INFO: task hung in add_transaction_credits
13 views
Skip to first unread message
syzbot
Jul 30, 2018, 10:19:06 AM7/30/18
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 3cfb6772d4cf Merge tag 'ext4_for_linus_stable' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1108b1c2400000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffb4428fdc82f93b
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3136c11be796025c31
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [ja...@suse.com linux...@vger.kernel.org
linux-...@vger.kernel.org ty...@mit.edu]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7f3136...@syzkaller.appspotmail.com
INFO: task kworker/u4:0:7 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:0 D15496 7 2 0x80000000
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_writepages+0x180a/0x4080 fs/ext4/inode.c:2836
do_writepages+0x9a/0x1a0 mm/page-writeback.c:2341
__writeback_single_inode+0x1ec/0x15e0 fs/fs-writeback.c:1323
writeback_sb_inodes+0x71f/0x11d0 fs/fs-writeback.c:1587
__writeback_inodes_wb+0x1b8/0x340 fs/fs-writeback.c:1656
wb_writeback+0x9f1/0xf80 fs/fs-writeback.c:1765
wb_check_old_data_flush fs/fs-writeback.c:1867 [inline]
wb_do_writeback fs/fs-writeback.c:1920 [inline]
wb_workfn+0xfb7/0x1760 fs/fs-writeback.c:1949
process_one_work+0xc73/0x1ba0 kernel/workqueue.c:2153
worker_thread+0x189/0x13c0 kernel/workqueue.c:2296
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
INFO: task khugepaged:779 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
khugepaged D20424 779 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
__rwsem_down_write_failed_common+0x95d/0x1630
kernel/locking/rwsem-xadd.c:566
rwsem_down_write_failed+0xe/0x10 kernel/locking/rwsem-xadd.c:595
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
__down_write arch/x86/include/asm/rwsem.h:142 [inline]
down_write+0xaa/0x130 kernel/locking/rwsem.c:72
collapse_huge_page+0x2b9/0x2140 mm/khugepaged.c:1006
khugepaged_scan_pmd mm/khugepaged.c:1215 [inline]
khugepaged_scan_mm_slot+0x20a1/0x3370 mm/khugepaged.c:1734
khugepaged_do_scan mm/khugepaged.c:1815 [inline]
khugepaged+0x9aa/0xce0 mm/khugepaged.c:1860
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
INFO: task jbd2/sda1-8:2169 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
jbd2/sda1-8 D17368 2169 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
jbd2_journal_commit_transaction+0xccf/0x8c54 fs/jbd2/commit.c:434
kjournald2+0x274/0xb50 fs/jbd2/journal.c:229
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
INFO: task syz-fuzzer:4445 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-fuzzer D18968 4445 4428 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
file_update_time+0x390/0x640 fs/inode.c:1870
ext4_page_mkwrite+0x1fe/0x1430 fs/ext4/inode.c:6125
do_page_mkwrite+0x14e/0x520 mm/memory.c:2380
wp_page_shared mm/memory.c:2676 [inline]
do_wp_page+0xf78/0x19b0 mm/memory.c:2776
handle_pte_fault mm/memory.c:3988 [inline]
__handle_mm_fault+0x2a84/0x4460 mm/memory.c:4096
handle_mm_fault+0x53e/0xc80 mm/memory.c:4133
__do_page_fault+0x620/0xe50 arch/x86/mm/fault.c:1396
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x70b7b1
Code: 48 89 6c 24 10 48 8d 6c 24 10 48 8b 44 24 20 48 8b 48 08 48 8b 50 10
48 8d 58 08 48 83 fa 08 0f 8c 1e 01 00 00 48 8b 54 24 28 <88> 11 48 8b 48
08 48 8b 70 10 48 83 fe 01 0f 86 44 01 00 00 48 89
RSP: 002b:000000c42c5a1048 EFLAGS: 00010212
RAX: 000000c42c5a1880 RBX: 000000c42c5a1888 RCX: 00007f463e63b000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 000000c42c5a1148
RBP: 000000c42c5a1058 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000096203e R11: 0000000000000004 R12: 0000000000000000
R13: 0000000000000020 R14: 0000000000000013 R15: 000000c42c5a1a08
INFO: task syz-fuzzer:4446 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-fuzzer D19592 4446 4428 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x600 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1332
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x42283f
Code: 18 48 03 0e 48 8b 73 20 48 c7 00 00 00 00 00 48 c7 40 08 00 00 00 00
48 c7 40 10 00 00 00 00 48 89 48 18 48 29 d6 48 89 70 20 <c7> 40 60 00 00
00 00 48 c7 40 68 00 00 00 00 c6 40 64 00 48 c7 40
RSP: 002b:000000c4203cbdc0 EFLAGS: 00010206
RAX: 00007f4636a11fc0 RBX: 00007f4636a11f28 RCX: 000000c431150000
RDX: 0000000000000002 RSI: 0000000000000128 RDI: 0000000000000000
RBP: 000000c4203cbdf0 R08: 000000c420000180 R09: 0000000000000075
R10: 0000000000bfd400 R11: 000000005eaf9345 R12: 00000000e940fbb7
R13: 000000009113e0e0 R14: 0000000076bf68b7 R15: 0000000076cc115b
INFO: task syz-executor0:4458 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0 D21208 4458 4449 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
touch_atime+0x29e/0x320 fs/inode.c:1731
file_accessed include/linux/fs.h:2082 [inline]
iterate_dir+0x394/0x5d0 fs/readdir.c:56
__do_sys_getdents fs/readdir.c:231 [inline]
__se_sys_getdents fs/readdir.c:212 [inline]
__x64_sys_getdents+0x29f/0x510 fs/readdir.c:212
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x454eeb
Code: 24 68 48 8d 77 01 48 8b 44 24 40 48 8b 8c 24 b8 00 00 00 48 8b 54 24
30 48 8b 9c 24 90 00 00 00 48 39 c6 7d 52 48 8b 3c f1 48 <39> d6 0f 83 5e
0b 00 00 48 89 74 24 68 48 8b 04 f3 48 89 44 24 08
RSP: 002b:00007fff54d8cb30 EFLAGS: 00000206 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 0000000001bed970 RCX: 0000000000454eeb
RDX: 0000000000008000 RSI: 0000000001bed970 RDI: 0000000000000013
RBP: 0000000001bed970 R08: 0000000000000001 R09: 0000000001bec940
R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffd4
R13: 0000000000000016 R14: 0000000000000075 R15: badc0ffeebadface
INFO: task syz-executor3:4459 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3 D18280 4459 4451 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
jbd2_log_wait_commit+0x329/0x4b0 fs/jbd2/journal.c:726
jbd2_journal_stop+0xb54/0x15c0 fs/jbd2/transaction.c:1777
__ext4_journal_stop+0xde/0x1f0 fs/ext4/ext4_jbd2.c:103
ext4_mkdir+0xa2c/0xe60 fs/ext4/namei.c:2659
vfs_mkdir+0x42e/0x6b0 fs/namei.c:3827
do_mkdirat+0x27b/0x310 fs/namei.c:3850
__do_sys_mkdir fs/namei.c:3866 [inline]
__se_sys_mkdir fs/namei.c:3864 [inline]
__x64_sys_mkdir+0x5c/0x80 fs/namei.c:3864
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455e47
Code: 8d 6c 24 50 48 8b 44 24 60 c6 00 00 48 8b 4c 24 68 48 89 ca 48 89 50
08 48 8b 59 20 48 01 da 31 db 31 f6 31 ff eb 02 ff c3 44 <0f> b7 41 38 66
44 39 c3 73 50 44 0f b7 c3 4d 6b c0 38 4e 8d 0c 02
RSP: 002b:00007fffc53f5f18 EFLAGS: 00000206 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 000000000002efeb RCX: 0000000000455e47
RDX: 00007fffc53f5f35 RSI: 00000000000001ff RDI: 00007fffc53f5f30
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000005
R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000000270
R13: 000000000002efb3 R14: 0000000000000066 R15: badc0ffeebadface
INFO: task syz-executor7:4460 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D21592 4460 4454 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
touch_atime+0x29e/0x320 fs/inode.c:1731
file_accessed include/linux/fs.h:2082 [inline]
iterate_dir+0x394/0x5d0 fs/readdir.c:56
__do_sys_getdents fs/readdir.c:231 [inline]
__se_sys_getdents fs/readdir.c:212 [inline]
__x64_sys_getdents+0x29f/0x510 fs/readdir.c:212
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x454eeb
Code: 24 68 48 8d 77 01 48 8b 44 24 40 48 8b 8c 24 b8 00 00 00 48 8b 54 24
30 48 8b 9c 24 90 00 00 00 48 39 c6 7d 52 48 8b 3c f1 48 <39> d6 0f 83 5e
0b 00 00 48 89 74 24 68 48 8b 04 f3 48 89 44 24 08
RSP: 002b:00007ffe86e74fc0 EFLAGS: 00000206 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00000000012d8970 RCX: 0000000000454eeb
RDX: 0000000000008000 RSI: 00000000012d8970 RDI: 0000000000000013
RBP: 00000000012d8970 R08: 0000000000000001 R09: 00000000012d7940
R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffd4
R13: 0000000000000016 R14: 0000000000000065 R15: badc0ffeebadface
INFO: task syz-executor4:10561 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4 D23640 10561 4461 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
file_update_time+0x390/0x640 fs/inode.c:1870
ext4_page_mkwrite+0x1fe/0x1430 fs/ext4/inode.c:6125
do_page_mkwrite+0x14e/0x520 mm/memory.c:2380
do_shared_fault mm/memory.c:3706 [inline]
do_fault mm/memory.c:3745 [inline]
handle_pte_fault mm/memory.c:3972 [inline]
__handle_mm_fault+0x2b5d/0x4460 mm/memory.c:4096
handle_mm_fault+0x53e/0xc80 mm/memory.c:4133
__do_page_fault+0x620/0xe50 arch/x86/mm/fault.c:1396
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x405977
Code: 87 84 00 00 00 48 c1 e6 03 48 05 19 fc ff ff 48 f7 d8 48 89 c7 48 f7
d8 48 c1 f8 3f 48 21 c6 48 8d 04 33 48 39 d7 7e 49 48 89 <04> 24 48 8b 44
24 30 48 89 44 24 08 48 c1 e2 03 48 89 54 24 10 e8
RSP: 002b:00007ffc92564c50 EFLAGS: 00010287
RAX: 0000001b32322000 RBX: 0000000075fbdaa0 RCX: 0000001b33320000
RDX: 0000001b32322004 RSI: 0000000000000b9b RDI: ffffffff3a99ab9b
RBP: 0000000000000102 R08: 000000003a99ab9b R09: 000000003a99ab9f
R10: 00007ffc92564e00 R11: 0000000000000246 R12: 00000000009300a0
R13: 0000000080000000 R14: 00007fcb6ef67008 R15: 00000000000003c8
INFO: task syz-executor2:10603 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2 D23640 10603 4462 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
file_update_time+0x390/0x640 fs/inode.c:1870
ext4_page_mkwrite+0x1fe/0x1430 fs/ext4/inode.c:6125
do_page_mkwrite+0x14e/0x520 mm/memory.c:2380
do_shared_fault mm/memory.c:3706 [inline]
do_fault mm/memory.c:3745 [inline]
handle_pte_fault mm/memory.c:3972 [inline]
__handle_mm_fault+0x2b5d/0x4460 mm/memory.c:4096
handle_mm_fault+0x53e/0xc80 mm/memory.c:4133
__do_page_fault+0x620/0xe50 arch/x86/mm/fault.c:1396
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x405977
Code: 87 84 00 00 00 48 c1 e6 03 48 05 19 fc ff ff 48 f7 d8 48 89 c7 48 f7
d8 48 c1 f8 3f 48 21 c6 48 8d 04 33 48 39 d7 7e 49 48 89 <04> 24 48 8b 44
24 30 48 89 44 24 08 48 c1 e2 03 48 89 54 24 10 e8
RSP: 002b:00007ffcb37f6cf0 EFLAGS: 00010287
RAX: 0000001b32020000 RBX: 0000000000000003 RCX: 0000001b33020000
RDX: 0000001b32020004 RSI: 00007ffcb37f6ab0 RDI: 0000000000000000
RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000013
R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000002efae R14: 0000000000000064 R15: badc0ffeebadface
Showing all locks held in the system:
4 locks held by kworker/u4:0/7:
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: 0000000011a3962d ((work_completion)(&(&wb->dwork)->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
#2: 0000000016b1cb37 (&type->s_umount_key#29){++++}, at:
trylock_super+0x22/0x110 fs/super.c:409
#3: 0000000020f2404b (&sbi->s_journal_flag_rwsem){++++}, at:
do_writepages+0x9a/0x1a0 mm/page-writeback.c:2341
1 lock held by khungtaskd/773:
#0: 0000000038fab9bd (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4461
1 lock held by khugepaged/779:
#0: 0000000052db25a3 (&mm->mmap_sem){++++}, at:
collapse_huge_page+0x2b9/0x2140 mm/khugepaged.c:1006
3 locks held by rs:main Q:Reg/4317:
#0: 00000000f787e003 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
#1: 0000000001742808 (sb_writers#6){.+.+}, at: file_start_write
include/linux/fs.h:2738 [inline]
#1: 0000000001742808 (sb_writers#6){.+.+}, at: vfs_write+0x452/0x560
fs/read_write.c:548
#2: 000000006cd1b582 (&sb->s_type->i_mutex_key#12){++++}, at:
inode_trylock include/linux/fs.h:735 [inline]
#2: 000000006cd1b582 (&sb->s_type->i_mutex_key#12){++++}, at:
ext4_file_write_iter+0x2a1/0x1430 fs/ext4/file.c:232
1 lock held by rsyslogd/4319:
#0: 00000000a9e1ed02 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
2 locks held by getty/4409:
#0: 000000004ff77e18 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000001e53ebf2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4410:
#0: 000000002244363b (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000f6a3786f (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4411:
#0: 00000000160ae658 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 0000000000a75c24 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4412:
#0: 000000007874ec04 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 0000000090d9babd (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4413:
#0: 0000000073d7e7ec (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000007d649a7d (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4414:
#0: 0000000018c54836 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 0000000076724f40 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4415:
#0: 0000000075c22661 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000530cdc88 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by syz-fuzzer/4445:
#0: 0000000052db25a3 (&mm->mmap_sem){++++}, at:
__do_page_fault+0x389/0xe50 arch/x86/mm/fault.c:1325
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at: sb_start_pagefault
include/linux/fs.h:1583 [inline]
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at:
ext4_page_mkwrite+0x1d0/0x1430 fs/ext4/inode.c:6124
1 lock held by syz-fuzzer/4446:
#0: 0000000052db25a3 (&mm->mmap_sem){++++}, at:
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1332
2 locks held by syz-executor0/4458:
#0: 00000000bc5c7a00 (&type->i_mutex_dir_key){++++}, at:
iterate_dir+0xd4/0x5d0 fs/readdir.c:41
#1: 0000000001742808 (sb_writers#6){.+.+}, at: sb_start_write_trylock
include/linux/fs.h:1559 [inline]
#1: 0000000001742808 (sb_writers#6){.+.+}, at: touch_atime+0x16e/0x320
fs/inode.c:1716
2 locks held by syz-executor3/4459:
#0: 0000000001742808 (sb_writers#6){.+.+}, at: sb_start_write
include/linux/fs.h:1554 [inline]
#0: 0000000001742808 (sb_writers#6){.+.+}, at: mnt_want_write+0x3f/0xc0
fs/namespace.c:386
#1: 00000000f3513818 (&type->i_mutex_dir_key/1){+.+.}, at:
inode_lock_nested include/linux/fs.h:750 [inline]
#1: 00000000f3513818 (&type->i_mutex_dir_key/1){+.+.}, at:
filename_create+0x1b2/0x5b0 fs/namei.c:3645
2 locks held by syz-executor7/4460:
#0: 000000008f012af5 (&type->i_mutex_dir_key){++++}, at:
iterate_dir+0xd4/0x5d0 fs/readdir.c:41
#1: 0000000001742808 (sb_writers#6){.+.+}, at: sb_start_write_trylock
include/linux/fs.h:1559 [inline]
#1: 0000000001742808 (sb_writers#6){.+.+}, at: touch_atime+0x16e/0x320
fs/inode.c:1716
3 locks held by syz-executor6/10547:
2 locks held by syz-executor4/10561:
#0: 00000000a4f1acd5 (&mm->mmap_sem){++++}, at:
__do_page_fault+0x389/0xe50 arch/x86/mm/fault.c:1325
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at: sb_start_pagefault
include/linux/fs.h:1583 [inline]
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at:
ext4_page_mkwrite+0x1d0/0x1430 fs/ext4/inode.c:6124
2 locks held by syz-executor2/10603:
#0: 000000008bdccbee (&mm->mmap_sem){++++}, at:
__do_page_fault+0x389/0xe50 arch/x86/mm/fault.c:1325
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at: sb_start_pagefault
include/linux/fs.h:1583 [inline]
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at:
ext4_page_mkwrite+0x1d0/0x1430 fs/ext4/inode.c:6124
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 773 Comm: khungtaskd Not tainted 4.18.0-rc6+ #168
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.4+0x19/0xce lib/nmi_backtrace.c:103
nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
watchdog+0x9c4/0xf80 kernel/hung_task.c:252
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:54
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: 3cfb6772d4cf Merge tag 'ext4_for_linus_stable' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1108b1c2400000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffb4428fdc82f93b
dashboard link: https://syzkaller.appspot.com/bug?extid=7f3136c11be796025c31
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [ja...@suse.com linux...@vger.kernel.org
linux-...@vger.kernel.org ty...@mit.edu]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7f3136...@syzkaller.appspotmail.com
INFO: task kworker/u4:0:7 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:0 D15496 7 2 0x80000000
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_writepages+0x180a/0x4080 fs/ext4/inode.c:2836
do_writepages+0x9a/0x1a0 mm/page-writeback.c:2341
__writeback_single_inode+0x1ec/0x15e0 fs/fs-writeback.c:1323
writeback_sb_inodes+0x71f/0x11d0 fs/fs-writeback.c:1587
__writeback_inodes_wb+0x1b8/0x340 fs/fs-writeback.c:1656
wb_writeback+0x9f1/0xf80 fs/fs-writeback.c:1765
wb_check_old_data_flush fs/fs-writeback.c:1867 [inline]
wb_do_writeback fs/fs-writeback.c:1920 [inline]
wb_workfn+0xfb7/0x1760 fs/fs-writeback.c:1949
process_one_work+0xc73/0x1ba0 kernel/workqueue.c:2153
worker_thread+0x189/0x13c0 kernel/workqueue.c:2296
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
INFO: task khugepaged:779 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
khugepaged D20424 779 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
__rwsem_down_write_failed_common+0x95d/0x1630
kernel/locking/rwsem-xadd.c:566
rwsem_down_write_failed+0xe/0x10 kernel/locking/rwsem-xadd.c:595
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
__down_write arch/x86/include/asm/rwsem.h:142 [inline]
down_write+0xaa/0x130 kernel/locking/rwsem.c:72
collapse_huge_page+0x2b9/0x2140 mm/khugepaged.c:1006
khugepaged_scan_pmd mm/khugepaged.c:1215 [inline]
khugepaged_scan_mm_slot+0x20a1/0x3370 mm/khugepaged.c:1734
khugepaged_do_scan mm/khugepaged.c:1815 [inline]
khugepaged+0x9aa/0xce0 mm/khugepaged.c:1860
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
INFO: task jbd2/sda1-8:2169 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
jbd2/sda1-8 D17368 2169 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
jbd2_journal_commit_transaction+0xccf/0x8c54 fs/jbd2/commit.c:434
kjournald2+0x274/0xb50 fs/jbd2/journal.c:229
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
INFO: task syz-fuzzer:4445 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-fuzzer D18968 4445 4428 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
file_update_time+0x390/0x640 fs/inode.c:1870
ext4_page_mkwrite+0x1fe/0x1430 fs/ext4/inode.c:6125
do_page_mkwrite+0x14e/0x520 mm/memory.c:2380
wp_page_shared mm/memory.c:2676 [inline]
do_wp_page+0xf78/0x19b0 mm/memory.c:2776
handle_pte_fault mm/memory.c:3988 [inline]
__handle_mm_fault+0x2a84/0x4460 mm/memory.c:4096
handle_mm_fault+0x53e/0xc80 mm/memory.c:4133
__do_page_fault+0x620/0xe50 arch/x86/mm/fault.c:1396
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x70b7b1
Code: 48 89 6c 24 10 48 8d 6c 24 10 48 8b 44 24 20 48 8b 48 08 48 8b 50 10
48 8d 58 08 48 83 fa 08 0f 8c 1e 01 00 00 48 8b 54 24 28 <88> 11 48 8b 48
08 48 8b 70 10 48 83 fe 01 0f 86 44 01 00 00 48 89
RSP: 002b:000000c42c5a1048 EFLAGS: 00010212
RAX: 000000c42c5a1880 RBX: 000000c42c5a1888 RCX: 00007f463e63b000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 000000c42c5a1148
RBP: 000000c42c5a1058 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000096203e R11: 0000000000000004 R12: 0000000000000000
R13: 0000000000000020 R14: 0000000000000013 R15: 000000c42c5a1a08
INFO: task syz-fuzzer:4446 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-fuzzer D19592 4446 4428 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:269 [inline]
rwsem_down_read_failed+0x362/0x600 kernel/locking/rwsem-xadd.c:286
call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:83 [inline]
down_read+0xc3/0x1d0 kernel/locking/rwsem.c:26
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1332
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x42283f
Code: 18 48 03 0e 48 8b 73 20 48 c7 00 00 00 00 00 48 c7 40 08 00 00 00 00
48 c7 40 10 00 00 00 00 48 89 48 18 48 29 d6 48 89 70 20 <c7> 40 60 00 00
00 00 48 c7 40 68 00 00 00 00 c6 40 64 00 48 c7 40
RSP: 002b:000000c4203cbdc0 EFLAGS: 00010206
RAX: 00007f4636a11fc0 RBX: 00007f4636a11f28 RCX: 000000c431150000
RDX: 0000000000000002 RSI: 0000000000000128 RDI: 0000000000000000
RBP: 000000c4203cbdf0 R08: 000000c420000180 R09: 0000000000000075
R10: 0000000000bfd400 R11: 000000005eaf9345 R12: 00000000e940fbb7
R13: 000000009113e0e0 R14: 0000000076bf68b7 R15: 0000000076cc115b
INFO: task syz-executor0:4458 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0 D21208 4458 4449 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
touch_atime+0x29e/0x320 fs/inode.c:1731
file_accessed include/linux/fs.h:2082 [inline]
iterate_dir+0x394/0x5d0 fs/readdir.c:56
__do_sys_getdents fs/readdir.c:231 [inline]
__se_sys_getdents fs/readdir.c:212 [inline]
__x64_sys_getdents+0x29f/0x510 fs/readdir.c:212
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x454eeb
Code: 24 68 48 8d 77 01 48 8b 44 24 40 48 8b 8c 24 b8 00 00 00 48 8b 54 24
30 48 8b 9c 24 90 00 00 00 48 39 c6 7d 52 48 8b 3c f1 48 <39> d6 0f 83 5e
0b 00 00 48 89 74 24 68 48 8b 04 f3 48 89 44 24 08
RSP: 002b:00007fff54d8cb30 EFLAGS: 00000206 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 0000000001bed970 RCX: 0000000000454eeb
RDX: 0000000000008000 RSI: 0000000001bed970 RDI: 0000000000000013
RBP: 0000000001bed970 R08: 0000000000000001 R09: 0000000001bec940
R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffd4
R13: 0000000000000016 R14: 0000000000000075 R15: badc0ffeebadface
INFO: task syz-executor3:4459 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3 D18280 4459 4451 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
jbd2_log_wait_commit+0x329/0x4b0 fs/jbd2/journal.c:726
jbd2_journal_stop+0xb54/0x15c0 fs/jbd2/transaction.c:1777
__ext4_journal_stop+0xde/0x1f0 fs/ext4/ext4_jbd2.c:103
ext4_mkdir+0xa2c/0xe60 fs/ext4/namei.c:2659
vfs_mkdir+0x42e/0x6b0 fs/namei.c:3827
do_mkdirat+0x27b/0x310 fs/namei.c:3850
__do_sys_mkdir fs/namei.c:3866 [inline]
__se_sys_mkdir fs/namei.c:3864 [inline]
__x64_sys_mkdir+0x5c/0x80 fs/namei.c:3864
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455e47
Code: 8d 6c 24 50 48 8b 44 24 60 c6 00 00 48 8b 4c 24 68 48 89 ca 48 89 50
08 48 8b 59 20 48 01 da 31 db 31 f6 31 ff eb 02 ff c3 44 <0f> b7 41 38 66
44 39 c3 73 50 44 0f b7 c3 4d 6b c0 38 4e 8d 0c 02
RSP: 002b:00007fffc53f5f18 EFLAGS: 00000206 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 000000000002efeb RCX: 0000000000455e47
RDX: 00007fffc53f5f35 RSI: 00000000000001ff RDI: 00007fffc53f5f30
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000005
R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000000270
R13: 000000000002efb3 R14: 0000000000000066 R15: badc0ffeebadface
INFO: task syz-executor7:4460 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D21592 4460 4454 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
touch_atime+0x29e/0x320 fs/inode.c:1731
file_accessed include/linux/fs.h:2082 [inline]
iterate_dir+0x394/0x5d0 fs/readdir.c:56
__do_sys_getdents fs/readdir.c:231 [inline]
__se_sys_getdents fs/readdir.c:212 [inline]
__x64_sys_getdents+0x29f/0x510 fs/readdir.c:212
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x454eeb
Code: 24 68 48 8d 77 01 48 8b 44 24 40 48 8b 8c 24 b8 00 00 00 48 8b 54 24
30 48 8b 9c 24 90 00 00 00 48 39 c6 7d 52 48 8b 3c f1 48 <39> d6 0f 83 5e
0b 00 00 48 89 74 24 68 48 8b 04 f3 48 89 44 24 08
RSP: 002b:00007ffe86e74fc0 EFLAGS: 00000206 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00000000012d8970 RCX: 0000000000454eeb
RDX: 0000000000008000 RSI: 00000000012d8970 RDI: 0000000000000013
RBP: 00000000012d8970 R08: 0000000000000001 R09: 00000000012d7940
R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffd4
R13: 0000000000000016 R14: 0000000000000065 R15: badc0ffeebadface
INFO: task syz-executor4:10561 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4 D23640 10561 4461 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
file_update_time+0x390/0x640 fs/inode.c:1870
ext4_page_mkwrite+0x1fe/0x1430 fs/ext4/inode.c:6125
do_page_mkwrite+0x14e/0x520 mm/memory.c:2380
do_shared_fault mm/memory.c:3706 [inline]
do_fault mm/memory.c:3745 [inline]
handle_pte_fault mm/memory.c:3972 [inline]
__handle_mm_fault+0x2b5d/0x4460 mm/memory.c:4096
handle_mm_fault+0x53e/0xc80 mm/memory.c:4133
__do_page_fault+0x620/0xe50 arch/x86/mm/fault.c:1396
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x405977
Code: 87 84 00 00 00 48 c1 e6 03 48 05 19 fc ff ff 48 f7 d8 48 89 c7 48 f7
d8 48 c1 f8 3f 48 21 c6 48 8d 04 33 48 39 d7 7e 49 48 89 <04> 24 48 8b 44
24 30 48 89 44 24 08 48 c1 e2 03 48 89 54 24 10 e8
RSP: 002b:00007ffc92564c50 EFLAGS: 00010287
RAX: 0000001b32322000 RBX: 0000000075fbdaa0 RCX: 0000001b33320000
RDX: 0000001b32322004 RSI: 0000000000000b9b RDI: ffffffff3a99ab9b
RBP: 0000000000000102 R08: 000000003a99ab9b R09: 000000003a99ab9f
R10: 00007ffc92564e00 R11: 0000000000000246 R12: 00000000009300a0
R13: 0000000080000000 R14: 00007fcb6ef67008 R15: 00000000000003c8
INFO: task syz-executor2:10603 blocked for more than 140 seconds.
Not tainted 4.18.0-rc6+ #168
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2 D23640 10603 4462 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2853 [inline]
__schedule+0x87c/0x1ec0 kernel/sched/core.c:3501
schedule+0xfb/0x450 kernel/sched/core.c:3545
wait_transaction_locked+0x24d/0x310 fs/jbd2/transaction.c:159
add_transaction_credits+0x550/0xe90 fs/jbd2/transaction.c:187
start_this_handle+0x427/0x1260 fs/jbd2/transaction.c:357
jbd2__journal_start+0x3cb/0xa80 fs/jbd2/transaction.c:439
__ext4_journal_start_sb+0x182/0x600 fs/ext4/ext4_jbd2.c:81
__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_dirty_inode+0x62/0xc0 fs/ext4/inode.c:5977
__mark_inode_dirty+0x825/0x1550 fs/fs-writeback.c:2129
generic_update_time+0x26a/0x450 fs/inode.c:1643
update_time fs/inode.c:1659 [inline]
file_update_time+0x390/0x640 fs/inode.c:1870
ext4_page_mkwrite+0x1fe/0x1430 fs/ext4/inode.c:6125
do_page_mkwrite+0x14e/0x520 mm/memory.c:2380
do_shared_fault mm/memory.c:3706 [inline]
do_fault mm/memory.c:3745 [inline]
handle_pte_fault mm/memory.c:3972 [inline]
__handle_mm_fault+0x2b5d/0x4460 mm/memory.c:4096
handle_mm_fault+0x53e/0xc80 mm/memory.c:4133
__do_page_fault+0x620/0xe50 arch/x86/mm/fault.c:1396
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0033:0x405977
Code: 87 84 00 00 00 48 c1 e6 03 48 05 19 fc ff ff 48 f7 d8 48 89 c7 48 f7
d8 48 c1 f8 3f 48 21 c6 48 8d 04 33 48 39 d7 7e 49 48 89 <04> 24 48 8b 44
24 30 48 89 44 24 08 48 c1 e2 03 48 89 54 24 10 e8
RSP: 002b:00007ffcb37f6cf0 EFLAGS: 00010287
RAX: 0000001b32020000 RBX: 0000000000000003 RCX: 0000001b33020000
RDX: 0000001b32020004 RSI: 00007ffcb37f6ab0 RDI: 0000000000000000
RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000013
R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000002efae R14: 0000000000000064 R15: badc0ffeebadface
Showing all locks held in the system:
4 locks held by kworker/u4:0/7:
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: 00000000f71414e8 ((wq_completion)"writeback"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: 0000000011a3962d ((work_completion)(&(&wb->dwork)->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
#2: 0000000016b1cb37 (&type->s_umount_key#29){++++}, at:
trylock_super+0x22/0x110 fs/super.c:409
#3: 0000000020f2404b (&sbi->s_journal_flag_rwsem){++++}, at:
do_writepages+0x9a/0x1a0 mm/page-writeback.c:2341
1 lock held by khungtaskd/773:
#0: 0000000038fab9bd (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4461
1 lock held by khugepaged/779:
#0: 0000000052db25a3 (&mm->mmap_sem){++++}, at:
collapse_huge_page+0x2b9/0x2140 mm/khugepaged.c:1006
3 locks held by rs:main Q:Reg/4317:
#0: 00000000f787e003 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
#1: 0000000001742808 (sb_writers#6){.+.+}, at: file_start_write
include/linux/fs.h:2738 [inline]
#1: 0000000001742808 (sb_writers#6){.+.+}, at: vfs_write+0x452/0x560
fs/read_write.c:548
#2: 000000006cd1b582 (&sb->s_type->i_mutex_key#12){++++}, at:
inode_trylock include/linux/fs.h:735 [inline]
#2: 000000006cd1b582 (&sb->s_type->i_mutex_key#12){++++}, at:
ext4_file_write_iter+0x2a1/0x1430 fs/ext4/file.c:232
1 lock held by rsyslogd/4319:
#0: 00000000a9e1ed02 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
2 locks held by getty/4409:
#0: 000000004ff77e18 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000001e53ebf2 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4410:
#0: 000000002244363b (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000f6a3786f (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4411:
#0: 00000000160ae658 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 0000000000a75c24 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4412:
#0: 000000007874ec04 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 0000000090d9babd (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4413:
#0: 0000000073d7e7ec (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 000000007d649a7d (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4414:
#0: 0000000018c54836 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 0000000076724f40 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/4415:
#0: 0000000075c22661 (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: 00000000530cdc88 (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by syz-fuzzer/4445:
#0: 0000000052db25a3 (&mm->mmap_sem){++++}, at:
__do_page_fault+0x389/0xe50 arch/x86/mm/fault.c:1325
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at: sb_start_pagefault
include/linux/fs.h:1583 [inline]
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at:
ext4_page_mkwrite+0x1d0/0x1430 fs/ext4/inode.c:6124
1 lock held by syz-fuzzer/4446:
#0: 0000000052db25a3 (&mm->mmap_sem){++++}, at:
__do_page_fault+0xae1/0xe50 arch/x86/mm/fault.c:1332
2 locks held by syz-executor0/4458:
#0: 00000000bc5c7a00 (&type->i_mutex_dir_key){++++}, at:
iterate_dir+0xd4/0x5d0 fs/readdir.c:41
#1: 0000000001742808 (sb_writers#6){.+.+}, at: sb_start_write_trylock
include/linux/fs.h:1559 [inline]
#1: 0000000001742808 (sb_writers#6){.+.+}, at: touch_atime+0x16e/0x320
fs/inode.c:1716
2 locks held by syz-executor3/4459:
#0: 0000000001742808 (sb_writers#6){.+.+}, at: sb_start_write
include/linux/fs.h:1554 [inline]
#0: 0000000001742808 (sb_writers#6){.+.+}, at: mnt_want_write+0x3f/0xc0
fs/namespace.c:386
#1: 00000000f3513818 (&type->i_mutex_dir_key/1){+.+.}, at:
inode_lock_nested include/linux/fs.h:750 [inline]
#1: 00000000f3513818 (&type->i_mutex_dir_key/1){+.+.}, at:
filename_create+0x1b2/0x5b0 fs/namei.c:3645
2 locks held by syz-executor7/4460:
#0: 000000008f012af5 (&type->i_mutex_dir_key){++++}, at:
iterate_dir+0xd4/0x5d0 fs/readdir.c:41
#1: 0000000001742808 (sb_writers#6){.+.+}, at: sb_start_write_trylock
include/linux/fs.h:1559 [inline]
#1: 0000000001742808 (sb_writers#6){.+.+}, at: touch_atime+0x16e/0x320
fs/inode.c:1716
3 locks held by syz-executor6/10547:
2 locks held by syz-executor4/10561:
#0: 00000000a4f1acd5 (&mm->mmap_sem){++++}, at:
__do_page_fault+0x389/0xe50 arch/x86/mm/fault.c:1325
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at: sb_start_pagefault
include/linux/fs.h:1583 [inline]
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at:
ext4_page_mkwrite+0x1d0/0x1430 fs/ext4/inode.c:6124
2 locks held by syz-executor2/10603:
#0: 000000008bdccbee (&mm->mmap_sem){++++}, at:
__do_page_fault+0x389/0xe50 arch/x86/mm/fault.c:1325
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at: sb_start_pagefault
include/linux/fs.h:1583 [inline]
#1: 0000000014e5605d (sb_pagefaults){.+.+}, at:
ext4_page_mkwrite+0x1d0/0x1430 fs/ext4/inode.c:6124
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 773 Comm: khungtaskd Not tainted 4.18.0-rc6+ #168
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.4+0x19/0xce lib/nmi_backtrace.c:103
nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
watchdog+0x9c4/0xf80 kernel/hung_task.c:252
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:54
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
Reply all
Reply to author
Forward
0 new messages