syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1334]
≡ Subsystems
🐞 Fixed [7143]
🐞 Invalid [18889]
⬇ Missing Backports [220]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

INFO: task hung in lock_two_directories (3)

Status: auto-obsoleted due to no activity on 2025/03/25 10:32
Subsystems: fs
[Documentation on labels]
First crash: 529d, last: 529d
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in lock_two_directories overlayfs ext4 1 7 1083d 1128d 0/29 auto-obsoleted due to no activity on 2023/09/18 16:57
upstream INFO: task hung in lock_two_directories (2) kernfs 1 10 630d 777d 0/29 auto-obsoleted due to no activity on 2024/12/15 06:45
upstream INFO: task hung in lock_two_directories (4) exfat prio:high 1 C done done 6 118d 381d 0/29 auto-obsoleted due to no activity on 2026/05/20 14:47

Sample crash report:
INFO: task syz.5.2160:27825 blocked for more than 143 seconds.
      Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.2160      state:D stack:23088 pid:27825 tgid:27824 ppid:26941  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176
 __down_write_common kernel/locking/rwsem.c:1304 [inline]
 __down_write kernel/locking/rwsem.c:1313 [inline]
 down_write_nested+0x1e0/0x220 kernel/locking/rwsem.c:1694
 inode_lock_nested include/linux/fs.h:853 [inline]
 lock_two_directories+0x145/0x220 fs/namei.c:3185
 lock_rename fs/namei.c:3220 [inline]
 do_renameat2+0x5da/0x13f0 fs/namei.c:5159
 __do_sys_rename fs/namei.c:5271 [inline]
 __se_sys_rename fs/namei.c:5269 [inline]
 __x64_sys_rename+0x82/0x90 fs/namei.c:5269
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4bc7185d29
RSP: 002b:00007f4bc7f19038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f4bc7375fa0 RCX: 00007f4bc7185d29
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000020000040
RBP: 00007f4bc7201aa8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f4bc7375fa0 R15: 00007ffcce07b738
 </TASK>
INFO: task syz.5.2160:27850 blocked for more than 143 seconds.
      Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.2160      state:D stack:26768 pid:27850 tgid:27824 ppid:26941  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176
 __down_write_common kernel/locking/rwsem.c:1304 [inline]
 __down_write kernel/locking/rwsem.c:1313 [inline]
 down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578
 inode_lock include/linux/fs.h:818 [inline]
 open_last_lookups fs/namei.c:3745 [inline]
 path_openat+0x89a/0x3590 fs/namei.c:3984
 do_filp_open+0x27f/0x4e0 fs/namei.c:4014
 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
 do_sys_open fs/open.c:1417 [inline]
 __do_sys_openat fs/open.c:1433 [inline]
 __se_sys_openat fs/open.c:1428 [inline]
 __x64_sys_openat+0x247/0x2a0 fs/open.c:1428
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4bc7185d29
RSP: 002b:00007f4bc7ed7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f4bc7376160 RCX: 00007f4bc7185d29
RDX: 000000000000275a RSI: 0000000020000100 RDI: ffffffffffffff9c
RBP: 00007f4bc7201aa8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f4bc7376160 R15: 00007ffcce07b738
 </TASK>
INFO: task syz.5.2160:27854 blocked for more than 144 seconds.
      Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.2160      state:D stack:26224 pid:27854 tgid:27824 ppid:26941  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176
 __down_write_common kernel/locking/rwsem.c:1304 [inline]
 __down_write kernel/locking/rwsem.c:1313 [inline]
 down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578
 inode_lock include/linux/fs.h:818 [inline]
 open_last_lookups fs/namei.c:3745 [inline]
 path_openat+0x89a/0x3590 fs/namei.c:3984
 do_filp_open+0x27f/0x4e0 fs/namei.c:4014
 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
 do_sys_open fs/open.c:1417 [inline]
 __do_sys_openat fs/open.c:1433 [inline]
 __se_sys_openat fs/open.c:1428 [inline]
 __x64_sys_openat+0x247/0x2a0 fs/open.c:1428
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4bc7185d29
RSP: 002b:00007f4bc4bf4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f4bc7376240 RCX: 00007f4bc7185d29
RDX: 000000000000275a RSI: 0000000020000180 RDI: ffffffffffffff9c
RBP: 00007f4bc7201aa8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f4bc7376240 R15: 00007ffcce07b738
 </TASK>
INFO: lockdep is turned off.
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
 watchdog+0xff6/0x1040 kernel/hung_task.c:397
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30478 Comm: dhcpcd-run-hook Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:218 [inline]
RIP: 0010:unwind_next_frame+0x1d9/0x22d0 arch/x86/kernel/unwind_orc.c:494
Code: 86 55 18 00 00 44 89 f0 48 8d 1c 85 70 21 47 91 48 89 d8 48 c1 e8 03 42 0f b6 04 20 84 c0 4c 89 e5 0f 85 97 1a 00 00 44 8b 23 <44> 89 f0 ff c0 48 8d 1c 85 70 21 47 91 48 89 d8 48 c1 e8 03 0f b6
RSP: 0018:ffffc90004466d10 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff914b2dc8 RCX: 00000000000b0001
RDX: 00000000000b0001 RSI: ffffffff8203164f RDI: ffffffff814ba930
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffc90004466ed0
R10: ffffc90004466e30 R11: ffffffff818b39d0 R12: 0000000000036195
R13: ffffc90004466de0 R14: 0000000000010316 R15: ffffffff8203164e
FS:  00007f01dfae2380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f48ea18e000 CR3: 0000000068854000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:319 [inline]
 __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4119 [inline]
 slab_alloc_node mm/slub.c:4168 [inline]
 kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4220
 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:668
 alloc_skb include/linux/skbuff.h:1323 [inline]
 nlmsg_new include/net/netlink.h:1018 [inline]
 audit_buffer_alloc kernel/audit.c:1795 [inline]
 audit_log_start+0x186/0xa30 kernel/audit.c:1913
 common_lsm_audit+0xdd/0x1ce0 security/lsm_audit.c:449
 smack_log+0x421/0x540 security/smack/smack_access.c:383
 smk_tskacc+0x300/0x370 security/smack/smack_access.c:253
 smack_inode_permission+0x2dc/0x380 security/smack/smack_lsm.c:1234
 security_inode_permission+0x101/0x320 security/security.c:2319
 may_lookup fs/namei.c:1819 [inline]
 link_path_walk+0x204/0xea0 fs/namei.c:2425
 path_openat+0x266/0x3590 fs/namei.c:3983
 do_filp_open+0x27f/0x4e0 fs/namei.c:4014
 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
 do_sys_open fs/open.c:1417 [inline]
 __do_sys_openat fs/open.c:1433 [inline]
 __se_sys_openat fs/open.c:1428 [inline]
 __x64_sys_openat+0x247/0x2a0 fs/open.c:1428
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f01dfc3a477
Code: 10 00 00 00 44 8b 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 44 89 c2 4c 89 ce bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 82 69 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffe2dab7168 EFLAGS: 00000287 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f01dfc3a477
RDX: 0000000000090800 RSI: 000055a484625250 RDI: 00000000ffffff9c
RBP: 000055a48462032f R08: 0000000000090800 R09: 000055a484625250
R10: 0000000000000000 R11: 0000000000000287 R12: 00007ffe2dab72c8
R13: 000055a484620328 R14: 000055a484625277 R15: 000000000000002f
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/25 10:22 upstream 9b2ffa6148b1 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in lock_two_directories
* Struck through repros no longer work on HEAD.