INFO: task hung in lock_sock_nested
8 views
Skip to first unread message
syzbot
Nov 7, 2019, 11:38:08 AM11/7/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: c9fda4f2 Linux 4.14.152
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=115ce63ae00000
kernel config: https://syzkaller.appspot.com/x/.config?x=8e71058946820493
dashboard link: https://syzkaller.appspot.com/bug?extid=b12f2960625e43658f2c
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b12f29...@syzkaller.appspotmail.com
INFO: task syz-executor.0:9763 blocked for more than 140 seconds.
Not tainted 4.14.152 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D28024 9763 6901 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__lock_sock+0x132/0x210 net/core/sock.c:2240
lock_sock_nested+0xee/0x110 net/core/sock.c:2764
lock_sock include/net/sock.h:1462 [inline]
dccp_sendmsg+0xfb/0x950 net/dccp/proto.c:765
inet_sendmsg+0x122/0x500 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x840 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007f1cd4758c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a219
RDX: 00000000000003a6 RSI: 0000000020005700 RDI: 0000000000000006
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1cd47596d4
R13: 00000000004c7f9d R14: 00000000004de3c8 R15: 00000000ffffffff
Showing all locks held in the system:
1 lock held by khungtaskd/1016:
#0: (tasklist_lock){.+.+}, at: [<ffffffff814875a8>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4544
2 locks held by getty/6851:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6852:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6853:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6854:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6855:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6856:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6857:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 1016 Comm: khungtaskd Not tainted 4.14.152 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x197 lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
watchdog+0x5e7/0xb90 kernel/hung_task.c:274
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 9771 Comm: syz-executor.0 Not tainted 4.14.152 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff88806e7e6080 task.stack: ffff88805cae8000
RIP: 0010:mark_held_locks+0x9c/0x100 kernel/locking/lockdep.c:2841
RSP: 0018:ffff88805caef8c0 EFLAGS: 00000046
RAX: 0000000000000004 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffff88806e7e6900 RDI: ffff88806e7e6922
RBP: ffff88805caef8f8 R08: ffff88806e7e6080 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88806e7e6900
R13: 0000000000000002 R14: ffff88806e7e6080 R15: dffffc0000000000
FS: 00007f1cd4738700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001ca9108 CR3: 0000000073d2d000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__trace_hardirqs_on_caller kernel/locking/lockdep.c:2871 [inline]
trace_hardirqs_on_caller+0x19b/0x590 kernel/locking/lockdep.c:2926
trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2933
seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline]
read_seqcount_begin include/linux/seqlock.h:164 [inline]
ktime_get_with_offset+0x121/0x320 kernel/time/timekeeping.c:803
ktime_get_real include/linux/timekeeping.h:185 [inline]
ccid3_hc_tx_send_packet+0x62/0x84b net/dccp/ccids/ccid3.c:284
ccid_hc_tx_send_packet net/dccp/ccid.h:170 [inline]
dccp_write_xmit+0xad/0x1b0 net/dccp/output.c:353
dccp_sendmsg+0x7ad/0x950 net/dccp/proto.c:811
inet_sendmsg+0x122/0x500 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x70a/0x840 net/socket.c:2062
__sys_sendmsg+0xb9/0x140 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2103
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007f1cd4737c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000006
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1cd47386d4
R13: 00000000004c87a3 R14: 00000000004dedb8 R15: 00000000ffffffff
Code: c3 48 8d 04 80 49 8d 34 c4 48 8d 7e 22 48 89 f8 48 89 fa 48 c1 e8 03
83 e2 07 42 0f b6 04 38 38 d0 7f 04 84 c0 75 4d 0f b6 46 22 <8b> 55 d4 a8
03 41 0f 44 d5 a8 04 74 0c 4c 89 f7 e8 0f ed ff ff
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: c9fda4f2 Linux 4.14.152
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=115ce63ae00000
kernel config: https://syzkaller.appspot.com/x/.config?x=8e71058946820493
dashboard link: https://syzkaller.appspot.com/bug?extid=b12f2960625e43658f2c
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b12f29...@syzkaller.appspotmail.com
INFO: task syz-executor.0:9763 blocked for more than 140 seconds.
Not tainted 4.14.152 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D28024 9763 6901 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7b8/0x1cd0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__lock_sock+0x132/0x210 net/core/sock.c:2240
lock_sock_nested+0xee/0x110 net/core/sock.c:2764
lock_sock include/net/sock.h:1462 [inline]
dccp_sendmsg+0xfb/0x950 net/dccp/proto.c:765
inet_sendmsg+0x122/0x500 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x840 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007f1cd4758c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a219
RDX: 00000000000003a6 RSI: 0000000020005700 RDI: 0000000000000006
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1cd47596d4
R13: 00000000004c7f9d R14: 00000000004de3c8 R15: 00000000ffffffff
Showing all locks held in the system:
1 lock held by khungtaskd/1016:
#0: (tasklist_lock){.+.+}, at: [<ffffffff814875a8>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4544
2 locks held by getty/6851:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6852:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6853:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6854:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6855:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6856:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
2 locks held by getty/6857:
#0: (&tty->ldisc_sem){++++}, at: [<ffffffff861c4153>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff8310f506>]
n_tty_read+0x1e6/0x17b0 drivers/tty/n_tty.c:2156
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 1016 Comm: khungtaskd Not tainted 4.14.152 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x197 lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
watchdog+0x5e7/0xb90 kernel/hung_task.c:274
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 9771 Comm: syz-executor.0 Not tainted 4.14.152 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff88806e7e6080 task.stack: ffff88805cae8000
RIP: 0010:mark_held_locks+0x9c/0x100 kernel/locking/lockdep.c:2841
RSP: 0018:ffff88805caef8c0 EFLAGS: 00000046
RAX: 0000000000000004 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffff88806e7e6900 RDI: ffff88806e7e6922
RBP: ffff88805caef8f8 R08: ffff88806e7e6080 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88806e7e6900
R13: 0000000000000002 R14: ffff88806e7e6080 R15: dffffc0000000000
FS: 00007f1cd4738700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001ca9108 CR3: 0000000073d2d000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__trace_hardirqs_on_caller kernel/locking/lockdep.c:2871 [inline]
trace_hardirqs_on_caller+0x19b/0x590 kernel/locking/lockdep.c:2926
trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2933
seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline]
read_seqcount_begin include/linux/seqlock.h:164 [inline]
ktime_get_with_offset+0x121/0x320 kernel/time/timekeeping.c:803
ktime_get_real include/linux/timekeeping.h:185 [inline]
ccid3_hc_tx_send_packet+0x62/0x84b net/dccp/ccids/ccid3.c:284
ccid_hc_tx_send_packet net/dccp/ccid.h:170 [inline]
dccp_write_xmit+0xad/0x1b0 net/dccp/output.c:353
dccp_sendmsg+0x7ad/0x950 net/dccp/proto.c:811
inet_sendmsg+0x122/0x500 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x70a/0x840 net/socket.c:2062
__sys_sendmsg+0xb9/0x140 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2103
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007f1cd4737c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000006
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1cd47386d4
R13: 00000000004c87a3 R14: 00000000004dedb8 R15: 00000000ffffffff
Code: c3 48 8d 04 80 49 8d 34 c4 48 8d 7e 22 48 89 f8 48 89 fa 48 c1 e8 03
83 e2 07 42 0f b6 04 38 38 d0 7f 04 84 c0 75 4d 0f b6 46 22 <8b> 55 d4 a8
03 41 0f 44 d5 a8 04 74 0c 4c 89 f7 e8 0f ed ff ff
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Mar 6, 2020, 10:38:10 AM3/6/20
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages