 0010:lookup_bh_lru fs/buffer.c:1324 [inline]
RIP: 0010:__find_get_block+0xd9/0xb10 fs/buffer.c:1353
RSP: 0018:ffff888063a476f8 EFLAGS: 00000082
RAX: 0000000000000000 RBX: 0000000000000004 RCX: ffffc90007c54000
RDX: 0000000000040000 RSI: ffffffff82d7e0ac RDI: ffffffff869d1600
RBP: ffff888063a47758 R08: ffff88809c324140 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88809c324140 R12: ffff88809a31da80
R13: 0000000000000004 R14: dffffc0000000000 R15: ffff88809a31da80
FS: 00007f3035095700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffada99158 CR3: 000000008970f000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
__getblk_slow fs/buffer.c:1100 [inline]
__getblk_gfp+0x18b/0x710 fs/buffer.c:1383
__bread_gfp+0x2e/0x290 fs/buffer.c:1417
sb_bread include/linux/buffer_head.h:307 [inline]
udf_tread+0xe8/0x130 fs/udf/misc.c:44
udf_read_tagged+0x40/0x4b0 fs/udf/misc.c:210
udf_check_anchor_block+0x19b/0x580 fs/udf/super.c:1810
udf_scan_anchors+0x352/0x5a0 fs/udf/super.c:1872
udf_find_anchor fs/udf/super.c:1907 [inline]
udf_load_vrs+0x5c4/0xae0 fs/udf/super.c:1972
udf_fill_super+0x727/0x157f fs/udf/super.c:2164
mount_bdev+0x2c1/0x370 fs/super.c:1134
udf_mount+0x35/0x40 fs/udf/super.c:132
mount_fs+0x9d/0x2a7 fs/super.c:1237
vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0x417/0x27d0 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xab/0x120 fs/namespace.c:3072
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f3035094c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458c29
RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000020000000
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f30350956d4
R13: 00000000004c4c0e R14: 00000000004d8888 R15: 00000000ffffffff
Code: 9e 20 ae ff eb 11 e8 57 92 c3 ff 83 c3 01 83 fb 10 0f 84 06 01 00 00
e8 46 92 c3 ff 48 c7 c7 00 82 74 86 41 89 dd e8 c7 9d 3e 01 <65> 4e 8b 3c
ed 20 8b 02 00 4d 85 ff 4d 89 fc 74 ca e8 21 92 c3
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10ee7987200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=a30b1409be431c5b4fe4
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a30b14...@syzkaller.appspotmail.com
net_ratelimit: 20 callbacks suppressed
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
INFO: task syz-executor.1:17317 blocked for more than 140 seconds.
Not tainted 4.14.111 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1 D29912 17317 7008 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:276 [inline]
rwsem_down_read_failed+0x1f4/0x380 kernel/locking/rwsem-xadd.c:293
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x49/0xb0 kernel/locking/rwsem.c:26
__get_super.part.0+0x1cb/0x280 fs/super.c:678
__get_super include/linux/spinlock.h:317 [inline]
get_super+0x2e/0x50 fs/super.c:707
fsync_bdev+0x19/0xd0 fs/block_dev.c:495
blkdev_flushbuf block/ioctl.c:430 [inline]
blkdev_ioctl+0x705/0x1880 block/ioctl.c:514
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7b9/0x1070 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f3035073c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29
RDX: 0000000000000000 RSI: 0000000000001261 RDI: 0000000000000003
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f30350746d4
R13: 00000000004bffd6 R14: 00000000004d2360 R15: 00000000ffffffff
Showing all locks held in the system:
1 lock held by khungtaskd/1009:
#0: (tasklist_lock){.+.+}, at: [<ffffffff81486028>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4544
2 locks held by getty/6960:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6961:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6962:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6963:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6964:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6965:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6966:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a89e3>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83107006>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
1 lock held by syz-executor.1/17317:
#0: (&type->s_umount_key#75){.+.+}, at: [<ffffffff818da44b>]
__get_super.part.0+0x1cb/0x280 fs/super.c:678
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 1009 Comm: khungtaskd Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:194 [inline]
watchdog+0x5d8/0xb80 kernel/hung_task.c:250
kthread+0x31c/0x430 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 17312 Comm: syz-executor.1 Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff88809c324140 task.stack: ffff888063a40000
RIP: 0010:lookup_bh_lru fs/buffer.c:1324 [inline]
RIP: 0010:__find_get_block+0xd9/0xb10 fs/buffer.c:1353
RSP: 0018:ffff888063a476f8 EFLAGS: 00000082
RAX: 0000000000000000 RBX: 0000000000000004 RCX: ffffc90007c54000
RDX: 0000000000040000 RSI: ffffffff82d7e0ac RDI: ffffffff869d1600
RBP: ffff888063a47758 R08: ffff88809c324140 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88809c324140 R12: ffff88809a31da80
R13: 0000000000000004 R14: dffffc0000000000 R15: ffff88809a31da80
FS: 00007f3035095700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffada99158 CR3: 000000008970f000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
__getblk_slow fs/buffer.c:1100 [inline]
__getblk_gfp+0x18b/0x710 fs/buffer.c:1383
__bread_gfp+0x2e/0x290 fs/buffer.c:1417
sb_bread include/linux/buffer_head.h:307 [inline]
udf_tread+0xe8/0x130 fs/udf/misc.c:44
udf_read_tagged+0x40/0x4b0 fs/udf/misc.c:210
udf_check_anchor_block+0x19b/0x580 fs/udf/super.c:1810
udf_scan_anchors+0x352/0x5a0 fs/udf/super.c:1872
udf_find_anchor fs/udf/super.c:1907 [inline]
udf_load_vrs+0x5c4/0xae0 fs/udf/super.c:1972
udf_fill_super+0x727/0x157f fs/udf/super.c:2164
mount_bdev+0x2c1/0x370 fs/super.c:1134
udf_mount+0x35/0x40 fs/udf/super.c:132
mount_fs+0x9d/0x2a7 fs/super.c:1237
vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0x417/0x27d0 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xab/0x120 fs/namespace.c:3072
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f3035094c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458c29
RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000020000000
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f30350956d4
R13: 00000000004c4c0e R14: 00000000004d8888 R15: 00000000ffffffff
Code: 9e 20 ae ff eb 11 e8 57 92 c3 ff 83 c3 01 83 fb 10 0f 84 06 01 00 00
e8 46 92 c3 ff 48 c7 c7 00 82 74 86 41 89 dd e8 c7 9d 3e 01 <65> 4e 8b 3c
ed 20 8b 02 00 4d 85 ff 4d 89 fc 74 ca e8 21 92 c3
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 18, 2019, 11:16:06 AM4/18/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 4b0e041c Linux 4.19.35
syzbot found the following crash on:
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11a8dbd3200000
kernel config: https://syzkaller.appspot.com/x/.config?x=bb1bcac868b1655e
dashboard link: https://syzkaller.appspot.com/bug?extid=aa1e3076ccdf7c9e5330
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+aa1e30...@syzkaller.appspotmail.com
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
hfs: unable to load iocharset "c"
hfs: unable to parse mount options
hfs: unable to load iocharset "c"
hfs: unable to parse mount options
INFO: task syz-executor.2:17964 blocked for more than 140 seconds.
Not tainted 4.19.35 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D28576 17964 7868 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x813/0x1d00 kernel/sched/core.c:3474
schedule+0x92/0x1c0 kernel/sched/core.c:3518
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:276 [inline]
rwsem_down_read_failed+0x219/0x3c0 kernel/locking/rwsem-xadd.c:293
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0x49/0xb0 kernel/locking/rwsem.c:26
__get_super.part.0+0x203/0x2e0 fs/super.c:698
__get_super include/linux/spinlock.h:329 [inline]
get_super+0x2e/0x50 fs/super.c:727
fsync_bdev+0x19/0xd0 fs/block_dev.c:483
invalidate_partition+0x36/0x60 block/genhd.c:1561
drop_partitions block/partition-generic.c:447 [inline]
rescan_partitions+0xef/0xa20 block/partition-generic.c:520
__blkdev_reread_part+0x1a2/0x230 block/ioctl.c:173
blkdev_reread_part+0x27/0x40 block/ioctl.c:193
loop_reread_partitions+0x1c/0x40 drivers/block/loop.c:634
loop_set_status+0xe57/0x1380 drivers/block/loop.c:1296
loop_set_status64+0xc2/0x120 drivers/block/loop.c:1416
lo_ioctl+0x43b/0x20f0 drivers/block/loop.c:1559
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc4b/0x1ae0 block/ioctl.c:601
block_ioctl+0xee/0x130 fs/block_dev.c:1891
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458a97
Code: Bad RIP value.
RSP: 002b:00007f01f2a719f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f01f2a726d4 RCX: 0000000000458a97
RDX: 00007f01f2a71ab0 RSI: 0000000000004c04 RDI: 0000000000000004
RBP: 0000000000000242 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000202 R12: 0000000000000003
R13: 0000000000000003 R14: 0000000000000004 R15: 00000000ffffffff
INFO: task syz-executor.2:17968 blocked for more than 140 seconds.
Not tainted 4.19.35 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D28840 17968 7868 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x813/0x1d00 kernel/sched/core.c:3474
schedule+0x92/0x1c0 kernel/sched/core.c:3518
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3576
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
blkdev_put+0x34/0x560 fs/block_dev.c:1824
blkdev_close+0x8b/0xb0 fs/block_dev.c:1873
__fput+0x2df/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4129e1
Code: bb c8 00 00 00 ff 15 1e 6e 24 00 85 c0 89 c5 0f 85 7e fc ff ff e9 32
ff ff ff 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 <89> 5c 24 d0 4c
89 6c 24 e8 48 89 d3 48 89 6c 24 d8 4c 89 64 24 e0
RSP: 002b:00007f01f2a509f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007f01f2a516d4 RCX: 00000000004129e1
RDX: 0000000000000005 RSI: 0000000000004c00 RDI: 0000000000000006
RBP: 0000000000000010 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000005
R13: ffffffffffffffff R14: 0000000000000006 R15: 00000000ffffffff
INFO: task syz-executor.2:17970 blocked for more than 140 seconds.
Not tainted 4.19.35 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D28872 17970 7868 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x813/0x1d00 kernel/sched/core.c:3474
schedule+0x92/0x1c0 kernel/sched/core.c:3518
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3576
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
blkdev_get+0xc4/0x990 fs/block_dev.c:1625
blkdev_open+0x205/0x290 fs/block_dev.c:1783
do_dentry_open+0x4c6/0x1200 fs/open.c:777
vfs_open+0xa0/0xd0 fs/open.c:886
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x4690 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1069
__do_sys_open fs/open.c:1087 [inline]
__se_sys_open fs/open.c:1082 [inline]
__x64_sys_open+0x7e/0xc0 fs/open.c:1082
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x412bc1
Code: 01 49 83 c7 08 44 3b 74 24 0c 74 1f 49 8b 2f 48 85 ed 75 bd 41 83 fd
ff 45 0f 44 ee 41 83 c6 01 49 83 c7 08 44 3b 74 24 0c 75 <e1> 41 83 fd ff
c7 83 00 01 00 00 ff ff ff ff 48 c7 83 c8 00 00 00
RSP: 002b:00007f01f2a2f9f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f01f2a306d4 RCX: 0000000000412bc1
RDX: 00007f01f2a2fbaa RSI: 0000000000000002 RDI: 00007f01f2a2fba0
RBP: 0000000000000242 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000003 R14: 00007f01f2a306d4 R15: 00000000ffffffff
INFO: task syz-executor.2:18010 blocked for more than 140 seconds.
Not tainted 4.19.35 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D28872 18010 7868 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x813/0x1d00 kernel/sched/core.c:3474
schedule+0x92/0x1c0 kernel/sched/core.c:3518
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3576
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
blkdev_get+0xc4/0x990 fs/block_dev.c:1625
blkdev_open+0x205/0x290 fs/block_dev.c:1783
do_dentry_open+0x4c6/0x1200 fs/open.c:777
vfs_open+0xa0/0xd0 fs/open.c:886
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x4690 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1069
__do_sys_open fs/open.c:1087 [inline]
__se_sys_open fs/open.c:1082 [inline]
__x64_sys_open+0x7e/0xc0 fs/open.c:1082
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x412bc1
Code: 01 49 83 c7 08 44 3b 74 24 0c 74 1f 49 8b 2f 48 85 ed 75 bd 41 83 fd
ff 45 0f 44 ee 41 83 c6 01 49 83 c7 08 44 3b 74 24 0c 75 <e1> 41 83 fd ff
c7 83 00 01 00 00 ff ff ff ff 48 c7 83 c8 00 00 00
RSP: 002b:00007f01f2a0e9f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f01f2a0f6d4 RCX: 0000000000412bc1
RDX: 00007f01f2a0ebaa RSI: 0000000000000002 RDI: 00007f01f2a0eba0
RBP: 000000000073c0e0 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000005
R13: 0000000000000005 R14: 00000000004ddd18 R15: 00000000ffffffff
INFO: task blkid:17967 blocked for more than 140 seconds.
Not tainted 4.19.35 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
blkid D28728 17967 17533 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x813/0x1d00 kernel/sched/core.c:3474
schedule+0x92/0x1c0 kernel/sched/core.c:3518
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3576
__mutex_lock_common kernel/locking/mutex.c:1002 [inline]
__mutex_lock+0x726/0x1300 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
blkdev_get+0xc4/0x990 fs/block_dev.c:1625
blkdev_open+0x205/0x290 fs/block_dev.c:1783
do_dentry_open+0x4c6/0x1200 fs/open.c:777
vfs_open+0xa0/0xd0 fs/open.c:886
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x4690 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x550 fs/open.c:1069
__do_sys_open fs/open.c:1087 [inline]
__se_sys_open fs/open.c:1082 [inline]
__x64_sys_open+0x7e/0xc0 fs/open.c:1082
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f7cf60f6120
Code: Bad RIP value.
RSP: 002b:00007ffcd5370c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7cf60f6120
RDX: 00007ffcd5372f41 RSI: 0000000000000000 RDI: 00007ffcd5372f41
RBP: 0000000000000000 R08: 0000000000000078 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000001e91030
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005
Showing all locks held in the system:
#0: 0000000031b038ae (rcu_read_lock){....}, at:
debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4438
1 lock held by rsyslogd/7701:
#0: 00000000a702ca9f (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
fs/file.c:767
2 locks held by getty/7823:
#0: 00000000e62df19a (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
#1: 00000000d0341944 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7824:
#0: 000000001fa1cd38 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
#1: 00000000b93231c3 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7825:
#0: 00000000b4cb3f84 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
#1: 000000009c90eadc (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7826:
#0: 00000000f2efaf36 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
#1: 00000000e3473dc9 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7827:
#0: 0000000067e8a7ef (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
#1: 00000000db5ad0e1 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7828:
#0: 00000000c46c73f8 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
#1: 0000000087a33acc (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by getty/7829:
#0: 00000000dea89745 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:363
#1: 00000000a56fe286 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
2 locks held by syz-executor.1/17949:
2 locks held by syz-executor.2/17964:
#0: 0000000039d3a10c (&bdev->bd_mutex){+.+.}, at:
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
#1: 000000006433a7e6 (&type->s_umount_key#75){.+.+}, at:
__get_super.part.0+0x203/0x2e0 fs/super.c:698
1 lock held by syz-executor.2/17968:
#0: 0000000039d3a10c (&bdev->bd_mutex){+.+.}, at: blkdev_put+0x34/0x560
fs/block_dev.c:1824
1 lock held by syz-executor.2/17970:
#0: 0000000039d3a10c (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
1 lock held by syz-executor.2/18010:
#0: 0000000039d3a10c (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
1 lock held by blkid/17967:
#0: 0000000039d3a10c (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
=============================================
NMI backtrace for cpu 1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
Google 01/01/2011
Call Trace:
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:202 [inline]
watchdog+0x9c6/0xec0 kernel/hung_task.c:263
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 17949 Comm: syz-executor.1 Not tainted 4.19.35 #3
NMI backtrace for cpu 0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:23 [inline]
Google 01/01/2011
RIP: 0010:check_kcov_mode kernel/kcov.c:67 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x11/0x50 kernel/kcov.c:101
Code: 08 00 00 00 00 e9 ca e9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 55 48 89 e5 48 8b 75 08 65 48 8b 04 25 40 ee 01 00 <65> 8b 15 a8 b8
96 7e 81 e2 00 01 1f 00 75 2b 8b 90 d0 12 00 00 83
RSP: 0018:ffff888092c175e8 EFLAGS: 00000046
RAX: ffff8880549f4140 RBX: 0000000000000000 RCX: ffffffff8324a83a
RDX: 0000000000000000 RSI: ffffffff8324a7d8 RDI: 0000000000000007
RBP: ffff888092c175e8 R08: ffff8880549f4140 R09: fffff9400046ce0f
R10: fffff9400046ce0e R11: ffffea0002367077 R12: ffffffff87819f60
R13: 0000000000000000 R14: ffffffff8755bd60 R15: 000000000000000b
FS: 00007fb24554b700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 000000009f0c7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
check_preemption_disabled+0x48/0x290 lib/smp_processor_id.c:51
__this_cpu_preempt_check+0x1d/0x30 lib/smp_processor_id.c:62
lookup_bh_lru fs/buffer.c:1262 [inline]
__find_get_block+0xfa/0xcf0 fs/buffer.c:1291
__getblk_slow fs/buffer.c:1040 [inline]
__getblk_gfp+0x1b1/0x970 fs/buffer.c:1321
__bread_gfp+0x2f/0x300 fs/buffer.c:1355
sb_bread include/linux/buffer_head.h:307 [inline]
udf_tread+0xf1/0x140 fs/udf/misc.c:44
udf_read_tagged+0x50/0x530 fs/udf/misc.c:210
udf_check_anchor_block+0x1ef/0x680 fs/udf/super.c:1755
udf_scan_anchors+0x1cf/0x680 fs/udf/super.c:1795
udf_find_anchor fs/udf/super.c:1860 [inline]
udf_load_vrs+0x8bf/0xc80 fs/udf/super.c:1917
udf_fill_super+0x7cb/0x16f5 fs/udf/super.c:2112
mount_bdev+0x307/0x3c0 fs/super.c:1158
udf_mount+0x35/0x40 fs/udf/super.c:131
mount_fs+0xae/0x331 fs/super.c:1261
vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x53e/0x2bc0 fs/namespace.c:2799
ksys_mount+0xdb/0x150 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3026
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb24554ac78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458c29
RDX: 0000000020000140 RSI: 00000000200000c0 RDI: 0000000020000000
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb24554b6d4
R13: 00000000004c4c0e R14: 00000000004d8888 R15: 00000000ffffffff
syzbot
Jul 2, 2019, 4:24:08 AM7/2/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: f4cc0ed9 Linux 4.14.131
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=140559a3a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab1953b2cdac00f5
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150f3b39a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a30b14...@syzkaller.appspotmail.com
audit: type=1400 audit(1562055436.301:37): avc: denied { map } for
pid=7024 comm="syz-executor838" path="/root/syz-executor838660176"
dev="sda1" ino=2233 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
INFO: task syz-executor838:7026 blocked for more than 140 seconds.
Not tainted 4.14.131 #25
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
rwsem_down_read_failed+0x1f6/0x390 kernel/locking/rwsem-xadd.c:309
drop_partitions block/partition-generic.c:442 [inline]
rescan_partitions+0xe3/0x860 block/partition-generic.c:515
__blkdev_reread_part+0x15c/0x1e0 block/ioctl.c:173
blkdev_reread_part+0x27/0x40 block/ioctl.c:193
loop_reread_partitions+0x7c/0x90 drivers/block/loop.c:614
loop_set_status+0xc25/0x11f0 drivers/block/loop.c:1183
loop_set_status64+0xa6/0xf0 drivers/block/loop.c:1301
lo_ioctl+0x5c1/0x1ce0 drivers/block/loop.c:1431
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446b97
RSP: 002b:00007fd6d528cb68 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd6d528d6d0 RCX: 0000000000446b97
RDX: 00007fd6d528cc00 RSI: 0000000000004c04 RDI: 0000000000000004
RBP: 0000000000000006 R08: 0000000000000000 R09: 000000000000000a
INFO: task syz-executor838:7029 blocked for more than 140 seconds.
Not tainted 4.14.131 #25
schedule+0x92/0x1c0 kernel/sched/core.c:3427
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3485
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x73c/0x1470 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
ioctl_by_bdev+0xa5/0x110 fs/block_dev.c:2066
udf_get_last_session+0x87/0xe0 fs/udf/lowlevel.c:37
udf_fill_super+0x114d/0x157f fs/udf/super.c:2146
mount_bdev+0x2be/0x370 fs/super.c:1134
udf_mount+0x35/0x40 fs/udf/super.c:132
mount_fs+0x97/0x2a1 fs/super.c:1237
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446c89
RSP: 002b:00007fd6d526bdb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446c89
RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 0000000020000140
RBP: 00000000006dbc30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc3c
R13: 00007ffc2548ef9f R14: 00007fd6d526c9c0 R15: 20c49ba5e353f7cf
INFO: task blkid:7028 blocked for more than 140 seconds.
Not tainted 4.14.131 #25
schedule+0x92/0x1c0 kernel/sched/core.c:3427
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3485
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x73c/0x1470 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f70c56dd347
RSP: 002b:00007ffe0ede3878 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000a03030 RCX: 00007f70c56dd347
RDX: 0000000000000000 RSI: 0000000000005331 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007f70c598d5a0 R09: 0000000000000008
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000001d000 R14: 0000000000000003 R15: 0000000000000005
Showing all locks held in the system:
1 lock held by khungtaskd/1009:
#0: (tasklist_lock){.+.+}, at: [<ffffffff81483348>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4541
1 lock held by rsyslogd/6874:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff8193eafb>]
__fdget_pos+0xab/0xd0 fs/file.c:769
2 locks held by getty/6998:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6999:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7000:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7001:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7002:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7003:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7004:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
3 locks held by syz-executor838/7026:
#0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff837309cf>]
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
#1: (&bdev->bd_mutex){+.+.}, at: [<ffffffff82ca4def>]
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
#2: (&type->s_umount_key#52){.+.+}, at: [<ffffffff818db08b>]
__get_super.part.0+0x1cb/0x280 fs/super.c:678
2 locks held by syz-executor838/7029:
#0: (&type->s_umount_key#51/1){+.+.}, at: [<ffffffff818dbc71>]
alloc_super fs/super.c:251 [inline]
#0: (&type->s_umount_key#51/1){+.+.}, at: [<ffffffff818dbc71>]
sget_userns+0x551/0xc30 fs/super.c:516
#1: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff837309cf>]
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
1 lock held by blkid/7028:
#0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff837309cf>]
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 1009 Comm: khungtaskd Not tainted 4.14.131 #25
watchdog+0x5e7/0xb90 kernel/hung_task.c:274
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
HEAD commit: f4cc0ed9 Linux 4.14.131
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=140559a3a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab1953b2cdac00f5
dashboard link: https://syzkaller.appspot.com/bug?extid=a30b1409be431c5b4fe4
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16ace52ba00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150f3b39a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a30b14...@syzkaller.appspotmail.com
pid=7024 comm="syz-executor838" path="/root/syz-executor838660176"
dev="sda1" ino=2233 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
INFO: task syz-executor838:7026 blocked for more than 140 seconds.
Not tainted 4.14.131 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor838 D28352 7026 7024 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
context_switch kernel/sched/core.c:2807 [inline]
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
rwsem_down_read_failed+0x1f6/0x390 kernel/locking/rwsem-xadd.c:309
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x49/0xb0 kernel/locking/rwsem.c:26
__get_super.part.0+0x1cb/0x280 fs/super.c:678
__get_super include/linux/spinlock.h:317 [inline]
get_super+0x2e/0x50 fs/super.c:707
fsync_bdev+0x19/0xd0 fs/block_dev.c:495
invalidate_partition+0x36/0x60 block/genhd.c:1506
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x49/0xb0 kernel/locking/rwsem.c:26
__get_super.part.0+0x1cb/0x280 fs/super.c:678
__get_super include/linux/spinlock.h:317 [inline]
get_super+0x2e/0x50 fs/super.c:707
fsync_bdev+0x19/0xd0 fs/block_dev.c:495
drop_partitions block/partition-generic.c:442 [inline]
rescan_partitions+0xe3/0x860 block/partition-generic.c:515
__blkdev_reread_part+0x15c/0x1e0 block/ioctl.c:173
blkdev_reread_part+0x27/0x40 block/ioctl.c:193
loop_reread_partitions+0x7c/0x90 drivers/block/loop.c:614
loop_set_status+0xc25/0x11f0 drivers/block/loop.c:1183
loop_set_status64+0xa6/0xf0 drivers/block/loop.c:1301
lo_ioctl+0x5c1/0x1ce0 drivers/block/loop.c:1431
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446b97
RSP: 002b:00007fd6d528cb68 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd6d528d6d0 RCX: 0000000000446b97
RDX: 00007fd6d528cc00 RSI: 0000000000004c04 RDI: 0000000000000004
RBP: 0000000000000006 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000075 R11: 0000000000000202 R12: 0000000000000003
R13: 0000000000000003 R14: 0000000000000004 R15: 20c49ba5e353f7cf
INFO: task syz-executor838:7029 blocked for more than 140 seconds.
Not tainted 4.14.131 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor838 D29152 7029 7024 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
context_switch kernel/sched/core.c:2807 [inline]
schedule+0x92/0x1c0 kernel/sched/core.c:3427
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3485
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x73c/0x1470 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
ioctl_by_bdev+0xa5/0x110 fs/block_dev.c:2066
udf_get_last_session+0x87/0xe0 fs/udf/lowlevel.c:37
udf_fill_super+0x114d/0x157f fs/udf/super.c:2146
mount_bdev+0x2be/0x370 fs/super.c:1134
udf_mount+0x35/0x40 fs/udf/super.c:132
mount_fs+0x97/0x2a1 fs/super.c:1237
vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0x417/0x27d0 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xab/0x120 fs/namespace.c:3072
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0x417/0x27d0 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xab/0x120 fs/namespace.c:3072
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446c89
RSP: 002b:00007fd6d526bdb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446c89
RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 0000000020000140
RBP: 00000000006dbc30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc3c
R13: 00007ffc2548ef9f R14: 00007fd6d526c9c0 R15: 20c49ba5e353f7cf
INFO: task blkid:7028 blocked for more than 140 seconds.
Not tainted 4.14.131 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
blkid D28720 7028 6681 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
context_switch kernel/sched/core.c:2807 [inline]
schedule+0x92/0x1c0 kernel/sched/core.c:3427
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3485
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x73c/0x1470 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f70c56dd347
RSP: 002b:00007ffe0ede3878 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000a03030 RCX: 00007f70c56dd347
RDX: 0000000000000000 RSI: 0000000000005331 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007f70c598d5a0 R09: 0000000000000008
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000001d000 R14: 0000000000000003 R15: 0000000000000005
Showing all locks held in the system:
1 lock held by khungtaskd/1009:
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4541
1 lock held by rsyslogd/6874:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff8193eafb>]
__fdget_pos+0xab/0xd0 fs/file.c:769
2 locks held by getty/6998:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6999:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7000:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7001:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7002:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7003:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/7004:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861a5c53>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff83106146>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
3 locks held by syz-executor838/7026:
#0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff837309cf>]
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
#1: (&bdev->bd_mutex){+.+.}, at: [<ffffffff82ca4def>]
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
#2: (&type->s_umount_key#52){.+.+}, at: [<ffffffff818db08b>]
__get_super.part.0+0x1cb/0x280 fs/super.c:678
2 locks held by syz-executor838/7029:
#0: (&type->s_umount_key#51/1){+.+.}, at: [<ffffffff818dbc71>]
alloc_super fs/super.c:251 [inline]
#0: (&type->s_umount_key#51/1){+.+.}, at: [<ffffffff818dbc71>]
sget_userns+0x551/0xc30 fs/super.c:516
#1: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff837309cf>]
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
1 lock held by blkid/7028:
#0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff837309cf>]
lo_ioctl+0x8f/0x1ce0 drivers/block/loop.c:1404
=============================================
NMI backtrace for cpu 1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
watchdog+0x5e7/0xb90 kernel/hung_task.c:274
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff861a673e
syzbot
Nov 10, 2019, 3:01:09 AM11/10/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 5ee93551 Linux 4.19.82
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1227b92ce00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c62a146039e23bc4
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11bf9cc2e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+aa1e30...@syzkaller.appspotmail.com
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: Scanning with blocksize 4096 failed
INFO: task syz-executor126:10367 blocked for more than 140 seconds.
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
Not tainted 4.19.82 #0
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
syz-executor126 D
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: Scanning with blocksize 4096 failed
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
28680 10367 7577 0x00000004
Call Trace:
UDF-fs: Scanning with blocksize 1024 failed
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: Scanning with blocksize 4096 failed
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 4096 failed
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
schedule+0x92/0x1c0 kernel/sched/core.c:3559
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
rwsem_down_read_failed+0x21b/0x3c0 kernel/locking/rwsem-xadd.c:309
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
__get_super.part.0+0x203/0x2e0 fs/super.c:698
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
invalidate_partition+0x36/0x60 block/genhd.c:1580
drop_partitions block/partition-generic.c:454 [inline]
rescan_partitions+0xef/0xa20 block/partition-generic.c:527
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
loop_reread_partitions+0x1c/0x40 drivers/block/loop.c:634
UDF-fs: Scanning with blocksize 512 failed
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
loop_set_status+0xe54/0x1370 drivers/block/loop.c:1297
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
loop_set_status64+0xc2/0x120 drivers/block/loop.c:1417
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
lo_ioctl+0x432/0x20e0 drivers/block/loop.c:1560
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc38/0x1ab6 block/ioctl.c:601
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 4096 failed
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446aa7
Code: 65 20 25 64 00 00 00 00 00 00 00 25 64 3a 25 64 3a 25 64 3a 25 64 3a
25 64 3a 25 64 3a 25 64 3a 25 64 3a 25 64 3a 25 63 3a 25 <64> 3a 25 64 00
00 00 00 00 6f 62 6a 44 65 73 65 72 69 61 6c 69 7a
RSP: 002b:00007f5167ac5b68 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000446aa7
RDX: 00007f5167ac5c00 RSI: 0000000000004c04 RDI: 0000000000000004
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
RBP: 00007f5167ac66d0 R08: 0000000000000000 R09: 000000000000000a
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
R10: 0000000000000075 R11: 0000000000000202 R12: 00000000006dbc2c
R13: 00007ffffcad85cf R14: 0000000000000004 R15: 000000000000002d
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
Showing all locks held in the system:
1 lock held by khungtaskd/1035:
UDF-fs: Scanning with blocksize 512 failed
#0: 00000000c655c729 (rcu_read_lock){....}, at:
debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4438
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
1 lock held by rsyslogd/7426:
UDF-fs: Scanning with blocksize 1024 failed
#0: 00000000b45d5d02 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
fs/file.c:767
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
2 locks held by getty/7548:
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
#0:
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
000000006d6d396b
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
#1: 000000006389141d (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: Scanning with blocksize 4096 failed
2 locks held by getty/7549:
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
#0:
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
000000008077515d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
#1: 00000000f031ac26 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
2 locks held by getty/7550:
#0: 00000000616f8dd7 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 000000001a5b59a5 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
2 locks held by getty/7551:
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
#0:
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
00000000b23efd04 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
UDF-fs: Scanning with blocksize 512 failed
#1: 00000000040b01ea (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
2 locks held by getty/7552:
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
UDF-fs: Scanning with blocksize 2048 failed
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
#0: 00000000e7e749e1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
UDF-fs: Scanning with blocksize 4096 failed
#1: 00000000392307b2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
UDF-fs: Scanning with blocksize 2048 failed
2 locks held by getty/7553:
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
#0:
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
UDF-fs: Scanning with blocksize 512 failed
000000001c2a3657 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 4096 failed
#1: 00000000c848eea9 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
2 locks held by getty/7554:
UDF-fs: Scanning with blocksize 2048 failed
#0:
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
00000000ca640fdb
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
UDF-fs: Scanning with blocksize 4096 failed
#1: 0000000072fe5f83 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
1 lock held by syz-executor126/7579:
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
#0: 00000000362cf0b6 (&bdev->bd_mutex){+.+.}, at:
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
2 locks held by syz-executor126/10367:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
#0: 0000000060d27555 (&bdev->bd_mutex){+.+.}, at:
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
UDF-fs: Scanning with blocksize 512 failed
#1: 00000000df9846d3 (&type->s_umount_key#52){.+.+}, at:
__get_super.part.0+0x203/0x2e0 fs/super.c:698
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
2 locks held by syz-executor126/10371:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
2 locks held by syz-executor126/14725:
UDF-fs: Scanning with blocksize 1024 failed
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
#0: 000000003a1990ff (&bdev->bd_mutex){+.+.}, at:
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
#1: 000000000d525c1d (&type->s_umount_key#52){.+.+}, at:
__get_super.part.0+0x203/0x2e0 fs/super.c:698
1 lock held by syz-executor126/14729:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
1 lock held by blkid/14738:
UDF-fs: Scanning with blocksize 2048 failed
#0: 000000003a1990ff (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
1 lock held by syz-executor126/16323:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
#0:
UDF-fs: Scanning with blocksize 4096 failed
00000000413b53ac (loop_ctl_mutex){+.+.}, at: blkdev_reread_part+0x1f/0x40
block/ioctl.c:192
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
1 lock held by syz-executor126/16324:
2 locks held by blkid/16327:
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
#0: 00000000b2b82199 (&rq->lock){-.-.}, at: rq_lock
kernel/sched/sched.h:1821 [inline]
#0: 00000000b2b82199 (&rq->lock){-.-.}, at: __schedule+0x1f8/0x1dc0
kernel/sched/core.c:3453
#1: 00000000c655c729 (rcu_read_lock){....}, at: trace_sched_stat_runtime
include/trace/events/sched.h:423 [inline]
#1: 00000000c655c729 (rcu_read_lock){....}, at: update_curr+0x2cc/0x8a0
kernel/sched/fair.c:828
1 lock held by syz-executor126/16330:
#0: 00000000413b53ac (loop_ctl_mutex){+.+.}, at: loop_get_status+0x23/0xc0
drivers/block/loop.c:1309
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
1 lock held by syz-executor126/16333:
#0: 00000000362cf0b6 (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
2 locks held by blkid/16331:
#0: 00000000362cf0b6 (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
#1: 00000000c655c729 (rcu_read_lock){....}, at: trace_sched_stat_runtime
include/trace/events/sched.h:423 [inline]
#1: 00000000c655c729 (rcu_read_lock){....}, at: update_curr+0x2cc/0x8a0
kernel/sched/fair.c:828
UDF-fs: Scanning with blocksize 512 failed
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
1 lock held by blkid/16336:
#0: 00000000413b53ac (loop_ctl_mutex){+.+.}, at: lo_simple_ioctl
drivers/block/loop.c:1515 [inline]
#0: 00000000413b53ac (loop_ctl_mutex){+.+.}, at: lo_ioctl+0xce/0x20e0
drivers/block/loop.c:1573
UDF-fs: Scanning with blocksize 1024 failed
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
UDF-fs: Scanning with blocksize 2048 failed
=============================================
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
watchdog+0x9df/0xee0 kernel/hung_task.c:287
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 0 to CPUs 1:
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
Code: 00 eb 8e e8 55 b4 47 00 e9 63 ff ff ff 48 b8 00 00 00 00 00 fc ff df
55 48 89 e5 53 48 89 fb 48 83 c7 20 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
2e 31 c0 48 83 7b 20 00 74 22 48 8d 7b 08 48 b8 00
RSP: 0018:ffff8880ae907cc0 EFLAGS: 00000806
RAX: dffffc0000000000 RBX: ffff8880ae92cff8 RCX: 1ffffffff10f41e1
RDX: 1ffff11015d25a03 RSI: ffffffffffffd704 RDI: ffff8880ae92d018
RBP: ffff8880ae907cc8 R08: 00000001000189e8 R09: ffffffff887a0f08
R10: ffffffff887a11d8 R11: 0000000000009599 R12: ffff8880ae92cfe0
R13: dffffc0000000000 R14: ffff8880ae92cfc0 R15: ffffffff8879fc00
FS: 00007f5167aa5700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
__rcu_pending kernel/rcu/tree.c:3304 [inline]
rcu_pending kernel/rcu/tree.c:3336 [inline]
rcu_check_callbacks+0x3dd/0x1090 kernel/rcu/tree.c:2682
update_process_times+0x32/0x80 kernel/time/timer.c:1638
tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:164
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1274
__run_hrtimer kernel/time/hrtimer.c:1398 [inline]
__hrtimer_run_queues+0x33b/0xdc0 kernel/time/hrtimer.c:1460
hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1518
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
smp_apic_timer_interrupt+0x111/0x550 arch/x86/kernel/apic/apic.c:1092
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789
[inline]
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:1689 [inline]
RIP: 0010:vprintk_emit+0x5b8/0x690 kernel/printk/printk.c:1926
Code: 48 b8 00 00 00 00 00 fc ff df 41 80 7c 05 00 00 0f 85 a2 00 00 00 48
83 3d 0c 2c 1d 07 00 74 29 e8 bd ab 15 00 48 89 df 57 9d <0f> 1f 44 00 00
e9 79 fe ff ff e8 a9 ab 15 00 0f 0b e8 a2 ab 15 00
RSP: 0018:ffff888093f27780 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff88809651a400 RBX: 0000000000000293 RCX: 1ffff11012ca3594
RDX: 0000000000000000 RSI: ffffffff81551b83 RDI: 0000000000000293
RBP: ffff888093f277c8 R08: ffff88809651a400 R09: ffff88809651aca0
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000003a
R13: 1ffffffff10e48f1 R14: 0000000000000200 R15: ffff8880a81ea540
vprintk_default+0x28/0x30 kernel/printk/printk.c:1968
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
printk+0xba/0xed kernel/printk/printk.c:2001
_udf_warn+0xdc/0x110 fs/udf/super.c:2274
udf_load_vrs.cold+0x61/0x6c fs/udf/super.c:1902
udf_fill_super+0x7cb/0x16f5 fs/udf/super.c:2112
mount_bdev+0x304/0x3c0 fs/super.c:1158
udf_mount+0x35/0x40 fs/udf/super.c:131
mount_fs+0xa8/0x31f fs/super.c:1261
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446b99
Code: 2d 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
RSP: 002b:00007f5167aa4db8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446b99
RDX: 0000000020000200 RSI: 0000000020000180 RDI: 0000000020000140
RBP: 00000000006dbc30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc3c
R13: 00007ffffcad85cf R14: 00007f5167aa59c0 R15: 000000000000002d
HEAD commit: 5ee93551 Linux 4.19.82
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1227b92ce00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c62a146039e23bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=aa1e3076ccdf7c9e5330
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16f9a7ece00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11bf9cc2e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+aa1e30...@syzkaller.appspotmail.com
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: Scanning with blocksize 4096 failed
INFO: task syz-executor126:10367 blocked for more than 140 seconds.
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
Not tainted 4.19.82 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
syz-executor126 D
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: Scanning with blocksize 4096 failed
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
28680 10367 7577 0x00000004
Call Trace:
UDF-fs: Scanning with blocksize 1024 failed
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
context_switch kernel/sched/core.c:2826 [inline]
__schedule+0x866/0x1dc0 kernel/sched/core.c:3515
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: Scanning with blocksize 4096 failed
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 4096 failed
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
schedule+0x92/0x1c0 kernel/sched/core.c:3559
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
rwsem_down_read_failed+0x21b/0x3c0 kernel/locking/rwsem-xadd.c:309
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0x49/0xb0 kernel/locking/rwsem.c:26
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0x49/0xb0 kernel/locking/rwsem.c:26
__get_super.part.0+0x203/0x2e0 fs/super.c:698
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
__get_super include/linux/spinlock.h:329 [inline]
get_super+0x2e/0x50 fs/super.c:727
fsync_bdev+0x19/0xd0 fs/block_dev.c:483
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
get_super+0x2e/0x50 fs/super.c:727
fsync_bdev+0x19/0xd0 fs/block_dev.c:483
invalidate_partition+0x36/0x60 block/genhd.c:1580
drop_partitions block/partition-generic.c:454 [inline]
rescan_partitions+0xef/0xa20 block/partition-generic.c:527
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
__blkdev_reread_part+0x1a2/0x230 block/ioctl.c:173
blkdev_reread_part+0x27/0x40 block/ioctl.c:193
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
blkdev_reread_part+0x27/0x40 block/ioctl.c:193
loop_reread_partitions+0x1c/0x40 drivers/block/loop.c:634
UDF-fs: Scanning with blocksize 512 failed
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
loop_set_status+0xe54/0x1370 drivers/block/loop.c:1297
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
loop_set_status64+0xc2/0x120 drivers/block/loop.c:1417
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
lo_ioctl+0x432/0x20e0 drivers/block/loop.c:1560
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc38/0x1ab6 block/ioctl.c:601
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 4096 failed
block_ioctl+0xee/0x130 fs/block_dev.c:1891
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446aa7
Code: 65 20 25 64 00 00 00 00 00 00 00 25 64 3a 25 64 3a 25 64 3a 25 64 3a
25 64 3a 25 64 3a 25 64 3a 25 64 3a 25 64 3a 25 63 3a 25 <64> 3a 25 64 00
00 00 00 00 6f 62 6a 44 65 73 65 72 69 61 6c 69 7a
RSP: 002b:00007f5167ac5b68 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000446aa7
RDX: 00007f5167ac5c00 RSI: 0000000000004c04 RDI: 0000000000000004
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
RBP: 00007f5167ac66d0 R08: 0000000000000000 R09: 000000000000000a
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
R10: 0000000000000075 R11: 0000000000000202 R12: 00000000006dbc2c
R13: 00007ffffcad85cf R14: 0000000000000004 R15: 000000000000002d
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
Showing all locks held in the system:
UDF-fs: Scanning with blocksize 512 failed
#0: 00000000c655c729 (rcu_read_lock){....}, at:
debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4438
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
1 lock held by rsyslogd/7426:
UDF-fs: Scanning with blocksize 1024 failed
#0: 00000000b45d5d02 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
fs/file.c:767
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
2 locks held by getty/7548:
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
#0:
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
000000006d6d396b
UDF-fs: Scanning with blocksize 2048 failed
(&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
#1: 000000006389141d (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: Scanning with blocksize 4096 failed
2 locks held by getty/7549:
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
#0:
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
000000008077515d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
#1: 00000000f031ac26 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
2 locks held by getty/7550:
#0: 00000000616f8dd7 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
#1: 000000001a5b59a5 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
2 locks held by getty/7551:
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
#0:
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
00000000b23efd04 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
UDF-fs: Scanning with blocksize 512 failed
#1: 00000000040b01ea (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
2 locks held by getty/7552:
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
UDF-fs: Scanning with blocksize 2048 failed
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
#0: 00000000e7e749e1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
UDF-fs: Scanning with blocksize 4096 failed
#1: 00000000392307b2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
UDF-fs: Scanning with blocksize 2048 failed
2 locks held by getty/7553:
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
#0:
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
UDF-fs: Scanning with blocksize 512 failed
000000001c2a3657 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 4096 failed
#1: 00000000c848eea9 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
2 locks held by getty/7554:
UDF-fs: Scanning with blocksize 2048 failed
#0:
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
UDF-fs: warning (device loop2): udf_load_vrs: No VRS found
00000000ca640fdb
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
UDF-fs: Scanning with blocksize 4096 failed
(&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
drivers/tty/tty_ldsem.c:362
#1: 0000000072fe5f83 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x232/0x1b30 drivers/tty/n_tty.c:2154
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
1 lock held by syz-executor126/7579:
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
#0: 00000000362cf0b6 (&bdev->bd_mutex){+.+.}, at:
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
2 locks held by syz-executor126/10367:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
#0: 0000000060d27555 (&bdev->bd_mutex){+.+.}, at:
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
UDF-fs: Scanning with blocksize 512 failed
#1: 00000000df9846d3 (&type->s_umount_key#52){.+.+}, at:
__get_super.part.0+0x203/0x2e0 fs/super.c:698
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
2 locks held by syz-executor126/10371:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
2 locks held by syz-executor126/14725:
UDF-fs: Scanning with blocksize 1024 failed
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
#0: 000000003a1990ff (&bdev->bd_mutex){+.+.}, at:
blkdev_reread_part+0x1f/0x40 block/ioctl.c:192
#1: 000000000d525c1d (&type->s_umount_key#52){.+.+}, at:
__get_super.part.0+0x203/0x2e0 fs/super.c:698
1 lock held by syz-executor126/14729:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
1 lock held by blkid/14738:
UDF-fs: Scanning with blocksize 2048 failed
#0: 000000003a1990ff (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
1 lock held by syz-executor126/16323:
UDF-fs: warning (device loop4): udf_load_vrs: No VRS found
#0:
UDF-fs: Scanning with blocksize 4096 failed
00000000413b53ac (loop_ctl_mutex){+.+.}, at: blkdev_reread_part+0x1f/0x40
block/ioctl.c:192
kobject: 'loop5' (0000000059f7bd0f): kobject_uevent_env
kobject: 'loop5' (0000000059f7bd0f): fill_kobj_path: path
= '/devices/virtual/block/loop5'
1 lock held by syz-executor126/16324:
2 locks held by blkid/16327:
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
#0: 00000000b2b82199 (&rq->lock){-.-.}, at: rq_lock
kernel/sched/sched.h:1821 [inline]
#0: 00000000b2b82199 (&rq->lock){-.-.}, at: __schedule+0x1f8/0x1dc0
kernel/sched/core.c:3453
#1: 00000000c655c729 (rcu_read_lock){....}, at: trace_sched_stat_runtime
include/trace/events/sched.h:423 [inline]
#1: 00000000c655c729 (rcu_read_lock){....}, at: update_curr+0x2cc/0x8a0
kernel/sched/fair.c:828
1 lock held by syz-executor126/16330:
#0: 00000000413b53ac (loop_ctl_mutex){+.+.}, at: loop_get_status+0x23/0xc0
drivers/block/loop.c:1309
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
1 lock held by syz-executor126/16333:
#0: 00000000362cf0b6 (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
2 locks held by blkid/16331:
#0: 00000000362cf0b6 (&bdev->bd_mutex){+.+.}, at:
__blkdev_get+0x19b/0x1660 fs/block_dev.c:1471
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
#1: 00000000c655c729 (rcu_read_lock){....}, at: trace_sched_stat_runtime
include/trace/events/sched.h:423 [inline]
#1: 00000000c655c729 (rcu_read_lock){....}, at: update_curr+0x2cc/0x8a0
kernel/sched/fair.c:828
UDF-fs: Scanning with blocksize 512 failed
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
1 lock held by blkid/16336:
#0: 00000000413b53ac (loop_ctl_mutex){+.+.}, at: lo_simple_ioctl
drivers/block/loop.c:1515 [inline]
#0: 00000000413b53ac (loop_ctl_mutex){+.+.}, at: lo_ioctl+0xce/0x20e0
drivers/block/loop.c:1573
UDF-fs: Scanning with blocksize 1024 failed
kobject: 'loop4' (0000000035457cf1): kobject_uevent_env
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
kobject: 'loop4' (0000000035457cf1): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop0' (00000000f5a3ad28): kobject_uevent_env
kobject: 'loop0' (00000000f5a3ad28): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000aa6c1c29): kobject_uevent_env
UDF-fs: Scanning with blocksize 2048 failed
=============================================
kobject: 'loop2' (00000000aa6c1c29): fill_kobj_path: path
= '/devices/virtual/block/loop2'
NMI backtrace for cpu 0
CPU: 0 PID: 1035 Comm: khungtaskd Not tainted 4.19.82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
watchdog+0x9df/0xee0 kernel/hung_task.c:287
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 0 to CPUs 1:
UDF-fs: warning (device loop5): udf_load_vrs: No VRS found
NMI backtrace for cpu 1
CPU: 1 PID: 16333 Comm: syz-executor126 Not tainted 4.19.82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:rcu_segcblist_ready_cbs+0x1d/0x60 kernel/rcu/rcu_segcblist.c:94
Google 01/01/2011
Code: 00 eb 8e e8 55 b4 47 00 e9 63 ff ff ff 48 b8 00 00 00 00 00 fc ff df
55 48 89 e5 53 48 89 fb 48 83 c7 20 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
2e 31 c0 48 83 7b 20 00 74 22 48 8d 7b 08 48 b8 00
RSP: 0018:ffff8880ae907cc0 EFLAGS: 00000806
RAX: dffffc0000000000 RBX: ffff8880ae92cff8 RCX: 1ffffffff10f41e1
RDX: 1ffff11015d25a03 RSI: ffffffffffffd704 RDI: ffff8880ae92d018
RBP: ffff8880ae907cc8 R08: 00000001000189e8 R09: ffffffff887a0f08
R10: ffffffff887a11d8 R11: 0000000000009599 R12: ffff8880ae92cfe0
R13: dffffc0000000000 R14: ffff8880ae92cfc0 R15: ffffffff8879fc00
FS: 00007f5167aa5700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5167a83e78 CR3: 00000000a0c13000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__rcu_pending kernel/rcu/tree.c:3304 [inline]
rcu_pending kernel/rcu/tree.c:3336 [inline]
rcu_check_callbacks+0x3dd/0x1090 kernel/rcu/tree.c:2682
update_process_times+0x32/0x80 kernel/time/timer.c:1638
tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:164
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1274
__run_hrtimer kernel/time/hrtimer.c:1398 [inline]
__hrtimer_run_queues+0x33b/0xdc0 kernel/time/hrtimer.c:1460
hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1518
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
smp_apic_timer_interrupt+0x111/0x550 arch/x86/kernel/apic/apic.c:1092
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789
[inline]
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:1689 [inline]
RIP: 0010:vprintk_emit+0x5b8/0x690 kernel/printk/printk.c:1926
Code: 48 b8 00 00 00 00 00 fc ff df 41 80 7c 05 00 00 0f 85 a2 00 00 00 48
83 3d 0c 2c 1d 07 00 74 29 e8 bd ab 15 00 48 89 df 57 9d <0f> 1f 44 00 00
e9 79 fe ff ff e8 a9 ab 15 00 0f 0b e8 a2 ab 15 00
RSP: 0018:ffff888093f27780 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff88809651a400 RBX: 0000000000000293 RCX: 1ffff11012ca3594
RDX: 0000000000000000 RSI: ffffffff81551b83 RDI: 0000000000000293
RBP: ffff888093f277c8 R08: ffff88809651a400 R09: ffff88809651aca0
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000003a
R13: 1ffffffff10e48f1 R14: 0000000000000200 R15: ffff8880a81ea540
vprintk_default+0x28/0x30 kernel/printk/printk.c:1968
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
printk+0xba/0xed kernel/printk/printk.c:2001
_udf_warn+0xdc/0x110 fs/udf/super.c:2274
udf_load_vrs.cold+0x61/0x6c fs/udf/super.c:1902
udf_fill_super+0x7cb/0x16f5 fs/udf/super.c:2112
mount_bdev+0x304/0x3c0 fs/super.c:1158
udf_mount+0x35/0x40 fs/udf/super.c:131
mount_fs+0xa8/0x31f fs/super.c:1261
vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x53e/0x2bc0 fs/namespace.c:2799
ksys_mount+0xdb/0x150 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3026
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x53e/0x2bc0 fs/namespace.c:2799
ksys_mount+0xdb/0x150 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3026
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446b99
Code: 2d 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 fb 06 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f5167aa4db8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446b99
RDX: 0000000020000200 RSI: 0000000020000180 RDI: 0000000020000140
RBP: 00000000006dbc30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc3c
R13: 00007ffffcad85cf R14: 00007f5167aa59c0 R15: 000000000000002d
Reply all
Reply to author
Forward
0 new messages