[syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1006f178e80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14ec6e62e80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11964f7ce80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz

The issue was bisected to:

commit 0d345996e4cb573f8cc81d49b3ee9a7fd2035bef
Author: Pengfei Xu <pengfei.xu@intel.com>
Date:   Mon Jul 31 03:04:18 2023 +0000

    x86/kernel: increase kcov coverage under arch/x86/kernel folder

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=14782eaae80000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=16782eaae80000
console output: https://syzkaller.appspot.com/x/log.txt?x=12782eaae80000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com
Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder")

INFO: task syz-executor216:5234 blocked for more than 143 seconds.
      Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor216 state:D stack:29104 pid:5234  tgid:5232  ppid:5106   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5399 [inline]
 __schedule+0xf15/0x5c00 kernel/sched/core.c:6726
 __schedule_loop kernel/sched/core.c:6801 [inline]
 schedule+0xe7/0x270 kernel/sched/core.c:6816
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6873
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x5b4/0x9c0 kernel/locking/mutex.c:747
 blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
 blkdev_common_ioctl+0x1575/0x1ce0 block/ioctl.c:562
 blkdev_ioctl+0x249/0x770 block/ioctl.c:627
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x62/0x6a
RIP: 0033:0x7f914d80ca89
RSP: 002b:00007f914cfa3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f914d89c1d8 RCX: 00007f914d80ca89
RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000004
RBP: 00007f914d89c1d0 R08: 00007ffdb3560fd7 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f914d89c1dc
R13: 000000000000006e R14: 00007ffdb3560ef0 R15: 00007ffdb3560fd8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8cfacf60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline]
 #0: ffffffff8cfacf60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
 #0: ffffffff8cfacf60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6613
1 lock held by klogd/4501:
 #0: ffff8880b993c718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:558
2 locks held by getty/4815:
 #0: ffff8880273ee0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc4/0x1490 drivers/tty/n_tty.c:2201
2 locks held by kworker/0:5/5180:
2 locks held by syz-executor216/5233:
1 lock held by syz-executor216/5234:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5240:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5241:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5245:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5246:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5248:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5249:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5251:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5252:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5254:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
1 lock held by syz-executor216/5255:
 #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x277/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x299/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf86/0x1210 kernel/hung_task.c:379
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5233 Comm: syz-executor216 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:__sanitizer_cov_trace_switch+0x4f/0x90 kernel/kcov.c:341
Code: 83 f8 10 75 2f 41 bd 03 00 00 00 4c 8b 75 00 31 db 4d 85 f6 74 1e 48 8b 74 dd 10 4c 89 e2 4c 89 ef 48 83 c3 01 48 8b 4c 24 28 <e8> 2c fe ff ff 49 39 de 75 e2 5b 5d 41 5c 41 5d 41 5e c3 48 83 f8
RSP: 0018:ffffc90003fdf3a0 EFLAGS: 00000202
RAX: 0000000000000008 RBX: 0000000000000001 RCX: ffffffff813a44c8
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffffff8ac9d800 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: dffffc0000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000003 R15: 0000000000000001
FS:  00007f914cfc46c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f914d899f18 CR3: 00000000a0ad4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 unwind_next_frame+0xea8/0x2390 arch/x86/kernel/unwind_orc.c:641
 arch_stack_walk+0xfa/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 save_stack+0x15e/0x1f0 mm/page_owner.c:130
 __set_page_owner+0x1f/0x60 mm/page_owner.c:196
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa16/0x3690 mm/page_alloc.c:3344
 __alloc_pages+0x22d/0x2400 mm/page_alloc.c:4600
 alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133
 relay_alloc_buf kernel/relay.c:121 [inline]
 relay_create_buf kernel/relay.c:162 [inline]
 relay_open_buf.part.0+0x27d/0xba0 kernel/relay.c:384
 relay_open_buf kernel/relay.c:536 [inline]
 relay_open+0x641/0xab0 kernel/relay.c:517
 do_blk_trace_setup+0x4a9/0xaa0 kernel/trace/blktrace.c:591
 __blk_trace_setup+0xd8/0x180 kernel/trace/blktrace.c:631
 blk_trace_ioctl+0x163/0x290 kernel/trace/blktrace.c:741
 blkdev_ioctl+0x111/0x770 block/ioctl.c:622
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x62/0x6a
RIP: 0033:0x7f914d80ca89
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f914cfc4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f914d89c1c8 RCX: 00007f914d80ca89
RDX: 0000000020000380 RSI: 00000000c0481273 RDI: 0000000000000004
RBP: 00007f914d89c1c0 R08: 00007f914cfc46c0 R09: 0000000000000000
R10: 00007f914cfc46c0 R11: 0000000000000246 R12: 00007f914d89c1cc
R13: 000000000000000b R14: 00007ffdb3560ef0 R15: 00007ffdb3560fd8
 </TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.100 msecs


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[Pengfei Xu]

Hi,

On 2023-12-01 at 05:17:19 +0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1006f178e80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14ec6e62e80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11964f7ce80000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz
> 

  Thanks for your report!
  I reverted the commit 0d345996e4cb573f8cc81d49b3ee9a7fd2035bef on top of
  v6.3-rc7 mainline kernel, this issue was still reproduced.
  Anyway, it's an interesting problem, I will update the email if I find
  more clue of the problem.

  Best Regards,
  Thanks!

> The issue was bisected to:
> 
> commit 0d345996e4cb573f8cc81d49b3ee9a7fd2035bef
> Author: Pengfei Xu <pengfei.xu@intel.com>
> Date:   Mon Jul 31 03:04:18 2023 +0000
> 
>     x86/kernel: increase kcov coverage under arch/x86/kernel folder
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=14782eaae80000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=16782eaae80000
> console output: https://syzkaller.appspot.com/x/log.txt?x=12782eaae80000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com
> Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder")
> 
> INFO: task syz-executor216:5234 blocked for more than 143 seconds.
>       Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor216 state:D stack:29104 pid:5234  tgid:5232  ppid:5106   flags:0x00004006
> Call Trace:
>  <TASK>
>  context_switch kernel/sched/core.c:5399 [inline]
>  __schedule+0xf15/0x5c00 kernel/sched/core.c:6726
>  __schedule_loop kernel/sched/core.c:6801 [inline]
>  schedule+0xe7/0x270 kernel/sched/core.c:6816
>  schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6873
>  __mutex_lock_common kernel/locking/mutex.c:679 [inline]
>  __mutex_lock+0x5b4/0x9c0 kernel/locking/mutex.c:747
>  blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
>  blkdev_common_ioctl+0x1575/0x1ce0 block/ioctl.c:562
>  blkdev_ioctl+0x249/0x770 block/ioctl.c:627
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:871 [inline]
>  __se_sys_ioctl fs/ioctl.c:857 [inline]
>  __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
>  do_syscall_x64 arch/x86/entry/common.c:51 [inline]
>  do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
>  entry_SYSCALL_64_after_hwframe+0x62/0x6a
> RIP: 0033:0x7f914d80ca89
> RSP: 002b:00007f914cfa3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007f914d89c1d8 RCX: 00007f914d80ca89
> RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000004
> RBP: 00007f914d89c1d0 R08: 00007ffdb3560fd7 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f914d89c1dc
> R13: 000000000000006e R14: 00007ffdb3560ef0 R15: 00007ffdb3560fd8
>  </TASK>
> 
> Showing all locks held in the system:
> 1 lock held by khungtaskd/29:
>  #0: ffffffff8cfacf60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline]
>  #0: ffffffff8cfacf60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
>  #0: ffffffff8cfacf60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6613
> 1 lock held by klogd/4501:
>  #0: ffff8880b993c718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:558
> 2 locks held by getty/4815:
>  #0: ffff8880273ee0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
>  #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc4/0x1490 drivers/tty/n_tty.c:2201
> 2 locks held by kworker/0:5/5180:
> 2 locks held by syz-executor216/5233:
> 1 lock held by syz-executor216/5234:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5240:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5241:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5245:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5246:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5248:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5249:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5251:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5252:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5254:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 1 lock held by syz-executor216/5255:
>  #0: ffff888142f94490 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0xc9/0x290 kernel/trace/blktrace.c:736
> 
> =============================================
> 
> NMI backtrace for cpu 0
> CPU: 0 PID: 29 Comm: khungtaskd Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
>  nmi_cpu_backtrace+0x277/0x390 lib/nmi_backtrace.c:113
>  nmi_trigger_cpumask_backtrace+0x299/0x300 lib/nmi_backtrace.c:62
>  trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
>  check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
>  watchdog+0xf86/0x1210 kernel/hung_task.c:379
>  kthread+0x2c1/0x3a0 kernel/kthread.c:389
>  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
>  </TASK>
> Sending NMI from CPU 0 to CPUs 1:
> NMI backtrace for cpu 1
> CPU: 1 PID: 5233 Comm: syz-executor216 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
> RIP: 0010:__sanitizer_cov_trace_switch+0x4f/0x90 kernel/kcov.c:341
> Code: 83 f8 10 75 2f 41 bd 03 00 00 00 4c 8b 75 00 31 db 4d 85 f6 74 1e 48 8b 74 dd 10 4c 89 e2 4c 89 ef 48 83 c3 01 48 8b 4c 24 28 <e8> 2c fe ff ff 49 39 de 75 e2 5b 5d 41 5c 41 5d 41 5e c3 48 83 f8
> RSP: 0018:ffffc90003fdf3a0 EFLAGS: 00000202
> RAX: 0000000000000008 RBX: 0000000000000001 RCX: ffffffff813a44c8
> RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000001
> RBP: ffffffff8ac9d800 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000001 R11: dffffc0000000000 R12: 0000000000000001
> R13: 0000000000000001 R14: 0000000000000003 R15: 0000000000000001
> FS:  00007f914cfc46c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f914d899f18 CR3: 00000000a0ad4000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>  <NMI>
>  </NMI>
>  <TASK>
>  unwind_next_frame+0xea8/0x2390 arch/x86/kernel/unwind_orc.c:641
>  arch_stack_walk+0xfa/0x170 arch/x86/kernel/stacktrace.c:25
>  stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
>  save_stack+0x15e/0x1f0 mm/page_owner.c:130
>  __set_page_owner+0x1f/0x60 mm/page_owner.c:196
>  set_page_owner include/linux/page_owner.h:31 [inline]
>  post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533
>  prep_new_page mm/page_alloc.c:1540 [inline]
>  get_page_from_freelist+0xa16/0x3690 mm/page_alloc.c:3344
>  __alloc_pages+0x22d/0x2400 mm/page_alloc.c:4600
>  alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133
>  relay_alloc_buf kernel/relay.c:121 [inline]
>  relay_create_buf kernel/relay.c:162 [inline]
>  relay_open_buf.part.0+0x27d/0xba0 kernel/relay.c:384
>  relay_open_buf kernel/relay.c:536 [inline]
>  relay_open+0x641/0xab0 kernel/relay.c:517
>  do_blk_trace_setup+0x4a9/0xaa0 kernel/trace/blktrace.c:591
>  __blk_trace_setup+0xd8/0x180 kernel/trace/blktrace.c:631
>  blk_trace_ioctl+0x163/0x290 kernel/trace/blktrace.c:741
>  blkdev_ioctl+0x111/0x770 block/ioctl.c:622
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:871 [inline]
>  __se_sys_ioctl fs/ioctl.c:857 [inline]
>  __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
>  do_syscall_x64 arch/x86/entry/common.c:51 [inline]
>  do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
>  entry_SYSCALL_64_after_hwframe+0x62/0x6a
> RIP: 0033:0x7f914d80ca89
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f914cfc4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007f914d89c1c8 RCX: 00007f914d80ca89
> RDX: 0000000020000380 RSI: 00000000c0481273 RDI: 0000000000000004
> RBP: 00007f914d89c1c0 R08: 00007f914cfc46c0 R09: 0000000000000000
> R10: 00007f914cfc46c0 R11: 0000000000000246 R12: 00007f914d89c1cc
> R13: 000000000000000b R14: 00007ffdb3560ef0 R15: 00007ffdb3560fd8
>  </TASK>
> INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.100 msecs
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [block?] [trace?] INFO: task hung in blk_trace_ioctl
Author: eadavis@qq.com

please test task hung in blk_trace_ioctl

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 8c9660f65153

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index d5d94510af..54ade89a1a 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -588,8 +588,10 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
 	debugfs_create_file("dropped", 0444, dir, bt, &blk_dropped_fops);
 	debugfs_create_file("msg", 0222, dir, bt, &blk_msg_fops);
 
+	mutex_unlock(&q->debugfs_mutex);
 	bt->rchan = relay_open("trace", dir, buts->buf_size,
 				buts->buf_nr, &blk_relay_callbacks, bt);
+	mutex_lock(&q->debugfs_mutex);
 	if (!bt->rchan)
 		goto err;
 

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [block?] [trace?] INFO: task hung in blk_trace_ioctl
Author: eadavis@qq.com

please test task hung in blk_trace_ioctl

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 8c9660f65153


diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 54ade89a1ad2..a1b341722693 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -735,7 +735,10 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
 	int ret, start = 0;
 	char b[BDEVNAME_SIZE];
 
-	mutex_lock(&q->debugfs_mutex);
+	if (cmd == BLKTRACESETUP)
+		mutex_lock_nested(&q->debugfs_mutex, 0);
+	else
+		mutex_lock_nested(&q->debugfs_mutex, 1);
 
 	switch (cmd) {
 	case BLKTRACESETUP:

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [block?] [trace?] INFO: task hung in blk_trace_ioctl
Author: eadavis@qq.com

please test task hung in blk_trace_ioctl

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 8c9660f65153

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 54ade89a1ad2..f5d3576ef3ed 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -735,7 +735,10 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
 	int ret, start = 0;
 	char b[BDEVNAME_SIZE];
 
-	mutex_lock(&q->debugfs_mutex);
+	if (cmd == BLKTRACESETUP)
+		mutex_lock(&q->debugfs_mutex);
+	else
+		mutex_lock_nested(&q->debugfs_mutex, 2);
 
 	switch (cmd) {
 	case BLKTRACESETUP:

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [block?] [trace?] INFO: task hung in blk_trace_ioctl
Author: eadavis@qq.com

please test task hung in blk_trace_ioctl

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 8c9660f65153

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 54ade89a1ad2..34e5bce42b1e 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -735,7 +735,8 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
 	int ret, start = 0;
 	char b[BDEVNAME_SIZE];
 
-	mutex_lock(&q->debugfs_mutex);
+	if (!mutex_trylock(&q->debugfs_mutex))
+		return -EBUSY;
 
 	switch (cmd) {
 	case BLKTRACESETUP:

Re: [PATCH next] trace/blktrace: fix task hung in blk_trace_ioctl

[Yu Kuai]

Hi,

在 2023/12/02 17:01, Edward Adam Davis 写道:
> The reproducer involves running test programs on multiple processors separately,
> in order to enter blkdev_ioctl() and ultimately reach blk_trace_ioctl() through
> two different paths, triggering an AA deadlock.
> 
> 	CPU0						CPU1
> 	---						---
> 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> 
> 
> The first path:
> blkdev_ioctl()->
> 	blk_trace_ioctl()->
> 		mutex_lock(&q->debugfs_mutex)
> 
> The second path:
> blkdev_ioctl()->				
> 	blkdev_common_ioctl()->
> 		blk_trace_ioctl()->
> 			mutex_lock(&q->debugfs_mutex)
I still don't understand how this AA deadlock is triggered, does the
'debugfs_mutex' already held before calling blk_trace_ioctl()?

> 
> The solution I have proposed is to exit blk_trace_ioctl() to avoid AA locks if
> a task has already obtained debugfs_mutex.
> 
> Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder")
> Reported-and-tested-by: syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>   kernel/trace/blktrace.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 54ade89a1ad2..34e5bce42b1e 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -735,7 +735,8 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
>   	int ret, start = 0;
>   	char b[BDEVNAME_SIZE];
>   
> -	mutex_lock(&q->debugfs_mutex);
> +	if (!mutex_trylock(&q->debugfs_mutex))
> +		return -EBUSY;

This is absolutely not a proper fix, a lot of user case will fail after
this patch.

Thanks,
Kuai

>   
>   	switch (cmd) {
>   	case BLKTRACESETUP:
> 

Re: [PATCH next] trace/blktrace: fix task hung in blk_trace_ioctl

[Steven Rostedt]

On Sat, 2 Dec 2023 17:19:25 +0800
Yu Kuai <yukuai1@huaweicloud.com> wrote:

> Hi,
> 
> 在 2023/12/02 17:01, Edward Adam Davis 写道:
> > The reproducer involves running test programs on multiple processors separately,
> > in order to enter blkdev_ioctl() and ultimately reach blk_trace_ioctl() through
> > two different paths, triggering an AA deadlock.
> > 
> > 	CPU0						CPU1
> > 	---						---
> > 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> > 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> > 
> > 
> > The first path:
> > blkdev_ioctl()->
> > 	blk_trace_ioctl()->
> > 		mutex_lock(&q->debugfs_mutex)
> > 
> > The second path:
> > blkdev_ioctl()->				
> > 	blkdev_common_ioctl()->
> > 		blk_trace_ioctl()->
> > 			mutex_lock(&q->debugfs_mutex)  
> I still don't understand how this AA deadlock is triggered, does the
> 'debugfs_mutex' already held before calling blk_trace_ioctl()?

Right, I don't see where the mutex is taken twice. You don't need two
paths for an AA lock, you only need one.

> 
> > 
> > The solution I have proposed is to exit blk_trace_ioctl() to avoid AA locks if
> > a task has already obtained debugfs_mutex.
> > 
> > Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder")

How does it fix the above? I don't see how the above is even related to this.

-- Steve

> > Reported-and-tested-by: syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > ---
> >   kernel/trace/blktrace.c | 3 ++-
> >   1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c

Re: [PATCH next] trace/blktrace: fix task hung in blk_trace_ioctl

[Pengfei Xu]

Hi,

On 2023-12-03 at 06:07:43 +0800, Steven Rostedt wrote:
> On Sat, 2 Dec 2023 17:19:25 +0800
> Yu Kuai <yukuai1@huaweicloud.com> wrote:
> 
> > Hi,
> > 
> > 在 2023/12/02 17:01, Edward Adam Davis 写道:
> > > The reproducer involves running test programs on multiple processors separately,
> > > in order to enter blkdev_ioctl() and ultimately reach blk_trace_ioctl() through
> > > two different paths, triggering an AA deadlock.
> > > 
> > > 	CPU0						CPU1
> > > 	---						---
> > > 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> > > 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> > > 
> > > 
> > > The first path:
> > > blkdev_ioctl()->
> > > 	blk_trace_ioctl()->
> > > 		mutex_lock(&q->debugfs_mutex)
> > > 
> > > The second path:
> > > blkdev_ioctl()->				
> > > 	blkdev_common_ioctl()->
> > > 		blk_trace_ioctl()->
> > > 			mutex_lock(&q->debugfs_mutex)  
> > I still don't understand how this AA deadlock is triggered, does the
> > 'debugfs_mutex' already held before calling blk_trace_ioctl()?
> 
> Right, I don't see where the mutex is taken twice. You don't need two
> paths for an AA lock, you only need one.
> 
> > 
> > > 
> > > The solution I have proposed is to exit blk_trace_ioctl() to avoid AA locks if
> > > a task has already obtained debugfs_mutex.
> > > 
> > > Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder")
> 
> How does it fix the above? I don't see how the above is even related to this.

I bisected this issue and the following fix information is more accurate:
"
Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
"

All the bisected info is in link: https://github.com/xupengfe/syzkaller_logs/tree/main/231203_140738_blk_trace_ioctl

Acked-by: Pengfei Xu <pengfei.xu@intel.com>

Thanks!

> 
> -- Steve
> 
> > > Reported-and-tested-by: syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > > ---
> > >   kernel/trace/blktrace.c | 3 ++-
> > >   1 file changed, 2 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[Jens Axboe]

On Thu, Nov 30, 2023 at 2:17?PM syzbot <syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1006f178e80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14ec6e62e80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11964f7ce80000

syz test: git://git.kernel.dk/linux btrace-fault

-- 
Jens Axboe

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[Aleksandr Nogikh]

(minus most people and mailing lists)

On Fri, Oct 11, 2024 at 9:20 PM Jens Axboe <axboe@kernel.dk> wrote:
>
> On Thu, Nov 30, 2023 at 2:17?PM syzbot <syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> > git tree:       linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1006f178e80000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> > dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
> > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14ec6e62e80000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11964f7ce80000
>
> syz test: git://git.kernel.dk/linux btrace-fault

It should begin with a # :)

#syz test: git://git.kernel.dk/linux btrace-fault

-- 
Aleksandr

>
> --
> Jens Axboe
>
> --

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[Jens Axboe]

On 10/11/24 1:32 PM, Aleksandr Nogikh wrote:
> (minus most people and mailing lists)
> 
> On Fri, Oct 11, 2024 at 9:20 PM Jens Axboe <axboe@kernel.dk> wrote:
>>
>> On Thu, Nov 30, 2023 at 2:17?PM syzbot <syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com> wrote:
>>>
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
>>> git tree:       linux-next
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1006f178e80000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
>>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14ec6e62e80000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11964f7ce80000
>>
>> syz test: git://git.kernel.dk/linux btrace-fault
> 
> It should begin with a # :)
> 
> #syz test: git://git.kernel.dk/linux btrace-fault

hah thanks, I always have to click the link to remember what to type.
Guess even with that I messed it up...

-- 
Jens Axboe

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[Aleksandr Nogikh]

On Fri, Oct 11, 2024 at 9:34 PM Jens Axboe <axboe@kernel.dk> wrote:
>
> On 10/11/24 1:32 PM, Aleksandr Nogikh wrote:
> > (minus most people and mailing lists)
> >
> > On Fri, Oct 11, 2024 at 9:20 PM Jens Axboe <axboe@kernel.dk> wrote:
> >>
> >> On Thu, Nov 30, 2023 at 2:17?PM syzbot <syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com> wrote:
> >>>
> >>> Hello,
> >>>
> >>> syzbot found the following issue on:
> >>>
> >>> HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> >>> git tree:       linux-next
> >>> console output: https://syzkaller.appspot.com/x/log.txt?x=1006f178e80000
> >>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> >>> dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
> >>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> >>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14ec6e62e80000
> >>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11964f7ce80000
> >>
> >> syz test: git://git.kernel.dk/linux btrace-fault
> >
> > It should begin with a # :)
> >
> > #syz test: git://git.kernel.dk/linux btrace-fault
>
> hah thanks, I always have to click the link to remember what to type.
> Guess even with that I messed it up...

FYI we've begun to include a small cheatsheet of the main syzbot
commands at the bottom of each syzbot report. So for the newer reports
you can just copy-paste the commands directly from the emails.

-- 
Aleksandr

>
> --
> Jens Axboe
>

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[Jens Axboe]

On 10/11/24 1:41 PM, Aleksandr Nogikh wrote:
> On Fri, Oct 11, 2024 at 9:34?PM Jens Axboe <axboe@kernel.dk> wrote:
>>
>> On 10/11/24 1:32 PM, Aleksandr Nogikh wrote:
>>> (minus most people and mailing lists)
>>>
>>> On Fri, Oct 11, 2024 at 9:20?PM Jens Axboe <axboe@kernel.dk> wrote:
>>>>
>>>> On Thu, Nov 30, 2023 at 2:17?PM syzbot <syzbot+ed812ed461471ab17a0c@syzkaller.appspotmail.com> wrote:
>>>>>
>>>>> Hello,
>>>>>
>>>>> syzbot found the following issue on:
>>>>>
>>>>> HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
>>>>> git tree:       linux-next
>>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1006f178e80000
>>>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
>>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
>>>>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>>>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14ec6e62e80000
>>>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11964f7ce80000
>>>>
>>>> syz test: git://git.kernel.dk/linux btrace-fault
>>>
>>> It should begin with a # :)
>>>
>>> #syz test: git://git.kernel.dk/linux btrace-fault
>>
>> hah thanks, I always have to click the link to remember what to type.
>> Guess even with that I messed it up...
> 
> FYI we've begun to include a small cheatsheet of the main syzbot
> commands at the bottom of each syzbot report. So for the newer reports
> you can just copy-paste the commands directly from the emails.

Ok question then - if I just include the patch inline in the email, what
do I type? Or does that not work?

-- 
Jens Axboe

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in blk_trace_setup

INFO: task syz-executor.0:5945 blocked for more than 143 seconds.
      Not tainted 6.12.0-rc2-syzkaller-00206-g3ae400ee2cd9 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:27360 pid:5945  tgid:5944  ppid:5899   flags:0x00000006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5322 [inline]
 __schedule+0x1895/0x4b30 kernel/sched/core.c:6682
 __schedule_loop kernel/sched/core.c:6759 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
 blk_trace_ioctl+0x182/0x830 kernel/trace/blktrace.c:730
 blkdev_ioctl+0x45f/0x6f0 block/ioctl.c:682
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0ebba7cae9
RSP: 002b:00007f0ebc7b30c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0ebbb9bf80 RCX: 00007f0ebba7cae9
RDX: 0000000020000380 RSI: 00000000c0481273 RDI: 0000000000000004
RBP: 00007f0ebbac847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f0ebbb9bf80 R15: 00007fff4cbbb418
 </TASK>
INFO: task syz-executor.0:5946 blocked for more than 145 seconds.
      Not tainted 6.12.0-rc2-syzkaller-00206-g3ae400ee2cd9 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:28752 pid:5946  tgid:5944  ppid:5899   flags:0x00000006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5322 [inline]
 __schedule+0x1895/0x4b30 kernel/sched/core.c:6682
 __schedule_loop kernel/sched/core.c:6759 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
 blkdev_common_ioctl+0xe7b/0x2480 block/ioctl.c:622
 blkdev_ioctl+0x51d/0x6f0 block/ioctl.c:687
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0ebba7cae9
RSP: 002b:00007f0ebc7920c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0ebbb9c050 RCX: 00007f0ebba7cae9
RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000004
RBP: 00007f0ebbac847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f0ebbb9c050 R15: 00007fff4cbbb418
 </TASK>
INFO: task syz-executor.4:5948 blocked for more than 146 seconds.
      Not tainted 6.12.0-rc2-syzkaller-00206-g3ae400ee2cd9 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4  state:D stack:27360 pid:5948  tgid:5947  ppid:5901   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5322 [inline]
 __schedule+0x1895/0x4b30 kernel/sched/core.c:6682
 __schedule_loop kernel/sched/core.c:6759 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
 blk_trace_ioctl+0x182/0x830 kernel/trace/blktrace.c:730
 blkdev_ioctl+0x45f/0x6f0 block/ioctl.c:682
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1da087cae9
RSP: 002b:00007f1da03ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1da099bf80 RCX: 00007f1da087cae9
RDX: 0000000020000380 RSI: 00000000c0481273 RDI: 0000000000000004
RBP: 00007f1da08c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f1da099bf80 R15: 00007fff0c43a168
 </TASK>
INFO: task syz-executor.4:5949 blocked for more than 146 seconds.
      Not tainted 6.12.0-rc2-syzkaller-00206-g3ae400ee2cd9 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4  state:D stack:28032 pid:5949  tgid:5947  ppid:5901   flags:0x00000006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5322 [inline]
 __schedule+0x1895/0x4b30 kernel/sched/core.c:6682
 __schedule_loop kernel/sched/core.c:6759 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
 blkdev_common_ioctl+0xe7b/0x2480 block/ioctl.c:622
 blkdev_ioctl+0x51d/0x6f0 block/ioctl.c:687
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1da087cae9
RSP: 002b:00007f1da03de0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1da099c050 RCX: 00007f1da087cae9
RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000004
RBP: 00007f1da08c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f1da099c050 R15: 00007fff0c43a168
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8e73a660 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8e73a660 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8e73a660 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6720
3 locks held by kworker/u8:5/1271:
 #0: ffff88814bf99948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
 #0: ffff88814bf99948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18f0 kernel/workqueue.c:3310
 #1: ffffc90004737d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
 #1: ffffc90004737d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18f0 kernel/workqueue.c:3310
 #2: ffffffff8fa498c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4736
2 locks held by kworker/u8:8/2844:
3 locks held by kworker/u9:1/4493:
 #0: ffff88809896c148 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
 #0: ffff88809896c148 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18f0 kernel/workqueue.c:3310
 #1: ffffc9000db1fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
 #1: ffffc9000db1fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18f0 kernel/workqueue.c:3310
 #2: ffff88802c874d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
4 locks held by klogd/4537:
 #0: ffff8880b913ea98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:593
 #1: ffffffff8e84ce60 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:593
 #2: ffff88807e2cc618 (&p->pi_lock){-.-.}-{2:2}, at: class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
 #2: ffff88807e2cc618 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0xbe/0x14b0 kernel/sched/core.c:4160
 #3: ffff8880b913ea98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:593
2 locks held by getty/4852:
 #0: ffff88802a4b80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211
3 locks held by kworker/1:5/5500:
 #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
 #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18f0 kernel/workqueue.c:3310
 #1: ffffc90004d17d00 (drain_vmap_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
 #1: ffffc90004d17d00 (drain_vmap_work){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18f0 kernel/workqueue.c:3310
 #2: ffffffff8e8373c8 (vmap_purge_lock){+.+.}-{3:3}, at: drain_vmap_area_work+0x17/0x40 mm/vmalloc.c:2321
3 locks held by syz-executor.5/5929:
1 lock held by syz-executor.0/5945:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.0/5946:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.4/5948:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.4/5949:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.1/5967:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.1/5968:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.2/5985:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.2/5986:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.3/6003:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.3/6004:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.5/6037:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.5/6038:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.0/6064:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.4/6066:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.4/6067:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.1/6087:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.1/6088:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.2/6106:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.2/6107:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.3/6125:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.3/6126:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by syz-executor.5/6147:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.5/6148:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
2 locks held by syz-executor.4/6165:
 #0: ffffffff8fa498c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fa498c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6672
 #1: ffffffff8e73fc38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:329 [inline]
 #1: ffffffff8e73fc38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x820 kernel/rcu/tree_exp.h:976
1 lock held by syz-executor.0/6168:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:630
1 lock held by syz-executor.0/6169:
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888142b6ad90 (&q->debugfs_mutex){+.+.}-{3:3}, at: blk_trace_ioctl+0x1b8/0x830 kernel/trace/blktrace.c:745
1 lock held by dhcpcd/6177:
 #0: ffff888065d3ca08 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
 #0: ffff888065d3ca08 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: __sock_release net/socket.c:657 [inline]
 #0: ffff888065d3ca08 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1426

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc2-syzkaller-00206-g3ae400ee2cd9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
 watchdog+0xff4/0x1040 kernel/hung_task.c:379
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 2844 Comm: kworker/u8:8 Not tainted 6.12.0-rc2-syzkaller-00206-g3ae400ee2cd9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: bat_events batadv_nc_worker
RIP: 0010:debug_lockdep_rcu_enabled+0x2a/0x40 kernel/rcu/update.c:321
Code: f3 0f 1e fa 31 c0 83 3d 9f 8e 50 04 00 74 1e 83 3d f6 bd 50 04 00 74 15 65 48 8b 0c 25 c0 d7 03 00 31 c0 83 b9 dc 0a 00 00 00 <0f> 94 c0 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00
RSP: 0018:ffffc90009de7b50 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888023995a80 RCX: ffff88802902bc00
RDX: dffffc0000000000 RSI: ffffffff8bead560 RDI: ffffffff8c4159e0
RBP: ffff888166c393b0 R08: ffffffff934ac807 R09: 1ffffffff2695900
R10: dffffc0000000000 R11: fffffbfff2695901 R12: ffff88816d91ccc0
R13: 0000000000000276 R14: ffff888023995a80 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efecd242040 CR3: 000000007b8e8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 rcu_read_lock include/linux/rcupdate.h:850 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
 batadv_nc_worker+0xf5/0x610 net/batman-adv/network-coding.c:719
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xabe/0x18f0 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


Tested on:

commit:         3ae400ee blktrace: move user copies out of q->debugfs_..
git tree:       git://git.kernel.dk/linux btrace-fault
console output: https://syzkaller.appspot.com/x/log.txt?x=17995fd0580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ac04e079248cbf6c
dashboard link: https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.

Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_ioctl (4)

[Aleksandr Nogikh]

Hi Jens,

On Fri, Oct 11, 2024 at 10:43 PM Jens Axboe <axboe@kernel.dk> wrote:
>
> On 10/11/24 1:41 PM, Aleksandr Nogikh wrote:
> > On Fri, Oct 11, 2024 at 9:34?PM Jens Axboe <axboe@kernel.dk> wrote:
> >>
> >> On 10/11/24 1:32 PM, Aleksandr Nogikh wrote:
> >>> (minus most people and mailing lists)
> >>>
> >>> On Fri, Oct 11, 2024 at 9:20?PM Jens Axboe <axboe@kernel.dk> wrote:
> >>>>
< ... >
> >>>>
> >>>> syz test: git://git.kernel.dk/linux btrace-fault
> >>>
> >>> It should begin with a # :)
> >>>
> >>> #syz test: git://git.kernel.dk/linux btrace-fault
> >>
> >> hah thanks, I always have to click the link to remember what to type.
> >> Guess even with that I messed it up...
> >
> > FYI we've begun to include a small cheatsheet of the main syzbot
> > commands at the bottom of each syzbot report. So for the newer reports
> > you can just copy-paste the commands directly from the emails.
>
> Ok question then - if I just include the patch inline in the email, what
> do I type? Or does that not work?

You'd need to type the exact same command. If there's no patch, syzbot
will just build the kernel from the specified repository and run the
reproducer on it. If you paste the git patch below the `syz test`
command, it will apply that patch before building the kernel.

-- 
Aleksandr

>
> --
> Jens Axboe