Messages in this thread | | | From | Dipanjan Das <> | Date | Wed, 27 Jul 2022 14:05:54 -0700 | Subject | INFO: task hung in gfs2_read_super |
| |
Hi,
We would like to report the following bug which has been found by our modified version of syzkaller.
====================================================== description: INFO: task hung in gfs2_read_super affected file: fs/gfs2/ops_fstype.c kernel version: 5.10.131 kernel commit: 8f95261a006489c828f1d909355669875649668b git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9 crash reproducer: attached ====================================================== Crash log: ====================================================== INFO: task syz-executor.5:11140 blocked for more than 143 seconds. Tainted: G OE 5.10.131+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.5 state:D stack:27224 pid:11140 ppid: 7772 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3792 [inline] __schedule+0x8ef/0x20c0 kernel/sched/core.c:4541 schedule+0xcf/0x270 kernel/sched/core.c:4619 io_schedule+0x17/0x70 kernel/sched/core.c:6292 wait_on_page_bit_common+0x333/0xf10 mm/filemap.c:1277 wait_on_page_locked include/linux/pagemap.h:674 [inline] gfs2_read_super+0xd28/0x1250 fs/gfs2/ops_fstype.c:266 init_names fs/gfs2/ops_fstype.c:371 [inline] gfs2_fill_super+0x14f2/0x2750 fs/gfs2/ops_fstype.c:1166 get_tree_bdev+0x421/0x740 fs/super.c:1344 gfs2_get_tree+0x4a/0x270 fs/gfs2/ops_fstype.c:1298 vfs_get_tree+0x89/0x2f0 fs/super.c:1549 do_new_mount fs/namespace.c:2899 [inline] path_mount+0x11c6/0x1b70 fs/namespace.c:3229 do_mount+0xf3/0x110 fs/namespace.c:3242 __do_sys_mount fs/namespace.c:3450 [inline] __se_sys_mount fs/namespace.c:3427 [inline] __x64_sys_mount+0x18f/0x230 fs/namespace.c:3427 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fdd892684ed RSP: 002b:00007fdd87218be8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fdd89386f60 RCX: 00007fdd892684ed RDX: 0000000020000180 RSI: 0000000020000140 RDI: 0000000020000040 RBP: 00007fdd892d42e1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc29abc18f R14: 00007fdd89386f60 R15: 00007fdd87218d80 INFO: task syz-executor.7:11142 blocked for more than 143 seconds. Tainted: G OE 5.10.131+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.7 state:D stack:26472 pid:11142 ppid: 7769 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3792 [inline] __schedule+0x8ef/0x20c0 kernel/sched/core.c:4541 schedule+0xcf/0x270 kernel/sched/core.c:4619 rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099 __down_read kernel/locking/rwsem.c:1341 [inline] down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506 iterate_supers+0xdb/0x290 fs/super.c:692 ksys_sync+0x86/0x150 fs/sync.c:114 __do_sys_sync+0xa/0x10 fs/sync.c:125 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fba021af4ed RSP: 002b:00007fba0015fbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 RAX: ffffffffffffffda RBX: 00007fba022cdf60 RCX: 00007fba021af4ed RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe2a11fc2f R14: 00007fba022cdf60 R15: 00007fba0015fd80 INFO: task syz-executor.7:11156 blocked for more than 143 seconds. Tainted: G OE 5.10.131+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.7 state:D stack:28616 pid:11156 ppid: 7769 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3792 [inline] __schedule+0x8ef/0x20c0 kernel/sched/core.c:4541 schedule+0xcf/0x270 kernel/sched/core.c:4619 rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099 __down_read kernel/locking/rwsem.c:1341 [inline] down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506 iterate_supers+0xdb/0x290 fs/super.c:692 ksys_sync+0x86/0x150 fs/sync.c:114 __do_sys_sync+0xa/0x10 fs/sync.c:125 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fba021af4ed RSP: 002b:00007fba0013ebe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 RAX: ffffffffffffffda RBX: 00007fba022ce040 RCX: 00007fba021af4ed RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe2a11fc2f R14: 00007fba022ce040 R15: 00007fba0013ed80 INFO: task syz-executor.7:11157 blocked for more than 143 seconds. Tainted: G OE 5.10.131+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.7 state:D stack:29384 pid:11157 ppid: 7769 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3792 [inline] __schedule+0x8ef/0x20c0 kernel/sched/core.c:4541 schedule+0xcf/0x270 kernel/sched/core.c:4619 rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099 __down_read kernel/locking/rwsem.c:1341 [inline] down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506 iterate_supers+0xdb/0x290 fs/super.c:692 ksys_sync+0x86/0x150 fs/sync.c:114 __do_sys_sync+0xa/0x10 fs/sync.c:125 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fba021af4ed RSP: 002b:00007fba0011dbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 RAX: ffffffffffffffda RBX: 00007fba022ce120 RCX: 00007fba021af4ed RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe2a11fc2f R14: 00007fba022ce120 R15: 00007fba0011dd80 INFO: task syz-executor.7:11158 blocked for more than 143 seconds. Tainted: G OE 5.10.131+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.7 state:D stack:29384 pid:11158 ppid: 7769 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3792 [inline] __schedule+0x8ef/0x20c0 kernel/sched/core.c:4541 schedule+0xcf/0x270 kernel/sched/core.c:4619 rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099 __down_read kernel/locking/rwsem.c:1341 [inline] down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506 iterate_supers+0xdb/0x290 fs/super.c:692 ksys_sync+0x86/0x150 fs/sync.c:114 __do_sys_sync+0xa/0x10 fs/sync.c:125 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fba021af4ed RSP: 002b:00007fba000fcbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 RAX: ffffffffffffffda RBX: 00007fba022ce200 RCX: 00007fba021af4ed RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe2a11fc2f R14: 00007fba022ce200 R15: 00007fba000fcd80 INFO: task syz-executor.7:11159 blocked for more than 143 seconds. Tainted: G OE 5.10.131+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.7 state:D stack:29384 pid:11159 ppid: 7769 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3792 [inline] __schedule+0x8ef/0x20c0 kernel/sched/core.c:4541 schedule+0xcf/0x270 kernel/sched/core.c:4619 rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099 __down_read kernel/locking/rwsem.c:1341 [inline] down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506 iterate_supers+0xdb/0x290 fs/super.c:692 ksys_sync+0x86/0x150 fs/sync.c:114 __do_sys_sync+0xa/0x10 fs/sync.c:125 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fba021af4ed RSP: 002b:00007fba000dbbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 RAX: ffffffffffffffda RBX: 00007fba022ce2e0 RCX: 00007fba021af4ed RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe2a11fc2f R14: 00007fba022ce2e0 R15: 00007fba000dbd80 INFO: task syz-executor.7:11160 blocked for more than 143 seconds. Tainted: G OE 5.10.131+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.7 state:D stack:29384 pid:11160 ppid: 7769 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3792 [inline] __schedule+0x8ef/0x20c0 kernel/sched/core.c:4541 schedule+0xcf/0x270 kernel/sched/core.c:4619 rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099 __down_read kernel/locking/rwsem.c:1341 [inline] down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506 iterate_supers+0xdb/0x290 fs/super.c:692 ksys_sync+0x86/0x150 fs/sync.c:114 __do_sys_sync+0xa/0x10 fs/sync.c:125 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fba021af4ed RSP: 002b:00007fba000babe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 RAX: ffffffffffffffda RBX: 00007fba022ce3c0 RCX: 00007fba021af4ed RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe2a11fc2f R14: 00007fba022ce3c0 R15: 00007fba000bad80
Showing all locks held in the system: 1 lock held by khungtaskd/1658: #0: ffffffff8b336d60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6389 1 lock held by in:imklog/7747: #0: ffff88810f7745f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:1003 1 lock held by syz-executor.5/11140: #0: ffff888111f9c0e0 (&type->s_umount_key#48/1){+.+.}-{3:3}, at: alloc_super+0x194/0xa40 fs/super.c:229 1 lock held by syz-executor.7/11142: #0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at: iterate_supers+0xdb/0x290 fs/super.c:692 1 lock held by syz-executor.7/11156: #0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at: iterate_supers+0xdb/0x290 fs/super.c:692 1 lock held by syz-executor.7/11157: #0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at: iterate_supers+0xdb/0x290 fs/super.c:692 1 lock held by syz-executor.7/11158: #0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at: iterate_supers+0xdb/0x290 fs/super.c:692 1 lock held by syz-executor.7/11159: #0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at: iterate_supers+0xdb/0x290 fs/super.c:692 1 lock held by syz-executor.7/11160: #0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at: iterate_supers+0xdb/0x290 fs/super.c:692
-- Thanks and Regards,
Dipanjan // autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h> #include <endian.h> #include <errno.h> #include <fcntl.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/prctl.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <sys/wait.h> #include <time.h> #include <unistd.h>
static void sleep_ms(uint64_t ms) { usleep(ms * 1000); }
static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; }
static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; }
static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf) - 1); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } }
static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } }
static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); }
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } }
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void) { intptr_t res = 0; memcpy((void*)0x200002c0, "/dev/nbd#\000", 10); res = -1; res = syz_open_dev(0x200002c0, 0, 0); if (res != -1) r[0] = res; res = syscall(__NR_socketpair, 0x1eul, 5ul, 0, 0x20001c80ul); if (res != -1) r[1] = *(uint32_t*)0x20001c80; syscall(__NR_ioctl, r[0], 0xab00, r[1]); memcpy((void*)0x20000000, "./file0\000", 8); syscall(__NR_mkdir, 0x20000000ul, 0ul); memcpy((void*)0x20000040, "/dev/nbd", 8); *(uint8_t*)0x20000048 = 0x30; *(uint8_t*)0x20000049 = 0; memcpy((void*)0x20000140, "./file0\000", 8); memcpy((void*)0x20000180, "gfs2\000", 5); syscall(__NR_mount, 0x20000040ul, 0x20000140ul, 0x20000180ul, 0ul, 0ul);
} int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); loop(); return 0; } [unhandled content-type:application/octet-stream] | |