INFO: task hung in ocfs2_get_sector

From: Marius Fleischer
Date: Tue May 21 2024 - 17:38:45 EST

Next message: Fan Wu: "Re: [PATCH v18 12/21] dm: add finalize hook to target_type"
Previous message: Mike Rapoport: "[PATCH] arm64: patching: fix handling of execmem addresses"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

We would like to report the following bug which has been found by our
modified version of syzkaller.

======================================================
description: INFO: task hung in ocfs2_get_sector
affected file: drivers/block/floppy.c
kernel version: 5.15.159
kernel commit: a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6
git tree: upstream
kernel config: attached
crash reproducer: attached
======================================================
Crash log:
INFO: task syz-executor.4:92137 blocked for more than 143 seconds.
Not tainted 5.15.159 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:27168 pid:92137 ppid: 6651 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5030 [inline]
__schedule+0xb54/0x5560 kernel/sched/core.c:6376
schedule+0x113/0x240 kernel/sched/core.c:6459
io_schedule+0xba/0x130 kernel/sched/core.c:8484
bit_wait_io+0x12/0xd0 kernel/sched/wait_bit.c:209
__wait_on_bit+0x60/0x190 kernel/sched/wait_bit.c:49
out_of_line_wait_on_bit+0xd8/0x110 kernel/sched/wait_bit.c:64
wait_on_bit_io include/linux/wait_bit.h:101 [inline]
__wait_on_buffer+0x7c/0x90 fs/buffer.c:122
wait_on_buffer include/linux/buffer_head.h:390 [inline]
ocfs2_get_sector+0x34d/0x540 fs/ocfs2/super.c:1772
ocfs2_sb_probe fs/ocfs2/super.c:748 [inline]
ocfs2_fill_super+0x3d5/0x3cc0 fs/ocfs2/super.c:989
mount_bdev+0x34f/0x410 fs/super.c:1387
legacy_get_tree+0x105/0x220 fs/fs_context.c:611
vfs_get_tree+0x89/0x2f0 fs/super.c:1517
do_new_mount fs/namespace.c:3005 [inline]
path_mount+0x6a5/0x2010 fs/namespace.c:3335
do_mount fs/namespace.c:3348 [inline]
__do_sys_mount fs/namespace.c:3556 [inline]
__se_sys_mount fs/namespace.c:3533 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3533
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fb030b75dad
RSP: 002b:00007fb02f0c4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb030cb3050 RCX: 00007fb030b75dad
RDX: 0000000020000080 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00007fb030bd74a6 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007fb030cb3050 R15: 00007fb02f0a4000
</TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8b9876c0 (rcu_read_lock){....}-{1:2}, at:
debug_show_all_locks+0x53/0x272 kernel/locking/lockdep.c:6452
2 locks held by systemd-journal/3015:
1 lock held by in:imklog/6431:
#0: ffff888152c46870 (&f->f_pos_lock){+.+.}-{3:3}, at:
__fdget_pos+0xed/0x190 fs/file.c:1088
1 lock held by syz-executor.4/92137:
#0: ffff8880792300e0 (&type->s_umount_key#105/1){+.+.}-{3:3}, at:
alloc_super+0x233/0xb70 fs/super.c:229
2 locks held by syz-executor.4/92619:
#0: ffff88801774f008 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at:
mount_bdev+0x90/0x410 fs/super.c:1354
#1: ffff8880792300e0 (&type->s_umount_key#115){+.+.}-{3:3}, at:
grab_super+0x59/0x260 fs/super.c:389
1 lock held by syz-executor.4/92621:
#0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at:
nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460
1 lock held by syz-executor.4/92622:
#0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at:
nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460
1 lock held by syz-executor.4/93058:
#0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at:
nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460
1 lock held by syz-executor.4/93059:
#0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at:
nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460
1 lock held by syz-executor.4/93060:
#0: ffff88801ab2e208 (&nbd->config_lock){+.+.}-{3:3}, at:
nbd_ioctl+0x151/0xba0 drivers/block/nbd.c:1460
1 lock held by syz-executor.4/93061:
#0: ffff88801774f008 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at:
mount_bdev+0x90/0x410 fs/super.c:1354

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 30 Comm: khungtaskd Not tainted 5.15.159 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1ea/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc5f/0xf30 kernel/hung_task.c:295
kthread+0x3e5/0x4d0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 34028 Comm: kworker/u4:6 Not tainted 5.15.159 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__lock_acquire+0x1ab/0x5340 kernel/locking/lockdep.c:4918
Code: 0f 84 e1 10 00 00 48 ba ab aa aa aa aa aa aa aa 48 2d 40 7e d9
8f 48 8d bd f0 0a 00 00 48 c1 f8 06 48 0f af c2 48 89 7c 24 28 <48> 89
44 24 10 8b 44 24 08 48 89 c6 48 8d 04 80 85 f6 4c 8d 24 c5
RSP: 0000:ffffc9000737fa38 EFLAGS: 00000803
RAX: 0000000000000015 RBX: 0000000000000000 RCX: 0000000000000000
RDX: aaaaaaaaaaaaaaab RSI: 0000000000000000 RDI: ffff88801a762f30
RBP: ffff88801a762440 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff90582768 R12: 0000000000000000
R13: ffffffff8b9876c0 R14: 0000000000000000 R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff88823bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc544a1d4a8 CR3: 0000000147ec5000 CR4: 0000000000750ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<NMI>
</NMI>
<TASK>
lock_acquire kernel/locking/lockdep.c:5623 [inline]
lock_acquire+0x1ab/0x4e0 kernel/locking/lockdep.c:5588
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:739 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline]
batadv_nc_worker+0x12d/0xfe0 net/batman-adv/network-coding.c:723
process_one_work+0x9bc/0x1550 kernel/workqueue.c:2310
worker_thread+0x65d/0x1130 kernel/workqueue.c:2457
kthread+0x3e5/0x4d0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300
</TASK>
======================================================

Wishing you a nice day!

Best,
Marius

Attachment: repro.syz
Description: Binary data

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
if (a0 == 0xc || a0 == 0xb) {
char buf[128];
sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
(uint8_t)a2);
return open(buf, O_RDWR, 0);
} else {
char buf[1024];
char* hash;
strncpy(buf, (char*)a0, sizeof(buf) - 1);
buf[sizeof(buf) - 1] = 0;
while ((hash = strchr(buf, '#'))) {
*hash = '0' + (char)(a1 % 10);
a1 /= 10;
}
return open(buf, a2, 0);
}
}

static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}

static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

void execute_one(void)
{
intptr_t res = 0;
res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=*/1ul, /*proto=*/0,
/*fds=*/0x20000340ul);
if (res != -1)
r[0] = *(uint32_t*)0x20000340;
memcpy((void*)0x20000000, "/dev/nbd#\000", 10);
res = -1;
res = syz_open_dev(/*dev=*/0x20000000, /*id=*/0, /*flags=*/0x80402);
if (res != -1)
r[1] = res;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xab00, /*arg=*/r[0]);
memcpy((void*)0x200000c0, "/dev/nbd", 8);
*(uint8_t*)0x200000c8 = 0x30;
*(uint8_t*)0x200000c9 = 0;
memcpy((void*)0x20000000, ".\000", 2);
memcpy((void*)0x20000080, "ocfs2\000", 6);
syscall(__NR_mount, /*src=*/0x200000c0ul, /*dst=*/0x20000000ul,
/*type=*/0x20000080ul, /*flags=*/0ul, /*data=*/0ul);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
loop();
return 0;
}

Attachment: config-5.15.159
Description: Binary data

Next message: Fan Wu: "Re: [PATCH v18 12/21] dm: add finalize hook to target_type"
Previous message: Mike Rapoport: "[PATCH] arm64: patching: fix handling of execmem addresses"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]