INFO: task hung in lo_ioctl (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a85772d7ba90 Linux 4.14.297
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1100df29880000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7c676c786714374
dashboard link: https://syzkaller.appspot.com/bug?extid=a95db47f0eaa2012f743
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/39db606a8a5a/disk-a85772d7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bc47cfcb03c7/vmlinux-a85772d7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5aa85f7ae07/bzImage-a85772d7.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a95db4...@syzkaller.appspotmail.com

Bluetooth: hci8 command 0x040f tx timeout
Bluetooth: hci8 command 0x0419 tx timeout
Bluetooth: hci7 command 0x0406 tx timeout
Bluetooth: hci6 command 0x0406 tx timeout
Bluetooth: hci8 command 0x0406 tx timeout
INFO: task syz-executor.2:12035 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D28336 12035 8025 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
ioctl_by_bdev+0xa0/0x110 fs/block_dev.c:2092
udf_get_last_block+0x8a/0x180 fs/udf/lowlevel.c:59
udf_load_vrs+0x48d/0xa90 fs/udf/super.c:1978
udf_fill_super+0x715/0x1660 fs/udf/super.c:2177
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2572 [inline]
do_mount+0xe65/0x2a30 fs/namespace.c:2905
SYSC_mount fs/namespace.c:3121 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3098
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12051 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D30272 12051 8025 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_flushbuf block/ioctl.c:426 [inline]
blkdev_ioctl+0x84e/0x1830 block/ioctl.c:514
block_ioctl+0xd9/0x120 fs/block_dev.c:1893
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.4:12044 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D29048 12044 8027 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
rwsem_down_read_failed+0x1e6/0x350 kernel/locking/rwsem-xadd.c:309
call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x44/0x80 kernel/locking/rwsem.c:26
__get_super.part.0+0x271/0x390 fs/super.c:678
__get_super include/linux/spinlock.h:317 [inline]
get_super+0x2b/0x50 fs/super.c:707
fsync_bdev+0x14/0xc0 fs/block_dev.c:495
invalidate_partition+0x74/0xb0 block/genhd.c:1509
drop_partitions.isra.0+0x83/0x150 block/partition-generic.c:442
rescan_partitions+0xa9/0x800 block/partition-generic.c:515
__blkdev_reread_part+0x140/0x1d0 block/ioctl.c:173
blkdev_reread_part+0x23/0x40 block/ioctl.c:193
loop_reread_partitions drivers/block/loop.c:624 [inline]
loop_set_status+0xeeb/0x12b0 drivers/block/loop.c:1193
loop_set_status64+0x92/0xe0 drivers/block/loop.c:1316
lo_ioctl+0x587/0x1cd0 drivers/block/loop.c:1446
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
block_ioctl+0xd9/0x120 fs/block_dev.c:1893
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.4:12171 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D25912 12171 1 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
__blkdev_get+0x191/0x1090 fs/block_dev.c:1455
blkdev_get+0x88/0x890 fs/block_dev.c:1611
blkdev_open+0x1cc/0x250 fs/block_dev.c:1772
do_dentry_open+0x44b/0xec0 fs/open.c:777
vfs_open+0x105/0x220 fs/open.c:888
do_last fs/namei.c:3428 [inline]
path_openat+0x628/0x2970 fs/namei.c:3571
do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12657 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D29368 12657 12169 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
__blkdev_get+0x191/0x1090 fs/block_dev.c:1455
blkdev_get+0x88/0x890 fs/block_dev.c:1611
blkdev_open+0x1cc/0x250 fs/block_dev.c:1772
do_dentry_open+0x44b/0xec0 fs/open.c:777
vfs_open+0x105/0x220 fs/open.c:888
do_last fs/namei.c:3428 [inline]
path_openat+0x628/0x2970 fs/namei.c:3571
do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12659 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D29968 12659 12169 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
__blkdev_get+0x191/0x1090 fs/block_dev.c:1455
blkdev_get+0x441/0x890 fs/block_dev.c:1611
blkdev_get_by_path+0x38/0xa0 fs/block_dev.c:1692
mount_bdev+0x4c/0x360 fs/super.c:1092
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2572 [inline]
do_mount+0xe65/0x2a30 fs/namespace.c:2905
SYSC_mount fs/namespace.c:3121 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3098
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12937 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D28728 12937 12692 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
__blkdev_get+0x191/0x1090 fs/block_dev.c:1455
blkdev_get+0x88/0x890 fs/block_dev.c:1611
blkdev_open+0x1cc/0x250 fs/block_dev.c:1772
do_dentry_open+0x44b/0xec0 fs/open.c:777
vfs_open+0x105/0x220 fs/open.c:888
do_last fs/namei.c:3428 [inline]
path_openat+0x628/0x2970 fs/namei.c:3571
do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
INFO: task syz-executor.2:12939 blocked for more than 140 seconds.
Not tainted 4.14.297-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2 D30016 12939 12692 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
bd_prepare_to_claim fs/block_dev.c:1078 [inline]
bd_start_claiming fs/block_dev.c:1149 [inline]
blkdev_get+0x3ee/0x890 fs/block_dev.c:1604
blkdev_get_by_path+0x38/0xa0 fs/block_dev.c:1692
mount_bdev+0x4c/0x360 fs/super.c:1092
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2572 [inline]
do_mount+0xe65/0x2a30 fs/namespace.c:2905
SYSC_mount fs/namespace.c:3121 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3098
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3

Showing all locks held in the system:
1 lock held by khungtaskd/1533:
#0: (tasklist_lock){.+.+}, at: [<ffffffff87029579>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
1 lock held by in:imklog/7699:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff818d8b5b>] __fdget_pos+0x1fb/0x2b0 fs/file.c:819
2 locks held by syz-executor.2/12035:
#0: (&type->s_umount_key#70/1){+.+.}, at: [<ffffffff81878e26>] alloc_super fs/super.c:251 [inline]
#0: (&type->s_umount_key#70/1){+.+.}, at: [<ffffffff81878e26>] sget_userns+0x556/0xc10 fs/super.c:516
#1: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838dd557>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
1 lock held by syz-executor.2/12051:
#0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838dd557>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
3 locks held by syz-executor.4/12044:
#0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<ffffffff838dd557>] lo_ioctl+0x87/0x1cd0 drivers/block/loop.c:1419
#1: (&bdev->bd_mutex){+.+.}, at: [<ffffffff830c3fdb>] blkdev_reread_part+0x1b/0x40 block/ioctl.c:192
#2: (&type->s_umount_key#71){.+.+}, at: [<ffffffff8187a6c1>] __get_super.part.0+0x271/0x390 fs/super.c:678
1 lock held by syz-executor.4/12171:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
1 lock held by syz-executor.2/12657:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
1 lock held by syz-executor.2/12659:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455
1 lock held by syz-executor.2/12937:
#0: (&bdev->bd_mutex){+.+.}, at: [<ffffffff81943961>] __blkdev_get+0x191/0x1090 fs/block_dev.c:1455

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1533 Comm: khungtaskd Not tainted 4.14.297-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
watchdog+0x5b9/0xb40 kernel/hung_task.c:274
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 7700 Comm: rs:main Q:Reg Not tainted 4.14.297-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
task: ffff8880a1dec540 task.stack: ffff8880907a0000
RIP: 0010:fput_many+0x0/0x140 fs/file_table.c:265
RSP: 0018:ffff8880907a7e78 EFLAGS: 00000297
RAX: ffff8880a1dec540 RBX: 0000000000000001 RCX: fffffbfff17d97b8
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880ab761580
RBP: ffff8880ab761580 R08: ffff8880a1dec540 R09: dffffc0000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff110120f4fd1
R13: 000000000005bbde R14: 00000000000004a6 R15: 000000000005b738
FS: 00007fecd2d70700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fafab90c028 CR3: 00000000b00f7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
fdput include/linux/file.h:41 [inline]
fdput_pos include/linux/file.h:76 [inline]
SYSC_write fs/read_write.c:593 [inline]
SyS_write+0x1ce/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
Code: 20 00 75 1a 48 8b 5d 00 48 89 ef e8 0b ef ff ff 48 85 db 75 d9 5b 5d 41 5c e9 cd f0 cd ff 48 89 ef e8 85 ae f7 ff eb dc 0f 1f 00 <41> 54 55 48 89 fd 53 89 f3 e8 b2 f0 cd ff 89 de f0 48 29 75 70


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.