INFO: task hung in chmod_common
5 views
Skip to first unread message
syzbot
Jul 15, 2018, 9:29:06 AM7/15/18
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 2db39a2f491a Merge branch 'i2c/for-current' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14e1b4c8400000
kernel config: https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7
dashboard link: https://syzkaller.appspot.com/bug?extid=3bc7280624f4df9fd57e
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org
vi...@zeniv.linux.org.uk]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3bc728...@syzkaller.appspotmail.com
RDX: 0000000000000001 RSI: 0000000020000540 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000020000180 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014
R13: 00000000004c1158 R14: 00000000004d1848 R15: 0000000000000001
dccp_invalid_packet: P.type (REQUEST) not Data || [Data]Ack, while P.X == 0
INFO: task syz-executor4:12081 blocked for more than 140 seconds.
Not tainted 4.18.0-rc4+ #146
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4 D25408 12081 4548 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ed0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
__rwsem_down_write_failed_common+0x95d/0x1630
kernel/locking/rwsem-xadd.c:566
rwsem_down_write_failed+0xe/0x10 kernel/locking/rwsem-xadd.c:595
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
__down_write arch/x86/include/asm/rwsem.h:142 [inline]
down_write+0xaa/0x130 kernel/locking/rwsem.c:72
inode_lock include/linux/fs.h:715 [inline]
chmod_common+0x1b1/0x590 fs/open.c:546
do_fchmodat+0xc3/0x160 fs/open.c:590
__do_sys_chmod fs/open.c:608 [inline]
__se_sys_chmod fs/open.c:606 [inline]
__x64_sys_chmod+0x5c/0x80 fs/open.c:606
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455ab9
Code: e0 1f 48 89 04 24 e8 b6 6f fd ff e8 81 6a fd ff e8 5c 68 fd ff 48 8d
05 92 9a 48 00 48 89 04 24 48 c7 44 24 08 1d 00 00 00 e8 <13> 5e fd ff 0f
0b e8 8c 44 00 00 e9 07 f0 ff ff cc cc cc cc cc cc
RSP: 002b:00007f0fd4c06c68 EFLAGS: 00000246 ORIG_RAX: 000000000000005a
RAX: ffffffffffffffda RBX: 00007f0fd4c076d4 RCX: 0000000000455ab9
RDX: 0000000000000000 RSI: 0000000000000600 RDI: 00000000200004c0
RBP: 000000000072bff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004bb0de R14: 00000000004c8c68 R15: 0000000000000002
Showing all locks held in the system:
1 lock held by khungtaskd/901:
#0: 00000000f92932f8 (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4461
1 lock held by rsyslogd/4408:
2 locks held by getty/4498:
#0: 0000000039245b3a (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000eb0bb0e1 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4499:
#0: 000000004e6f6a2c (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000003ddba549 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4500:
#0: 000000009bc3a30f (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000d5262f02 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4501:
#0: 000000004a27386e (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000c1a6312e (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4502:
#0: 00000000d5a8c204 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000e0f8717f (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4503:
#0: 00000000e6083ec8 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000009b815f8e (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4504:
#0: 0000000011f360b4 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000a7817cdb (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by syz-executor4/12009:
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: sb_start_write
include/linux/fs.h:1554 [inline]
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: mnt_want_write+0x3f/0xc0
fs/namespace.c:386
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at: inode_lock
include/linux/fs.h:715 [inline]
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at:
chmod_common+0x1b1/0x590 fs/open.c:546
2 locks held by syz-executor4/12081:
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: sb_start_write
include/linux/fs.h:1554 [inline]
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: mnt_want_write+0x3f/0xc0
fs/namespace.c:386
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at: inode_lock
include/linux/fs.h:715 [inline]
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at:
chmod_common+0x1b1/0x590 fs/open.c:546
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4+ #146
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.4+0x19/0xce lib/nmi_backtrace.c:103
nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
watchdog+0x9c4/0xf80 kernel/hung_task.c:252
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:54
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: 2db39a2f491a Merge branch 'i2c/for-current' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14e1b4c8400000
kernel config: https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7
dashboard link: https://syzkaller.appspot.com/bug?extid=3bc7280624f4df9fd57e
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org
vi...@zeniv.linux.org.uk]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3bc728...@syzkaller.appspotmail.com
RDX: 0000000000000001 RSI: 0000000020000540 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000020000180 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014
R13: 00000000004c1158 R14: 00000000004d1848 R15: 0000000000000001
dccp_invalid_packet: P.type (REQUEST) not Data || [Data]Ack, while P.X == 0
INFO: task syz-executor4:12081 blocked for more than 140 seconds.
Not tainted 4.18.0-rc4+ #146
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4 D25408 12081 4548 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ed0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
__rwsem_down_write_failed_common+0x95d/0x1630
kernel/locking/rwsem-xadd.c:566
rwsem_down_write_failed+0xe/0x10 kernel/locking/rwsem-xadd.c:595
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
__down_write arch/x86/include/asm/rwsem.h:142 [inline]
down_write+0xaa/0x130 kernel/locking/rwsem.c:72
inode_lock include/linux/fs.h:715 [inline]
chmod_common+0x1b1/0x590 fs/open.c:546
do_fchmodat+0xc3/0x160 fs/open.c:590
__do_sys_chmod fs/open.c:608 [inline]
__se_sys_chmod fs/open.c:606 [inline]
__x64_sys_chmod+0x5c/0x80 fs/open.c:606
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455ab9
Code: e0 1f 48 89 04 24 e8 b6 6f fd ff e8 81 6a fd ff e8 5c 68 fd ff 48 8d
05 92 9a 48 00 48 89 04 24 48 c7 44 24 08 1d 00 00 00 e8 <13> 5e fd ff 0f
0b e8 8c 44 00 00 e9 07 f0 ff ff cc cc cc cc cc cc
RSP: 002b:00007f0fd4c06c68 EFLAGS: 00000246 ORIG_RAX: 000000000000005a
RAX: ffffffffffffffda RBX: 00007f0fd4c076d4 RCX: 0000000000455ab9
RDX: 0000000000000000 RSI: 0000000000000600 RDI: 00000000200004c0
RBP: 000000000072bff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004bb0de R14: 00000000004c8c68 R15: 0000000000000002
Showing all locks held in the system:
1 lock held by khungtaskd/901:
#0: 00000000f92932f8 (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4461
1 lock held by rsyslogd/4408:
2 locks held by getty/4498:
#0: 0000000039245b3a (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000eb0bb0e1 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4499:
#0: 000000004e6f6a2c (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000003ddba549 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4500:
#0: 000000009bc3a30f (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000d5262f02 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4501:
#0: 000000004a27386e (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000c1a6312e (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4502:
#0: 00000000d5a8c204 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000e0f8717f (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4503:
#0: 00000000e6083ec8 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000009b815f8e (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4504:
#0: 0000000011f360b4 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000a7817cdb (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by syz-executor4/12009:
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: sb_start_write
include/linux/fs.h:1554 [inline]
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: mnt_want_write+0x3f/0xc0
fs/namespace.c:386
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at: inode_lock
include/linux/fs.h:715 [inline]
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at:
chmod_common+0x1b1/0x590 fs/open.c:546
2 locks held by syz-executor4/12081:
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: sb_start_write
include/linux/fs.h:1554 [inline]
#0: 000000007cb4e708 (sb_writers#15){.+.+}, at: mnt_want_write+0x3f/0xc0
fs/namespace.c:386
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at: inode_lock
include/linux/fs.h:715 [inline]
#1: 000000006f9caa03 (&sb->s_type->i_mutex_key#20){++++}, at:
chmod_common+0x1b1/0x590 fs/open.c:546
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4+ #146
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.4+0x19/0xce lib/nmi_backtrace.c:103
nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
watchdog+0x9c4/0xf80 kernel/hung_task.c:252
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:54
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
Dmitry Vyukov
Dec 31, 2018, 3:00:45 AM12/31/18
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
This stopped happening 2+ months ago, let's prevent potential new
future crashes from merging into this
#syz invalid
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/00000000000066ca50057109b212%40google.com.
> For more options, visit https://groups.google.com/d/optout.
future crashes from merging into this
#syz invalid
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/00000000000066ca50057109b212%40google.com.
> For more options, visit https://groups.google.com/d/optout.
Dmitry Vyukov
Dec 31, 2018, 3:01:01 AM12/31/18
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
These 2 look related:
https://syzkaller.appspot.com/bug?id=3d57c5af1521de5d0b7309e5868d320b5cfe17f6
https://syzkaller.appspot.com/bug?id=f98cef9a62a42b67ad0f3c74b3b2861492734b23
https://syzkaller.appspot.com/bug?id=3d57c5af1521de5d0b7309e5868d320b5cfe17f6
https://syzkaller.appspot.com/bug?id=f98cef9a62a42b67ad0f3c74b3b2861492734b23
Reply all
Reply to author
Forward
0 new messages