Re: [syzbot] [mm?] INFO: task hung in __lru_add_drain_all (2)

All of lore.kernel.org
 help / color / mirror / Atom feed

From: syzbot <syzbot+5294aa7d73bb0fa85bd0@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, crashfixer001@gmail.com,
	 linux-kernel@vger.kernel.org, linux-mm@kvack.org,
	 syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] INFO: task hung in __lru_add_drain_all (2)
Date: Tue, 17 Dec 2024 22:31:18 -0800	[thread overview]
Message-ID: <67626c36.050a0220.29fcd0.0086.GAE@google.com> (raw)
In-Reply-To: <000000000000eb11450618adde68@google.com>

syzbot has found a reproducer for the following issue on:

HEAD commit:    59dbb9d81adf Merge tag 'xsa465+xsa466-6.13-tag' of git://g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=164ff4f8580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1234f097ee657d8b
dashboard link: https://syzkaller.appspot.com/bug?extid=5294aa7d73bb0fa85bd0
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1649d7e8580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/235f123641b6/disk-59dbb9d8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/739d8d2f0615/vmlinux-59dbb9d8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6cb338ffd7a7/bzImage-59dbb9d8.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/346ce4b8e425/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/ff16fd187e15/mount_1.gz
mounted in repro #3: https://storage.googleapis.com/syzbot-assets/d04047a87b7d/mount_2.gz
mounted in repro #4: https://storage.googleapis.com/syzbot-assets/81c4fcd3a27a/mount_11.gz
mounted in repro #5: https://storage.googleapis.com/syzbot-assets/593b919eb65c/mount_16.gz
mounted in repro #6: https://storage.googleapis.com/syzbot-assets/429aaeb5fd39/mount_21.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5294aa7d73bb0fa85bd0@syzkaller.appspotmail.com

INFO: task syz-executor:5996 blocked for more than 143 seconds.
      Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:19616 pid:5996  tgid:5996  ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
 __mutex_lock_common kernel/locking/mutex.c:665 [inline]
 __mutex_lock+0x7e7/0xee0 kernel/locking/mutex.c:735
 __lru_add_drain_all+0x66/0x560 mm/swap.c:798
 invalidate_bdev+0x76/0xa0 block/bdev.c:101
 generic_shutdown_super+0x139/0x2d0 fs/super.c:642
 kill_block_super+0x44/0x90 fs/super.c:1710
 xfs_kill_sb+0x15/0x50 fs/xfs/xfs_super.c:2089
 deactivate_locked_super+0xc4/0x130 fs/super.c:473
 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36baf87057
RSP: 002b:00007ffd594f4c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f36baf87057
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd594f4cf0
RBP: 00007ffd594f4cf0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd594f5d70
R13: 00007f36bb00180c R14: 00007ffd594f5db0 R15: 0000000000000024
 </TASK>
INFO: task syz-executor:5997 blocked for more than 146 seconds.
      Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:20024 pid:5997  tgid:5997  ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
 __flush_work+0xa37/0xc50 kernel/workqueue.c:4231
 __lru_add_drain_all+0x4f6/0x560 mm/swap.c:843
 invalidate_bdev+0x76/0xa0 block/bdev.c:101
 generic_shutdown_super+0x139/0x2d0 fs/super.c:642
 kill_block_super+0x44/0x90 fs/super.c:1710
 xfs_kill_sb+0x15/0x50 fs/xfs/xfs_super.c:2089
 deactivate_locked_super+0xc4/0x130 fs/super.c:473
 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5877f87057
RSP: 002b:00007ffd3d19dce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5877f87057
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3d19dda0
RBP: 00007ffd3d19dda0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd3d19ee20
R13: 00007f587800180c R14: 00007ffd3d19ee60 R15: 0000000000000023
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8e937ae0 (rcu_read_lock){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
4 locks held by kworker/u8:2/35:
1 lock held by udevd/5193:
2 locks held by getty/5578:
 #0: ffff88803530a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/5996:
 #0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 fs/super.c:505
 #1: ffffffff8e9f9ce8 (lock#3){+.+.}-{4:4}, at: __lru_add_drain_all+0x66/0x560 mm/swap.c:798
2 locks held by syz-executor/5997:
 #0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 fs/super.c:505
 #1: ffffffff8e9f9ce8 (lock#3){+.+.}-{4:4}, at: __lru_add_drain_all+0x66/0x560 mm/swap.c:798
2 locks held by syz.2.358/10421:
4 locks held by syz.0.359/10425:
2 locks held by syz.5.360/10432:
2 locks held by syz.1.361/10438:
1 lock held by syz.1.361/10439:
4 locks held by rm/10442:
1 lock held by syz.6.362/10444:
2 locks held by syz.6.362/10445:

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
 watchdog+0xff6/0x1040 kernel/hung_task.c:397
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
lapbether: lapb_data_request error - 4
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Workqueue: events_unbound macvlan_process_broadcast
RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:409
Code: 30 33 57 fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 b1 10 bb fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c
RSP: 0018:ffffc90000a17f78 EFLAGS: 00000002
RAX: 1ffffffff34d7a00 RBX: ffffffff9a6bd5e0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020
RBP: 0000000000000000 R08: ffffffff85484066 R09: 1ffff1100497a046
R10: dffffc0000000000 R11: ffffffff85484020 R12: dffffc0000000000
R13: ffffffff9a3b7f70 R14: 00000000000003fd R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fea64077ff8 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 serial_in drivers/tty/serial/8250/8250.h:137 [inline]
 serial_lsr_in drivers/tty/serial/8250/8250.h:159 [inline]
 wait_for_lsr drivers/tty/serial/8250/8250_port.c:2088 [inline]
 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3335 [inline]
 serial8250_console_write+0x1373/0x1ed0 drivers/tty/serial/8250/8250_port.c:3413
 console_emit_next_record kernel/printk/printk.c:3122 [inline]
 console_flush_all+0x869/0xeb0 kernel/printk/printk.c:3210
 __console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
 console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
 vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
 _printk+0xd5/0x120 kernel/printk/printk.c:2457
 lapbeth_xmit+0x1dc/0x260 drivers/net/wan/lapbether.c:225
 __netdev_start_xmit include/linux/netdevice.h:5002 [inline]
 netdev_start_xmit include/linux/netdevice.h:5011 [inline]
 xmit_one net/core/dev.c:3590 [inline]
 dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606
 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
 x25_link_control+0x626/0xb50
 x25_receive_data net/x25/x25_dev.c:43 [inline]
 x25_lapb_receive_frame+0x3d0/0x1010 net/x25/x25_dev.c:127
 __netif_receive_skb_one_core net/core/dev.c:5672 [inline]
 netif_receive_skb_core+0x3f0/0x400 net/core/dev.c:5697
 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:99
 __napi_poll+0xcb/0x490 net/core/dev.c:6883
 napi_poll net/core/dev.c:6952 [inline]
 net_rx_action+0x89b/0x1240 net/core/dev.c:7074
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 do_softirq+0x11b/0x1e0 kernel/softirq.c:462
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:389
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 netif_rx+0x83/0x90 net/core/dev.c:5257
 macvlan_broadcast+0x3c4/0x670 drivers/net/macvlan.c:290
 macvlan_process_broadcast+0x50e/0x7f0 drivers/net/macvlan.c:338
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

     prev parent reply	other threads:[~2024-12-18  6:31 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-05-17 22:28 [syzbot] [mm?] INFO: task hung in __lru_add_drain_all (2) syzbot
2024-12-18  6:31 ` syzbot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=67626c36.050a0220.29fcd0.0086.GAE@google.com \
    --to=syzbot+5294aa7d73bb0fa85bd0@syzkaller.appspotmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=crashfixer001@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.