Messages in this thread | ![/](/images/icornerl.gif) | | From | Marius Fleischer <> | Date | Tue, 21 May 2024 14:38:06 -0700 | Subject | INFO: task hung in ocfs2_get_sector |
| |
Hi,
We would like to report the following bug which has been found by our modified version of syzkaller.
====================================================== description: INFO: task hung in ocfs2_get_sector affected file: drivers/block/floppy.c kernel version: 5.15.159 kernel commit: a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 git tree: upstream kernel config: attached crash reproducer: attached ====================================================== Crash log: INFO: task syz-executor.4:92137 blocked for more than 143 seconds. Not tainted 5.15.159 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:27168 pid:92137 ppid: 6651 flags:0x00004006 Call Trace: <TASK> context_switch kernel/sched/core.c:5030 [inline] __schedule+0xb54/0x5560 kernel/sched/core.c:6376 schedule+0x113/0x240 kernel/sched/core.c:6459 io_schedule+0xba/0x130 kernel/sched/core.c:8484 bit_wait_io+0x12/0xd0 kernel/sched/wait_bit.c:209 __wait_on_bit+0x60/0x190 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0xd8/0x110 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:101 [inline] __wait_on_buffer+0x7c/0x90 fs/buffer.c:122 wait_on_buffer include/linux/buffer_head.h:390 [inline] ocfs2_get_sector+0x34d/0x540 fs/ocfs2/super.c:1772 ocfs2_sb_probe fs/ocfs2/super.c:748 [inline] ocfs2_fill_super+0x3d5/0x3cc0 fs/ocfs2/super.c:989 mount_bdev+0x34f/0x410 fs/super.c:1387 legacy_get_tree+0x105/0x220 fs/fs_context.c:611 vfs_get_tree+0x89/0x2f0 fs/super.c:1517 do_new_mount fs/namespace.c:3005 [inline] path_mount+0x6a5/0x2010 fs/namespace.c:3335 do_mount fs/namespace.c:3348 [inline] __do_sys_mount fs/namespace.c:3556 [inline] __se_sys_mount fs/namespace.c:3533 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3533 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fb030b75dad RSP: 002b:00007fb02f0c4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fb030cb3050 RCX: 00007fb030b75dad RDX: 0000000020000080 RSI: 0000000020000000 RDI: 00000000200000c0 RBP: 00007fb030bd74a6 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fb030cb3050 R15: 00007fb02f0a4000 </TASK>
Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8b9876c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x272 kernel/locking/lockdep.c:6452 2 locks held by systemd-journal/3015: 1 lock held by in:imklog/6431: #0: ffff888152c46870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xed/0x190 fs/file.c:1088 1 lock held by syz-executor.4/92137: #0: ffff8880792300e0 (&type->s_umount_key#105/1){+.+.}-{3:3}, at: alloc_super+0x233/0xb70 fs/super.c:229 2 locks held by syz-executor.4/92619: #0: ffff88801774f008 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: mount_bdev+0x90/0x410 fs/super.c:1354 #1: ffff8880792300e0 (&type->s_umount_key#115){+.+.}-{3:3}, at: grab_super+0x59/0x260 fs/super.c:389 1 lock held by syz-executor.4/92621: #0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460 1 lock held by syz-executor.4/92622: #0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460 1 lock held by syz-executor.4/93058: #0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460 1 lock held by syz-executor.4/93059: #0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460 1 lock held by syz-executor.4/93060: #0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460 1 lock held by syz-executor.4/93061: #0: ffff88801774f008 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: mount_bdev+0x90/0x410 fs/super.c:1354
=============================================
NMI backtrace for cpu 0 CPU: 0 PID: 30 Comm: khungtaskd Not tainted 5.15.159 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1ea/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc5f/0xf30 kernel/hung_task.c:295 kthread+0x3e5/0x4d0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300 </TASK> Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 34028 Comm: kworker/u4:6 Not tainted 5.15.159 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: bat_events batadv_nc_worker RIP: 0010:__lock_acquire+0x1ab/0x5340 kernel/locking/lockdep.c:4918 Code: 0f 84 e1 10 00 00 48 ba ab aa aa aa aa aa aa aa 48 2d 40 7e d9 8f 48 8d bd f0 0a 00 00 48 c1 f8 06 48 0f af c2 48 89 7c 24 28 <48> 89 44 24 10 8b 44 24 08 48 89 c6 48 8d 04 80 85 f6 4c 8d 24 c5 RSP: 0000:ffffc9000737fa38 EFLAGS: 00000803 RAX: 0000000000000015 RBX: 0000000000000000 RCX: 0000000000000000 RDX: aaaaaaaaaaaaaaab RSI: 0000000000000000 RDI: ffff88801a762f30 RBP: ffff88801a762440 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff90582768 R12: 0000000000000000 R13: ffffffff8b9876c0 R14: 0000000000000000 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff88823bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc544a1d4a8 CR3: 0000000147ec5000 CR4: 0000000000750ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <NMI> </NMI> <TASK> lock_acquire kernel/locking/lockdep.c:5623 [inline] lock_acquire+0x1ab/0x4e0 kernel/locking/lockdep.c:5588 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:739 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline] batadv_nc_worker+0x12d/0xfe0 net/batman-adv/network-coding.c:723 process_one_work+0x9bc/0x1550 kernel/workqueue.c:2310 worker_thread+0x65d/0x1130 kernel/workqueue.c:2457 kthread+0x3e5/0x4d0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300 </TASK> ======================================================
Wishing you a nice day!
Best, Marius [unhandled content-type:application/octet-stream]// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h> #include <endian.h> #include <errno.h> #include <fcntl.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/prctl.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <sys/wait.h> #include <time.h> #include <unistd.h>
static void sleep_ms(uint64_t ms) { usleep(ms * 1000); }
static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; }
static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; }
static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf) - 1); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } }
static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } }
static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); }
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } }
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void) { intptr_t res = 0; res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=*/1ul, /*proto=*/0, /*fds=*/0x20000340ul); if (res != -1) r[0] = *(uint32_t*)0x20000340; memcpy((void*)0x20000000, "/dev/nbd#\000", 10); res = -1; res = syz_open_dev(/*dev=*/0x20000000, /*id=*/0, /*flags=*/0x80402); if (res != -1) r[1] = res; syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xab00, /*arg=*/r[0]); memcpy((void*)0x200000c0, "/dev/nbd", 8); *(uint8_t*)0x200000c8 = 0x30; *(uint8_t*)0x200000c9 = 0; memcpy((void*)0x20000000, ".\000", 2); memcpy((void*)0x20000080, "ocfs2\000", 6); syscall(__NR_mount, /*src=*/0x200000c0ul, /*dst=*/0x20000000ul, /*type=*/0x20000080ul, /*flags=*/0ul, /*data=*/0ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); loop(); return 0; } [unhandled content-type:application/octet-stream] | ![\](/images/icornerr.gif) |