INFO: task hung in __do_page_fault (2)
9 views
Skip to first unread message
syzbot
Sep 1, 2018, 7:11:04 AM9/1/18
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 050cdc6c9501 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c20a96400000
kernel config: https://syzkaller.appspot.com/x/.config?x=49927b422dcf0b29
dashboard link: https://syzkaller.appspot.com/bug?extid=863500c4e957099629d2
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [ak...@linux-foundation.org ebie...@xmission.com
kees...@chromium.org linux-...@vger.kernel.org
pau...@linux.vnet.ibm.com sudipm.m...@gmail.com
vi...@zeniv.linux.org.uk]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+863500...@syzkaller.appspotmail.com
binder: undelivered TRANSACTION_ERROR: 29189
INFO: task syz-executor7:15907 blocked for more than 140 seconds.
Not tainted 4.19.0-rc1+ #212
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D23992 15907 4492 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2825 [inline]
__schedule+0x87c/0x1df0 kernel/sched/core.c:3473
schedule+0xfb/0x450 kernel/sched/core.c:3517
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x610 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1331
do_page_fault+0xf6/0x7a4 arch/x86/mm/fault.c:1470
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161
RIP: 0033:0x40052d
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 002b:00007fff45e30990 EFLAGS: 00010246
RAX: 000000002001d000 RBX: fffffffffffffffe RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000001c5f848
RBP: 0000000000930aa0 R08: 0000000000000000 R09: 0000000000000000
R10: 00007fff45e30aa0 R11: 0000000000000246 R12: 00000000000003e8
R13: 000000000093028c R14: 0000000000062540 R15: 0000000000062513
INFO: task syz-executor7:15969 blocked for more than 140 seconds.
Not tainted 4.19.0-rc1+ #212
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D19816 15969 4492 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2825 [inline]
__schedule+0x87c/0x1df0 kernel/sched/core.c:3473
schedule+0xfb/0x450 kernel/sched/core.c:3517
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x610 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
exit_mm kernel/exit.c:511 [inline]
do_exit+0x593/0x26e0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x851/0x18e0 kernel/signal.c:2513
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457089
Code: 08 e8 3b a9 fb ff 48 8b 44 24 20 48 8b 4c 24 18 48 8b 54 24 38 48 8b
7c 24 48 eb 8d 48 8b 6c 24 50 48 83 c4 58 c3 48 89 04 24 <48> 89 5c 24 08
e8 0d a9 fb ff 48 8b 44 24 40 48 8b 4c 24 48 48 8b
RSP: 002b:00007f5399c29cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00000000009301e8 RCX: 0000000000457089
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000009301e8
RBP: 00000000009301e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000009301ec
R13: 00007fff45e3094f R14: 00007f5399c2a9c0 R15: 0000000000000002
INFO: task syz-executor7:15975 blocked for more than 140 seconds.
Not tainted 4.19.0-rc1+ #212
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D23608 15975 4492 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2825 [inline]
__schedule+0x87c/0x1df0 kernel/sched/core.c:3473
schedule+0xfb/0x450 kernel/sched/core.c:3517
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x610 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
exit_mm kernel/exit.c:511 [inline]
do_exit+0x593/0x26e0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x851/0x18e0 kernel/signal.c:2513
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457089
Code: 08 e8 3b a9 fb ff 48 8b 44 24 20 48 8b 4c 24 18 48 8b 54 24 38 48 8b
7c 24 48 eb 8d 48 8b 6c 24 50 48 83 c4 58 c3 48 89 04 24 <48> 89 5c 24 08
e8 0d a9 fb ff 48 8b 44 24 40 48 8b 4c 24 48 48 8b
RSP: 002b:00007f5399c08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 0000000000930288 RCX: 0000000000457089
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000930288
RBP: 0000000000930280 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000093028c
R13: 00007fff45e3094f R14: 00007f5399c099c0 R15: 0000000000000003
Showing all locks held in the system:
1 lock held by khungtaskd/775:
#0: 000000005085199a (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4436
1 lock held by rsyslogd/4351:
#0: 00000000c3b0c241 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
2 locks held by getty/4441:
#0: 000000003afd8eca (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000002b1780a9 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4442:
#0: 00000000d2a67ff1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000006d43f6c2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4443:
#0: 00000000aa749d4c (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000b97d1a99 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4444:
#0: 00000000d4a7863d (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 0000000067f4469e (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4445:
#0: 00000000feb1d169 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000006685d50b (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4446:
#0: 000000000200e474 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000fd5edb6d (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4447:
#0: 00000000c0aaed1c (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000c0093800 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
1 lock held by syz-executor7/15907:
#0: 000000000755167b (&mm->mmap_sem){++++}, at:
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1331
1 lock held by syz-executor7/15912:
1 lock held by syz-executor7/15969:
#0: 000000000755167b (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 000000000755167b (&mm->mmap_sem){++++}, at: do_exit+0x593/0x26e0
kernel/exit.c:854
1 lock held by syz-executor7/15975:
#0: 000000000755167b (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 000000000755167b (&mm->mmap_sem){++++}, at: do_exit+0x593/0x26e0
kernel/exit.c:854
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 775 Comm: khungtaskd Not tainted 4.19.0-rc1+ #212
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.3+0x48/0x88 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
watchdog+0xb39/0x1040 kernel/hung_task.c:265
kthread+0x35a/0x420 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:56
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: 050cdc6c9501 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c20a96400000
kernel config: https://syzkaller.appspot.com/x/.config?x=49927b422dcf0b29
dashboard link: https://syzkaller.appspot.com/bug?extid=863500c4e957099629d2
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [ak...@linux-foundation.org ebie...@xmission.com
kees...@chromium.org linux-...@vger.kernel.org
pau...@linux.vnet.ibm.com sudipm.m...@gmail.com
vi...@zeniv.linux.org.uk]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+863500...@syzkaller.appspotmail.com
binder: undelivered TRANSACTION_ERROR: 29189
INFO: task syz-executor7:15907 blocked for more than 140 seconds.
Not tainted 4.19.0-rc1+ #212
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D23992 15907 4492 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2825 [inline]
__schedule+0x87c/0x1df0 kernel/sched/core.c:3473
schedule+0xfb/0x450 kernel/sched/core.c:3517
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x610 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1331
do_page_fault+0xf6/0x7a4 arch/x86/mm/fault.c:1470
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161
RIP: 0033:0x40052d
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 002b:00007fff45e30990 EFLAGS: 00010246
RAX: 000000002001d000 RBX: fffffffffffffffe RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000001c5f848
RBP: 0000000000930aa0 R08: 0000000000000000 R09: 0000000000000000
R10: 00007fff45e30aa0 R11: 0000000000000246 R12: 00000000000003e8
R13: 000000000093028c R14: 0000000000062540 R15: 0000000000062513
INFO: task syz-executor7:15969 blocked for more than 140 seconds.
Not tainted 4.19.0-rc1+ #212
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D19816 15969 4492 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2825 [inline]
__schedule+0x87c/0x1df0 kernel/sched/core.c:3473
schedule+0xfb/0x450 kernel/sched/core.c:3517
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x610 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
exit_mm kernel/exit.c:511 [inline]
do_exit+0x593/0x26e0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x851/0x18e0 kernel/signal.c:2513
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457089
Code: 08 e8 3b a9 fb ff 48 8b 44 24 20 48 8b 4c 24 18 48 8b 54 24 38 48 8b
7c 24 48 eb 8d 48 8b 6c 24 50 48 83 c4 58 c3 48 89 04 24 <48> 89 5c 24 08
e8 0d a9 fb ff 48 8b 44 24 40 48 8b 4c 24 48 48 8b
RSP: 002b:00007f5399c29cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00000000009301e8 RCX: 0000000000457089
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000009301e8
RBP: 00000000009301e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000009301ec
R13: 00007fff45e3094f R14: 00007f5399c2a9c0 R15: 0000000000000002
INFO: task syz-executor7:15975 blocked for more than 140 seconds.
Not tainted 4.19.0-rc1+ #212
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D23608 15975 4492 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2825 [inline]
__schedule+0x87c/0x1df0 kernel/sched/core.c:3473
schedule+0xfb/0x450 kernel/sched/core.c:3517
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x610 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
exit_mm kernel/exit.c:511 [inline]
do_exit+0x593/0x26e0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x851/0x18e0 kernel/signal.c:2513
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457089
Code: 08 e8 3b a9 fb ff 48 8b 44 24 20 48 8b 4c 24 18 48 8b 54 24 38 48 8b
7c 24 48 eb 8d 48 8b 6c 24 50 48 83 c4 58 c3 48 89 04 24 <48> 89 5c 24 08
e8 0d a9 fb ff 48 8b 44 24 40 48 8b 4c 24 48 48 8b
RSP: 002b:00007f5399c08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 0000000000930288 RCX: 0000000000457089
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000930288
RBP: 0000000000930280 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000093028c
R13: 00007fff45e3094f R14: 00007f5399c099c0 R15: 0000000000000003
Showing all locks held in the system:
1 lock held by khungtaskd/775:
#0: 000000005085199a (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4436
1 lock held by rsyslogd/4351:
#0: 00000000c3b0c241 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
2 locks held by getty/4441:
#0: 000000003afd8eca (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000002b1780a9 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4442:
#0: 00000000d2a67ff1 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000006d43f6c2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4443:
#0: 00000000aa749d4c (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000b97d1a99 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4444:
#0: 00000000d4a7863d (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 0000000067f4469e (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4445:
#0: 00000000feb1d169 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000006685d50b (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4446:
#0: 000000000200e474 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000fd5edb6d (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4447:
#0: 00000000c0aaed1c (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000c0093800 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
1 lock held by syz-executor7/15907:
#0: 000000000755167b (&mm->mmap_sem){++++}, at:
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1331
1 lock held by syz-executor7/15912:
1 lock held by syz-executor7/15969:
#0: 000000000755167b (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 000000000755167b (&mm->mmap_sem){++++}, at: do_exit+0x593/0x26e0
kernel/exit.c:854
1 lock held by syz-executor7/15975:
#0: 000000000755167b (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 000000000755167b (&mm->mmap_sem){++++}, at: do_exit+0x593/0x26e0
kernel/exit.c:854
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 775 Comm: khungtaskd Not tainted 4.19.0-rc1+ #212
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.3+0x48/0x88 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
watchdog+0xb39/0x1040 kernel/hung_task.c:265
kthread+0x35a/0x420 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:56
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot
Oct 26, 2018, 9:55:03 PM10/26/18
to syzkaller-upst...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 8c60c36d0b8c Add linux-next specific files for 20181019
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12df710b400000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b6d7c4c81535e89
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117df913400000
CC: [ak...@linux-foundation.org ebie...@xmission.com
linux-...@vger.kernel.org li...@dominikbrodowski.net mcg...@kernel.org
sudipm.m...@gmail.com]
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+863500...@syzkaller.appspotmail.com
INFO: task syz-executor730:7827 blocked for more than 140 seconds.
Not tainted 4.19.0-rc8-next-20181019+ #98
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8cf/0x21d0 kernel/sched/core.c:3480
schedule+0xfe/0x460 kernel/sched/core.c:3524
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
do_user_addr_fault arch/x86/mm/fault.c:1363 [inline]
__do_page_fault+0xbb0/0xe40 arch/x86/mm/fault.c:1490
do_page_fault+0xed/0x7d1 arch/x86/mm/fault.c:1521
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1139
RIP: 0033:0x4ab5dd
Code: Bad RIP value.
RSP: 002b:00007ffd86f75bb0 EFLAGS: 00010202
RAX: 00000000004ab700 RBX: 0000000000000001 RCX: 00000000006e0350
RDX: 00000000004073b0 RSI: 0000000000000000 RDI: 00000000004cc9d0
RBP: 00007ffd86f75bd0 R08: 000000037ffffa00 R09: 000000037ffffa00
R10: 00007ffd86f75c40 R11: 0000000000000000 R12: 0000000000000001
R13: 00000000006e0340 R14: 0000000000000008 R15: 00000000006dbd4c
INFO: task syz-executor730:7828 blocked for more than 140 seconds.
Not tainted 4.19.0-rc8-next-20181019+ #98
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8cf/0x21d0 kernel/sched/core.c:3480
schedule+0xfe/0x460 kernel/sched/core.c:3524
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
exit_mm kernel/exit.c:511 [inline]
do_exit+0x59c/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8a8/0x1970 kernel/signal.c:2517
Code: 63 65 20 69 73 20 65 6d 70 74 79 2c 20 79 6f 75 20 6d 61 79 20 77 61
6e 74 20 74 6f 20 2e 2f 63 6f 6e 66 69 67 75 72 65 20 2d <2d> 65 6e 61 62
6c 65 2d 72 74 69 6e 73 74 0a 00 00 00 00 00 00 00
RSP: 002b:00007f1037700db8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00000000006dbc48 RCX: 0000000000446569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006dbc48
RBP: 00000000006dbc40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc4c
R13: 00007ffd86f75baf R14: 00007f10377019c0 R15: 00000000006dbd4c
INFO: task syz-executor730:7829 blocked for more than 140 seconds.
Not tainted 4.19.0-rc8-next-20181019+ #98
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8cf/0x21d0 kernel/sched/core.c:3480
schedule+0xfe/0x460 kernel/sched/core.c:3524
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
exit_mm kernel/exit.c:511 [inline]
do_exit+0x59c/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8a8/0x1970 kernel/signal.c:2517
Code: 63 65 20 69 73 20 65 6d 70 74 79 2c 20 79 6f 75 20 6d 61 79 20 77 61
6e 74 20 74 6f 20 2e 2f 63 6f 6e 66 69 67 75 72 65 20 2d <2d> 65 6e 61 62
6c 65 2d 72 74 69 6e 73 74 0a 00 00 00 00 00 00 00
RSP: 002b:00007f10376dfdb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00000000006dbc58 RCX: 0000000000446569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006dbc58
RBP: 00000000006dbc50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc5c
R13: 00007ffd86f75baf R14: 00007f10376e09c0 R15: 00000000006dbd4c
Showing all locks held in the system:
1 lock held by khungtaskd/982:
#0: 00000000e415a54a (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379
1 lock held by rsyslogd/5486:
#0: 00000000ad3fe44b (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
2 locks held by getty/5575:
#0: 000000005b3583de (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000acd546e2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5576:
#0: 0000000069f65f0e (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000007216cb9a (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5577:
#0: 000000009520ab56 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000001c00c669 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5578:
#0: 0000000067ed37ba (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000be81bcc0 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5579:
#0: 0000000023caeefd (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000aace2394 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5580:
#0: 00000000786e2310 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 0000000087eb604b (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5581:
#0: 00000000c7cefdab (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000b36ac022 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
1 lock held by syz-executor730/7827:
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: do_user_addr_fault
arch/x86/mm/fault.c:1363 [inline]
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at:
__do_page_fault+0xbb0/0xe40 arch/x86/mm/fault.c:1490
1 lock held by syz-executor730/7828:
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: do_exit+0x59c/0x26d0
kernel/exit.c:854
1 lock held by syz-executor730/7829:
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: do_exit+0x59c/0x26d0
kernel/exit.c:854
1 lock held by syz-executor730/7830:
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 982 Comm: khungtaskd Not tainted 4.19.0-rc8-next-20181019+ #98
nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62
kthread+0x35a/0x440 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
4.19.0-rc8-next-20181019+ #98
[inline]
RIP: 0010:lock_is_held_type+0x18b/0x210 kernel/locking/lockdep.c:3884
Code: ff df 41 c7 84 24 7c 08 00 00 00 00 00 00 48 89 fa 48 c1 ea 03 80 3c
02 00 75 63 48 83 3d 9c 84 d1 07 00 74 30 48 89 df 57 9d <0f> 1f 44 00 00
48 83 c4 08 44 89 e8 5b 41 5c 41 5d 5d c3 48 83 c4
RSP: 0018:ffff8801b907f040 EFLAGS: 00000282
RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000000
RDX: 1ffffffff1263f96 RSI: 0000000000000000 RDI: 0000000000000282
RBP: ffff8801b907f060 R08: ffffffff819826bb R09: ffffed0037354616
R10: ffff8801b907f500 R11: ffff8801b9aa30b7 R12: ffff8801ce486700
R13: 0000000000000000 R14: ffffffff880b1b80 R15: 000000000000038c
FS: 00007f10376bf700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 00000001d2912000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_is_held include/linux/lockdep.h:339 [inline]
___might_sleep+0x27f/0x340 kernel/sched/core.c:6115
__might_sleep+0x95/0x190 kernel/sched/core.c:6103
__mutex_lock_common kernel/locking/mutex.c:908 [inline]
__mutex_lock+0x138/0x16f0 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
perf_mmap+0x86b/0x1cb0 kernel/events/core.c:5646
call_mmap include/linux/fs.h:1849 [inline]
mmap_region+0xe85/0x1cd0 mm/mmap.c:1786
do_mmap+0xa22/0x1230 mm/mmap.c:1559
do_mmap_pgoff include/linux/mm.h:2320 [inline]
vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357
ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1609
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
__x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446569
Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f10376beda8 EFLAGS: 00000216 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00000000006dbc68 RCX: 0000000000446569
RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffd000
RBP: 00000000006dbc60 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000216 R12: 00000000006dbc6c
R13: 00007ffd86f75baf R14: 00007f10376bf9c0 R15: 00000000006dbd4c
HEAD commit: 8c60c36d0b8c Add linux-next specific files for 20181019
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12df710b400000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b6d7c4c81535e89
dashboard link: https://syzkaller.appspot.com/bug?extid=863500c4e957099629d2
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15cf3199400000
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117df913400000
CC: [ak...@linux-foundation.org ebie...@xmission.com
linux-...@vger.kernel.org li...@dominikbrodowski.net mcg...@kernel.org
sudipm.m...@gmail.com]
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+863500...@syzkaller.appspotmail.com
Not tainted 4.19.0-rc8-next-20181019+ #98
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor730 D23336 7827 5603 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8cf/0x21d0 kernel/sched/core.c:3480
schedule+0xfe/0x460 kernel/sched/core.c:3524
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0x9b/0x120 kernel/locking/rwsem.c:26
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
do_user_addr_fault arch/x86/mm/fault.c:1363 [inline]
__do_page_fault+0xbb0/0xe40 arch/x86/mm/fault.c:1490
do_page_fault+0xed/0x7d1 arch/x86/mm/fault.c:1521
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1139
RIP: 0033:0x4ab5dd
Code: Bad RIP value.
RSP: 002b:00007ffd86f75bb0 EFLAGS: 00010202
RAX: 00000000004ab700 RBX: 0000000000000001 RCX: 00000000006e0350
RDX: 00000000004073b0 RSI: 0000000000000000 RDI: 00000000004cc9d0
RBP: 00007ffd86f75bd0 R08: 000000037ffffa00 R09: 000000037ffffa00
R10: 00007ffd86f75c40 R11: 0000000000000000 R12: 0000000000000001
R13: 00000000006e0340 R14: 0000000000000008 R15: 00000000006dbd4c
INFO: task syz-executor730:7828 blocked for more than 140 seconds.
Not tainted 4.19.0-rc8-next-20181019+ #98
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor730 D23400 7828 5603 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8cf/0x21d0 kernel/sched/core.c:3480
schedule+0xfe/0x460 kernel/sched/core.c:3524
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0x9b/0x120 kernel/locking/rwsem.c:26
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
exit_mm kernel/exit.c:511 [inline]
do_exit+0x59c/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8a8/0x1970 kernel/signal.c:2517
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446569
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: 63 65 20 69 73 20 65 6d 70 74 79 2c 20 79 6f 75 20 6d 61 79 20 77 61
6e 74 20 74 6f 20 2e 2f 63 6f 6e 66 69 67 75 72 65 20 2d <2d> 65 6e 61 62
6c 65 2d 72 74 69 6e 73 74 0a 00 00 00 00 00 00 00
RSP: 002b:00007f1037700db8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00000000006dbc48 RCX: 0000000000446569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006dbc48
RBP: 00000000006dbc40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc4c
R13: 00007ffd86f75baf R14: 00007f10377019c0 R15: 00000000006dbd4c
INFO: task syz-executor730:7829 blocked for more than 140 seconds.
Not tainted 4.19.0-rc8-next-20181019+ #98
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor730 D23472 7829 5603 0x80000004
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8cf/0x21d0 kernel/sched/core.c:3480
schedule+0xfe/0x460 kernel/sched/core.c:3524
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0x9b/0x120 kernel/locking/rwsem.c:26
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
exit_mm kernel/exit.c:511 [inline]
do_exit+0x59c/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8a8/0x1970 kernel/signal.c:2517
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446569
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: 63 65 20 69 73 20 65 6d 70 74 79 2c 20 79 6f 75 20 6d 61 79 20 77 61
6e 74 20 74 6f 20 2e 2f 63 6f 6e 66 69 67 75 72 65 20 2d <2d> 65 6e 61 62
6c 65 2d 72 74 69 6e 73 74 0a 00 00 00 00 00 00 00
RSP: 002b:00007f10376dfdb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00000000006dbc58 RCX: 0000000000446569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006dbc58
RBP: 00000000006dbc50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc5c
R13: 00007ffd86f75baf R14: 00007f10376e09c0 R15: 00000000006dbd4c
Showing all locks held in the system:
#0: 00000000e415a54a (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379
1 lock held by rsyslogd/5486:
#0: 00000000ad3fe44b (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
2 locks held by getty/5575:
#0: 000000005b3583de (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000acd546e2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5576:
#0: 0000000069f65f0e (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000007216cb9a (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5577:
#0: 000000009520ab56 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 000000001c00c669 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5578:
#0: 0000000067ed37ba (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000be81bcc0 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5579:
#0: 0000000023caeefd (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000aace2394 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5580:
#0: 00000000786e2310 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 0000000087eb604b (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5581:
#0: 00000000c7cefdab (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
#1: 00000000b36ac022 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
1 lock held by syz-executor730/7827:
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: do_user_addr_fault
arch/x86/mm/fault.c:1363 [inline]
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at:
__do_page_fault+0xbb0/0xe40 arch/x86/mm/fault.c:1490
1 lock held by syz-executor730/7828:
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: do_exit+0x59c/0x26d0
kernel/exit.c:854
1 lock held by syz-executor730/7829:
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511
[inline]
#0: 00000000b5f3f953 (&mm->mmap_sem){++++}, at: do_exit+0x59c/0x26d0
kernel/exit.c:854
1 lock held by syz-executor730/7830:
=============================================
NMI backtrace for cpu 0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x244/0x39d lib/dump_stack.c:113
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
watchdog+0xb39/0x1050 kernel/hung_task.c:265
trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
kthread+0x35a/0x440 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 7830 Comm: syz-executor730 Not tainted
NMI backtrace for cpu 1
4.19.0-rc8-next-20181019+ #98
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:761
Google 01/01/2011
[inline]
RIP: 0010:lock_is_held_type+0x18b/0x210 kernel/locking/lockdep.c:3884
Code: ff df 41 c7 84 24 7c 08 00 00 00 00 00 00 48 89 fa 48 c1 ea 03 80 3c
02 00 75 63 48 83 3d 9c 84 d1 07 00 74 30 48 89 df 57 9d <0f> 1f 44 00 00
48 83 c4 08 44 89 e8 5b 41 5c 41 5d 5d c3 48 83 c4
RSP: 0018:ffff8801b907f040 EFLAGS: 00000282
RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000000
RDX: 1ffffffff1263f96 RSI: 0000000000000000 RDI: 0000000000000282
RBP: ffff8801b907f060 R08: ffffffff819826bb R09: ffffed0037354616
R10: ffff8801b907f500 R11: ffff8801b9aa30b7 R12: ffff8801ce486700
R13: 0000000000000000 R14: ffffffff880b1b80 R15: 000000000000038c
FS: 00007f10376bf700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 00000001d2912000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_is_held include/linux/lockdep.h:339 [inline]
___might_sleep+0x27f/0x340 kernel/sched/core.c:6115
__might_sleep+0x95/0x190 kernel/sched/core.c:6103
__mutex_lock_common kernel/locking/mutex.c:908 [inline]
__mutex_lock+0x138/0x16f0 kernel/locking/mutex.c:1072
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
perf_mmap+0x86b/0x1cb0 kernel/events/core.c:5646
call_mmap include/linux/fs.h:1849 [inline]
mmap_region+0xe85/0x1cd0 mm/mmap.c:1786
do_mmap+0xa22/0x1230 mm/mmap.c:1559
do_mmap_pgoff include/linux/mm.h:2320 [inline]
vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357
ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1609
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
__x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446569
Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f10376beda8 EFLAGS: 00000216 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00000000006dbc68 RCX: 0000000000446569
RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffd000
RBP: 00000000006dbc60 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000216 R12: 00000000006dbc6c
R13: 00007ffd86f75baf R14: 00007f10376bf9c0 R15: 00000000006dbd4c
Dmitry Vyukov
Oct 27, 2018, 4:08:32 AM10/27/18
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
#syz upstream
On Sat, Oct 27, 2018 at 2:55 AM, syzbot <syzbot+863500...@syzkaller.appspotmail.com> wrote:
syzbot has found a reproducer for the following crash on:
HEAD commit: 8c60c36d0b8c Add linux-next specific files for 20181019
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12df710b400000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b6d7c4c81535e89
dashboard link: https://syzkaller.appspot.com/bug?extid=863500c4e957099629d2
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15cf3199400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117df913400000
CC: [ak...@linux-foundation.org ebie...@xmission.com linux-...@vger.kernel.org li...@dominikbrodowski.net mcg...@kernel.org sudipm.m...@gmail.com]
IMPORTANT: if you fix the bug, please add the following tag to the commit:
--
You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-moderation+unsub...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/000000000000d0295305792c1fc8%40google.com.
Reply all
Reply to author
Forward
0 new messages