| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 27 Jul 2022 14:05:54 -0700
From: Dipanjan Das <mail.dipanjan.das@...il.com>
To: rpeterso@...hat.com, agruenba@...hat.com, cluster-devel@...hat.com,
linux-kernel@...r.kernel.org
Cc: syzkaller@...glegroups.com, fleischermarius@...glemail.com,
its.priyanka.bose@...il.com
Subject: INFO: task hung in gfs2_read_super
Hi,
We would like to report the following bug which has been found by our
modified version of syzkaller.
======================================================
description: INFO: task hung in gfs2_read_super
affected file: fs/gfs2/ops_fstype.c
kernel version: 5.10.131
kernel commit: 8f95261a006489c828f1d909355669875649668b
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
crash reproducer: attached
======================================================
Crash log:
======================================================
INFO: task syz-executor.5:11140 blocked for more than 143 seconds.
Tainted: G OE 5.10.131+ #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.5 state:D stack:27224 pid:11140 ppid: 7772 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:3792 [inline]
__schedule+0x8ef/0x20c0 kernel/sched/core.c:4541
schedule+0xcf/0x270 kernel/sched/core.c:4619
io_schedule+0x17/0x70 kernel/sched/core.c:6292
wait_on_page_bit_common+0x333/0xf10 mm/filemap.c:1277
wait_on_page_locked include/linux/pagemap.h:674 [inline]
gfs2_read_super+0xd28/0x1250 fs/gfs2/ops_fstype.c:266
init_names fs/gfs2/ops_fstype.c:371 [inline]
gfs2_fill_super+0x14f2/0x2750 fs/gfs2/ops_fstype.c:1166
get_tree_bdev+0x421/0x740 fs/super.c:1344
gfs2_get_tree+0x4a/0x270 fs/gfs2/ops_fstype.c:1298
vfs_get_tree+0x89/0x2f0 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x11c6/0x1b70 fs/namespace.c:3229
do_mount+0xf3/0x110 fs/namespace.c:3242
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount fs/namespace.c:3427 [inline]
__x64_sys_mount+0x18f/0x230 fs/namespace.c:3427
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fdd892684ed
RSP: 002b:00007fdd87218be8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fdd89386f60 RCX: 00007fdd892684ed
RDX: 0000000020000180 RSI: 0000000020000140 RDI: 0000000020000040
RBP: 00007fdd892d42e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc29abc18f R14: 00007fdd89386f60 R15: 00007fdd87218d80
INFO: task syz-executor.7:11142 blocked for more than 143 seconds.
Tainted: G OE 5.10.131+ #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.7 state:D stack:26472 pid:11142 ppid: 7769 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:3792 [inline]
__schedule+0x8ef/0x20c0 kernel/sched/core.c:4541
schedule+0xcf/0x270 kernel/sched/core.c:4619
rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506
iterate_supers+0xdb/0x290 fs/super.c:692
ksys_sync+0x86/0x150 fs/sync.c:114
__do_sys_sync+0xa/0x10 fs/sync.c:125
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fba021af4ed
RSP: 002b:00007fba0015fbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fba022cdf60 RCX: 00007fba021af4ed
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2a11fc2f R14: 00007fba022cdf60 R15: 00007fba0015fd80
INFO: task syz-executor.7:11156 blocked for more than 143 seconds.
Tainted: G OE 5.10.131+ #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.7 state:D stack:28616 pid:11156 ppid: 7769 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:3792 [inline]
__schedule+0x8ef/0x20c0 kernel/sched/core.c:4541
schedule+0xcf/0x270 kernel/sched/core.c:4619
rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506
iterate_supers+0xdb/0x290 fs/super.c:692
ksys_sync+0x86/0x150 fs/sync.c:114
__do_sys_sync+0xa/0x10 fs/sync.c:125
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fba021af4ed
RSP: 002b:00007fba0013ebe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fba022ce040 RCX: 00007fba021af4ed
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2a11fc2f R14: 00007fba022ce040 R15: 00007fba0013ed80
INFO: task syz-executor.7:11157 blocked for more than 143 seconds.
Tainted: G OE 5.10.131+ #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.7 state:D stack:29384 pid:11157 ppid: 7769 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:3792 [inline]
__schedule+0x8ef/0x20c0 kernel/sched/core.c:4541
schedule+0xcf/0x270 kernel/sched/core.c:4619
rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506
iterate_supers+0xdb/0x290 fs/super.c:692
ksys_sync+0x86/0x150 fs/sync.c:114
__do_sys_sync+0xa/0x10 fs/sync.c:125
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fba021af4ed
RSP: 002b:00007fba0011dbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fba022ce120 RCX: 00007fba021af4ed
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2a11fc2f R14: 00007fba022ce120 R15: 00007fba0011dd80
INFO: task syz-executor.7:11158 blocked for more than 143 seconds.
Tainted: G OE 5.10.131+ #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.7 state:D stack:29384 pid:11158 ppid: 7769 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:3792 [inline]
__schedule+0x8ef/0x20c0 kernel/sched/core.c:4541
schedule+0xcf/0x270 kernel/sched/core.c:4619
rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506
iterate_supers+0xdb/0x290 fs/super.c:692
ksys_sync+0x86/0x150 fs/sync.c:114
__do_sys_sync+0xa/0x10 fs/sync.c:125
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fba021af4ed
RSP: 002b:00007fba000fcbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fba022ce200 RCX: 00007fba021af4ed
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2a11fc2f R14: 00007fba022ce200 R15: 00007fba000fcd80
INFO: task syz-executor.7:11159 blocked for more than 143 seconds.
Tainted: G OE 5.10.131+ #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.7 state:D stack:29384 pid:11159 ppid: 7769 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:3792 [inline]
__schedule+0x8ef/0x20c0 kernel/sched/core.c:4541
schedule+0xcf/0x270 kernel/sched/core.c:4619
rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506
iterate_supers+0xdb/0x290 fs/super.c:692
ksys_sync+0x86/0x150 fs/sync.c:114
__do_sys_sync+0xa/0x10 fs/sync.c:125
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fba021af4ed
RSP: 002b:00007fba000dbbe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fba022ce2e0 RCX: 00007fba021af4ed
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2a11fc2f R14: 00007fba022ce2e0 R15: 00007fba000dbd80
INFO: task syz-executor.7:11160 blocked for more than 143 seconds.
Tainted: G OE 5.10.131+ #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.7 state:D stack:29384 pid:11160 ppid: 7769 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:3792 [inline]
__schedule+0x8ef/0x20c0 kernel/sched/core.c:4541
schedule+0xcf/0x270 kernel/sched/core.c:4619
rwsem_down_read_slowpath+0x4be/0xfa0 kernel/locking/rwsem.c:1099
__down_read kernel/locking/rwsem.c:1341 [inline]
down_read+0x1e7/0x430 kernel/locking/rwsem.c:1506
iterate_supers+0xdb/0x290 fs/super.c:692
ksys_sync+0x86/0x150 fs/sync.c:114
__do_sys_sync+0xa/0x10 fs/sync.c:125
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fba021af4ed
RSP: 002b:00007fba000babe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fba022ce3c0 RCX: 00007fba021af4ed
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fba0221b2e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2a11fc2f R14: 00007fba022ce3c0 R15: 00007fba000bad80
Showing all locks held in the system:
1 lock held by khungtaskd/1658:
#0: ffffffff8b336d60 (rcu_read_lock){....}-{1:2}, at:
debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6389
1 lock held by in:imklog/7747:
#0: ffff88810f7745f0 (&f->f_pos_lock){+.+.}-{3:3}, at:
__fdget_pos+0xe9/0x100 fs/file.c:1003
1 lock held by syz-executor.5/11140:
#0: ffff888111f9c0e0 (&type->s_umount_key#48/1){+.+.}-{3:3}, at:
alloc_super+0x194/0xa40 fs/super.c:229
1 lock held by syz-executor.7/11142:
#0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at:
iterate_supers+0xdb/0x290 fs/super.c:692
1 lock held by syz-executor.7/11156:
#0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at:
iterate_supers+0xdb/0x290 fs/super.c:692
1 lock held by syz-executor.7/11157:
#0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at:
iterate_supers+0xdb/0x290 fs/super.c:692
1 lock held by syz-executor.7/11158:
#0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at:
iterate_supers+0xdb/0x290 fs/super.c:692
1 lock held by syz-executor.7/11159:
#0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at:
iterate_supers+0xdb/0x290 fs/super.c:692
1 lock held by syz-executor.7/11160:
#0: ffff888111f9c0e0 (&type->s_umount_key#65){.+.+}-{3:3}, at:
iterate_supers+0xdb/0x290 fs/super.c:692
--
Thanks and Regards,
Dipanjan
View attachment "repro.c" of type "text/x-csrc" (3979 bytes)
Download attachment "repro.syz" of type "application/octet-stream" (323 bytes)
Powered by blists - more mailing lists