INFO: task hung in copy_process

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: fa5941f4 Linux 4.14.114
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10ea3d60a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d7780000df8e070e
dashboard link: https://syzkaller.appspot.com/bug?extid=1f6cad35aa03f5f82053
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1f6cad...@syzkaller.appspotmail.com

IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20003
IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20003
INFO: task syz-executor.0:12253 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D28936 12253 7054 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12260 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D29072 12260 7054 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12262 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D29112 12262 12257 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12261 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D28840 12261 12253 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12278 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D29032 12278 12260 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12280 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D29472 12280 12272 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12288 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D29288 12288 12261 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12289 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D29112 12289 12270 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12293 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D28496 12293 7054 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b
R13: 000000000000000c R14: 000000000000000d R15: 00000000ffffffff
INFO: task syz-executor.0:12295 blocked for more than 140 seconds.
Not tainted 4.14.114 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D28760 12295 12266 0x00000000
Call Trace:
context_switch kernel/sched/core.c:2807 [inline]
__schedule+0x7be/0x1cf0 kernel/sched/core.c:3383
schedule+0x92/0x1c0 kernel/sched/core.c:3427
__rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:572 [inline]
rwsem_down_write_failed+0x5cd/0xbe0 kernel/locking/rwsem-xadd.c:601
call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
__down_write arch/x86/include/asm/rwsem.h:126 [inline]
down_write+0x53/0x90 kernel/locking/rwsem.c:56
i_mmap_lock_write include/linux/fs.h:470 [inline]
dup_mmap kernel/fork.c:681 [inline]
dup_mm kernel/fork.c:1199 [inline]
copy_mm kernel/fork.c:1253 [inline]
copy_process.part.0+0x4147/0x6950 kernel/fork.c:1755
copy_process kernel/fork.c:1570 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2058
SYSC_clone kernel/fork.c:2168 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2162
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x20000309
RSP: 002b:00007f1bd2b33bd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000020000309
RDX: d0d70f4487fd4c1c RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000000e8 R08: 0000000000000005 R09: 0000000000000006
R10: 0000000000000007 R11: 0000000000000212 R12: 000000000000000b


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.