INFO: task hung in __block_write_begin_int

[Wei Chen]

Dear Linux Developer,

Recently when using our tool to fuzz kernel, the following crash was triggered:

HEAD commit: 64570fbc14f8 Linux 5.15-rc5
git tree: upstream
compiler: clang 12.0.0
console output:
https://drive.google.com/file/d/1dk3H5-D3ppxAONucKu_Vh7uXI2e94HyI/view?usp=sharing
Syzlang reproducer:
https://drive.google.com/file/d/1dcYG-en7_om3HWtUUMip3vooPxr38is2/view?usp=sharing
C reproducer: https://drive.google.com/file/d/15cJ2SBbvNIBJXFux85lmVFz5kbwNsY4w/view?usp=sharing
kernel config: https://drive.google.com/file/d/1lNwvovjLNrcuyFGrg05IoSmgO5jaKBBJ/view?usp=sharing

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: Wei Chen <harperchen1110@xxxxxxxxx>

INFO: task syz-executor:14691 blocked for more than 143 seconds.
      Not tainted 5.15.0-rc5+ #14
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25712 pid:14691 ppid:  6522 flags:0x00004004
Call Trace:
 __schedule+0xc1a/0x11e0
 schedule+0x14b/0x210
 io_schedule+0x83/0x100
 bit_wait_io+0xe/0xc0
 __wait_on_bit+0xbb/0x180
 out_of_line_wait_on_bit+0x1c3/0x240
 __block_write_begin_int+0x187e/0x1a10
 block_write_begin+0x54/0x2c0
 generic_perform_write+0x28c/0x5e0
 __generic_file_write_iter+0x26d/0x540
 blkdev_write_iter+0x3a2/0x560
 vfs_write+0x868/0xf50
 ksys_write+0x175/0x2b0
 do_syscall_64+0x3d/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f08ee707c4d
RSP: 002b:00007f08ebc6fc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f08ee82e0a0 RCX: 00007f08ee707c4d
RDX: 00000000000006a8 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f08ee780d80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f08ee82e0a0
R13: 00007ffc57334f2f R14: 00007ffc573350d0 R15: 00007f08ebc6fdc0

Showing all locks held in the system:
2 locks held by kworker/u2:1/10:
1 lock held by khungtaskd/21:
 #0: ffffffff8cf1c040 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
1 lock held by in:imklog/6329:
 #0: ffff888016c2dc70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x26c/0x310

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 21 Comm: khungtaskd Not tainted 5.15.0-rc5+ #14
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 dump_stack_lvl+0x1d8/0x2c4
 nmi_cpu_backtrace+0x452/0x480
 nmi_trigger_cpumask_backtrace+0x1a3/0x330
 watchdog+0xdbe/0xe30
 kthread+0x419/0x510
 ret_from_fork+0x1f/0x30

Best,
Wei