* [syzbot] INFO: task hung in io_uring_cancel_generic
@ 2021-07-11 12:24 syzbot
2021-07-11 13:54 ` Jens Axboe
0 siblings, 1 reply; 8+ messages in thread
From: syzbot @ 2021-07-11 12:24 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 3dbdb38e Merge branch 'for-5.14' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14cd9efbd00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
dashboard link: https://syzkaller.appspot.com/bug?extid=ba6fcd859210f4e9e109
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13bbf280300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1111ec9c300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
INFO: task syz-executor015:8439 blocked for more than 143 seconds.
Tainted: G W 5.13.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor015 state:D stack:28184 pid: 8439 ppid: 8438 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x934/0x2710 kernel/sched/core.c:5940
schedule+0xd3/0x270 kernel/sched/core.c:6019
io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9203
io_uring_files_cancel include/linux/io_uring.h:16 [inline]
do_exit+0x28b/0x2a50 kernel/exit.c:780
do_group_exit+0x125/0x310 kernel/exit.c:922
__do_sys_exit_group kernel/exit.c:933 [inline]
__se_sys_exit_group kernel/exit.c:931 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43eac9
RSP: 002b:00007ffc2d1b6378 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000004b02f0 RCX: 000000000043eac9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00000000f0ffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004b02f0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
INFO: lockdep is turned off.
NMI backtrace for cpu 0
CPU: 0 PID: 1650 Comm: khungtaskd Tainted: G W 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
watchdog+0xd4b/0xfb0 kernel/hung_task.c:294
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt drivers/acpi/processor_idle.c:109 [inline]
NMI backtrace for cpu 1 skipped: idling at acpi_idle_do_entry+0x1c6/0x250 drivers/acpi/processor_idle.c:553
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] INFO: task hung in io_uring_cancel_generic
2021-07-11 12:24 [syzbot] INFO: task hung in io_uring_cancel_generic syzbot
@ 2021-07-11 13:54 ` Jens Axboe
2021-07-11 14:39 ` syzbot
0 siblings, 1 reply; 8+ messages in thread
From: Jens Axboe @ 2021-07-11 13:54 UTC (permalink / raw)
To: syzbot, asml.silence, io-uring, linux-kernel, syzkaller-bugs
On 7/11/21 6:24 AM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3dbdb38e Merge branch 'for-5.14' of git://git.kernel.org/p..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14cd9efbd00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
> dashboard link: https://syzkaller.appspot.com/bug?extid=ba6fcd859210f4e9e109
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13bbf280300000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1111ec9c300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> INFO: task syz-executor015:8439 blocked for more than 143 seconds.
> Tainted: G W 5.13.0-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor015 state:D stack:28184 pid: 8439 ppid: 8438 flags:0x00000004
> Call Trace:
> context_switch kernel/sched/core.c:4683 [inline]
> __schedule+0x934/0x2710 kernel/sched/core.c:5940
> schedule+0xd3/0x270 kernel/sched/core.c:6019
> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9203
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x28b/0x2a50 kernel/exit.c:780
> do_group_exit+0x125/0x310 kernel/exit.c:922
> __do_sys_exit_group kernel/exit.c:933 [inline]
> __se_sys_exit_group kernel/exit.c:931 [inline]
> __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x43eac9
> RSP: 002b:00007ffc2d1b6378 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
> RAX: ffffffffffffffda RBX: 00000000004b02f0 RCX: 000000000043eac9
> RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
> RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00000000f0ffffff
> R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004b02f0
> R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
> INFO: lockdep is turned off.
> NMI backtrace for cpu 0
> CPU: 0 PID: 1650 Comm: khungtaskd Tainted: G W 5.13.0-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
> nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
> nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
> trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
> check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
> watchdog+0xd4b/0xfb0 kernel/hung_task.c:294
> kthread+0x3e5/0x4d0 kernel/kthread.c:319
> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
> Sending NMI from CPU 0 to CPUs 1:
> NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
> NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
> NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt drivers/acpi/processor_idle.c:109 [inline]
> NMI backtrace for cpu 1 skipped: idling at acpi_idle_do_entry+0x1c6/0x250 drivers/acpi/processor_idle.c:553
#syz test: git://git.kernel.dk/linux-block io_uring-5.14
--
Jens Axboe
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] INFO: task hung in io_uring_cancel_generic
2021-07-11 13:54 ` Jens Axboe
@ 2021-07-11 14:39 ` syzbot
2021-07-11 14:45 ` Jens Axboe
0 siblings, 1 reply; 8+ messages in thread
From: syzbot @ 2021-07-11 14:39 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
ace driver bcm203x
[ 9.302351][ T1] usbcore: registered new interface driver bpa10x
[ 9.303473][ T1] usbcore: registered new interface driver bfusb
[ 9.305628][ T1] usbcore: registered new interface driver btusb
[ 9.306881][ T1] usbcore: registered new interface driver ath3k
[ 9.308526][ T1] CAPI 2.0 started up with major 68 (middleware)
[ 9.309416][ T1] Modular ISDN core version 1.1.29
[ 9.310922][ T1] NET: Registered PF_ISDN protocol family
[ 9.312213][ T1] DSP module 2.0
[ 9.312966][ T1] mISDN_dsp: DSP clocks every 80 samples. This equals 1 jiffies.
[ 9.327662][ T1] mISDN: Layer-1-over-IP driver Rev. 2.00
[ 9.329185][ T1] 0 virtual devices registered
[ 9.330263][ T1] usbcore: registered new interface driver HFC-S_USB
[ 9.331803][ T1] VUB300 Driver rom wait states = 1C irqpoll timeout = 0400
[ 9.332793][ T1] usbcore: registered new interface driver vub300
[ 9.335457][ T1] usbcore: registered new interface driver ushc
[ 9.342005][ T1] iscsi: registered transport (iser)
[ 9.343604][ T1] SoftiWARP attached
[ 9.344289][ T1] Driver 'framebuffer' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 9.346043][ T1] Driver 'memconsole' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 9.347617][ T1] Driver 'vpd' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[ 9.357668][ T1] hid: raw HID events driver (C) Jiri Kosina
[ 9.385985][ T1] usbcore: registered new interface driver usbhid
[ 9.387037][ T1] usbhid: USB HID core driver
[ 9.390066][ T1] usbcore: registered new interface driver es2_ap_driver
[ 9.393006][ T1] comedi: version 0.7.76 - http://www.comedi.org
[ 9.394302][ T1] usbcore: registered new interface driver dt9812
[ 9.395545][ T1] usbcore: registered new interface driver ni6501
[ 9.396763][ T1] usbcore: registered new interface driver usbdux
[ 9.397991][ T1] usbcore: registered new interface driver usbduxfast
[ 9.399198][ T1] usbcore: registered new interface driver usbduxsigma
[ 9.402039][ T1] usbcore: registered new interface driver vmk80xx
[ 9.403629][ T1] usbcore: registered new interface driver prism2_usb
[ 9.405013][ T1] usbcore: registered new interface driver r8712u
[ 9.407131][ T1] ashmem: initialized
[ 9.408362][ T1] greybus: registered new driver hid
[ 9.409362][ T1] greybus: registered new driver gbphy
[ 9.410305][ T1] gb_gbphy: registered new driver usb
[ 9.411889][ T1] asus_wmi: ASUS WMI generic driver loaded
[ 9.486305][ T1] usbcore: registered new interface driver snd-usb-audio
[ 9.487650][ T1] usbcore: registered new interface driver snd-ua101
[ 9.488918][ T1] usbcore: registered new interface driver snd-usb-usx2y
[ 9.492672][ T1] usbcore: registered new interface driver snd-usb-us122l
[ 9.494778][ T1] usbcore: registered new interface driver snd-usb-caiaq
[ 9.496007][ T1] usbcore: registered new interface driver snd-usb-6fire
[ 9.497262][ T1] usbcore: registered new interface driver snd-usb-hiface
[ 9.498782][ T1] usbcore: registered new interface driver snd-bcd2000
[ 9.499887][ T1] usbcore: registered new interface driver snd_usb_pod
[ 9.501897][ T1] usbcore: registered new interface driver snd_usb_podhd
[ 9.503388][ T1] usbcore: registered new interface driver snd_usb_toneport
[ 9.505421][ T1] usbcore: registered new interface driver snd_usb_variax
[ 9.506582][ T1] drop_monitor: Initializing network drop monitor service
[ 9.508642][ T1] NET: Registered PF_LLC protocol family
[ 9.509528][ T1] GACT probability on
[ 9.510771][ T1] Mirror/redirect action on
[ 9.511554][ T1] Simple TC action Loaded
[ 9.514496][ T1] netem: version 1.3
[ 9.515461][ T1] u32 classifier
[ 9.515990][ T1] Performance counters on
[ 9.516615][ T1] input device check on
[ 9.517586][ T1] Actions configured
[ 9.519992][ T1] nf_conntrack_irc: failed to register helpers
[ 9.521431][ T1] nf_conntrack_sane: failed to register helpers
[ 9.558483][ T1] nf_conntrack_sip: failed to register helpers
[ 9.563419][ T1] xt_time: kernel timezone is -0000
[ 9.564476][ T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 9.565840][ T1] IPVS: Connection hash table configured (size=4096, memory=64Kbytes)
[ 9.567503][ T1] IPVS: ipvs loaded.
[ 9.568192][ T1] IPVS: [rr] scheduler registered.
[ 9.568956][ T1] IPVS: [wrr] scheduler registered.
[ 9.569738][ T1] IPVS: [lc] scheduler registered.
[ 9.570511][ T1] IPVS: [wlc] scheduler registered.
[ 9.571373][ T1] IPVS: [fo] scheduler registered.
[ 9.572445][ T1] IPVS: [ovf] scheduler registered.
[ 9.573312][ T1] IPVS: [lblc] scheduler registered.
[ 9.574091][ T1] IPVS: [lblcr] scheduler registered.
[ 9.575006][ T1] IPVS: [dh] scheduler registered.
[ 9.575796][ T1] IPVS: [sh] scheduler registered.
[ 9.576720][ T1] IPVS: [mh] scheduler registered.
[ 9.577462][ T1] IPVS: [sed] scheduler registered.
[ 9.578179][ T1] IPVS: [nq] scheduler registered.
[ 9.578924][ T1] IPVS: [twos] scheduler registered.
[ 9.580010][ T1] IPVS: [sip] pe registered.
[ 9.580916][ T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[ 9.583382][ T1] gre: GRE over IPv4 demultiplexor driver
[ 9.584183][ T1] ip_gre: GRE over IPv4 tunneling driver
[ 9.589932][ T1] IPv4 over IPsec tunneling driver
[ 9.593837][ T1] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
[ 9.594983][ T1] Initializing XFRM netlink socket
[ 9.596079][ T1] IPsec XFRM device driver
[ 9.598464][ T1] NET: Registered PF_INET6 protocol family
[ 9.608978][ T1] Segment Routing with IPv6
[ 9.609706][ T1] RPL Segment Routing with IPv6
[ 9.610809][ T1] mip6: Mobile IPv6
[ 9.615121][ T1] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 9.619694][ T1] ip6_gre: GRE over IPv6 tunneling driver
[ 9.622557][ T1] NET: Registered PF_PACKET protocol family
[ 9.623545][ T1] NET: Registered PF_KEY protocol family
[ 9.624882][ T1] Bridge firewalling registered
[ 9.626399][ T1] NET: Registered PF_X25 protocol family
[ 9.627654][ T1] X25: Linux Version 0.2
[ 9.658018][ T1] NET: Registered PF_NETROM protocol family
[ 9.690465][ T1] NET: Registered PF_ROSE protocol family
[ 9.691536][ T1] NET: Registered PF_AX25 protocol family
[ 9.692549][ T1] can: controller area network core
[ 9.693668][ T1] NET: Registered PF_CAN protocol family
[ 9.694924][ T1] can: raw protocol
[ 9.695672][ T1] can: broadcast manager protocol
[ 9.696412][ T1] can: netlink gateway - max_hops=1
[ 9.698003][ T1] can: SAE J1939
[ 9.698531][ T1] can: isotp protocol
[ 9.699817][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 9.702356][ T1] Bluetooth: RFCOMM socket layer initialized
[ 9.703679][ T1] Bluetooth: RFCOMM ver 1.11
[ 9.704852][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 9.705927][ T1] Bluetooth: BNEP filters: protocol multicast
[ 9.706958][ T1] Bluetooth: BNEP socket layer initialized
[ 9.707792][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[ 9.708751][ T1] Bluetooth: CMTP socket layer initialized
[ 9.709753][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 9.710823][ T1] Bluetooth: HIDP socket layer initialized
[ 9.714808][ T1] NET: Registered PF_RXRPC protocol family
[ 9.715884][ T1] Key type rxrpc registered
[ 9.716522][ T1] Key type rxrpc_s registered
[ 9.718643][ T1] NET: Registered PF_KCM protocol family
[ 9.720344][ T1] lec:lane_module_init: lec.c: initialized
[ 9.721491][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 9.722893][ T1] l2tp_core: L2TP core driver, V2.0
[ 9.723943][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 9.724919][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 9.726037][ T1] l2tp_netlink: L2TP netlink interface
[ 9.726945][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 9.728211][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 9.729626][ T1] NET: Registered PF_PHONET protocol family
[ 9.731015][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 9.740161][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 9.741707][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 9.744573][ T1] sctp: Hash tables configured (bind 32/56)
[ 9.747220][ T1] NET: Registered PF_RDS protocol family
[ 9.749148][ T1] Registered RDS/infiniband transport
[ 9.750956][ T1] Registered RDS/tcp transport
[ 9.751705][ T1] tipc: Activated (version 2.0.0)
[ 9.752972][ T1] NET: Registered PF_TIPC protocol family
[ 9.754278][ T1] tipc: Started in single node mode
[ 9.755659][ T1] NET: Registered PF_SMC protocol family
[ 9.756824][ T1] 9pnet: Installing 9P2000 support
[ 9.757958][ T1] NET: Registered PF_CAIF protocol family
[ 9.763274][ T1] NET: Registered PF_IEEE802154 protocol family
[ 9.764544][ T1] Key type dns_resolver registered
[ 9.765265][ T1] Key type ceph registered
[ 9.766634][ T1] libceph: loaded (mon/osd proto 15/24)
[ 9.769906][ T1] batman_adv: B.A.T.M.A.N. advanced 2021.2 (compatibility version 15) loaded
[ 9.771371][ T1] openvswitch: Open vSwitch switching datapath
[ 9.774437][ T1] NET: Registered PF_VSOCK protocol family
[ 9.775493][ T1] mpls_gso: MPLS GSO support
[ 9.785657][ T1] IPI shorthand broadcast: enabled
[ 9.786804][ T1] AVX2 version of gcm_enc/dec engaged.
[ 9.787910][ T1] AES CTR mode by8 optimization enabled
[ 9.794810][ T1] sched_clock: Marking stable (9773193399, 21522192)->(9795960439, -1244848)
[ 9.797259][ T1] registered taskstats version 1
[ 9.805286][ T1] Loading compiled-in X.509 certificates
[ 9.807833][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: f850c787ad998c396ae089c083b940ff0a9abb77'
[ 9.810756][ T1] zswap: loaded using pool lzo/zbud
[ 9.812477][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 9.814730][ T1] Key type ._fscrypt registered
[ 9.815701][ T1] Key type .fscrypt registered
[ 9.816492][ T1] Key type fscrypt-provisioning registered
[ 9.819908][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 9.821630][ T1] FS-Cache: Netfs 'afs' registered for caching
[ 9.829938][ T1] Btrfs loaded, crc32c=crc32c-intel, assert=on, zoned=yes
[ 9.832751][ T1] Key type big_key registered
[ 9.836164][ T1] Key type encrypted registered
[ 9.836954][ T1] AppArmor: AppArmor sha1 policy hashing enabled
[ 9.837875][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 9.838746][ T1] Loading compiled-in module X.509 certificates
[ 9.840036][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: f850c787ad998c396ae089c083b940ff0a9abb77'
[ 9.841866][ T1] ima: Allocated hash algorithm: sha256
[ 9.842970][ T1] ima: No architecture policies found
[ 9.844189][ T1] evm: Initialising EVM extended attributes:
[ 9.845100][ T1] evm: security.selinux (disabled)
[ 9.845782][ T1] evm: security.SMACK64 (disabled)
[ 9.846463][ T1] evm: security.SMACK64EXEC (disabled)
[ 9.847188][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 9.848128][ T1] evm: security.SMACK64MMAP (disabled)
[ 9.848898][ T1] evm: security.apparmor
[ 9.849482][ T1] evm: security.ima
[ 9.850284][ T1] evm: security.capability
[ 9.851141][ T1] evm: HMAC attrs: 0x1
[ 9.851611][ T855] floppy0: no floppy controllers found
[ 9.853250][ T855] work still pending
[ 9.854504][ T1] PM: Magic number: 13:793:535
[ 9.855444][ T1] usb usb35-port4: hash matches
[ 9.857025][ T1] bdi 1:13: hash matches
[ 9.859054][ T1] printk: console [netcon0] enabled
[ 9.859823][ T1] netconsole: network logging started
[ 9.860932][ T1] gtp: GTP module loaded (pdp ctx size 104 bytes)
[ 9.863283][ T1] rdma_rxe: loaded
[ 9.865260][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 9.868221][ T1] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 9.870545][ T7] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 9.871871][ T1] ALSA device list:
[ 9.872225][ T7] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 9.872637][ T1] #0: Dummy 1
[ 9.874348][ T1] #1: Loopback 1
[ 9.874960][ T1] #2: Virtual MIDI Card 1
[ 9.877845][ T1] md: Waiting for all devices to be available before autodetect
[ 9.879094][ T1] md: If you don't use raid, use raid=noautodetect
[ 9.880372][ T1] md: Autodetecting RAID arrays.
[ 9.881327][ T1] md: autorun ...
[ 9.881824][ T1] md: ... autorun DONE.
[ 9.885213][ T1] VFS: Cannot open root device "sda1" or unknown-block(0,0): error -6
[ 9.886783][ T1] Please append a correct "root=" boot option; here are the available partitions:
[ 9.888572][ T1] 0100 4096 ram0
[ 9.888583][ T1] (driver?)
[ 9.889669][ T1] 0101 4096 ram1
[ 9.889677][ T1] (driver?)
[ 9.890870][ T1] 0102 4096 ram2
[ 9.890884][ T1] (driver?)
[ 9.892018][ T1] 0103 4096 ram3
[ 9.892027][ T1] (driver?)
[ 9.893121][ T1] 0104 4096 ram4
[ 9.893129][ T1] (driver?)
[ 9.894283][ T1] 0105 4096 ram5
[ 9.894291][ T1] (driver?)
[ 9.895698][ T1] 0106 4096 ram6
[ 9.895706][ T1] (driver?)
[ 9.896758][ T1] 0107 4096 ram7
[ 9.896766][ T1] (driver?)
[ 9.898038][ T1] 0108 4096 ram8
[ 9.898046][ T1] (driver?)
[ 9.899196][ T1] 0109 4096 ram9
[ 9.899204][ T1] (driver?)
[ 9.901225][ T1] 010a 4096 ram10
[ 9.901235][ T1] (driver?)
[ 9.902295][ T1] 010b 4096 ram11
[ 9.902303][ T1] (driver?)
[ 9.903361][ T1] 010c 4096 ram12
[ 9.903369][ T1] (driver?)
[ 9.904433][ T1] 010d 4096 ram13
[ 9.904441][ T1] (driver?)
[ 9.905537][ T1] 010e 4096 ram14
[ 9.905545][ T1] (driver?)
[ 9.906605][ T1] 010f 4096 ram15
[ 9.906613][ T1] (driver?)
[ 9.907702][ T1] 1f00 128 mtdblock0
[ 9.907710][ T1] (driver?)
[ 9.909222][ T1] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 9.910524][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.13.0-syzkaller #0
[ 9.911577][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 9.913030][ T1] Call Trace:
[ 9.913582][ T1] dump_stack_lvl+0xcd/0x134
[ 9.914352][ T1] panic+0x306/0x73d
[ 9.914959][ T1] ? __warn_printk+0xf3/0xf3
[ 9.916524][ T1] mount_block_root+0x3f8/0x4dd
[ 9.917211][ T1] ? init_rootfs+0x59/0x59
[ 9.918287][ T1] ? memcpy+0x39/0x60
[ 9.919164][ T1] mount_root+0x1af/0x1f5
[ 9.919838][ T1] ? mount_block_root+0x4dd/0x4dd
[ 9.920611][ T1] ? memcpy+0x39/0x60
[ 9.921332][ T1] prepare_namespace+0x1ff/0x234
[ 9.922015][ T1] kernel_init_freeable+0x729/0x741
[ 9.922766][ T1] ? rest_init+0x3e0/0x3e0
[ 9.923398][ T1] kernel_init+0x1a/0x1d0
[ 9.924014][ T1] ? rest_init+0x3e0/0x3e0
[ 9.924684][ T1] ret_from_fork+0x1f/0x30
[ 9.931512][ T1] Kernel Offset: disabled
[ 9.932134][ T1] Rebooting in 86400 seconds..
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=115cd5e4300000
Tested on:
commit: 1b2d5f60 io_uring: use right task for exiting checks
git tree: git://git.kernel.dk/linux-block io_uring-5.14
kernel config: https://syzkaller.appspot.com/x/.config?x=c4b9715112a24a2b
dashboard link: https://syzkaller.appspot.com/bug?extid=ba6fcd859210f4e9e109
compiler:
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] INFO: task hung in io_uring_cancel_generic
2021-07-11 14:39 ` syzbot
@ 2021-07-11 14:45 ` Jens Axboe
2021-07-11 15:27 ` syzbot
0 siblings, 1 reply; 8+ messages in thread
From: Jens Axboe @ 2021-07-11 14:45 UTC (permalink / raw)
To: syzbot, asml.silence, io-uring, linux-kernel, syzkaller-bugs
On 7/11/21 8:39 AM, syzbot wrote:
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
Unrelated failure, let's try the patch on the old base instead:
#syz test: git://git.kernel.dk/linux-block io_uring-5.14-test
--
Jens Axboe
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] INFO: task hung in io_uring_cancel_generic
2021-07-11 14:45 ` Jens Axboe
@ 2021-07-11 15:27 ` syzbot
2021-07-11 20:20 ` Pavel Begunkov
0 siblings, 1 reply; 8+ messages in thread
From: syzbot @ 2021-07-11 15:27 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in io_uring_cancel_generic
INFO: task syz-executor.5:10156 blocked for more than 143 seconds.
Tainted: G W 5.13.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.5 state:D stack:27976 pid:10156 ppid: 8832 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x934/0x2710 kernel/sched/core.c:5940
schedule+0xd3/0x270 kernel/sched/core.c:6019
io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
io_uring_files_cancel include/linux/io_uring.h:16 [inline]
do_exit+0x28b/0x2a50 kernel/exit.c:780
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2150 kernel/signal.c:2796
arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
RSP: 002b:00007fc32f0d4218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000056bf88 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
R13: 00007ffee94563df R14: 00007fc32f0d4300 R15: 0000000000022000
INFO: task syz-executor.2:10228 blocked for more than 143 seconds.
Tainted: G W 5.13.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:29192 pid:10228 ppid: 8825 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x934/0x2710 kernel/sched/core.c:5940
schedule+0xd3/0x270 kernel/sched/core.c:6019
io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
io_uring_files_cancel include/linux/io_uring.h:16 [inline]
do_exit+0x28b/0x2a50 kernel/exit.c:780
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2150 kernel/signal.c:2796
arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
RSP: 002b:00007f48eed2e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
R13: 00007ffc352d975f R14: 00007f48eed2e300 R15: 0000000000022000
INFO: task syz-executor.3:10229 blocked for more than 143 seconds.
Tainted: G W 5.13.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:27976 pid:10229 ppid: 8828 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x934/0x2710 kernel/sched/core.c:5940
schedule+0xd3/0x270 kernel/sched/core.c:6019
io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
io_uring_files_cancel include/linux/io_uring.h:16 [inline]
do_exit+0x28b/0x2a50 kernel/exit.c:780
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2150 kernel/signal.c:2796
arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
RSP: 002b:00007fb1b5eac218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
R13: 00007ffdb651a9bf R14: 00007fb1b5eac300 R15: 0000000000022000
INFO: task syz-executor.0:10241 blocked for more than 144 seconds.
Tainted: G W 5.13.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0 state:D stack:27976 pid:10241 ppid: 8830 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x934/0x2710 kernel/sched/core.c:5940
schedule+0xd3/0x270 kernel/sched/core.c:6019
io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
io_uring_files_cancel include/linux/io_uring.h:16 [inline]
do_exit+0x28b/0x2a50 kernel/exit.c:780
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2150 kernel/signal.c:2796
arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
RSP: 002b:00007fa3ce68b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
R13: 00007ffcf35d4ebf R14: 00007fa3ce68b300 R15: 0000000000022000
INFO: task syz-executor.1:10247 blocked for more than 144 seconds.
Tainted: G W 5.13.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1 state:D stack:27976 pid:10247 ppid: 8831 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x934/0x2710 kernel/sched/core.c:5940
schedule+0xd3/0x270 kernel/sched/core.c:6019
io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
io_uring_files_cancel include/linux/io_uring.h:16 [inline]
do_exit+0x28b/0x2a50 kernel/exit.c:780
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2150 kernel/signal.c:2796
arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
RSP: 002b:00007f7c4a218218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
R13: 00007ffdaa7cc7af R14: 00007f7c4a218300 R15: 0000000000022000
INFO: task syz-executor.4:10271 blocked for more than 144 seconds.
Tainted: G W 5.13.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:27976 pid:10271 ppid: 8827 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4683 [inline]
__schedule+0x934/0x2710 kernel/sched/core.c:5940
schedule+0xd3/0x270 kernel/sched/core.c:6019
io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
io_uring_files_cancel include/linux/io_uring.h:16 [inline]
do_exit+0x28b/0x2a50 kernel/exit.c:780
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2150 kernel/signal.c:2796
arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
RSP: 002b:00007fcb3ff30218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
R13: 00007ffd6fb6745f R14: 00007fcb3ff30300 R15: 0000000000022000
INFO: lockdep is turned off.
NMI backtrace for cpu 1
CPU: 1 PID: 1635 Comm: khungtaskd Tainted: G W 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
watchdog+0xd4b/0xfb0 kernel/hung_task.c:294
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 8 Comm: kworker/0:2 Tainted: G W 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_power_efficient toggle_allocation_gate
RIP: 0010:__kasan_check_read+0x4/0x10 mm/kasan/shadow.c:31
Code: 24 07 48 85 db 0f 85 f6 0d 26 07 48 83 c4 60 5b 5d 41 5c 41 5d c3 c3 e9 f6 0e 26 07 cc cc cc cc cc cc cc cc cc cc 48 8b 0c 24 <89> f6 31 d2 e9 03 f9 ff ff 0f 1f 00 48 8b 0c 24 89 f6 ba 01 00 00
RSP: 0018:ffffc90000cd79a8 EFLAGS: 00000046
RAX: 0000000000000001 RBX: ffff888140158660 RCX: ffffffff81347c5f
RDX: ffffed102802b0cd RSI: 0000000000000008 RDI: ffffffff8baa4870
RBP: ffffffff8baa4460 R08: 0000000000000001 R09: ffff888140158667
R10: ffffed102802b0cc R11: 000000000000003f R12: ffff888140158000
R13: ffffffff8baa4870 R14: ffff888140158660 R15: ffffffff8baa4400
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f089e135020 CR3: 000000013fe38000 CR4: 0000000000350ef0
Call Trace:
instrument_atomic_read include/linux/instrumented.h:71 [inline]
atomic64_read include/asm-generic/atomic-instrumented.h:605 [inline]
switch_mm_irqs_off+0x1df/0x9b0 arch/x86/mm/tlb.c:556
unuse_temporary_mm arch/x86/kernel/alternative.c:763 [inline]
__text_poke+0x541/0x8c0 arch/x86/kernel/alternative.c:859
text_poke_bp_batch+0x3d7/0x560 arch/x86/kernel/alternative.c:1178
text_poke_flush arch/x86/kernel/alternative.c:1268 [inline]
text_poke_flush arch/x86/kernel/alternative.c:1265 [inline]
text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1275
arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:145
jump_label_update+0x1d5/0x430 kernel/jump_label.c:827
static_key_enable_cpuslocked+0x1b1/0x260 kernel/jump_label.c:177
static_key_enable+0x16/0x20 kernel/jump_label.c:190
toggle_allocation_gate mm/kfence/core.c:623 [inline]
toggle_allocation_gate+0x100/0x390 mm/kfence/core.c:615
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Tested on:
commit: dfa01077 io_uring: use right task for exiting checks
git tree: git://git.kernel.dk/linux-block io_uring-5.14-test
console output: https://syzkaller.appspot.com/x/log.txt?x=13b501e2300000
kernel config: https://syzkaller.appspot.com/x/.config?x=c650d78cfe48974c
dashboard link: https://syzkaller.appspot.com/bug?extid=ba6fcd859210f4e9e109
compiler:
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] INFO: task hung in io_uring_cancel_generic
2021-07-11 15:27 ` syzbot
@ 2021-07-11 20:20 ` Pavel Begunkov
2021-07-11 21:43 ` Pavel Begunkov
0 siblings, 1 reply; 8+ messages in thread
From: Pavel Begunkov @ 2021-07-11 20:20 UTC (permalink / raw)
To: syzbot, axboe, io-uring, linux-kernel, syzkaller-bugs
On 7/11/21 4:27 PM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in io_uring_cancel_generic
I think I see what it is. To not duplicate efforts...
>
> INFO: task syz-executor.5:10156 blocked for more than 143 seconds.
> Tainted: G W 5.13.0-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.5 state:D stack:27976 pid:10156 ppid: 8832 flags:0x00004004
> Call Trace:
> context_switch kernel/sched/core.c:4683 [inline]
> __schedule+0x934/0x2710 kernel/sched/core.c:5940
> schedule+0xd3/0x270 kernel/sched/core.c:6019
> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x28b/0x2a50 kernel/exit.c:780
> do_group_exit+0x125/0x310 kernel/exit.c:922
> get_signal+0x47f/0x2150 kernel/signal.c:2796
> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x4665d9
> RSP: 002b:00007fc32f0d4218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: fffffffffffffe00 RBX: 000000000056bf88 RCX: 00000000004665d9
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
> R13: 00007ffee94563df R14: 00007fc32f0d4300 R15: 0000000000022000
> INFO: task syz-executor.2:10228 blocked for more than 143 seconds.
> Tainted: G W 5.13.0-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.2 state:D stack:29192 pid:10228 ppid: 8825 flags:0x00004004
> Call Trace:
> context_switch kernel/sched/core.c:4683 [inline]
> __schedule+0x934/0x2710 kernel/sched/core.c:5940
> schedule+0xd3/0x270 kernel/sched/core.c:6019
> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x28b/0x2a50 kernel/exit.c:780
> do_group_exit+0x125/0x310 kernel/exit.c:922
> get_signal+0x47f/0x2150 kernel/signal.c:2796
> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x4665d9
> RSP: 002b:00007f48eed2e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
> R13: 00007ffc352d975f R14: 00007f48eed2e300 R15: 0000000000022000
> INFO: task syz-executor.3:10229 blocked for more than 143 seconds.
> Tainted: G W 5.13.0-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.3 state:D stack:27976 pid:10229 ppid: 8828 flags:0x00004004
> Call Trace:
> context_switch kernel/sched/core.c:4683 [inline]
> __schedule+0x934/0x2710 kernel/sched/core.c:5940
> schedule+0xd3/0x270 kernel/sched/core.c:6019
> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x28b/0x2a50 kernel/exit.c:780
> do_group_exit+0x125/0x310 kernel/exit.c:922
> get_signal+0x47f/0x2150 kernel/signal.c:2796
> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x4665d9
> RSP: 002b:00007fb1b5eac218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
> R13: 00007ffdb651a9bf R14: 00007fb1b5eac300 R15: 0000000000022000
> INFO: task syz-executor.0:10241 blocked for more than 144 seconds.
> Tainted: G W 5.13.0-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.0 state:D stack:27976 pid:10241 ppid: 8830 flags:0x00004004
> Call Trace:
> context_switch kernel/sched/core.c:4683 [inline]
> __schedule+0x934/0x2710 kernel/sched/core.c:5940
> schedule+0xd3/0x270 kernel/sched/core.c:6019
> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x28b/0x2a50 kernel/exit.c:780
> do_group_exit+0x125/0x310 kernel/exit.c:922
> get_signal+0x47f/0x2150 kernel/signal.c:2796
> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x4665d9
> RSP: 002b:00007fa3ce68b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
> R13: 00007ffcf35d4ebf R14: 00007fa3ce68b300 R15: 0000000000022000
> INFO: task syz-executor.1:10247 blocked for more than 144 seconds.
> Tainted: G W 5.13.0-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.1 state:D stack:27976 pid:10247 ppid: 8831 flags:0x00004004
> Call Trace:
> context_switch kernel/sched/core.c:4683 [inline]
> __schedule+0x934/0x2710 kernel/sched/core.c:5940
> schedule+0xd3/0x270 kernel/sched/core.c:6019
> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x28b/0x2a50 kernel/exit.c:780
> do_group_exit+0x125/0x310 kernel/exit.c:922
> get_signal+0x47f/0x2150 kernel/signal.c:2796
> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x4665d9
> RSP: 002b:00007f7c4a218218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
> R13: 00007ffdaa7cc7af R14: 00007f7c4a218300 R15: 0000000000022000
> INFO: task syz-executor.4:10271 blocked for more than 144 seconds.
> Tainted: G W 5.13.0-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.4 state:D stack:27976 pid:10271 ppid: 8827 flags:0x00004004
> Call Trace:
> context_switch kernel/sched/core.c:4683 [inline]
> __schedule+0x934/0x2710 kernel/sched/core.c:5940
> schedule+0xd3/0x270 kernel/sched/core.c:6019
> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x28b/0x2a50 kernel/exit.c:780
> do_group_exit+0x125/0x310 kernel/exit.c:922
> get_signal+0x47f/0x2150 kernel/signal.c:2796
> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x4665d9
> RSP: 002b:00007fcb3ff30218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
> R13: 00007ffd6fb6745f R14: 00007fcb3ff30300 R15: 0000000000022000
> INFO: lockdep is turned off.
> NMI backtrace for cpu 1
> CPU: 1 PID: 1635 Comm: khungtaskd Tainted: G W 5.13.0-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
> nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
> nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
> trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
> check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
> watchdog+0xd4b/0xfb0 kernel/hung_task.c:294
> kthread+0x3e5/0x4d0 kernel/kthread.c:319
> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
> Sending NMI from CPU 1 to CPUs 0:
> NMI backtrace for cpu 0
> CPU: 0 PID: 8 Comm: kworker/0:2 Tainted: G W 5.13.0-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Workqueue: events_power_efficient toggle_allocation_gate
> RIP: 0010:__kasan_check_read+0x4/0x10 mm/kasan/shadow.c:31
> Code: 24 07 48 85 db 0f 85 f6 0d 26 07 48 83 c4 60 5b 5d 41 5c 41 5d c3 c3 e9 f6 0e 26 07 cc cc cc cc cc cc cc cc cc cc 48 8b 0c 24 <89> f6 31 d2 e9 03 f9 ff ff 0f 1f 00 48 8b 0c 24 89 f6 ba 01 00 00
> RSP: 0018:ffffc90000cd79a8 EFLAGS: 00000046
> RAX: 0000000000000001 RBX: ffff888140158660 RCX: ffffffff81347c5f
> RDX: ffffed102802b0cd RSI: 0000000000000008 RDI: ffffffff8baa4870
> RBP: ffffffff8baa4460 R08: 0000000000000001 R09: ffff888140158667
> R10: ffffed102802b0cc R11: 000000000000003f R12: ffff888140158000
> R13: ffffffff8baa4870 R14: ffff888140158660 R15: ffffffff8baa4400
> FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f089e135020 CR3: 000000013fe38000 CR4: 0000000000350ef0
> Call Trace:
> instrument_atomic_read include/linux/instrumented.h:71 [inline]
> atomic64_read include/asm-generic/atomic-instrumented.h:605 [inline]
> switch_mm_irqs_off+0x1df/0x9b0 arch/x86/mm/tlb.c:556
> unuse_temporary_mm arch/x86/kernel/alternative.c:763 [inline]
> __text_poke+0x541/0x8c0 arch/x86/kernel/alternative.c:859
> text_poke_bp_batch+0x3d7/0x560 arch/x86/kernel/alternative.c:1178
> text_poke_flush arch/x86/kernel/alternative.c:1268 [inline]
> text_poke_flush arch/x86/kernel/alternative.c:1265 [inline]
> text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1275
> arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:145
> jump_label_update+0x1d5/0x430 kernel/jump_label.c:827
> static_key_enable_cpuslocked+0x1b1/0x260 kernel/jump_label.c:177
> static_key_enable+0x16/0x20 kernel/jump_label.c:190
> toggle_allocation_gate mm/kfence/core.c:623 [inline]
> toggle_allocation_gate+0x100/0x390 mm/kfence/core.c:615
> process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
> worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
> kthread+0x3e5/0x4d0 kernel/kthread.c:319
> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
>
>
> Tested on:
>
> commit: dfa01077 io_uring: use right task for exiting checks
> git tree: git://git.kernel.dk/linux-block io_uring-5.14-test
> console output: https://syzkaller.appspot.com/x/log.txt?x=13b501e2300000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c650d78cfe48974c
> dashboard link: https://syzkaller.appspot.com/bug?extid=ba6fcd859210f4e9e109
> compiler:
>
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] INFO: task hung in io_uring_cancel_generic
2021-07-11 20:20 ` Pavel Begunkov
@ 2021-07-11 21:43 ` Pavel Begunkov
2021-07-11 22:05 ` syzbot
0 siblings, 1 reply; 8+ messages in thread
From: Pavel Begunkov @ 2021-07-11 21:43 UTC (permalink / raw)
To: syzbot, axboe, io-uring, linux-kernel, syzkaller-bugs
On 7/11/21 9:20 PM, Pavel Begunkov wrote:
> On 7/11/21 4:27 PM, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> INFO: task hung in io_uring_cancel_generic
>
> I think I see what it is. To not duplicate efforts...
#syz test: https://github.com/isilence/linux.git drain_fix_syztest
>>
>> INFO: task syz-executor.5:10156 blocked for more than 143 seconds.
>> Tainted: G W 5.13.0-syzkaller #0
>> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> task:syz-executor.5 state:D stack:27976 pid:10156 ppid: 8832 flags:0x00004004
>> Call Trace:
>> context_switch kernel/sched/core.c:4683 [inline]
>> __schedule+0x934/0x2710 kernel/sched/core.c:5940
>> schedule+0xd3/0x270 kernel/sched/core.c:6019
>> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
>> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
>> do_exit+0x28b/0x2a50 kernel/exit.c:780
>> do_group_exit+0x125/0x310 kernel/exit.c:922
>> get_signal+0x47f/0x2150 kernel/signal.c:2796
>> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
>> handle_signal_work kernel/entry/common.c:148 [inline]
>> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
>> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
>> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
>> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
>> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> RIP: 0033:0x4665d9
>> RSP: 002b:00007fc32f0d4218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: fffffffffffffe00 RBX: 000000000056bf88 RCX: 00000000004665d9
>> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
>> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
>> R13: 00007ffee94563df R14: 00007fc32f0d4300 R15: 0000000000022000
>> INFO: task syz-executor.2:10228 blocked for more than 143 seconds.
>> Tainted: G W 5.13.0-syzkaller #0
>> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> task:syz-executor.2 state:D stack:29192 pid:10228 ppid: 8825 flags:0x00004004
>> Call Trace:
>> context_switch kernel/sched/core.c:4683 [inline]
>> __schedule+0x934/0x2710 kernel/sched/core.c:5940
>> schedule+0xd3/0x270 kernel/sched/core.c:6019
>> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
>> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
>> do_exit+0x28b/0x2a50 kernel/exit.c:780
>> do_group_exit+0x125/0x310 kernel/exit.c:922
>> get_signal+0x47f/0x2150 kernel/signal.c:2796
>> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
>> handle_signal_work kernel/entry/common.c:148 [inline]
>> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
>> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
>> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
>> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
>> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> RIP: 0033:0x4665d9
>> RSP: 002b:00007f48eed2e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
>> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
>> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
>> R13: 00007ffc352d975f R14: 00007f48eed2e300 R15: 0000000000022000
>> INFO: task syz-executor.3:10229 blocked for more than 143 seconds.
>> Tainted: G W 5.13.0-syzkaller #0
>> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> task:syz-executor.3 state:D stack:27976 pid:10229 ppid: 8828 flags:0x00004004
>> Call Trace:
>> context_switch kernel/sched/core.c:4683 [inline]
>> __schedule+0x934/0x2710 kernel/sched/core.c:5940
>> schedule+0xd3/0x270 kernel/sched/core.c:6019
>> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
>> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
>> do_exit+0x28b/0x2a50 kernel/exit.c:780
>> do_group_exit+0x125/0x310 kernel/exit.c:922
>> get_signal+0x47f/0x2150 kernel/signal.c:2796
>> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
>> handle_signal_work kernel/entry/common.c:148 [inline]
>> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
>> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
>> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
>> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
>> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> RIP: 0033:0x4665d9
>> RSP: 002b:00007fb1b5eac218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
>> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
>> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
>> R13: 00007ffdb651a9bf R14: 00007fb1b5eac300 R15: 0000000000022000
>> INFO: task syz-executor.0:10241 blocked for more than 144 seconds.
>> Tainted: G W 5.13.0-syzkaller #0
>> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> task:syz-executor.0 state:D stack:27976 pid:10241 ppid: 8830 flags:0x00004004
>> Call Trace:
>> context_switch kernel/sched/core.c:4683 [inline]
>> __schedule+0x934/0x2710 kernel/sched/core.c:5940
>> schedule+0xd3/0x270 kernel/sched/core.c:6019
>> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
>> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
>> do_exit+0x28b/0x2a50 kernel/exit.c:780
>> do_group_exit+0x125/0x310 kernel/exit.c:922
>> get_signal+0x47f/0x2150 kernel/signal.c:2796
>> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
>> handle_signal_work kernel/entry/common.c:148 [inline]
>> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
>> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
>> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
>> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
>> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> RIP: 0033:0x4665d9
>> RSP: 002b:00007fa3ce68b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
>> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
>> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
>> R13: 00007ffcf35d4ebf R14: 00007fa3ce68b300 R15: 0000000000022000
>> INFO: task syz-executor.1:10247 blocked for more than 144 seconds.
>> Tainted: G W 5.13.0-syzkaller #0
>> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> task:syz-executor.1 state:D stack:27976 pid:10247 ppid: 8831 flags:0x00004004
>> Call Trace:
>> context_switch kernel/sched/core.c:4683 [inline]
>> __schedule+0x934/0x2710 kernel/sched/core.c:5940
>> schedule+0xd3/0x270 kernel/sched/core.c:6019
>> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
>> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
>> do_exit+0x28b/0x2a50 kernel/exit.c:780
>> do_group_exit+0x125/0x310 kernel/exit.c:922
>> get_signal+0x47f/0x2150 kernel/signal.c:2796
>> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
>> handle_signal_work kernel/entry/common.c:148 [inline]
>> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
>> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
>> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
>> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
>> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> RIP: 0033:0x4665d9
>> RSP: 002b:00007f7c4a218218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
>> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
>> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
>> R13: 00007ffdaa7cc7af R14: 00007f7c4a218300 R15: 0000000000022000
>> INFO: task syz-executor.4:10271 blocked for more than 144 seconds.
>> Tainted: G W 5.13.0-syzkaller #0
>> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> task:syz-executor.4 state:D stack:27976 pid:10271 ppid: 8827 flags:0x00004004
>> Call Trace:
>> context_switch kernel/sched/core.c:4683 [inline]
>> __schedule+0x934/0x2710 kernel/sched/core.c:5940
>> schedule+0xd3/0x270 kernel/sched/core.c:6019
>> io_uring_cancel_generic+0x54d/0x890 fs/io_uring.c:9148
>> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
>> do_exit+0x28b/0x2a50 kernel/exit.c:780
>> do_group_exit+0x125/0x310 kernel/exit.c:922
>> get_signal+0x47f/0x2150 kernel/signal.c:2796
>> arch_do_signal_or_restart+0x2a9/0x1eb0 arch/x86/kernel/signal.c:789
>> handle_signal_work kernel/entry/common.c:148 [inline]
>> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
>> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
>> __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
>> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
>> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> RIP: 0033:0x4665d9
>> RSP: 002b:00007fcb3ff30218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: 0000000000000000 RBX: 000000000056bf88 RCX: 00000000004665d9
>> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
>> RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
>> R13: 00007ffd6fb6745f R14: 00007fcb3ff30300 R15: 0000000000022000
>> INFO: lockdep is turned off.
>> NMI backtrace for cpu 1
>> CPU: 1 PID: 1635 Comm: khungtaskd Tainted: G W 5.13.0-syzkaller #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>> Call Trace:
>> __dump_stack lib/dump_stack.c:79 [inline]
>> dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
>> nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
>> nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
>> trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
>> check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
>> watchdog+0xd4b/0xfb0 kernel/hung_task.c:294
>> kthread+0x3e5/0x4d0 kernel/kthread.c:319
>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
>> Sending NMI from CPU 1 to CPUs 0:
>> NMI backtrace for cpu 0
>> CPU: 0 PID: 8 Comm: kworker/0:2 Tainted: G W 5.13.0-syzkaller #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>> Workqueue: events_power_efficient toggle_allocation_gate
>> RIP: 0010:__kasan_check_read+0x4/0x10 mm/kasan/shadow.c:31
>> Code: 24 07 48 85 db 0f 85 f6 0d 26 07 48 83 c4 60 5b 5d 41 5c 41 5d c3 c3 e9 f6 0e 26 07 cc cc cc cc cc cc cc cc cc cc 48 8b 0c 24 <89> f6 31 d2 e9 03 f9 ff ff 0f 1f 00 48 8b 0c 24 89 f6 ba 01 00 00
>> RSP: 0018:ffffc90000cd79a8 EFLAGS: 00000046
>> RAX: 0000000000000001 RBX: ffff888140158660 RCX: ffffffff81347c5f
>> RDX: ffffed102802b0cd RSI: 0000000000000008 RDI: ffffffff8baa4870
>> RBP: ffffffff8baa4460 R08: 0000000000000001 R09: ffff888140158667
>> R10: ffffed102802b0cc R11: 000000000000003f R12: ffff888140158000
>> R13: ffffffff8baa4870 R14: ffff888140158660 R15: ffffffff8baa4400
>> FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00007f089e135020 CR3: 000000013fe38000 CR4: 0000000000350ef0
>> Call Trace:
>> instrument_atomic_read include/linux/instrumented.h:71 [inline]
>> atomic64_read include/asm-generic/atomic-instrumented.h:605 [inline]
>> switch_mm_irqs_off+0x1df/0x9b0 arch/x86/mm/tlb.c:556
>> unuse_temporary_mm arch/x86/kernel/alternative.c:763 [inline]
>> __text_poke+0x541/0x8c0 arch/x86/kernel/alternative.c:859
>> text_poke_bp_batch+0x3d7/0x560 arch/x86/kernel/alternative.c:1178
>> text_poke_flush arch/x86/kernel/alternative.c:1268 [inline]
>> text_poke_flush arch/x86/kernel/alternative.c:1265 [inline]
>> text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1275
>> arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:145
>> jump_label_update+0x1d5/0x430 kernel/jump_label.c:827
>> static_key_enable_cpuslocked+0x1b1/0x260 kernel/jump_label.c:177
>> static_key_enable+0x16/0x20 kernel/jump_label.c:190
>> toggle_allocation_gate mm/kfence/core.c:623 [inline]
>> toggle_allocation_gate+0x100/0x390 mm/kfence/core.c:615
>> process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
>> worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
>> kthread+0x3e5/0x4d0 kernel/kthread.c:319
>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
>>
>>
>> Tested on:
>>
>> commit: dfa01077 io_uring: use right task for exiting checks
>> git tree: git://git.kernel.dk/linux-block io_uring-5.14-test
>> console output: https://syzkaller.appspot.com/x/log.txt?x=13b501e2300000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=c650d78cfe48974c
>> dashboard link: https://syzkaller.appspot.com/bug?extid=ba6fcd859210f4e9e109
>> compiler:
>>
>
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] INFO: task hung in io_uring_cancel_generic
2021-07-11 21:43 ` Pavel Begunkov
@ 2021-07-11 22:05 ` syzbot
0 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2021-07-11 22:05 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: [email protected]
Tested on:
commit: 66af6ccf io_uring: fix io_drain_req()
git tree: https://github.com/isilence/linux.git drain_fix_syztest
kernel config: https://syzkaller.appspot.com/x/.config?x=c650d78cfe48974c
dashboard link: https://syzkaller.appspot.com/bug?extid=ba6fcd859210f4e9e109
compiler:
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-07-11 22:05 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-07-11 12:24 [syzbot] INFO: task hung in io_uring_cancel_generic syzbot
2021-07-11 13:54 ` Jens Axboe
2021-07-11 14:39 ` syzbot
2021-07-11 14:45 ` Jens Axboe
2021-07-11 15:27 ` syzbot
2021-07-11 20:20 ` Pavel Begunkov
2021-07-11 21:43 ` Pavel Begunkov
2021-07-11 22:05 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox