From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CCF6CD1284 for ; Thu, 4 Apr 2024 10:56:28 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 115A06B008C; Thu, 4 Apr 2024 06:56:28 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0C4766B0092; Thu, 4 Apr 2024 06:56:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id ECE286B0093; Thu, 4 Apr 2024 06:56:27 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id CEA5F6B008C for ; Thu, 4 Apr 2024 06:56:27 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 550EC4105A for ; Thu, 4 Apr 2024 10:56:27 +0000 (UTC) X-FDA: 81971545614.03.82B90A5 Received: from mail-il1-f200.google.com (mail-il1-f200.google.com [209.85.166.200]) by imf04.hostedemail.com (Postfix) with ESMTP id 95C7E40010 for ; Thu, 4 Apr 2024 10:56:25 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=none; spf=pass (imf04.hostedemail.com: domain of 3WIcOZgkbANcLRSD3EE7K3IIB6.9HH9E7NL7K5HGM7GM.5HF@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.200 as permitted sender) smtp.mailfrom=3WIcOZgkbANcLRSD3EE7K3IIB6.9HH9E7NL7K5HGM7GM.5HF@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712228185; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references; bh=SYpek9BoJPzKH+SPDXrSodfODP6NdfrQUMHv+6rUDwc=; b=K+WrTLL1PNERbRqY9Eb833qGZGG9XQhmGt2RU6hLNs+PDUC4yiiLrInrGAxtLOA+WsKKHu CjkPaB3KCZXWhSQAs49DdDZFo3mWbgvz7l8rbNqAZY4Evk7XZrFbn0ubyFPdNL447uemVr GMd10gUnD/IRIRcYGqXxZ0SGJ3XMPQ4= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712228185; a=rsa-sha256; cv=none; b=k7coUgQQrqJoUgtdZQ/XHXK0kXTj30dn218jUdj6GXPTVLAg3mj4h/IG84ss4O685cENdb r9CXJsbBhjZDj2nDfPiLhxssScUi17+EEtooLZq0D1uGGL6t/WN+mvvz7EEeRTa9IqAdph JjK6cZRMFgI/rpxyMFxmlc0IMPWe1PE= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=none; spf=pass (imf04.hostedemail.com: domain of 3WIcOZgkbANcLRSD3EE7K3IIB6.9HH9E7NL7K5HGM7GM.5HF@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.200 as permitted sender) smtp.mailfrom=3WIcOZgkbANcLRSD3EE7K3IIB6.9HH9E7NL7K5HGM7GM.5HF@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none) Received: by mail-il1-f200.google.com with SMTP id e9e14a558f8ab-369f5068fbeso7829825ab.1 for ; Thu, 04 Apr 2024 03:56:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712228184; x=1712832984; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=SYpek9BoJPzKH+SPDXrSodfODP6NdfrQUMHv+6rUDwc=; b=LZpwUzerR4+iDqwvj5sahWJCHarhM3rMDzVsvOCpVGmTsV1w3Vv6WPmfwxID0CC3ey AOdhIDeujN2rXNC7Pn9cy3H2hZp7ujjwss9kbYEfEapHup9ooTMGa/IkarGdy2sbWpo+ 6ApcxHXD4DJCPyTU63EmgWLI17X26WcQEYOFZWfaJr0V6Z5S1FjCKqSKrRxXv2Cw3SXv Xmg5hvGP5HHo2mQ6m4PraDbuvqBEIV8I8W+h1Bdhu5Jji7ewbrZjXJhtu8YLCHKg5HiW RbMeIWHTSn+3ktwTP4glYArvmzkqcJKxjiHk5eSTKlOpRLp31VVszIV4pshJSyUcrq95 CnGw== X-Forwarded-Encrypted: i=1; AJvYcCXANLdjDf3N3iZLObVyhyx6YhINekpOq99JHFWrAzu0eXogDin4jN1vOYOlRjJaUxhxyEk5hUIFStMt9KPxin8BmK4= X-Gm-Message-State: AOJu0YyiuFdq8pk5OaUOJob173wScRtq47wp0XBFbwpRdD4nJP/iMBqX LThjTz85eCbCxSHqiusXgLXGhlAs53yTa+sqdh/9AUmlPp1WxVS1NTD5jUIDk37YdaVPtVNEv7o E1Fq3rZyN42/HmQ67YYl/8wVsw1/+NoNjKQprTJKQXdozk4ezoWlgIC0= X-Google-Smtp-Source: AGHT+IEe6dNQEfdg5ryyn3c83j5DQi2XkbCquNM1PvbFB16XeLJ4Zp80no1rnvHgz7F+aPwvyaQgC8rfNNrO32DBy/i+NmBlnV+w MIME-Version: 1.0 X-Received: by 2002:a05:6e02:1d12:b0:369:b997:7342 with SMTP id i18-20020a056e021d1200b00369b9977342mr114511ila.3.1712228184691; Thu, 04 Apr 2024 03:56:24 -0700 (PDT) Date: Thu, 04 Apr 2024 03:56:24 -0700 In-Reply-To: <000000000000662a630615207d87@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <000000000000b92a9d0615433065@google.com> Subject: Re: [syzbot] [mm?] WARNING: bad unlock balance in madvise_cold_or_pageout_pte_range From: syzbot To: akpm@linux-foundation.org, david@redhat.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, ryan.roberts@arm.com, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 95C7E40010 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: wgmsgfkd54k896bpqda8p4tdzx4sefac X-HE-Tag: 1712228185-121687 X-HE-Meta: U2FsdGVkX19NARET+YK4LMQwri3sAKGuyXcKKHJZRF1VW/o1gZ3od3+WE7sO7oL5ITlpy+QNLmiHILnzwSKqeVvrxRDOLlSDpZ2ZkowZ6fRiu8wERbO6KHqbAEUDYL/ExpVYhBMWUCE5SMDrozkUN6P368/YEHlD/OWErl+XPyLltu2FxvF/B+AXqXhq64eMU+l74lUwBKdQ0mFhq05rHUr2BCCwxq8+YNBsTr7qSNQoth0M+GGNGkyxeJA1uZUl74UMG7HH5lfmDRIkg9gizvS8O3doY5hLBxRjWY3LHxmrWNj9WE7dIIvQokFEsImB9Cz2hZBnKMFctC8lDMu+F8NTdruWbAkBI8nKgBpymso0iXTyb2tNk4gIVzkUvwf8OVCciI2YgIGHYw7GtyV4GUoSVmj9rie4MsBNRq100yWIEycQfK4UYWVP6wS32ykj00u0t/vnb40C5JRsw/Cf2W9mkw6udTshRcA8wZK47rcTAZFAnJxt84UO9T3y3vx3NS2uQjYP7q2SQWGSyrTMXwwjtCulgmwbzUTVNoizCSAmwMZvQGp7/vborWQuCe5MHAhu6WOcSQEEdYqKYT7VLAWM5j2bBYUbn9W0f7fS4zYKP4T9+kmim9T0uQGssRQl8r7uEzh5DeL/e9B+Ctpf+MDuaDV8+pLJPqfsZVKhwuYAE93HNIFZFuHP+L9Jn3fm+W2S9gzmysH27C9i5khrkemhrW9qvfgEFU8GywVDe6INqHXNJGkCnQoCVSF8s0TYWcARGEAweFlP7Ujsla3PJqe/yvNIRLDVz/M96YTq9ftQ7wGbUfRh6hWJlcGOvTIp7TdZssxAL38e3z+tAd8852XK8OcKTCJcL7b8Q1cjw+0YWg4v1velzCh1kB91R98TwMdDn0DRgqJLbEz39h8ZEOwF68gkRQMXSfkCQci7nsqlhyVRICD7SrwmfrlQEKnc2GSMvPE7cRcStopge7K e8yETks9 IRyhsccIbNtaVuCN/Va58V62qCB4nMERvN50r4w7rRVjIc5UfQql8HkF3qMPZXAnYY4EHfDyQQ5n+PC8QdBx3RGEjHMoHHGP3tYfCossMrF3gYhoGXAHO5sC2IKbhk3YZ+Q0e2V12qbytJaWGc4kpTk91hQlizPIzgQuT5/jWHB1ognusuH6NWIqQJSepLlIFijVEDt30s3hUmpnq8mpxNbAQ9Rki4n9IVwtPhdXURKPZ0WrguYU0K0AWwWBzQvIhbAWtcXwoV8CI5vY9m2W63SFKbCsVc2AWLwusYD32hmwSBTpJRWQk7K0IZs+3YR0aj6xefz97tCEgfsHQI9TwwSiYjqnQUcio2+n5cBMoWolTE/7DKhZVj1U6sANmN30hpmFC+NF7oyMdwJACK0gNR0nKmFfQxGwE3BUvWJm+t2pAH0ZUIayHHSaPPGCB69SPnHaJo7d4RA3okqbcA58cN6pzngZUBTb+TJX86q3KX1ec02qx6M8a8FlVsVf8QG/tFw+VhoFp5fmfX/0EiwZNLkimvtEYuuN25muT0MbCweb8OClXtuHBi+8mS7YSMyfCG1rfIJbYo+TuNsDf/ZWACOkeWLT+IsNoGRYFvSEZWOxIwzcs6GBvDNDpwm1ufBaicdYPRF1T6WxMkorNHs1MQ/dlbiPlhlLOLs/Q3W6MixXjtGdZ9QSW9EK4xPJBopjsBF1ojcwYVkK+5T6bS1Q39wXi5jejPz4VQjLIDjeeMkoTz9vw3j3RyJVytyIz4ZCFg+tcR9dRqVIBhzxYUBAedKqpxu25RfPybF3WUujpic051crVvb6kG2I7eAXMZDg5CO6Q8tpcQwVZ4GyxJw0aWIXpIcNKxQTlwv4Gsv1XDB7k85mtoTbTdbZS8IHkFJB61D7aPRSKKdXa2NRto3QGo1Q8Td4NteUealcK996ByUqwe3sZbtP5PTQaX+0Fna0TLy1hOVtxSJTKtSH2VWCtCnGNhkFQ X9uiu7BL FFJfdKKuAgH2SJcJWDj6RODzwi5/N/MRadogpmnNy1IHIMdq0Yo3UJIKmMjl3Gt1p1uVgiX5uZhZaNs15F77Hy9dZrBt9YKwLpRapqENZGxlyjoPJB7iKPf3B0PLtPtVIh666JmTkRzA0IV2MoYBiI6WJmpnfyexZYnK7vs1ND5NNv9BRhgaAcFA2OKN6AHd6dMPMdoajTqeLrxP5rD6og== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: syzbot has found a reproducer for the following issue on: HEAD commit: 727900b675b7 Add linux-next specific files for 20240403 git tree: linux-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=11f66223180000 kernel config: https://syzkaller.appspot.com/x/.config?x=afcaf46d374cec8c dashboard link: https://syzkaller.appspot.com/bug?extid=c641706ad4e9688cccdf compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12a62423180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13764a3d180000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/f8fb4daa7a83/disk-727900b6.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/d2a6994aee53/vmlinux-727900b6.xz kernel image: https://storage.googleapis.com/syzbot-assets/6759e5411c39/bzImage-727900b6.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+c641706ad4e9688cccdf@syzkaller.appspotmail.com ===================================== WARNING: bad unlock balance detected! 6.9.0-rc2-next-20240403-syzkaller #0 Not tainted ------------------------------------- syz-executor799/5099 is trying to release lock (ptlock_ptr(ptdesc)) at: [] spin_unlock include/linux/spinlock.h:391 [inline] [] madvise_cold_or_pageout_pte_range+0x170f/0x3990 mm/madvise.c:480 but there are no more locks to release! other info that might help us debug this: 1 lock held by syz-executor799/5099: #0: ffff888015073a98 (&mm->mmap_lock){++++}-{3:3} , at: mmap_read_lock include/linux/mmap_lock.h:144 [inline] , at: do_madvise+0x481/0x44a0 mm/madvise.c:1429 stack backtrace: CPU: 1 PID: 5099 Comm: syz-executor799 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_unlock_imbalance_bug+0x256/0x2c0 kernel/locking/lockdep.c:5194 __lock_release kernel/locking/lockdep.c:5431 [inline] lock_release+0x599/0x9f0 kernel/locking/lockdep.c:5774 __raw_spin_unlock include/linux/spinlock_api_smp.h:141 [inline] _raw_spin_unlock+0x16/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] madvise_cold_or_pageout_pte_range+0x170f/0x3990 mm/madvise.c:480 walk_pmd_range mm/pagewalk.c:143 [inline] walk_pud_range mm/pagewalk.c:221 [inline] walk_p4d_range mm/pagewalk.c:256 [inline] walk_pgd_range+0xba1/0x1810 mm/pagewalk.c:293 __walk_page_range+0x132/0x720 mm/pagewalk.c:395 walk_page_range+0x58f/0x7c0 mm/pagewalk.c:521 madvise_cold_page_range mm/madvise.c:562 [inline] madvise_cold mm/madvise.c:584 [inline] madvise_vma_behavior mm/madvise.c:1028 [inline] madvise_walk_vmas mm/madvise.c:1256 [inline] do_madvise+0x1e7b/0x44a0 mm/madvise.c:1442 __do_sys_madvise mm/madvise.c:1457 [inline] __se_sys_madvise mm/madvise.c:1455 [inline] __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:1455 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x72/0x7a RIP: 0033:0x7f3928ac2419 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3928a5c218 EFLAGS: 00000246 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 00007f3928b4c318 RCX: 00007f3928ac2419 RDX: 0000000000000014 RSI: 00000000dfc3efff RDI: 00000000203c1000 RBP: 00007f3928b4c310 R08: 00007ffd7796b097 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3928b19064 R13: 000000080000000e R14: 000000200000007f R15: 00000000dfc3efff ------------[ cut here ]------------ pvqspinlock: lock 0xffff88802ec45b40 has corrupted value 0x0! WARNING: CPU: 1 PID: 5099 at kernel/locking/qspinlock_paravirt.h:510 __pv_queued_spin_unlock_slowpath+0x241/0x2f0 kernel/locking/qspinlock_paravirt.h:508 Modules linked in: CPU: 1 PID: 5099 Comm: syz-executor799 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__pv_queued_spin_unlock_slowpath+0x241/0x2f0 kernel/locking/qspinlock_paravirt.h:508 Code: 85 0a 6e f6 4c 89 f0 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 9f 00 00 00 41 8b 16 48 c7 c7 c0 26 cb 8b 4c 89 f6 e8 40 b3 cb f5 90 <0f> 0b 90 90 eb 8d 44 89 f1 80 e1 07 38 c1 0f 8c 26 ff ff ff 4c 89 RSP: 0018:ffffc9000364f238 EFLAGS: 00010246 RAX: 9a7270b7f8439200 RBX: dffffc0000000000 RCX: ffff888023139e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: dffffc0000000000 R08: ffffffff81580152 R09: 1ffffffff1f526cd R10: dffffc0000000000 R11: fffffbfff1f526ce R12: 1ffff11005d88b6a R13: ffff88802ec45b50 R14: ffff88802ec45b40 R15: ffff88802ec45b40 FS: 00007f3928a5c6c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561c1eec8018 CR3: 00000000213dc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __raw_callee_save___pv_queued_spin_unlock_slowpath+0x15/0x30 .slowpath+0x9/0x16 pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:589 [inline] queued_spin_unlock arch/x86/include/asm/qspinlock.h:57 [inline] do_raw_spin_unlock+0x13c/0x8b0 kernel/locking/spinlock_debug.c:142 __raw_spin_unlock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_unlock+0x1e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] madvise_cold_or_pageout_pte_range+0x170f/0x3990 mm/madvise.c:480 walk_pmd_range mm/pagewalk.c:143 [inline] walk_pud_range mm/pagewalk.c:221 [inline] walk_p4d_range mm/pagewalk.c:256 [inline] walk_pgd_range+0xba1/0x1810 mm/pagewalk.c:293 __walk_page_range+0x132/0x720 mm/pagewalk.c:395 walk_page_range+0x58f/0x7c0 mm/pagewalk.c:521 madvise_cold_page_range mm/madvise.c:562 [inline] madvise_cold mm/madvise.c:584 [inline] madvise_vma_behavior mm/madvise.c:1028 [inline] madvise_walk_vmas mm/madvise.c:1256 [inline] do_madvise+0x1e7b/0x44a0 mm/madvise.c:1442 --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing.