public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [syzbot] [jfs?] INFO: task hung in txBegin
@ 2024-06-25 15:36 syzbot
  2024-07-20  2:31 ` Edward Adam Davis
                   ` (2 more replies)
  0 siblings, 3 replies; 10+ messages in thread
From: syzbot @ 2024-06-25 15:36 UTC (permalink / raw)
  To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    50736169ecc8 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=172777ee980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17dccdda980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1644d08e980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5cd6a6f1e8a6/disk-50736169.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2fb1a68197bc/vmlinux-50736169.xz
kernel image: https://storage.googleapis.com/syzbot-assets/783059c8c714/bzImage-50736169.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/95d758e45724/mount_0.gz

Bisection is inconclusive: the issue happens on the oldest tested release.

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13861201980000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=10461201980000
console output: https://syzkaller.appspot.com/x/log.txt?x=17861201980000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eda89a33c5856f66f823@syzkaller.appspotmail.com

INFO: task kworker/u8:11:2848 blocked for more than 143 seconds.
      Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:11   state:D stack:23552 pid:2848  tgid:2848  ppid:2      flags:0x00004000
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5408 [inline]
 __schedule+0x1796/0x49d0 kernel/sched/core.c:6745
 __schedule_loop kernel/sched/core.c:6822 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6837
 io_schedule+0x8d/0x110 kernel/sched/core.c:9043
 TXN_SLEEP_DROP_LOCK fs/jfs/jfs_txnmgr.c:125 [inline]
 txBegin+0x260/0xce0 fs/jfs/jfs_txnmgr.c:374
 jfs_commit_inode+0x223/0x590 fs/jfs/inode.c:101
 jfs_write_inode+0x143/0x220 fs/jfs/inode.c:132
 write_inode fs/fs-writeback.c:1497 [inline]
 __writeback_single_inode+0x6b9/0x10b0 fs/fs-writeback.c:1716
 writeback_sb_inodes+0x99c/0x1380 fs/fs-writeback.c:1947
 wb_writeback+0x481/0xd40 fs/fs-writeback.c:2127
 wb_do_writeback fs/fs-writeback.c:2274 [inline]
 wb_workfn+0x410/0x1090 fs/fs-writeback.c:2314
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz-executor117:5099 blocked for more than 143 seconds.
      Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor117 state:D stack:19408 pid:5099  tgid:5099  ppid:5098   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5408 [inline]
 __schedule+0x1796/0x49d0 kernel/sched/core.c:6745
 __schedule_loop kernel/sched/core.c:6822 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6837
 wb_wait_for_completion+0x166/0x290 fs/fs-writeback.c:216
 __writeback_inodes_sb_nr+0x2d2/0x380 fs/fs-writeback.c:2706
 sync_filesystem+0xa4/0x230 fs/sync.c:54
 generic_shutdown_super+0x72/0x2d0 fs/super.c:621
 kill_block_super+0x44/0x90 fs/super.c:1676
 deactivate_locked_super+0xc4/0x130 fs/super.c:473
 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
 task_work_run+0x24f/0x310 kernel/task_work.c:180
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe052acc017
RSP: 002b:00007ffd7811a4d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe052acc017
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd7811a590
RBP: 00007ffd7811a590 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffd7811b5f0
R13: 00005555816966c0 R14: 000000000000000f R15: 431bde82d7b634db
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
 #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
 #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614
2 locks held by kworker/u8:11/2848:
 #0: ffff88801ae86148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff88801ae86148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc900098b7d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc900098b7d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
2 locks held by getty/4845:
 #0: ffff88802a5ab0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002f162f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2211
1 lock held by syz-executor117/5099:
 #0: ffff88802c5e00e0 (&type->s_umount_key#46){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88802c5e00e0 (&type->s_umount_key#46){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88802c5e00e0 (&type->s_umount_key#46){+.+.}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 30 Comm: khungtaskd Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
 watchdog+0xfde/0x1020 kernel/hung_task.c:379
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 51 Comm: kworker/u8:3 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x0/0x90 kernel/kcov.c:310
Code: 10 48 89 74 0a 18 4c 89 44 0a 20 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 4c 8b 04 24 65 48 8b 0c 25 80 d4 03 00 65 8b 05 f0 aa
RSP: 0018:ffffc90000bb7638 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 000ffffffffff000 RCX: ffff888015193c00
RDX: 000000001507c558 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000bb7730 R08: ffffffff81e6dded R09: 1ffffffff25edcb0
R10: dffffc0000000000 R11: fffffbfff25edcb1 R12: 1ffff92000176ed0
R13: 000000001507c067 R14: 0000000000000000 R15: 1ffff92000176ed8
FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005617e0440680 CR3: 000000000e132000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 pmd_pfn_mask arch/x86/include/asm/pgtable_types.h:453 [inline]
 pmd_pfn arch/x86/include/asm/pgtable.h:234 [inline]
 pte_lockptr include/linux/mm.h:2955 [inline]
 __pte_offset_map_lock+0x17b/0x300 mm/pgtable-generic.c:374
 get_locked_pte include/linux/mm.h:2744 [inline]
 __text_poke+0x2c5/0xd30 arch/x86/kernel/alternative.c:1883
 text_poke arch/x86/kernel/alternative.c:1968 [inline]
 text_poke_bp_batch+0x8cd/0xb30 arch/x86/kernel/alternative.c:2357
 text_poke_flush arch/x86/kernel/alternative.c:2470 [inline]
 text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2477
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x136/0x260 kernel/jump_label.c:205
 static_key_enable+0x1a/0x20 kernel/jump_label.c:218
 toggle_allocation_gate+0xb5/0x250 mm/kfence/core.c:826
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.555 msecs


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
       [not found] <20240627005133.770565-1-lizhi.xu@windriver.com>
@ 2024-06-27  1:24 ` syzbot
  0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-06-27  1:24 UTC (permalink / raw)
  To: linux-kernel, lizhi.xu, syzkaller-bugs

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

] sched_clock: Marking stable (15250029932, 36185301)->(15287226125, -1010892)
[   15.298765][    T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[   15.310198][    T1] registered taskstats version 1
[   15.329828][    T1] Loading compiled-in X.509 certificates
[   15.340885][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: d166f013ab7b5f705951ab1c608c6a6dfb658aa3'
[   15.661847][    T1] zswap: loaded using pool lzo/zsmalloc
[   15.670437][    T1] Demotion targets for Node 0: null
[   15.675655][    T1] Demotion targets for Node 1: null
[   15.681002][    T1] debug_vm_pgtable: [debug_vm_pgtable         ]: Validating architecture page table helpers
[   18.073034][    T1] Key type .fscrypt registered
[   18.077881][    T1] Key type fscrypt-provisioning registered
[   18.091455][    T1] kAFS: Red Hat AFS client v0.1 registering.
[   18.115633][    T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[   18.124399][    T1] Key type big_key registered
[   18.138791][    T1] Key type encrypted registered
[   18.143916][    T1] ima: No TPM chip found, activating TPM-bypass!
[   18.150666][    T1] Loading compiled-in module X.509 certificates
[   18.160083][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: d166f013ab7b5f705951ab1c608c6a6dfb658aa3'
[   18.171536][    T1] ima: Allocated hash algorithm: sha256
[   18.177605][    T1] ima: No architecture policies found
[   18.183789][    T1] evm: Initialising EVM extended attributes:
[   18.189828][    T1] evm: security.selinux (disabled)
[   18.194960][    T1] evm: security.SMACK64
[   18.199198][    T1] evm: security.SMACK64EXEC
[   18.203935][    T1] evm: security.SMACK64TRANSMUTE
[   18.209359][    T1] evm: security.SMACK64MMAP
[   18.213937][    T1] evm: security.apparmor (disabled)
[   18.219172][    T1] evm: security.ima
[   18.223027][    T1] evm: security.capability
[   18.227718][    T1] evm: HMAC attrs: 0x1
[   18.234253][    T1] PM:   Magic number: 12:850:256
[   18.239435][    T1] sound controlC0: hash matches
[   18.244901][    T1] vhci_hcd vhci_hcd.3: hash matches
[   18.250600][    T1] tty ttytf: hash matches
[   18.255802][    T1] printk: legacy console [netcon0] enabled
[   18.261717][    T1] netconsole: network logging started
[   18.267921][    T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[   18.275848][    T1] rdma_rxe: loaded
[   18.280657][    T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[   18.291523][    T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[   18.299806][    T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[   18.310214][    T1] clk: Disabling unused clocks
[   18.315369][    T1] ALSA device list:
[   18.320941][   T45] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[   18.326362][    T1]   #0: Dummy 1
[   18.330739][   T45] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[   18.334034][    T1]   #1: Loopback 1
[   18.346869][    T1]   #2: Virtual MIDI Card 1
[   18.354968][    T1] md: Waiting for all devices to be available before autodetect
[   18.362861][    T1] md: If you don't use raid, use raid=noautodetect
[   18.369494][    T1] md: Autodetecting RAID arrays.
[   18.374524][    T1] md: autorun ...
[   18.378180][    T1] md: ... autorun DONE.
[   18.453031][    T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[   18.466879][    T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[   18.563174][    T1] devtmpfs: mounted
[   18.648281][    T1] Freeing unused kernel image (initmem) memory: 25888K
[   18.659532][    T1] Write protecting the kernel read-only data: 212992k
[   18.676292][    T1] Freeing unused kernel image (rodata/data gap) memory: 756K
[   18.782315][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   18.790468][    T1] x86/mm: Checking user space page tables
[   18.882494][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   18.896143][    T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[   18.906366][    T1] Run /sbin/init as init process
[   19.536334][ T4501] mount (4501) used greatest stack depth: 23680 bytes left
[   19.574177][ T4502] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[   19.682917][ T4505] mount (4505) used greatest stack depth: 20432 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [   20.560303][ T4535] udevd[4535]: starting version 3.2.11
[   20.864707][ T4536] udevd[4536]: starting eudev-3.2.11
[   20.867564][ T4535] udevd (4535) used greatest stack depth: 18776 bytes left
[   24.630142][   T35] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1578
[   24.640074][   T35] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 35, name: kworker/u8:2
[   24.649231][   T35] preempt_count: 1, expected: 0
[   24.654121][   T35] RCU nest depth: 0, expected: 0
[   24.659688][   T35] 3 locks held by kworker/u8:2/35:
[   24.665009][   T35]  #0: ffff88801aef1148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[   24.676546][   T35]  #1: ffffc90000ab7d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[   24.689351][   T35]  #2: ffff888022f160d8 (&wb->list_lock){+.+.}-{2:2}, at: wb_writeback+0x29f/0xd90
[   24.699132][   T35] Preemption disabled at:
[   24.699147][   T35] [<0000000000000000>] 0x0
[   24.708275][   T35] CPU: 1 PID: 35 Comm: kworker/u8:2 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
[   24.719246][   T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   24.729422][   T35] Workqueue: writeback wb_workfn (flush-8:0)
[   24.735469][   T35] Call Trace:
[   24.738795][   T35]  <TASK>
[   24.741764][   T35]  dump_stack_lvl+0x241/0x360
[   24.746593][   T35]  ? __pfx_dump_stack_lvl+0x10/0x10
[   24.751997][   T35]  ? __pfx__printk+0x10/0x10
[   24.756629][   T35]  __might_resched+0x5d4/0x780
[   24.761435][   T35]  ? __pfx___might_resched+0x10/0x10
[   24.766849][   T35]  ? do_raw_spin_lock+0x14f/0x370
[   24.771922][   T35]  ? rcu_is_watching+0x15/0xb0
[   24.776730][   T35]  down_write+0x19/0x50
[   24.780962][   T35]  wb_writeback+0x46d/0xd90
[   24.785615][   T35]  ? queue_io+0x3b1/0x5a0
[   24.790076][   T35]  ? __pfx_wb_writeback+0x10/0x10
[   24.795277][   T35]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   24.801400][   T35]  wb_workfn+0xba1/0x1090
[   24.805787][   T35]  ? __pfx_wb_workfn+0x10/0x10
[   24.810612][   T35]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   24.816631][   T35]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   24.823192][   T35]  ? process_scheduled_works+0x945/0x1830
[   24.829118][   T35]  process_scheduled_works+0xa2c/0x1830
[   24.834746][   T35]  ? __pfx_process_scheduled_works+0x10/0x10
[   24.840783][   T35]  ? assign_work+0x364/0x3d0
[   24.845504][   T35]  worker_thread+0x86d/0xd70
[   24.850226][   T35]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   24.856176][   T35]  ? __kthread_parkme+0x169/0x1d0
[   24.861349][   T35]  ? __pfx_worker_thread+0x10/0x10
[   24.866766][   T35]  kthread+0x2f0/0x390
[   24.871147][   T35]  ? __pfx_worker_thread+0x10/0x10
[   24.876294][   T35]  ? __pfx_kthread+0x10/0x10
[   24.881000][   T35]  ret_from_fork+0x4b/0x80
[   24.885712][   T35]  ? __pfx_kthread+0x10/0x10
[   24.890344][   T35]  ret_from_fork_asm+0x1a/0x30
[   24.895164][   T35]  </TASK>
[   24.898489][   T35] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001c: 0000 [#1] PREEMPT SMP KASAN PTI
[   24.911278][   T35] KASAN: null-ptr-deref in range [0x00000000000000e0-0x00000000000000e7]
[   24.919719][   T35] CPU: 1 PID: 35 Comm: kworker/u8:2 Tainted: G        W          6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
[   24.932070][   T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   24.942545][   T35] Workqueue: writeback wb_workfn (flush-8:0)
[   24.948754][   T35] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[   24.954267][   T35] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[   24.974168][   T35] RSP: 0018:ffffc90000ab74f0 EFLAGS: 00010002
[   24.980269][   T35] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[   24.988696][   T35] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[   24.996955][   T35] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[   25.004950][   T35] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[   25.013039][   T35] R13: 0000000000000000 R14: ffff88801b681e00 R15: 0000000000000000
[   25.021122][   T35] FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
[   25.030088][   T35] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   25.036701][   T35] CR2: 0000556986fc54d0 CR3: 00000000182a6000 CR4: 00000000003506f0
[   25.044884][   T35] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   25.053744][   T35] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   25.061994][   T35] Call Trace:
[   25.065274][   T35]  <TASK>
[   25.068217][   T35]  ? __die_body+0x88/0xe0
[   25.072557][   T35]  ? die_addr+0x108/0x140
[   25.076910][   T35]  ? exc_general_protection+0x3dd/0x5d0
[   25.082477][   T35]  ? asm_exc_general_protection+0x26/0x30
[   25.088247][   T35]  ? __lock_acquire+0x6a/0x1fd0
[   25.093088][   T35]  ? dump_stack_lvl+0x301/0x360
[   25.097954][   T35]  ? __pfx_dump_stack_lvl+0x10/0x10
[   25.103247][   T35]  ? __pfx__printk+0x10/0x10
[   25.107831][   T35]  lock_acquire+0x1ed/0x550
[   25.112421][   T35]  ? wb_writeback+0x46d/0xd90
[   25.117117][   T35]  ? __pfx_lock_acquire+0x10/0x10
[   25.122288][   T35]  ? __pfx___might_resched+0x10/0x10
[   25.127589][   T35]  ? do_raw_spin_lock+0x14f/0x370
[   25.132730][   T35]  ? rcu_is_watching+0x15/0xb0
[   25.137508][   T35]  down_write+0x3a/0x50
[   25.141748][   T35]  ? wb_writeback+0x46d/0xd90
[   25.146528][   T35]  wb_writeback+0x46d/0xd90
[   25.151051][   T35]  ? queue_io+0x3b1/0x5a0
[   25.155403][   T35]  ? __pfx_wb_writeback+0x10/0x10
[   25.160438][   T35]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   25.166596][   T35]  wb_workfn+0xba1/0x1090
[   25.170929][   T35]  ? __pfx_wb_workfn+0x10/0x10
[   25.175866][   T35]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   25.181870][   T35]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   25.188738][   T35]  ? process_scheduled_works+0x945/0x1830
[   25.194447][   T35]  process_scheduled_works+0xa2c/0x1830
[   25.200280][   T35]  ? __pfx_process_scheduled_works+0x10/0x10
[   25.206513][   T35]  ? assign_work+0x364/0x3d0
[   25.212499][   T35]  worker_thread+0x86d/0xd70
[   25.217342][   T35]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   25.223233][   T35]  ? __kthread_parkme+0x169/0x1d0
[   25.228357][   T35]  ? __pfx_worker_thread+0x10/0x10
[   25.233743][   T35]  kthread+0x2f0/0x390
[   25.237985][   T35]  ? __pfx_worker_thread+0x10/0x10
[   25.243209][   T35]  ? __pfx_kthread+0x10/0x10
[   25.247808][   T35]  ret_from_fork+0x4b/0x80
[   25.252226][   T35]  ? __pfx_kthread+0x10/0x10
[   25.257349][   T35]  ret_from_fork_asm+0x1a/0x30
[   25.262136][   T35]  </TASK>
[   25.265145][   T35] Modules linked in:
[   25.269128][   T35] ---[ end trace 0000000000000000 ]---
[   25.274926][   T35] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[   25.280593][   T35] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[   25.300315][   T35] RSP: 0018:ffffc90000ab74f0 EFLAGS: 00010002
[   25.306627][   T35] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[   25.314710][   T35] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[   25.322714][   T35] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[   25.331044][   T35] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[   25.339723][   T35] R13: 0000000000000000 R14: ffff88801b681e00 R15: 0000000000000000
[   25.347961][   T35] FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
[   25.357437][   T35] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   25.364092][   T35] CR2: 0000556986fc54d0 CR3: 00000000182a6000 CR4: 00000000003506f0
[   25.372259][   T35] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   25.380762][   T35] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   25.388774][   T35] Kernel panic - not syncing: Fatal exception
[   25.395138][   T35] Kernel Offset: disabled
[   25.399763][   T35] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2587984659=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at dac2aa43b4
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"dac2aa43b4dbdbffa2c5e24a736096a6d928f633\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15d203a6980000


Tested on:

commit:         50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1423533e980000


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
       [not found] <20240627015934.1159978-1-lizhi.xu@windriver.com>
@ 2024-06-27  2:20 ` syzbot
  0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-06-27  2:20 UTC (permalink / raw)
  To: linux-kernel, lizhi.xu, syzkaller-bugs

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

itialized
[   12.450194][    T1] Bluetooth: RFCOMM socket layer initialized
[   12.456398][    T1] Bluetooth: RFCOMM ver 1.11
[   12.461045][    T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   12.467274][    T1] Bluetooth: BNEP filters: protocol multicast
[   12.473507][    T1] Bluetooth: BNEP socket layer initialized
[   12.479400][    T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[   12.485274][    T1] Bluetooth: CMTP socket layer initialized
[   12.491147][    T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[   12.498194][    T1] Bluetooth: HIDP socket layer initialized
[   12.507632][    T1] NET: Registered PF_RXRPC protocol family
[   12.513531][    T1] Key type rxrpc registered
[   12.518063][    T1] Key type rxrpc_s registered
[   12.523550][    T1] NET: Registered PF_KCM protocol family
[   12.530117][    T1] lec:lane_module_init: lec.c: initialized
[   12.536001][    T1] mpoa:atm_mpoa_init: mpc.c: initialized
[   12.541990][    T1] l2tp_core: L2TP core driver, V2.0
[   12.547437][    T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   12.553068][    T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[   12.559736][    T1] l2tp_netlink: L2TP netlink interface
[   12.565426][    T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[   12.572210][    T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[   12.579806][    T1] NET: Registered PF_PHONET protocol family
[   12.586291][    T1] 8021q: 802.1Q VLAN Support v1.8
[   12.605218][    T1] DCCP: Activated CCID 2 (TCP-like)
[   12.610742][    T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[   12.617954][    T1] DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   12.629617][    T1] sctp: Hash tables configured (bind 32/56)
[   12.637290][    T1] NET: Registered PF_RDS protocol family
[   12.643689][    T1] Registered RDS/infiniband transport
[   12.650504][    T1] Registered RDS/tcp transport
[   12.655260][    T1] tipc: Activated (version 2.0.0)
[   12.661683][    T1] NET: Registered PF_TIPC protocol family
[   12.668462][    T1] tipc: Started in single node mode
[   12.674475][    T1] NET: Registered PF_SMC protocol family
[   12.680577][    T1] 9pnet: Installing 9P2000 support
[   12.686466][    T1] NET: Registered PF_CAIF protocol family
[   12.696408][    T1] NET: Registered PF_IEEE802154 protocol family
[   12.702904][    T1] Key type dns_resolver registered
[   12.708146][    T1] Key type ceph registered
[   12.713281][    T1] libceph: loaded (mon/osd proto 15/24)
[   12.720605][    T1] batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
[   12.730351][    T1] openvswitch: Open vSwitch switching datapath
[   12.739867][    T1] NET: Registered PF_VSOCK protocol family
[   12.746313][    T1] mpls_gso: MPLS GSO support
[   12.768127][    T1] IPI shorthand broadcast: enabled
[   12.773633][    T1] AVX2 version of gcm_enc/dec engaged.
[   12.779675][    T1] AES CTR mode by8 optimization enabled
[   14.227701][    T1] sched_clock: Marking stable (14190061000, 35522337)->(14229701277, -4117940)
[   14.241866][    T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[   14.253943][    T1] registered taskstats version 1
[   14.270550][    T1] Loading compiled-in X.509 certificates
[   14.280599][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: 4d8a14ab1354649e588ef893344f8a054513da14'
[   14.601155][    T1] zswap: loaded using pool lzo/zsmalloc
[   14.608936][    T1] Demotion targets for Node 0: null
[   14.614169][    T1] Demotion targets for Node 1: null
[   14.628617][    T1] debug_vm_pgtable: [debug_vm_pgtable         ]: Validating architecture page table helpers
[   17.258079][    T1] Key type .fscrypt registered
[   17.263049][    T1] Key type fscrypt-provisioning registered
[   17.276013][    T1] kAFS: Red Hat AFS client v0.1 registering.
[   17.300345][    T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[   17.309004][    T1] Key type big_key registered
[   17.323034][    T1] Key type encrypted registered
[   17.328323][    T1] ima: No TPM chip found, activating TPM-bypass!
[   17.334853][    T1] Loading compiled-in module X.509 certificates
[   17.344084][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: 4d8a14ab1354649e588ef893344f8a054513da14'
[   17.354904][    T1] ima: Allocated hash algorithm: sha256
[   17.360822][    T1] ima: No architecture policies found
[   17.366993][    T1] evm: Initialising EVM extended attributes:
[   17.372956][    T1] evm: security.selinux (disabled)
[   17.378069][    T1] evm: security.SMACK64
[   17.382213][    T1] evm: security.SMACK64EXEC
[   17.386715][    T1] evm: security.SMACK64TRANSMUTE
[   17.391638][    T1] evm: security.SMACK64MMAP
[   17.396145][    T1] evm: security.apparmor (disabled)
[   17.401333][    T1] evm: security.ima
[   17.405130][    T1] evm: security.capability
[   17.409889][    T1] evm: HMAC attrs: 0x1
[   17.416387][    T1] PM:   Magic number: 12:853:157
[   17.421445][    T1] usb usb36-port8: hash matches
[   17.426621][    T1] bdi 1:9: hash matches
[   17.431495][    T1] printk: legacy console [netcon0] enabled
[   17.437427][    T1] netconsole: network logging started
[   17.443443][    T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[   17.451315][    T1] rdma_rxe: loaded
[   17.455890][    T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[   17.468001][    T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[   17.477349][    T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[   17.487009][  T786] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[   17.499048][    T1] clk: Disabling unused clocks
[   17.503984][    T1] ALSA device list:
[   17.507873][  T786] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[   17.515939][    T1]   #0: Dummy 1
[   17.520114][    T1]   #1: Loopback 1
[   17.523819][    T1]   #2: Virtual MIDI Card 1
[   17.531956][    T1] md: Waiting for all devices to be available before autodetect
[   17.539623][    T1] md: If you don't use raid, use raid=noautodetect
[   17.546155][    T1] md: Autodetecting RAID arrays.
[   17.551160][    T1] md: autorun ...
[   17.554815][    T1] md: ... autorun DONE.
[   17.623375][    T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[   17.636264][    T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[   17.649480][    T1] devtmpfs: mounted
[   17.737799][    T1] Freeing unused kernel image (initmem) memory: 25888K
[   17.748732][    T1] Write protecting the kernel read-only data: 212992k
[   17.766778][    T1] Freeing unused kernel image (rodata/data gap) memory: 756K
[   17.872267][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   17.880469][    T1] x86/mm: Checking user space page tables
[   17.972322][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   17.985697][    T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[   17.995475][    T1] Run /sbin/init as init process
[   18.362152][ T4502] mount (4502) used greatest stack depth: 23680 bytes left
[   18.417722][ T4503] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
[   18.432004][ T4503] mount (4503) used greatest stack depth: 23608 bytes left
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[   18.598864][ T4506] mount (4506) used greatest stack depth: 20672 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [   19.589483][ T4536] udevd[4536]: starting version 3.2.11
[   19.881043][ T4537] udevd[4537]: starting eudev-3.2.11
[   19.883595][ T4536] udevd (4536) used greatest stack depth: 18776 bytes left
[   23.456570][ T2487] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001c: 0000 [#1] PREEMPT SMP KASAN PTI
[   23.469312][ T2487] KASAN: null-ptr-deref in range [0x00000000000000e0-0x00000000000000e7]
[   23.477745][ T2487] CPU: 0 PID: 2487 Comm: kworker/u8:9 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
[   23.488606][ T2487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   23.498891][ T2487] Workqueue: writeback wb_workfn (flush-8:0)
[   23.504940][ T2487] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[   23.510524][ T2487] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[   23.530239][ T2487] RSP: 0018:ffffc900097874f0 EFLAGS: 00010002
[   23.536424][ T2487] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[   23.544419][ T2487] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[   23.552415][ T2487] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[   23.560670][ T2487] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[   23.568661][ T2487] R13: 0000000000000000 R14: ffff88802a7a3c00 R15: 0000000000000000
[   23.576662][ T2487] FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
[   23.585609][ T2487] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   23.592299][ T2487] CR2: 00007f77ff6ed907 CR3: 000000001f0a4000 CR4: 00000000003506f0
[   23.600343][ T2487] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   23.608338][ T2487] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   23.616341][ T2487] Call Trace:
[   23.619811][ T2487]  <TASK>
[   23.622841][ T2487]  ? __die_body+0x88/0xe0
[   23.627291][ T2487]  ? die_addr+0x108/0x140
[   23.631844][ T2487]  ? exc_general_protection+0x3dd/0x5d0
[   23.637448][ T2487]  ? asm_exc_general_protection+0x26/0x30
[   23.643205][ T2487]  ? __lock_acquire+0x6a/0x1fd0
[   23.648379][ T2487]  lock_acquire+0x1ed/0x550
[   23.653004][ T2487]  ? wb_writeback+0x13a/0xd80
[   23.657730][ T2487]  ? __pfx_lock_acquire+0x10/0x10
[   23.662789][ T2487]  ? __lock_acquire+0x1346/0x1fd0
[   23.667840][ T2487]  ? __pfx___might_resched+0x10/0x10
[   23.673653][ T2487]  ? __asan_memset+0x23/0x50
[   23.678272][ T2487]  down_write+0x3a/0x50
[   23.682535][ T2487]  ? wb_writeback+0x13a/0xd80
[   23.687231][ T2487]  wb_writeback+0x13a/0xd80
[   23.691774][ T2487]  ? mark_lock+0x9a/0x350
[   23.696126][ T2487]  ? __pfx_wb_writeback+0x10/0x10
[   23.701173][ T2487]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   23.707179][ T2487]  wb_workfn+0xba1/0x1090
[   23.711621][ T2487]  ? __pfx_wb_workfn+0x10/0x10
[   23.716432][ T2487]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   23.722440][ T2487]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   23.728884][ T2487]  ? process_scheduled_works+0x945/0x1830
[   23.734721][ T2487]  process_scheduled_works+0xa2c/0x1830
[   23.740393][ T2487]  ? __pfx_process_scheduled_works+0x10/0x10
[   23.746411][ T2487]  ? assign_work+0x364/0x3d0
[   23.751113][ T2487]  worker_thread+0x86d/0xd70
[   23.755744][ T2487]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   23.761710][ T2487]  ? __kthread_parkme+0x169/0x1d0
[   23.766764][ T2487]  ? __pfx_worker_thread+0x10/0x10
[   23.772004][ T2487]  kthread+0x2f0/0x390
[   23.776101][ T2487]  ? __pfx_worker_thread+0x10/0x10
[   23.781334][ T2487]  ? __pfx_kthread+0x10/0x10
[   23.786212][ T2487]  ret_from_fork+0x4b/0x80
[   23.790664][ T2487]  ? __pfx_kthread+0x10/0x10
[   23.795373][ T2487]  ret_from_fork_asm+0x1a/0x30
[   23.800262][ T2487]  </TASK>
[   23.803312][ T2487] Modules linked in:
[   23.807246][ T2487] ---[ end trace 0000000000000000 ]---
[   23.812972][ T2487] RIP: 0010:__lock_acquire+0x6a/0x1fd0
[   23.818459][ T2487] Code: df 0f b6 04 30 84 c0 0f 85 4b 16 00 00 83 3d c8 e1 39 0e 00 0f 84 1c 11 00 00 83 3d bf 9d ad 0c 00 74 2c 4c 89 e0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 e7 e8 28 1d 86 00 48 be 00 00 00 00 00 fc
[   23.838435][ T2487] RSP: 0018:ffffc900097874f0 EFLAGS: 00010002
[   23.844527][ T2487] RAX: 000000000000001c RBX: 0000000000000000 RCX: 0000000000000000
[   23.852515][ T2487] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 00000000000000e0
[   23.860505][ T2487] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[   23.868584][ T2487] R10: dffffc0000000000 R11: fffffbfff1f58356 R12: 00000000000000e0
[   23.876574][ T2487] R13: 0000000000000000 R14: ffff88802a7a3c00 R15: 0000000000000000
[   23.884566][ T2487] FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
[   23.893785][ T2487] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   23.900586][ T2487] CR2: 00007f77ff6ed907 CR3: 000000001f0a4000 CR4: 00000000003506f0
[   23.908579][ T2487] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   23.916664][ T2487] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   23.924658][ T2487] Kernel panic - not syncing: Fatal exception
[   23.931104][ T2487] Kernel Offset: disabled
[   23.935520][ T2487] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1113195296=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at dac2aa43b4
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=dac2aa43b4dbdbffa2c5e24a736096a6d928f633 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240620-104534'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"dac2aa43b4dbdbffa2c5e24a736096a6d928f633\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15ee7dfa980000


Tested on:

commit:         50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12ee231e980000


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
       [not found] <20240627025257.1496287-1-lizhi.xu@windriver.com>
@ 2024-06-27  3:14 ` syzbot
  0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-06-27  3:14 UTC (permalink / raw)
  To: linux-kernel, lizhi.xu, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in wb_writeback

INFO: task kworker/u8:6:1105 blocked for more than 143 seconds.
      Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:6    state:D stack:22288 pid:1105  tgid:1105  ppid:2      flags:0x00004000
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5408 [inline]
 __schedule+0x1796/0x49d0 kernel/sched/core.c:6745
 __schedule_loop kernel/sched/core.c:6822 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6837
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6894
 rwsem_down_write_slowpath+0xeeb/0x13b0 kernel/locking/rwsem.c:1178
 __down_write_common+0x1af/0x200 kernel/locking/rwsem.c:1306
 wb_writeback+0x143/0xda0 fs/fs-writeback.c:2083
 wb_do_writeback fs/fs-writeback.c:2279 [inline]
 wb_workfn+0x410/0x1090 fs/fs-writeback.c:2319
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz-executor:5687 blocked for more than 143 seconds.
      Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:20288 pid:5687  tgid:5687  ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5408 [inline]
 __schedule+0x1796/0x49d0 kernel/sched/core.c:6745
 __schedule_loop kernel/sched/core.c:6822 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6837
 wb_wait_for_completion+0x166/0x290 fs/fs-writeback.c:216
 __writeback_inodes_sb_nr+0x2d2/0x380 fs/fs-writeback.c:2711
 sync_filesystem+0xa4/0x230 fs/sync.c:54
 generic_shutdown_super+0x72/0x2d0 fs/super.c:621
 kill_block_super+0x44/0x90 fs/super.c:1676
 deactivate_locked_super+0xc4/0x130 fs/super.c:473
 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
 task_work_run+0x24f/0x310 kernel/task_work.c:180
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6f9d87e257
RSP: 002b:00007fff1d6cb318 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6f9d87e257
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff1d6cb3d0
RBP: 00007fff1d6cb3d0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff1d6cc480
R13: 00007f6f9d8d96c6 R14: 000000000001846f R15: 0000000000000001
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
 #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
 #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614
3 locks held by kworker/u8:6/1105:
 #0: ffff88801aef9148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff88801aef9148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc90004117d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc90004117d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
 #2: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: wb_writeback+0x143/0xda0 fs/fs-writeback.c:2083
2 locks held by getty/4837:
 #0: ffff88802b0160a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2211
1 lock held by syz-executor/5687:
 #0: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88801cf800e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 30 Comm: khungtaskd Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
 watchdog+0xfde/0x1020 kernel/hung_task.c:379
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3962 Comm: kworker/u8:10 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:236 [inline]
RIP: 0010:__sanitizer_cov_trace_switch+0x9d/0x120 kernel/kcov.c:341
Code: 00 00 4d 85 d2 0f 84 8b 00 00 00 4c 8b 4c 24 20 65 4c 8b 1c 25 80 d4 03 00 31 d2 eb 08 48 ff c2 49 39 d2 74 71 4c 8b 74 d6 10 <65> 8b 05 c4 a9 6d 7e a9 00 01 ff 00 74 11 a9 00 01 00 00 74 de 41
RSP: 0018:ffffc9000c266798 EFLAGS: 00000212
RAX: 0000000000000000 RBX: 0000000000000016 RCX: ffff88802e735a00
RDX: 000000000000001b RSI: ffffffff8f8548d0 RDI: 0000000000000003
RBP: ffffc9000c266bb0 R08: 0000000000000001 R09: ffffffff8afbe03a
R10: 0000000000000028 R11: ffff88802e735a00 R12: ffff888021f2e02f
R13: dffffc0000000000 R14: 000000000000007f R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556005801600 CR3: 000000000e132000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 _ieee802_11_parse_elems_full+0x6da/0x49f0 net/mac80211/parse.c:215
 ieee802_11_parse_elems_full+0xde7/0x2870 net/mac80211/parse.c:902
 ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2332 [inline]
 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2339 [inline]
 ieee80211_inform_bss+0x15f/0x1080 net/mac80211/scan.c:79
 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
 cfg80211_inform_single_bss_data+0x1121/0x2360 net/wireless/scan.c:2293
 cfg80211_inform_bss_data+0x3dd/0x5a70 net/wireless/scan.c:3117
 cfg80211_inform_bss_frame_data+0x3bc/0x720 net/wireless/scan.c:3207
 ieee80211_bss_info_update+0x8a7/0xbc0 net/mac80211/scan.c:226
 ieee80211_rx_bss_info net/mac80211/ibss.c:1099 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1578 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1962/0x2d70 net/mac80211/ibss.c:1605
 ieee80211_iface_process_skb net/mac80211/iface.c:1603 [inline]
 ieee80211_iface_work+0x8a3/0xf10 net/mac80211/iface.c:1657
 cfg80211_wiphy_work+0x221/0x260 net/wireless/core.c:437
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


Tested on:

commit:         50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11f12b3e980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=148dfb01980000


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
  2024-06-25 15:36 syzbot
@ 2024-07-20  2:31 ` Edward Adam Davis
  2024-07-20  3:00   ` syzbot
  2024-08-04  7:32 ` Edward Adam Davis
  2024-08-05 11:46 ` Edward Adam Davis
  2 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-07-20  2:31 UTC (permalink / raw)
  To: syzbot+eda89a33c5856f66f823; +Cc: linux-kernel, syzkaller-bugs

with sb rwsem lock to order syncfs and wb worker

#syz test: upstream 50736169ecc8

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 92a5b8283528..660a1ac8912f 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2123,8 +2123,12 @@ static long wb_writeback(struct bdi_writeback *wb,
 			queue_io(wb, work, dirtied_before);
 			queued = true;
 		}
-		if (work->sb)
+		if (work->sb) {
+			printk("sb: %p, %s\n", work->sb, __func__);
+			down_write(&work->sb->s_umount);
 			progress = writeback_sb_inodes(work->sb, wb, work);
+			up_write(&work->sb->s_umount);
+		}
 		else
 			progress = __writeback_inodes_wb(wb, work);
 		trace_writeback_written(wb, work);
diff --git a/fs/sync.c b/fs/sync.c
index dc725914e1ed..111c3c29b139 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -51,6 +51,7 @@ int sync_filesystem(struct super_block *sb)
 	 * methods call sync_dirty_buffer() and thus effectively write one block
 	 * at a time.
 	 */
+	printk("sb: %p, %s\n", sb, __func__);
 	writeback_inodes_sb(sb, WB_REASON_SYNC);
 	if (sb->s_op->sync_fs) {
 		ret = sb->s_op->sync_fs(sb, 0);


^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
  2024-07-20  2:31 ` Edward Adam Davis
@ 2024-07-20  3:00   ` syzbot
  0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-07-20  3:00 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: sleeping function called from invalid context in wb_writeback

sb: ffff88802058c000, wb_writeback
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1578
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2837, name: kworker/u8:7
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
3 locks held by kworker/u8:7/2837:
 #0: ffff8880186ea948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff8880186ea948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc90009a67d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc90009a67d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
 #2: ffff888020b920d8 (&wb->list_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff888020b920d8 (&wb->list_lock){+.+.}-{2:2}, at: wb_writeback+0x29e/0xdb0 fs/fs-writeback.c:2106
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 2837 Comm: kworker/u8:7 Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 __might_resched+0x5d4/0x780 kernel/sched/core.c:10196
 down_write+0x19/0x50 kernel/locking/rwsem.c:1578
 wb_writeback+0x836/0xdb0 fs/fs-writeback.c:2128
 wb_do_writeback fs/fs-writeback.c:2278 [inline]
 wb_workfn+0x410/0x1090 fs/fs-writeback.c:2318
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

=============================
[ BUG: Invalid wait context ]
6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0 Tainted: G        W         
-----------------------------
kworker/u8:7/2837 is trying to lock:
ffff88802058c0e0 (&type->s_umount_key#52){+.+.}-{3:3}, at: wb_writeback+0x836/0xdb0 fs/fs-writeback.c:2128
other info that might help us debug this:
context-{4:4}
3 locks held by kworker/u8:7/2837:
 #0: ffff8880186ea948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff8880186ea948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc90009a67d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc90009a67d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
 #2: ffff888020b920d8 (&wb->list_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff888020b920d8 (&wb->list_lock){+.+.}-{2:2}, at: wb_writeback+0x29e/0xdb0 fs/fs-writeback.c:2106
stack backtrace:
CPU: 1 PID: 2837 Comm: kworker/u8:7 Tainted: G        W          6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4751 [inline]
 check_wait_context kernel/locking/lockdep.c:4821 [inline]
 __lock_acquire+0x1507/0x1fd0 kernel/locking/lockdep.c:5087
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
 down_write+0x3a/0x50 kernel/locking/rwsem.c:1579
 wb_writeback+0x836/0xdb0 fs/fs-writeback.c:2128
 wb_do_writeback fs/fs-writeback.c:2278 [inline]
 wb_workfn+0x410/0x1090 fs/fs-writeback.c:2318
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
BUG: scheduling while atomic: kworker/u8:7/2837/0x00000002
INFO: lockdep is turned off.
Modules linked in:
Preemption disabled at:
[<0000000000000000>] 0x0


Tested on:

commit:         50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1212f7a5980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1442b72d980000


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
  2024-06-25 15:36 syzbot
  2024-07-20  2:31 ` Edward Adam Davis
@ 2024-08-04  7:32 ` Edward Adam Davis
  2024-08-04  7:57   ` syzbot
  2024-08-05 11:46 ` Edward Adam Davis
  2 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-08-04  7:32 UTC (permalink / raw)
  To: syzbot+eda89a33c5856f66f823; +Cc: linux-kernel, syzkaller-bugs

with sb rwsem lock to order syncfs and wb worker

#syz test: upstream 50736169ecc8

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index b865a3fa52f3..172ca9e1eed5 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -1865,6 +1865,7 @@ static long writeback_sb_inodes(struct super_block *sb,
 	long total_wrote = 0;  /* count both pages and inodes */
 	unsigned long dirtied_before = jiffies;
 
+	printk("path1, sb: %p, %s\n", sb, __func__);
 	if (work->for_kupdate)
 		dirtied_before = jiffies -
 			msecs_to_jiffies(dirty_expire_interval * 10);
@@ -1993,6 +1994,7 @@ static long writeback_sb_inodes(struct super_block *sb,
 				break;
 		}
 	}
+	printk("path1,end sb: %p, total_wrote:%lu, %s\n", sb, total_wrote, __func__);
 	return total_wrote;
 }
 
@@ -2720,6 +2722,7 @@ void writeback_inodes_sb_nr(struct super_block *sb,
 			    unsigned long nr,
 			    enum wb_reason reason)
 {
+	printk("path2: nr: %lu, sb: %p, %s\n", nr, sb, __func__);
 	__writeback_inodes_sb_nr(sb, nr, reason, false);
 }
 EXPORT_SYMBOL(writeback_inodes_sb_nr);


^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
  2024-08-04  7:32 ` Edward Adam Davis
@ 2024-08-04  7:57   ` syzbot
  0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-08-04  7:57 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in lmLogSync

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 114 Comm: jfsCommit Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 1e 97 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 01 97 d3 fe 48 8b 3b e8 b9 c5 a6
RSP: 0018:ffffc90002cefc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 328fe0b8e03e5b00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002cefd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002cef9e8 R11: fffff5200059df6b R12: ffff88806a112800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807cb0ba38
FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055559488b938 CR3: 000000000e132000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 jfs_syncpt+0x7d/0xa0 fs/jfs/jfs_logmgr.c:1041
 txEnd+0x30f/0x560 fs/jfs/jfs_txnmgr.c:549
 txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
 jfs_lazycommit+0x634/0xb80 fs/jfs/jfs_txnmgr.c:2733
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 1e 97 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 01 97 d3 fe 48 8b 3b e8 b9 c5 a6
RSP: 0018:ffffc90002cefc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 328fe0b8e03e5b00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002cefd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002cef9e8 R11: fffff5200059df6b R12: ffff88806a112800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807cb0ba38
FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055559488b938 CR3: 000000002bf6a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)
   1:	fe 49 8d             	decb   -0x73(%rcx)
   4:	5f                   	pop    %rdi
   5:	f0 48 89 d8          	lock mov %rbx,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  12:	74 08                	je     0x1c
  14:	48 89 df             	mov    %rbx,%rdi
  17:	e8 1e 97 d3 fe       	call   0xfed3973a
  1c:	48 8b 1b             	mov    (%rbx),%rbx
  1f:	48 83 c3 30          	add    $0x30,%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 01 97 d3 fe       	call   0xfed3973a
  39:	48 8b 3b             	mov    (%rbx),%rdi
  3c:	e8                   	.byte 0xe8
  3d:	b9                   	.byte 0xb9
  3e:	c5                   	.byte 0xc5
  3f:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)


Tested on:

commit:         50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16ca70f3980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1688319d980000


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
  2024-06-25 15:36 syzbot
  2024-07-20  2:31 ` Edward Adam Davis
  2024-08-04  7:32 ` Edward Adam Davis
@ 2024-08-05 11:46 ` Edward Adam Davis
  2024-08-05 12:20   ` syzbot
  2 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-08-05 11:46 UTC (permalink / raw)
  To: syzbot+eda89a33c5856f66f823; +Cc: linux-kernel, syzkaller-bugs

with sb rwsem lock to order syncfs and wb worker

#syz test: upstream 50736169ecc8

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index b865a3fa52f3..682c5a237edc 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -985,6 +985,7 @@ static void bdi_split_work_to_wbs(struct backing_dev_info *bdi,
 	struct bdi_writeback *last_wb = NULL;
 	struct bdi_writeback *wb = list_entry(&bdi->wb_list,
 					      struct bdi_writeback, bdi_node);
+	bool no_queue = true;
 
 	might_sleep();
 restart:
@@ -1015,6 +1016,7 @@ static void bdi_split_work_to_wbs(struct backing_dev_info *bdi,
 			*work = *base_work;
 			work->nr_pages = nr_pages;
 			work->auto_free = 1;
+			no_queue = false;
 			wb_queue_work(wb, work);
 			continue;
 		}
@@ -1043,6 +1045,12 @@ static void bdi_split_work_to_wbs(struct backing_dev_info *bdi,
 		wb_wait_for_completion(&fallback_work_done);
 		goto restart;
 	}
+
+	if (no_queue) {
+		printk("no queue\n");
+		base_work->auto_free = 1;
+		finish_writeback_work(base_work);
+	}
 	rcu_read_unlock();
 
 	if (last_wb)


^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [syzbot] [jfs?] INFO: task hung in txBegin
  2024-08-05 11:46 ` Edward Adam Davis
@ 2024-08-05 12:20   ` syzbot
  0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-08-05 12:20 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in lmLogSync

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 112 Comm: jfsCommit Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 fe 96 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 e1 96 d3 fe 48 8b 3b e8 99 c5 a6
RSP: 0018:ffffc90002c8fc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: cec33d79cc59c000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002c8fd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002c8f9e8 R11: fffff52000591f6b R12: ffff88807720a800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807dc3f238
FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0017f8000 CR3: 000000002f11c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 jfs_syncpt+0x7d/0xa0 fs/jfs/jfs_logmgr.c:1041
 txEnd+0x30f/0x560 fs/jfs/jfs_txnmgr.c:549
 txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
 jfs_lazycommit+0x634/0xb80 fs/jfs/jfs_txnmgr.c:2733
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 fe 96 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 e1 96 d3 fe 48 8b 3b e8 99 c5 a6
RSP: 0018:ffffc90002c8fc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: cec33d79cc59c000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002c8fd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002c8f9e8 R11: fffff52000591f6b R12: ffff88807720a800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807dc3f238
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f43bc3ff000 CR3: 000000002f11c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)
   1:	fe 49 8d             	decb   -0x73(%rcx)
   4:	5f                   	pop    %rdi
   5:	f0 48 89 d8          	lock mov %rbx,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  12:	74 08                	je     0x1c
  14:	48 89 df             	mov    %rbx,%rdi
  17:	e8 fe 96 d3 fe       	call   0xfed3971a
  1c:	48 8b 1b             	mov    (%rbx),%rbx
  1f:	48 83 c3 30          	add    $0x30,%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 e1 96 d3 fe       	call   0xfed3971a
  39:	48 8b 3b             	mov    (%rbx),%rdi
  3c:	e8                   	.byte 0xe8
  3d:	99                   	cltd
  3e:	c5                   	.byte 0xc5
  3f:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)


Tested on:

commit:         50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1500d4d3980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13a018f3980000


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2024-08-05 12:20 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <20240627005133.770565-1-lizhi.xu@windriver.com>
2024-06-27  1:24 ` [syzbot] [jfs?] INFO: task hung in txBegin syzbot
     [not found] <20240627025257.1496287-1-lizhi.xu@windriver.com>
2024-06-27  3:14 ` syzbot
     [not found] <20240627015934.1159978-1-lizhi.xu@windriver.com>
2024-06-27  2:20 ` syzbot
2024-06-25 15:36 syzbot
2024-07-20  2:31 ` Edward Adam Davis
2024-07-20  3:00   ` syzbot
2024-08-04  7:32 ` Edward Adam Davis
2024-08-04  7:57   ` syzbot
2024-08-05 11:46 ` Edward Adam Davis
2024-08-05 12:20   ` syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox