INFO: task hung in filemap_fault (2)

17 views
Skip to first unread message

syzbot

unread,
Mar 31, 2018, 8:00:03 PM3/31/18
to syzkaller-upst...@googlegroups.com
Hello,

syzbot hit the following crash on upstream commit
3eb2ce825ea1ad89d20f7a3b5780df850e4be274 (Sun Mar 25 22:44:30 2018 +0000)
Linux 4.16-rc7
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=36bd22071b36dd701a10

Unfortunately, I don't have any reproducer for this crash yet.
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=5491071991676928
Kernel config:
https://syzkaller.appspot.com/x/.config?id=-8440362230543204781
compiler: gcc (GCC) 7.1.1 20170620
CC: [a...@linux.intel.com ak...@linux-foundation.org arya...@virtuozzo.com
ja...@suse.cz jla...@redhat.com linux-...@vger.kernel.org
linu...@kvack.org mgo...@techsingularity.net rgol...@suse.com
vi...@zeniv.linux.org.uk]

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+36bd22...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

cannot load conntrack support for proto=7
cannot load conntrack support for proto=7
bond0 (unregistering): Released all slaves
INFO: task syz-executor4:18929 blocked for more than 120 seconds.
Not tainted 4.16.0-rc7+ #368
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4 D23440 18929 10757 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2862 [inline]
__schedule+0x8fb/0x1ec0 kernel/sched/core.c:3440
schedule+0xf5/0x430 kernel/sched/core.c:3499
io_schedule+0x1c/0x70 kernel/sched/core.c:5115
wait_on_page_bit_common+0x4b3/0x770 mm/filemap.c:1099
wait_on_page_bit mm/filemap.c:1132 [inline]
wait_on_page_locked include/linux/pagemap.h:530 [inline]
__lock_page_or_retry+0x3f7/0x4f0 mm/filemap.c:1310
lock_page_or_retry include/linux/pagemap.h:510 [inline]
filemap_fault+0x1016/0x1e20 mm/filemap.c:2532
__do_fault+0xe1/0x3c0 mm/memory.c:3238
do_read_fault mm/memory.c:3648 [inline]
do_fault mm/memory.c:3748 [inline]
handle_pte_fault mm/memory.c:3979 [inline]
__handle_mm_fault+0x1ae5/0x38c0 mm/memory.c:4103
handle_mm_fault+0x44a/0xb10 mm/memory.c:4140
faultin_page mm/gup.c:502 [inline]
__get_user_pages+0x509/0x1600 mm/gup.c:699
populate_vma_page_range+0x20e/0x2f0 mm/gup.c:1203
__mm_populate+0x23a/0x450 mm/gup.c:1253
mm_populate include/linux/mm.h:2232 [inline]
vm_mmap_pgoff+0x241/0x280 mm/util.c:360
SYSC_mmap_pgoff mm/mmap.c:1533 [inline]
SyS_mmap_pgoff+0x462/0x5f0 mm/mmap.c:1491
SYSC_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:91
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x454889
RSP: 002b:00007f2bdb5bbc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f2bdb5bc6d4 RCX: 0000000000454889
RDX: 0000000000000001 RSI: 0000000000003000 RDI: 0000000020ffb000
RBP: 000000000072bea0 R08: 0000000000000013 R09: 0000000000000000
R10: 0000000000008012 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000003f4 R14: 00000000006f7f80 R15: 0000000000000000

Showing all locks held in the system:
2 locks held by khungtaskd/867:
#0: (rcu_read_lock){....}, at: [<000000002a283d26>]
check_hung_uninterruptible_tasks kernel/hung_task.c:175 [inline]
#0: (rcu_read_lock){....}, at: [<000000002a283d26>] watchdog+0x1c5/0xd60
kernel/hung_task.c:249
#1: (tasklist_lock){.+.+}, at: [<0000000050657d15>]
debug_show_all_locks+0xd3/0x3d0 kernel/locking/lockdep.c:4470
1 lock held by rsyslogd/4315:
#0: (&f->f_pos_lock){+.+.}, at: [<00000000d1a98120>]
__fdget_pos+0x12b/0x190 fs/file.c:765
2 locks held by getty/4405:
#0: (&tty->ldisc_sem){++++}, at: [<0000000048741a25>]
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (&ldata->atomic_read_lock){+.+.}, at: [<0000000085349a96>]
n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131
2 locks held by getty/4406:
#0: (&tty->ldisc_sem){++++}, at: [<0000000048741a25>]
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (&ldata->atomic_read_lock){+.+.}, at: [<0000000085349a96>]
n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131
2 locks held by getty/4407:
#0: (&tty->ldisc_sem){++++}, at: [<0000000048741a25>]
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (&ldata->atomic_read_lock){+.+.}, at: [<0000000085349a96>]
n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131
2 locks held by getty/4408:
#0: (&tty->ldisc_sem){++++}, at: [<0000000048741a25>]
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (&ldata->atomic_read_lock){+.+.}, at: [<0000000085349a96>]
n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131
2 locks held by getty/4409:
#0: (&tty->ldisc_sem){++++}, at: [<0000000048741a25>]
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (&ldata->atomic_read_lock){+.+.}, at: [<0000000085349a96>]
n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131
2 locks held by getty/4410:
#0: (&tty->ldisc_sem){++++}, at: [<0000000048741a25>]
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (&ldata->atomic_read_lock){+.+.}, at: [<0000000085349a96>]
n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131
2 locks held by getty/4411:
#0: (&tty->ldisc_sem){++++}, at: [<0000000048741a25>]
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (&ldata->atomic_read_lock){+.+.}, at: [<0000000085349a96>]
n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 867 Comm: khungtaskd Not tainted 4.16.0-rc7+ #368
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
nmi_cpu_backtrace+0x1d2/0x210 lib/nmi_backtrace.c:103
nmi_trigger_cpumask_backtrace+0x123/0x180 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_task kernel/hung_task.c:132 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:190 [inline]
watchdog+0x90c/0xd60 kernel/hung_task.c:249
kthread+0x33c/0x400 kernel/kthread.c:238
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:406
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.16.0-rc7+ #368
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:188 [inline]
RIP: 0010:llist_empty include/linux/llist.h:201 [inline]
RIP: 0010:scheduler_ipi+0xec/0x820 kernel/sched/core.c:1778
RSP: 0018:ffff8801db207d70 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: 000000000002c5c0 RCX: 000000000000080b
RDX: 1ffff1003b645a34 RSI: 0000000000000000 RDI: ffff8801db22d1a0
RBP: ffff8801db207e90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801db22c5c0
R13: 1ffff1003b640fb1 R14: ffff8801db207e68 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001d90000 CR3: 0000000007a22005 CR4: 00000000001606f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
smp_reschedule_interrupt+0xe6/0x650 arch/x86/kernel/smp.c:277
reschedule_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:881
</IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
RSP: 0018:ffffffff87a07c38 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff02
RAX: dffffc0000000000 RBX: 1ffffffff0f40f8a RCX: 0000000000000000
RDX: 1ffffffff0f59580 RSI: 0000000000000001 RDI: ffffffff87acac00
RBP: ffffffff87a07c38 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff87a07cf0 R14: ffffffff883b4a20 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
default_idle+0xbf/0x430 arch/x86/kernel/process.c:354
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:345
default_idle_call+0x36/0x90 kernel/sched/idle.c:98
cpuidle_idle_call kernel/sched/idle.c:156 [inline]
do_idle+0x24a/0x3b0 kernel/sched/idle.c:246
cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:351
rest_init+0xed/0xf0 init/main.c:437
start_kernel+0x7f1/0x819 init/main.c:717
x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:378
x86_64_start_kernel+0x77/0x7a arch/x86/kernel/head64.c:359
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:239
Code: 49 8d bc 24 e0 0b 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
ea 03 80 3c 02 00 0f 85 78 05 00 00 4d 8b bc 24 e0 0b 00 00 <4d> 8d a6 40
ff ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
To upstream this report, please reply with:
#syz upstream

syzbot

unread,
Apr 20, 2019, 2:20:04 AM4/20/19
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages