From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E497C3DA61 for ; Thu, 18 Jul 2024 22:51:30 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DDF9B6B0089; Thu, 18 Jul 2024 18:51:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D67B66B0092; Thu, 18 Jul 2024 18:51:29 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BE10D6B0093; Thu, 18 Jul 2024 18:51:29 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 9513F6B0089 for ; Thu, 18 Jul 2024 18:51:29 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 27F0C1C0950 for ; Thu, 18 Jul 2024 22:51:29 +0000 (UTC) X-FDA: 82354371498.22.BF774B7 Received: from mail-io1-f70.google.com (mail-io1-f70.google.com [209.85.166.70]) by imf16.hostedemail.com (Postfix) with ESMTP id 696DB180006 for ; Thu, 18 Jul 2024 22:51:27 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=none; spf=pass (imf16.hostedemail.com: domain of 3bpyZZgkbAEk39Avlwwp2l00to.rzzrwp53p2nzy4py4.nzx@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.70 as permitted sender) smtp.mailfrom=3bpyZZgkbAEk39Avlwwp2l00to.rzzrwp53p2nzy4py4.nzx@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1721343055; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references; bh=pLOMDoX3/n4YhSJy3kXGSwCuyRrO+KyDK5eQ4HHpqAg=; b=mLAoBQEJUndyebGTUEarXYKubNK0zEEzmuKjswp/WoiIkxd3v7gyvznyHXk/nhPsbDGA4l /cpq6oyly6nOWsOMT6cYykoFmTezeWRX70dujW66P9wCCQXp8LhphfpRcH5EKPGvazU8J7 vXHota0cqniWGlaOC7mMGY7+YglDh1s= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=none; spf=pass (imf16.hostedemail.com: domain of 3bpyZZgkbAEk39Avlwwp2l00to.rzzrwp53p2nzy4py4.nzx@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.70 as permitted sender) smtp.mailfrom=3bpyZZgkbAEk39Avlwwp2l00to.rzzrwp53p2nzy4py4.nzx@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none) ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1721343055; a=rsa-sha256; cv=none; b=7D617nfHq/mklJxk41xX1ovGyMMthTaSiFKCYNYlD6y4cvSvJmv0nV4LSo8bvDagjWqEg9 kzRB8TKMf5S1rigNZHxHg5/YSkCch4nX/1oM4cbByhlT+IVr/yzOixf0m8Th07H/eZf9U/ S5F5w3az39rY3u5kOiQ6Yiapj99rkLQ= Received: by mail-io1-f70.google.com with SMTP id ca18e2360f4ac-8152f0c4837so193855139f.0 for ; Thu, 18 Jul 2024 15:51:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721343086; x=1721947886; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=pLOMDoX3/n4YhSJy3kXGSwCuyRrO+KyDK5eQ4HHpqAg=; b=gXU/dA1tJh7zLHYR6sOC7UkORZVrp9DqXrmugY/OOaX7r8J/DhsNkVL04JWnxZMNk9 y8IIhOiLoTzT8UCkTLq5yd3G2Kq9NSP5Y1aJW0772PQ0rxnJZLfmM+HrsESGkfFfOucp HViL0XFn7j8nwIQXtka6+3mYtrt42YB/YHuTJmwUOsqoKsfrc3sEjJpBHuqggCiEvnRC FFIcDdPvss2lCzR6MArHWUY3Y7BdCc3EyryGVTjpSLhTJNv1Yz+xZ3qSTKc1QCDHCaLR 4dd27pFMjDwDMLZ6HG4ySaEmFZ8/Tx/rXetTbtGue9MEDQQ9yal2pmrRqW3S0FkF9NFv gGgQ== X-Forwarded-Encrypted: i=1; AJvYcCXdsU0QygcXOaJCJlHJpXPnkQH2d3kNoil4ShT0xXYVxN2tE4jaesUANtVmrHHRLbO8iREoV5r0jeET3mm4NvvJpg4= X-Gm-Message-State: AOJu0YwWpl2ruXMm1tnmuIb+f3rVqT5JtAUN9iVD7hsUAC6IE/aRORQh SYFy2fmdrJoZbv3b0YiIv6bdgIXNd1VaACknh4kYEIMljoQ5JCa0k/oByjaioDISxcKIqFVecX2 P6x17EYF9MltL5wbEyl2K2pjTn1qo9q7Y0g/wVPdk7KGUhPo0L1Ro0C0= X-Google-Smtp-Source: AGHT+IF0s4dojWYc+De78j1F4r25m5KjlrSLHELcPAgFaPF1q/dfz8FR0NiyG6IZX5Wc56OKMvBNobTnZygqHPj5g3R3MEbw37nP MIME-Version: 1.0 X-Received: by 2002:a05:6638:3015:b0:4c0:73d0:3d77 with SMTP id 8926c6da1cb9f-4c215d03b50mr403814173.5.1721343086426; Thu, 18 Jul 2024 15:51:26 -0700 (PDT) Date: Thu, 18 Jul 2024 15:51:26 -0700 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <000000000000341f5f061d8d6bcb@google.com> Subject: [syzbot] [mm?] BUG: Bad page map (8) From: syzbot To: akpm@linux-foundation.org, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: 79ta4g7m9gw7pp18wa81jkqh9uua8fdn X-Rspam-User: X-Rspamd-Queue-Id: 696DB180006 X-Rspamd-Server: rspam02 X-HE-Tag: 1721343087-574965 X-HE-Meta: U2FsdGVkX18C7zmKhCljuDtIIHYN7OdzrpMqt8wIb91m9aDbN3UQDk2VX88DaZ7uozWOTW5uowoPJbt3PpMJaw44uTiNzBJxhTm8/R7tLOEdKllOisWoBHPMaH+TixbQN5LByEDWdw+fSPEO8aeVy95IZtFOTiP6FLENpofkmyjepg1WHYT1moSmaP1LDbYFvW1FY4I8QtOrpe0VfASw2UGpcOXQyOM4dSgQdMY0veVeUsH5d33mJnAFBkcAVzV3aJcK6BfKJTszcl/U1zPi9TnJLpwREb5f+rGZe077L9paAWoeDkXh1kcKpBB8wE08BA32qjiNA0ANOt6L6RMSb75QqyqI515AkL4cszbdssyGWj+naXBP/bi3e1uow3DGVrczUa6rFtEoN+kg6tANpXg7WZZY3nr2Y3MrI3p+y04r9NcKHtNm3btjholeiMzJTGYnR6BH9cMDzwypacZoYQkRZ+cW1ps0WlVLBcuEUtCWOMK4u/ZP+X0rZTF+dxGlv7QjPoPTlDQlfeEAoHa67KI6QDmAhyPPQIKdnI2R0C39m+miavvXzo/jELcO62qaqFmRkjKhA+KDvpRkAXw0yn9O/pHc9zHJh76I8qxH9Q5diNdg1xVQiVQ0Sho3bAYVP+/ue8JwKgpTghH4Po7pIAlitBdz+5iDHfY93z1kUZnP0Qc0w/EbApLCIPL5Rs3LvRF6z+0Yo4pc/zLlL1pybaouRBmDvkUOQ3nFat7AMD5FVJLNYIx7BjJ1sAnlRdwcbhu1I07+HuheM8CMPNlBb4NuAvdVNzYoyC/1c492FfVEnTi5ZhnqwOr7cvFtzgjunOnb4mTyIus4RmarzubypJnWmVk8zTIiHNO00srijMDLnpNSW4VOpR2Koy7EAb2ZgTEsMk4gn93IqlzqabLfxeoFKkTI58Baxe+VkyhKsCjwrAYlfPFRumJmvK4Xm/zrYJ+E0QsFNH1E0ShJOWr rK+kj00i 4o+ObyZbZeSbbDVywjxGGH4S/EI5znE5cWpLyuJR4g9lReOADSbC3jUKW8dOUo44zv7zgbgXTaibZZ0ZJuMIJcKNDZd/aYK8P9C4DvxcGLDe/zgEhNpyQpgxe33fukdK0j8mV1c5yRxKIw0hTcFEHUDw7J7U1txBLO1mOUKNT2aF/pU12/d0ZsdO5FYPj25/hVIOve3IjnQQWOFzvjbPxwPxfRpnd4kMrDzEFq+7pJtkSxXajvQrVXXWkkB1XbCvkN+zJybh/ATDA7s/a+ZtSTlrfKg+dbUcs2caOego2NLbTZKznzd8qd7gDkZE5uD2DmlFvfAnt/ZXhETgCZGsoyyFkPeiXM0eP5W8ZSyg7kP9EtVQWwcPiERt6EXWDjSurVGK/oQudi3kB0Y8HRY6vPdYof5rxU8lzdZ495drWYuX8L4lVD//icHLY1pDSt45pXa91JXOK0ycBvLwSwkIF0SRYRz76w45pZmMbbzw7LX0ClOtyDIYmvPECI8ZhXDcWZnXc7ylT99vCWKMXraSxv8usNz19lowfdqC19HU72zWRHf/9XUjQ6jpQNkNnpvYo8jim/T5EqJI8QnCih3VYux2zA5Er2z30BB7bM2BwrNrIP/QqJOxEcQBNm+6+NbsMdPXRwN7WtakIc39vPapaUQUDFsTjF7M2cAcT4C2H4HuJmBHlb+hQjhANt+aVL24TI4PKDbIo0ynJn3sLk/xwElpkp9XbDGaqai1eumD0ddCJDP/XZzDqHK/uOF3257JUPyZZK3apgfh6NltmaxLzTVhD58Lq1AFBGKvTnCCHbi96zK3mfDFvU4tIK7DgJGVXay5qMukVQc8jc31qOFda2xnM91B44QFVriLTz/Ks3Tk2ldqQzwVVbBboeBuZMm7YQqBFLaHpaXITxX0MzeCvVxwsVZBwrz6dP2MLmXHDtwKWeGhry+YRPzCW47qJRAwQa+zvDoTETmf7wViG4pXVqIoJpkPD 5Xh1WYek 6pgFZcng7Cyy6f+tXJtyeGlWJyRJs5VXjzmfkqvDNL2awGBim7MqbM/3vNRW9MVBc1OTpzbwTRiNXkHGVOPZsVPmHuBQ2cjkHUfL46npy6fNLYkqtNNBdVkeabzMvuOMGND0jsHT6I2uZoMQeozP1Dsr/fh7dldKU+XmNSY6c+P+UcuP8L8pQrBbeC7CAhXZtDIqxze7N8MMgWozox2bjUl8JRv5bUmCBK/DEXptS2wQyjlNeL4o+dOdEZmvCP1U6aP5J853H9WQZMnEoBU+2UggLagIbWkg X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hello, syzbot found the following issue on: HEAD commit: 4d145e3f830b Merge tag 'i2c-for-6.10-rc8' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11321495980000 kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31 dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113e054e980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1366ab85980000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-4d145e3f.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/28dead26b828/vmlinux-4d145e3f.xz kernel image: https://storage.googleapis.com/syzbot-assets/079a7ff04a12/Image-4d145e3f.gz.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com BUG: Bad page cache in process syz-executor356 pfn:ba081 page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x0 pfn:0xba081 memcg:f7f0000002c3a000 aops:shmem_aops ino:3 flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002d ffffc1ffc01cd7c8 ffffc1ffc1e86288 f9f000000749ba50 raw: 0000000000000000 0000000000000000 0000000400000000 f7f0000002c3a000 page dumped because: still mapped when deleted CPU: 0 PID: 3196 Comm: syz-executor356 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167 __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231 filemap_remove_folio+0x48/0xa8 mm/filemap.c:264 truncate_inode_folio+0x30/0x4c mm/truncate.c:195 shmem_undo_range+0x208/0x620 mm/shmem.c:1012 shmem_truncate_range mm/shmem.c:1125 [inline] shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253 evict+0xb4/0x198 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput fs/inode.c:1767 [inline] iput+0x100/0x1b8 fs/inode.c:1753 dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404 __dentry_kill+0x7c/0x1d4 fs/dcache.c:607 dput.part.0+0x30/0xbc fs/dcache.c:849 dput+0x4c/0x50 fs/dcache.c:860 __fput+0x110/0x2d4 fs/file_table.c:430 __fput_sync+0x50/0x5c fs/file_table.c:507 __do_sys_close fs/open.c:1563 [inline] __se_sys_close fs/open.c:1548 [inline] __arm64_sys_close+0x38/0x7c fs/open.c:1548 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page cache in process syz-executor356 pfn:ba18a page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x1 pfn:0xba18a memcg:f7f0000002c3a000 aops:shmem_aops ino:3 flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002d ffffc1ffc1e82048 ffffc1ffc028a2c8 f9f000000749ba50 raw: 0000000000000001 0000000000000000 0000000400000000 f7f0000002c3a000 page dumped because: still mapped when deleted CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167 __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231 filemap_remove_folio+0x48/0xa8 mm/filemap.c:264 truncate_inode_folio+0x30/0x4c mm/truncate.c:195 shmem_undo_range+0x208/0x620 mm/shmem.c:1012 shmem_truncate_range mm/shmem.c:1125 [inline] shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253 evict+0xb4/0x198 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput fs/inode.c:1767 [inline] iput+0x100/0x1b8 fs/inode.c:1753 dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404 __dentry_kill+0x7c/0x1d4 fs/dcache.c:607 dput.part.0+0x30/0xbc fs/dcache.c:849 dput+0x4c/0x50 fs/dcache.c:860 __fput+0x110/0x2d4 fs/file_table.c:430 __fput_sync+0x50/0x5c fs/file_table.c:507 __do_sys_close fs/open.c:1563 [inline] __se_sys_close fs/open.c:1548 [inline] __arm64_sys_close+0x38/0x7c fs/open.c:1548 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page map in process syz-executor356 pte:600000ba0818c3 pmd:800000047670003 page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081 memcg:f7f0000002c3a000 flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002c ffffc1ffc028c708 ffffc1ffc1e86288 0000000000000000 raw: 0000000000000000 0000000000000000 00000001fffffffe f7f0000002c3a000 page dumped because: bad pte addr:00000000209a0000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:0 file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0 CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 print_bad_pte+0x1c8/0x258 mm/memory.c:538 zap_present_folio_ptes mm/memory.c:1508 [inline] zap_present_ptes mm/memory.c:1564 [inline] zap_pte_range mm/memory.c:1606 [inline] zap_pmd_range mm/memory.c:1724 [inline] zap_pud_range mm/memory.c:1753 [inline] zap_p4d_range mm/memory.c:1774 [inline] unmap_page_range+0x904/0x1190 mm/memory.c:1795 unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841 unmap_vmas+0x7c/0x170 mm/memory.c:1885 exit_mmap+0xc0/0x288 mm/mmap.c:3341 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page map in process syz-executor356 pte:600000ba18a8c3 pmd:800000047670003 page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a memcg:f7f0000002c3a000 flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002c ffffc1ffc1e82048 ffffc1ffc028a2c8 0000000000000000 raw: 0000000000000001 0000000000000000 00000001fffffffe f7f0000002c3a000 page dumped because: bad pte addr:00000000209a1000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:1 file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0 CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 print_bad_pte+0x1c8/0x258 mm/memory.c:538 zap_present_folio_ptes mm/memory.c:1508 [inline] zap_present_ptes mm/memory.c:1564 [inline] zap_pte_range mm/memory.c:1606 [inline] zap_pmd_range mm/memory.c:1724 [inline] zap_pud_range mm/memory.c:1753 [inline] zap_p4d_range mm/memory.c:1774 [inline] unmap_page_range+0x904/0x1190 mm/memory.c:1795 unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841 unmap_vmas+0x7c/0x170 mm/memory.c:1885 exit_mmap+0xc0/0x288 mm/mmap.c:3341 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page state in process syz-executor356 pfn:ba081 page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081 flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 bad_page+0x84/0x11c mm/page_alloc.c:498 free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904 free_page_is_bad mm/page_alloc.c:914 [inline] free_pages_prepare mm/page_alloc.c:1085 [inline] free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637 folios_put_refs+0x108/0x284 mm/swap.c:1024 free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu mm/mmu_gather.c:373 [inline] tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465 exit_mmap+0x13c/0x288 mm/mmap.c:3354 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page state in process syz-executor356 pfn:ba18a page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 bad_page+0x84/0x11c mm/page_alloc.c:498 free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904 free_page_is_bad mm/page_alloc.c:914 [inline] free_pages_prepare mm/page_alloc.c:1085 [inline] free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637 folios_put_refs+0x108/0x284 mm/swap.c:1024 free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu mm/mmu_gather.c:373 [inline] tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465 exit_mmap+0x13c/0x288 mm/mmap.c:3354 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup