syzbot
INFO: task hung in i2c_smbus_xfer (5)
Status: auto-obsoleted due to no activity on 2026/09/15 08:56
Subsystems:
i2c
Labels:
prio:low
[Documentation on labels]
First crash: 196d, last: 100d
Sample crash report:
INFO: task syz.5.4013:20990 blocked for more than 430 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.4013 state:D stack:0 pid:20990 tgid:20989 ppid:18874 task_flags:0x400040 flags:0x00000001
Call trace:
[<81ae882c>] (__schedule) from [<80294a2c>] (__schedule_loop kernel/sched/core.c:6993 [inline])
[<81ae882c>] (__schedule) from [<80294a2c>] (rt_mutex_schedule+0x20/0x38 kernel/sched/core.c:7289)
r10:00000000 r9:83816e40 r8:eabadd98 r7:eabadda0 r6:83816e40 r5:98bf6e40
r4:98bf6e40
[<80294a0c>] (rt_mutex_schedule) from [<81aefa74>] (rt_mutex_slowlock_block.constprop.0+0x16c/0x1e4 kernel/locking/rtmutex.c:1647)
r5:98bf6e40 r4:83846854
[<81aef908>] (rt_mutex_slowlock_block.constprop.0) from [<81af0ea4>] (__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline])
[<81aef908>] (rt_mutex_slowlock_block.constprop.0) from [<81af0ea4>] (__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline])
[<81aef908>] (rt_mutex_slowlock_block.constprop.0) from [<81af0ea4>] (rt_mutex_slowlock.constprop.0+0xcc/0x3d0 kernel/locking/rtmutex.c:1800)
r10:98bf6e40 r9:60000013 r8:eabadda0 r7:eabadd98 r6:00000002 r5:83846854
r4:98bf6e40
[<81af0dd8>] (rt_mutex_slowlock.constprop.0) from [<81af128c>] (__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline])
[<81af0dd8>] (rt_mutex_slowlock.constprop.0) from [<81af128c>] (__rt_mutex_lock_common kernel/locking/rtmutex_api.c:49 [inline])
[<81af0dd8>] (rt_mutex_slowlock.constprop.0) from [<81af128c>] (rt_mutex_lock+0x44/0x48 kernel/locking/rtmutex_api.c:89)
r10:98bf6e40 r9:00000006 r8:00000000 r7:00000006 r6:00000000 r5:00000001
r4:83846840
[<81af1248>] (rt_mutex_lock) from [<81141d60>] (i2c_adapter_lock_bus+0x14/0x18 drivers/i2c/i2c-core-base.c:849)
[<81141d4c>] (i2c_adapter_lock_bus) from [<811479c4>] (i2c_lock_bus include/linux/i2c.h:809 [inline])
[<81141d4c>] (i2c_adapter_lock_bus) from [<811479c4>] (__i2c_lock_bus_helper drivers/i2c/i2c-core.h:46 [inline])
[<81141d4c>] (i2c_adapter_lock_bus) from [<811479c4>] (i2c_smbus_xfer+0xe4/0x124 drivers/i2c/i2c-core-smbus.c:542)
[<811478e0>] (i2c_smbus_xfer) from [<811498f8>] (i2cdev_ioctl_smbus+0xf4/0x3a4 drivers/i2c/i2c-dev.c:389)
r8:00000001 r7:20000080 r6:85825800 r5:00000001 r4:00000001
[<81149804>] (i2cdev_ioctl_smbus) from [<81149e94>] (i2cdev_ioctl+0x2ec/0x3ac drivers/i2c/i2c-dev.c:478)
r10:98bf6e40 r9:00000005 r8:85837cc0 r7:20000200 r6:85825800 r5:b5403587
r4:20000200
[<81149ba8>] (i2cdev_ioctl) from [<80590c2c>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<81149ba8>] (i2cdev_ioctl) from [<80590c2c>] (do_vfs_ioctl fs/ioctl.c:551 [inline])
[<81149ba8>] (i2cdev_ioctl) from [<80590c2c>] (__do_sys_ioctl fs/ioctl.c:595 [inline])
[<81149ba8>] (i2cdev_ioctl) from [<80590c2c>] (sys_ioctl+0x244/0xb5c fs/ioctl.c:583)
r7:20000200 r6:00000720 r5:85837cc1 r4:00000000
[<805909e8>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xeabadfa8 to 0xeabadff0)
dfa0: 00000000 00000000 00000005 00000720 20000200 00000000
dfc0: 00000000 00000000 00346310 00000036 003462d8 00000000 00000001 76fa80dc
dfe0: 76fa7e88 76fa7e78 00018ba0 001302e0
r10:00000036 r9:98bf6e40 r8:8020029c r7:00000036 r6:00346310 r5:00000000
r4:00000000
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 29 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: ARM-Versatile Express
Call trace:
[<80201a14>] (dump_backtrace) from [<80201b08>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
r7:60030093 r6:60030093 r5:822a81d4 r4:00000000
[<80201af0>] (show_stack) from [<8021e3f8>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201af0>] (show_stack) from [<8021e3f8>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e39c>] (dump_stack_lvl) from [<8021e424>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
r7:00000000 r6:00030013 r5:00000000 r4:00000001
[<8021e40c>] (dump_stack) from [<81ad225c>] (nmi_cpu_backtrace+0x150/0x170 lib/nmi_backtrace.c:113)
[<81ad210c>] (nmi_cpu_backtrace) from [<81ad23ac>] (nmi_trigger_cpumask_backtrace+0x130/0x1d8 lib/nmi_backtrace.c:62)
r7:00000000 r6:8280c550 r5:8281afb8 r4:ffffffff
[<81ad227c>] (nmi_trigger_cpumask_backtrace) from [<8022f104>] (arch_trigger_cpumask_backtrace+0x18/0x1c arch/arm/kernel/smp.c:852)
r9:82ac7834 r8:8280c6d8 r7:00052b00 r6:98bf7628 r5:82804d80 r4:00000048
[<8022f0ec>] (arch_trigger_cpumask_backtrace) from [<81ad9e9c>] (trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline])
[<8022f0ec>] (arch_trigger_cpumask_backtrace) from [<81ad9e9c>] (__sys_info lib/sys_info.c:157 [inline])
[<8022f0ec>] (arch_trigger_cpumask_backtrace) from [<81ad9e9c>] (sys_info+0x68/0xa8 lib/sys_info.c:165)
[<81ad9e34>] (sys_info) from [<80384f6c>] (check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline])
[<81ad9e34>] (sys_info) from [<80384f6c>] (watchdog+0x59c/0x8d8 kernel/hung_task.c:515)
r5:82804d80 r4:8385d414
[<803849d0>] (watchdog) from [<8028141c>] (kthread+0x11c/0x154 kernel/kthread.c:436)
r10:00000000 r9:df819e60 r8:83103500 r7:00000000 r6:803849d0 r5:831f8000
r4:8333dc00
[<80281300>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137)
Exception stack(0xdf8d5fb0 to 0xdf8d5ff8)
5fa0: 00000000 00000000 00000000 00000000
5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281300 r4:8333dc00
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 18808 Comm: syz.3.3571 Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: ARM-Versatile Express
PC is at i2c_versatile_getscl+0x14/0x20 drivers/i2c/busses/i2c-versatile.c:52
LR is at sclhi+0x64/0xa8 drivers/i2c/algos/i2c-algo-bit.c:86
pc : [<8114f234>] lr : [<8114a994>] psr: 20000013
sp : df965d20 ip : df965d30 fp : df965d2c
r10: 00000172 r9 : 824bfe94 r8 : 00000000
r7 : 83846840 r6 : 00052ac9 r5 : 82804d80 r4 : 83846af0
r3 : df8ce000 r2 : 00000064 r1 : 00000000 r0 : 00000000
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 30c5387d Table: 85be9a80 DAC: 00000000
Call trace:
[<8114f220>] (i2c_versatile_getscl) from [<8114a994>] (sclhi+0x64/0xa8 drivers/i2c/algos/i2c-algo-bit.c:86)
[<8114a930>] (sclhi) from [<8114aa1c>] (i2c_stop+0x44/0x60 drivers/i2c/algos/i2c-algo-bit.c:138)
r6:45013708 r5:824bfe94 r4:83846af0
[<8114a9d8>] (i2c_stop) from [<8114b184>] (try_address+0x34/0x88 drivers/i2c/algos/i2c-algo-bit.c:330)
r5:83846af0 r4:ffffff92
[<8114b150>] (try_address) from [<8114b3bc>] (bit_doAddress drivers/i2c/algos/i2c-algo-bit.c:512 [inline])
[<8114b150>] (try_address) from [<8114b3bc>] (bit_xfer+0x1e4/0x58c drivers/i2c/algos/i2c-algo-bit.c:552)
r10:8280c500 r9:45013708 r8:83846af0 r7:83846af0 r6:df965e68 r5:00000000
r4:00000000 r3:00000000
[<8114b1d8>] (bit_xfer) from [<81143570>] (__i2c_transfer+0x1ac/0x8e8 drivers/i2c/i2c-core-base.c:2261)
r10:8280c500 r9:0004040a r8:00000000 r7:df965e68 r6:00000001 r5:82804d80
r4:83846840
[<811433c4>] (__i2c_transfer) from [<81143d2c>] (i2c_transfer+0x80/0x108 drivers/i2c/i2c-core-base.c:2317)
r10:00000092 r9:00000001 r8:83816e40 r7:8530a400 r6:df965e68 r5:00000001
r4:83846840
[<81143cac>] (i2c_transfer) from [<81143e10>] (i2c_transfer_buffer_flags+0x5c/0x8c drivers/i2c/i2c-core-base.c:2345)
r6:00000000 r5:8ece3680 r4:00000001
[<81143db4>] (i2c_transfer_buffer_flags) from [<81149090>] (i2c_master_send include/linux/i2c.h:109 [inline])
[<81143db4>] (i2c_transfer_buffer_flags) from [<81149090>] (i2cdev_write+0x70/0xc8 drivers/i2c/i2c-dev.c:183)
r6:8a8bf000 r5:8ece3680 r4:00000001
[<81149020>] (i2cdev_write) from [<805749d8>] (do_loop_readv_writev fs/read_write.c:852 [inline])
[<81149020>] (i2cdev_write) from [<805749d8>] (do_loop_readv_writev fs/read_write.c:837 [inline])
[<81149020>] (i2cdev_write) from [<805749d8>] (vfs_writev+0x244/0x3c0 fs/read_write.c:1061)
r7:df965f60 r6:8a8bf000 r5:81149020 r4:00000000
[<80574794>] (vfs_writev) from [<80574bd0>] (do_writev+0x7c/0x148 fs/read_write.c:1105)
r9:00000000 r8:00000000 r7:00000000 r6:8a8bf000 r5:8a8bf001 r4:83816e40
[<80574b54>] (do_writev) from [<8057652c>] (__do_sys_writev fs/read_write.c:1173 [inline])
[<80574b54>] (do_writev) from [<8057652c>] (sys_writev+0x14/0x18 fs/read_write.c:1170)
r9:83816e40 r8:8020029c r7:00000092 r6:00346310 r5:00000000 r4:00000000
[<80576518>] (sys_writev) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf965fa8 to 0xdf965ff0)
5fa0: 00000000 00000000 00000005 20000180 00000001 00000000
5fc0: 00000000 00000000 00346310 00000092 003462d8 00000000 00000001 76f250dc
5fe0: 76f24e88 76f24e78 00018ba0 001302e0
* Struck through repros no longer work on HEAD.