* BUG: Bad page state (6) @ 2019-02-28 10:32 syzbot 2019-02-28 10:36 ` Dmitry Vyukov 0 siblings, 1 reply; 8+ messages in thread From: syzbot @ 2019-02-28 10:32 UTC (permalink / raw) To: akpm, arunks, dan.j.williams, ldr709, linux-kernel, linux-mm, mhocko, nborisov, rppt, syzkaller-bugs, vbabka, willy, yuehaibing Hello, syzbot found the following crash on: HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com BUG: Bad page state in process syz-executor193 pfn:9225a page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 shmem_aops name:"memfd:cgroup2" flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: non-NULL mapping Modules linked in: CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 #45 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 bad_page.cold+0xda/0xff mm/page_alloc.c:586 free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 free_pages_check mm/page_alloc.c:1022 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_pcp_prepare mm/page_alloc.c:1137 [inline] free_unref_page_prepare mm/page_alloc.c:3001 [inline] free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 release_pages+0x60d/0x1940 mm/swap.c:794 pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 activate_page_drain mm/swap.c:297 [inline] lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 lru_add_drain+0x20/0x60 mm/swap.c:647 exit_mmap+0x290/0x530 mm/mmap.c:3134 __mmput kernel/fork.c:1047 [inline] mmput+0x15f/0x4c0 kernel/fork.c:1068 exit_mm kernel/exit.c:546 [inline] do_exit+0x816/0x2fa0 kernel/exit.c:863 do_group_exit+0x135/0x370 kernel/exit.c:980 __do_sys_exit_group kernel/exit.c:991 [inline] __se_sys_exit_group kernel/exit.c:989 [inline] __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x442a58 Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: BUG: Bad page state (6) 2019-02-28 10:32 BUG: Bad page state (6) syzbot @ 2019-02-28 10:36 ` Dmitry Vyukov 2019-02-28 17:42 ` Eric Biggers 0 siblings, 1 reply; 8+ messages in thread From: Dmitry Vyukov @ 2019-02-28 10:36 UTC (permalink / raw) To: syzbot, Jens Axboe, Eric Biggers Cc: Andrew Morton, arunks, Dan Williams, Lance Roy, LKML, Linux-MM, Michal Hocko, nborisov, Mike Rapoport, syzkaller-bugs, Vlastimil Babka, Matthew Wilcox, yuehaibing On Thu, Feb 28, 2019 at 11:32 AM syzbot <syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com> wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f > dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com +Jens, Eric, Looks similar to: https://groups.google.com/forum/#!msg/syzkaller-bugs/E3v3XQweVBw/6BPrkIYJIgAJ Perhaps the fixing commit is not in the build yet? > BUG: Bad page state in process syz-executor193 pfn:9225a > page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 > shmem_aops > name:"memfd:cgroup2" > flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) > raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 > raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 > page dumped because: non-NULL mapping > Modules linked in: > CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 > #45 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > bad_page.cold+0xda/0xff mm/page_alloc.c:586 > free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 > free_pages_check mm/page_alloc.c:1022 [inline] > free_pages_prepare mm/page_alloc.c:1112 [inline] > free_pcp_prepare mm/page_alloc.c:1137 [inline] > free_unref_page_prepare mm/page_alloc.c:3001 [inline] > free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 > release_pages+0x60d/0x1940 mm/swap.c:794 > pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 > activate_page_drain mm/swap.c:297 [inline] > lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 > lru_add_drain+0x20/0x60 mm/swap.c:647 > exit_mmap+0x290/0x530 mm/mmap.c:3134 > __mmput kernel/fork.c:1047 [inline] > mmput+0x15f/0x4c0 kernel/fork.c:1068 > exit_mm kernel/exit.c:546 [inline] > do_exit+0x816/0x2fa0 kernel/exit.c:863 > do_group_exit+0x135/0x370 kernel/exit.c:980 > __do_sys_exit_group kernel/exit.c:991 [inline] > __se_sys_exit_group kernel/exit.c:989 [inline] > __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 > do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x442a58 > Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 > 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff > ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 > RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 > RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 > RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 > R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 > R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 > > > --- > This bug is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. See: > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with > syzbot. > syzbot can test patches for this bug, for details see: > https://goo.gl/tpsmEJ#testing-patches > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000024b3aa0582f1cde7%40google.com. > For more options, visit https://groups.google.com/d/optout. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: BUG: Bad page state (6) 2019-02-28 10:36 ` Dmitry Vyukov @ 2019-02-28 17:42 ` Eric Biggers 2019-02-28 17:51 ` Jens Axboe 2019-02-28 18:04 ` Dmitry Vyukov 0 siblings, 2 replies; 8+ messages in thread From: Eric Biggers @ 2019-02-28 17:42 UTC (permalink / raw) To: Dmitry Vyukov Cc: syzbot, Jens Axboe, Andrew Morton, arunks, Dan Williams, Lance Roy, LKML, Linux-MM, Michal Hocko, nborisov, Mike Rapoport, syzkaller-bugs, Vlastimil Babka, Matthew Wilcox, yuehaibing On Thu, Feb 28, 2019 at 11:36:21AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: > On Thu, Feb 28, 2019 at 11:32 AM syzbot > <syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com> wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 > > git tree: linux-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f > > dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com > > +Jens, Eric, > > Looks similar to: > https://groups.google.com/forum/#!msg/syzkaller-bugs/E3v3XQweVBw/6BPrkIYJIgAJ > Perhaps the fixing commit is not in the build yet? > > > > BUG: Bad page state in process syz-executor193 pfn:9225a > > page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 > > shmem_aops > > name:"memfd:cgroup2" > > flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) > > raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 > > raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 > > page dumped because: non-NULL mapping > > Modules linked in: > > CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 > > #45 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > Call Trace: > > __dump_stack lib/dump_stack.c:77 [inline] > > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > > bad_page.cold+0xda/0xff mm/page_alloc.c:586 > > free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 > > free_pages_check mm/page_alloc.c:1022 [inline] > > free_pages_prepare mm/page_alloc.c:1112 [inline] > > free_pcp_prepare mm/page_alloc.c:1137 [inline] > > free_unref_page_prepare mm/page_alloc.c:3001 [inline] > > free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 > > release_pages+0x60d/0x1940 mm/swap.c:794 > > pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 > > activate_page_drain mm/swap.c:297 [inline] > > lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 > > lru_add_drain+0x20/0x60 mm/swap.c:647 > > exit_mmap+0x290/0x530 mm/mmap.c:3134 > > __mmput kernel/fork.c:1047 [inline] > > mmput+0x15f/0x4c0 kernel/fork.c:1068 > > exit_mm kernel/exit.c:546 [inline] > > do_exit+0x816/0x2fa0 kernel/exit.c:863 > > do_group_exit+0x135/0x370 kernel/exit.c:980 > > __do_sys_exit_group kernel/exit.c:991 [inline] > > __se_sys_exit_group kernel/exit.c:989 [inline] > > __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 > > do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > RIP: 0033:0x442a58 > > Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 > > 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff > > ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 > > RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 > > RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 > > RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 > > R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 > > R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 > > > > > > --- > > This bug is generated by a bot. It may contain errors. > > See https://goo.gl/tpsmEJ for more information about syzbot. > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > syzbot will keep track of this bug report. See: > > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with > > syzbot. > > syzbot can test patches for this bug, for details see: > > https://goo.gl/tpsmEJ#testing-patches > > > > -- > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000024b3aa0582f1cde7%40google.com. > > For more options, visit https://groups.google.com/d/optout. > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CACT4Y%2BbyrcaasUaEJj%3DhcemEEBBkon%3DVC24gPwGXHzfeRP0E3w%40mail.gmail.com. > For more options, visit https://groups.google.com/d/optout. It bisects down to the same patch ("block: implement bio helper to add iter bvec pages to bio") so apparently it's just still broken despite Jens' fix. BTW, as this is trivially bisectable with the reproducer, I still don't see why syzbot can't do the bisection itself and use get_maintainer.pl on the broken patch to actually send the report to the right person: $ ./scripts/get_maintainer.pl 0001-block-implement-bio-helper-to-add-iter-bvec-pages-to.patch Jens Axboe <axboe@kernel.dk> (maintainer:BLOCK LAYER) linux-block@vger.kernel.org (open list:BLOCK LAYER) linux-kernel@vger.kernel.org (open list) Spamming unrelated lists and maintainers not only prevents the bug from being fixed, but it also reduces the average usefulness of syzbot reports which teaches people to ignore them. - Eric ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: BUG: Bad page state (6) 2019-02-28 17:42 ` Eric Biggers @ 2019-02-28 17:51 ` Jens Axboe 2019-02-28 17:53 ` Dmitry Vyukov 2019-02-28 18:04 ` Dmitry Vyukov 1 sibling, 1 reply; 8+ messages in thread From: Jens Axboe @ 2019-02-28 17:51 UTC (permalink / raw) To: Eric Biggers, Dmitry Vyukov Cc: syzbot, Andrew Morton, arunks, Dan Williams, Lance Roy, LKML, Linux-MM, Michal Hocko, nborisov, Mike Rapoport, syzkaller-bugs, Vlastimil Babka, Matthew Wilcox, yuehaibing On 2/28/19 10:42 AM, Eric Biggers wrote: > On Thu, Feb 28, 2019 at 11:36:21AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: >> On Thu, Feb 28, 2019 at 11:32 AM syzbot >> <syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com> wrote: >>> >>> Hello, >>> >>> syzbot found the following crash on: >>> >>> HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 >>> git tree: linux-next >>> console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 >>> kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f >>> dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 >>> compiler: gcc (GCC) 9.0.0 20181231 (experimental) >>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 >>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 >>> >>> IMPORTANT: if you fix the bug, please add the following tag to the commit: >>> Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com >> >> +Jens, Eric, >> >> Looks similar to: >> https://groups.google.com/forum/#!msg/syzkaller-bugs/E3v3XQweVBw/6BPrkIYJIgAJ >> Perhaps the fixing commit is not in the build yet? >> >> >>> BUG: Bad page state in process syz-executor193 pfn:9225a >>> page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 >>> shmem_aops >>> name:"memfd:cgroup2" >>> flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) >>> raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 >>> raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 >>> page dumped because: non-NULL mapping >>> Modules linked in: >>> CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 >>> #45 >>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS >>> Google 01/01/2011 >>> Call Trace: >>> __dump_stack lib/dump_stack.c:77 [inline] >>> dump_stack+0x172/0x1f0 lib/dump_stack.c:113 >>> bad_page.cold+0xda/0xff mm/page_alloc.c:586 >>> free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 >>> free_pages_check mm/page_alloc.c:1022 [inline] >>> free_pages_prepare mm/page_alloc.c:1112 [inline] >>> free_pcp_prepare mm/page_alloc.c:1137 [inline] >>> free_unref_page_prepare mm/page_alloc.c:3001 [inline] >>> free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 >>> release_pages+0x60d/0x1940 mm/swap.c:794 >>> pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 >>> activate_page_drain mm/swap.c:297 [inline] >>> lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 >>> lru_add_drain+0x20/0x60 mm/swap.c:647 >>> exit_mmap+0x290/0x530 mm/mmap.c:3134 >>> __mmput kernel/fork.c:1047 [inline] >>> mmput+0x15f/0x4c0 kernel/fork.c:1068 >>> exit_mm kernel/exit.c:546 [inline] >>> do_exit+0x816/0x2fa0 kernel/exit.c:863 >>> do_group_exit+0x135/0x370 kernel/exit.c:980 >>> __do_sys_exit_group kernel/exit.c:991 [inline] >>> __se_sys_exit_group kernel/exit.c:989 [inline] >>> __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 >>> do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 >>> entry_SYSCALL_64_after_hwframe+0x49/0xbe >>> RIP: 0033:0x442a58 >>> Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 >>> 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff >>> ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 >>> RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 >>> RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 >>> RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 >>> R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 >>> R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 >>> >>> >>> --- >>> This bug is generated by a bot. It may contain errors. >>> See https://goo.gl/tpsmEJ for more information about syzbot. >>> syzbot engineers can be reached at syzkaller@googlegroups.com. >>> >>> syzbot will keep track of this bug report. See: >>> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with >>> syzbot. >>> syzbot can test patches for this bug, for details see: >>> https://goo.gl/tpsmEJ#testing-patches >>> >>> -- >>> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. >>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. >>> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000024b3aa0582f1cde7%40google.com. >>> For more options, visit https://groups.google.com/d/optout. >> >> -- >> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. >> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. >> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CACT4Y%2BbyrcaasUaEJj%3DhcemEEBBkon%3DVC24gPwGXHzfeRP0E3w%40mail.gmail.com. >> For more options, visit https://groups.google.com/d/optout. > > It bisects down to the same patch ("block: implement bio helper to add iter bvec > pages to bio") so apparently it's just still broken despite Jens' fix. > > BTW, as this is trivially bisectable with the reproducer, I still don't see why > syzbot can't do the bisection itself and use get_maintainer.pl on the broken > patch to actually send the report to the right person: > > $ ./scripts/get_maintainer.pl 0001-block-implement-bio-helper-to-add-iter-bvec-pages-to.patch > Jens Axboe <axboe@kernel.dk> (maintainer:BLOCK LAYER) > linux-block@vger.kernel.org (open list:BLOCK LAYER) > linux-kernel@vger.kernel.org (open list) > > Spamming unrelated lists and maintainers not only prevents the bug from being > fixed, but it also reduces the average usefulness of syzbot reports which > teaches people to ignore them. Huh, weird. Where's the reproducer for this one? -- Jens Axboe ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: BUG: Bad page state (6) 2019-02-28 17:51 ` Jens Axboe @ 2019-02-28 17:53 ` Dmitry Vyukov 2019-02-28 17:54 ` Jens Axboe 2019-02-28 19:51 ` Jens Axboe 0 siblings, 2 replies; 8+ messages in thread From: Dmitry Vyukov @ 2019-02-28 17:53 UTC (permalink / raw) To: Jens Axboe Cc: Eric Biggers, syzbot, Andrew Morton, arunks, Dan Williams, Lance Roy, LKML, Linux-MM, Michal Hocko, nborisov, Mike Rapoport, syzkaller-bugs, Vlastimil Babka, Matthew Wilcox, yuehaibing On Thu, Feb 28, 2019 at 6:51 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 2/28/19 10:42 AM, Eric Biggers wrote: > > On Thu, Feb 28, 2019 at 11:36:21AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: > >> On Thu, Feb 28, 2019 at 11:32 AM syzbot > >> <syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com> wrote: > >>> > >>> Hello, > >>> > >>> syzbot found the following crash on: > >>> > >>> HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 > >>> git tree: linux-next > >>> console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 > >>> kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f > >>> dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 > >>> compiler: gcc (GCC) 9.0.0 20181231 (experimental) > >>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 > >>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 > >>> > >>> IMPORTANT: if you fix the bug, please add the following tag to the commit: > >>> Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com > >> > >> +Jens, Eric, > >> > >> Looks similar to: > >> https://groups.google.com/forum/#!msg/syzkaller-bugs/E3v3XQweVBw/6BPrkIYJIgAJ > >> Perhaps the fixing commit is not in the build yet? > >> > >> > >>> BUG: Bad page state in process syz-executor193 pfn:9225a > >>> page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 > >>> shmem_aops > >>> name:"memfd:cgroup2" > >>> flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) > >>> raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 > >>> raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 > >>> page dumped because: non-NULL mapping > >>> Modules linked in: > >>> CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 > >>> #45 > >>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > >>> Google 01/01/2011 > >>> Call Trace: > >>> __dump_stack lib/dump_stack.c:77 [inline] > >>> dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > >>> bad_page.cold+0xda/0xff mm/page_alloc.c:586 > >>> free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 > >>> free_pages_check mm/page_alloc.c:1022 [inline] > >>> free_pages_prepare mm/page_alloc.c:1112 [inline] > >>> free_pcp_prepare mm/page_alloc.c:1137 [inline] > >>> free_unref_page_prepare mm/page_alloc.c:3001 [inline] > >>> free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 > >>> release_pages+0x60d/0x1940 mm/swap.c:794 > >>> pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 > >>> activate_page_drain mm/swap.c:297 [inline] > >>> lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 > >>> lru_add_drain+0x20/0x60 mm/swap.c:647 > >>> exit_mmap+0x290/0x530 mm/mmap.c:3134 > >>> __mmput kernel/fork.c:1047 [inline] > >>> mmput+0x15f/0x4c0 kernel/fork.c:1068 > >>> exit_mm kernel/exit.c:546 [inline] > >>> do_exit+0x816/0x2fa0 kernel/exit.c:863 > >>> do_group_exit+0x135/0x370 kernel/exit.c:980 > >>> __do_sys_exit_group kernel/exit.c:991 [inline] > >>> __se_sys_exit_group kernel/exit.c:989 [inline] > >>> __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 > >>> do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 > >>> entry_SYSCALL_64_after_hwframe+0x49/0xbe > >>> RIP: 0033:0x442a58 > >>> Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 > >>> 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff > >>> ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 > >>> RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > >>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 > >>> RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 > >>> RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 > >>> R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 > >>> R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 > >>> > >>> > >>> --- > >>> This bug is generated by a bot. It may contain errors. > >>> See https://goo.gl/tpsmEJ for more information about syzbot. > >>> syzbot engineers can be reached at syzkaller@googlegroups.com. > >>> > >>> syzbot will keep track of this bug report. See: > >>> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with > >>> syzbot. > >>> syzbot can test patches for this bug, for details see: > >>> https://goo.gl/tpsmEJ#testing-patches > >>> > >>> -- > >>> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > >>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > >>> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000024b3aa0582f1cde7%40google.com. > >>> For more options, visit https://groups.google.com/d/optout. > >> > >> -- > >> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > >> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > >> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CACT4Y%2BbyrcaasUaEJj%3DhcemEEBBkon%3DVC24gPwGXHzfeRP0E3w%40mail.gmail.com. > >> For more options, visit https://groups.google.com/d/optout. > > > > It bisects down to the same patch ("block: implement bio helper to add iter bvec > > pages to bio") so apparently it's just still broken despite Jens' fix. > > > > BTW, as this is trivially bisectable with the reproducer, I still don't see why > > syzbot can't do the bisection itself and use get_maintainer.pl on the broken > > patch to actually send the report to the right person: > > > > $ ./scripts/get_maintainer.pl 0001-block-implement-bio-helper-to-add-iter-bvec-pages-to.patch > > Jens Axboe <axboe@kernel.dk> (maintainer:BLOCK LAYER) > > linux-block@vger.kernel.org (open list:BLOCK LAYER) > > linux-kernel@vger.kernel.org (open list) > > > > Spamming unrelated lists and maintainers not only prevents the bug from being > > fixed, but it also reduces the average usefulness of syzbot reports which > > teaches people to ignore them. > > Huh, weird. Where's the reproducer for this one? Under the "C reproducer" link. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: BUG: Bad page state (6) 2019-02-28 17:53 ` Dmitry Vyukov @ 2019-02-28 17:54 ` Jens Axboe 2019-02-28 19:51 ` Jens Axboe 1 sibling, 0 replies; 8+ messages in thread From: Jens Axboe @ 2019-02-28 17:54 UTC (permalink / raw) To: Dmitry Vyukov Cc: Eric Biggers, syzbot, Andrew Morton, arunks, Dan Williams, Lance Roy, LKML, Linux-MM, Michal Hocko, nborisov, Mike Rapoport, syzkaller-bugs, Vlastimil Babka, Matthew Wilcox, yuehaibing On 2/28/19 10:53 AM, Dmitry Vyukov wrote: > On Thu, Feb 28, 2019 at 6:51 PM Jens Axboe <axboe@kernel.dk> wrote: >> >> On 2/28/19 10:42 AM, Eric Biggers wrote: >>> On Thu, Feb 28, 2019 at 11:36:21AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: >>>> On Thu, Feb 28, 2019 at 11:32 AM syzbot >>>> <syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com> wrote: >>>>> >>>>> Hello, >>>>> >>>>> syzbot found the following crash on: >>>>> >>>>> HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 >>>>> git tree: linux-next >>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 >>>>> kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f >>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 >>>>> compiler: gcc (GCC) 9.0.0 20181231 (experimental) >>>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 >>>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 >>>>> >>>>> IMPORTANT: if you fix the bug, please add the following tag to the commit: >>>>> Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com >>>> >>>> +Jens, Eric, >>>> >>>> Looks similar to: >>>> https://groups.google.com/forum/#!msg/syzkaller-bugs/E3v3XQweVBw/6BPrkIYJIgAJ >>>> Perhaps the fixing commit is not in the build yet? >>>> >>>> >>>>> BUG: Bad page state in process syz-executor193 pfn:9225a >>>>> page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 >>>>> shmem_aops >>>>> name:"memfd:cgroup2" >>>>> flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) >>>>> raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 >>>>> raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 >>>>> page dumped because: non-NULL mapping >>>>> Modules linked in: >>>>> CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 >>>>> #45 >>>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS >>>>> Google 01/01/2011 >>>>> Call Trace: >>>>> __dump_stack lib/dump_stack.c:77 [inline] >>>>> dump_stack+0x172/0x1f0 lib/dump_stack.c:113 >>>>> bad_page.cold+0xda/0xff mm/page_alloc.c:586 >>>>> free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 >>>>> free_pages_check mm/page_alloc.c:1022 [inline] >>>>> free_pages_prepare mm/page_alloc.c:1112 [inline] >>>>> free_pcp_prepare mm/page_alloc.c:1137 [inline] >>>>> free_unref_page_prepare mm/page_alloc.c:3001 [inline] >>>>> free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 >>>>> release_pages+0x60d/0x1940 mm/swap.c:794 >>>>> pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 >>>>> activate_page_drain mm/swap.c:297 [inline] >>>>> lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 >>>>> lru_add_drain+0x20/0x60 mm/swap.c:647 >>>>> exit_mmap+0x290/0x530 mm/mmap.c:3134 >>>>> __mmput kernel/fork.c:1047 [inline] >>>>> mmput+0x15f/0x4c0 kernel/fork.c:1068 >>>>> exit_mm kernel/exit.c:546 [inline] >>>>> do_exit+0x816/0x2fa0 kernel/exit.c:863 >>>>> do_group_exit+0x135/0x370 kernel/exit.c:980 >>>>> __do_sys_exit_group kernel/exit.c:991 [inline] >>>>> __se_sys_exit_group kernel/exit.c:989 [inline] >>>>> __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 >>>>> do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 >>>>> entry_SYSCALL_64_after_hwframe+0x49/0xbe >>>>> RIP: 0033:0x442a58 >>>>> Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 >>>>> 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff >>>>> ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 >>>>> RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >>>>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 >>>>> RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 >>>>> RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 >>>>> R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 >>>>> R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 >>>>> >>>>> >>>>> --- >>>>> This bug is generated by a bot. It may contain errors. >>>>> See https://goo.gl/tpsmEJ for more information about syzbot. >>>>> syzbot engineers can be reached at syzkaller@googlegroups.com. >>>>> >>>>> syzbot will keep track of this bug report. See: >>>>> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with >>>>> syzbot. >>>>> syzbot can test patches for this bug, for details see: >>>>> https://goo.gl/tpsmEJ#testing-patches >>>>> >>>>> -- >>>>> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. >>>>> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000024b3aa0582f1cde7%40google.com. >>>>> For more options, visit https://groups.google.com/d/optout. >>>> >>>> -- >>>> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. >>>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. >>>> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CACT4Y%2BbyrcaasUaEJj%3DhcemEEBBkon%3DVC24gPwGXHzfeRP0E3w%40mail.gmail.com. >>>> For more options, visit https://groups.google.com/d/optout. >>> >>> It bisects down to the same patch ("block: implement bio helper to add iter bvec >>> pages to bio") so apparently it's just still broken despite Jens' fix. >>> >>> BTW, as this is trivially bisectable with the reproducer, I still don't see why >>> syzbot can't do the bisection itself and use get_maintainer.pl on the broken >>> patch to actually send the report to the right person: >>> >>> $ ./scripts/get_maintainer.pl 0001-block-implement-bio-helper-to-add-iter-bvec-pages-to.patch >>> Jens Axboe <axboe@kernel.dk> (maintainer:BLOCK LAYER) >>> linux-block@vger.kernel.org (open list:BLOCK LAYER) >>> linux-kernel@vger.kernel.org (open list) >>> >>> Spamming unrelated lists and maintainers not only prevents the bug from being >>> fixed, but it also reduces the average usefulness of syzbot reports which >>> teaches people to ignore them. >> >> Huh, weird. Where's the reproducer for this one? > > Under the "C reproducer" link. Got it, for some reason I overlooked that. Thanks. -- Jens Axboe ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: BUG: Bad page state (6) 2019-02-28 17:53 ` Dmitry Vyukov 2019-02-28 17:54 ` Jens Axboe @ 2019-02-28 19:51 ` Jens Axboe 1 sibling, 0 replies; 8+ messages in thread From: Jens Axboe @ 2019-02-28 19:51 UTC (permalink / raw) To: Dmitry Vyukov Cc: Eric Biggers, syzbot, Andrew Morton, arunks, Dan Williams, Lance Roy, LKML, Linux-MM, Michal Hocko, nborisov, Mike Rapoport, syzkaller-bugs, Vlastimil Babka, Matthew Wilcox, yuehaibing On 2/28/19 10:53 AM, Dmitry Vyukov wrote: > On Thu, Feb 28, 2019 at 6:51 PM Jens Axboe <axboe@kernel.dk> wrote: >> >> On 2/28/19 10:42 AM, Eric Biggers wrote: >>> On Thu, Feb 28, 2019 at 11:36:21AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: >>>> On Thu, Feb 28, 2019 at 11:32 AM syzbot >>>> <syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com> wrote: >>>>> >>>>> Hello, >>>>> >>>>> syzbot found the following crash on: >>>>> >>>>> HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 >>>>> git tree: linux-next >>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 >>>>> kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f >>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 >>>>> compiler: gcc (GCC) 9.0.0 20181231 (experimental) >>>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 >>>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 >>>>> >>>>> IMPORTANT: if you fix the bug, please add the following tag to the commit: >>>>> Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com >>>> >>>> +Jens, Eric, >>>> >>>> Looks similar to: >>>> https://groups.google.com/forum/#!msg/syzkaller-bugs/E3v3XQweVBw/6BPrkIYJIgAJ >>>> Perhaps the fixing commit is not in the build yet? >>>> >>>> >>>>> BUG: Bad page state in process syz-executor193 pfn:9225a >>>>> page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 >>>>> shmem_aops >>>>> name:"memfd:cgroup2" >>>>> flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) >>>>> raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 >>>>> raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 >>>>> page dumped because: non-NULL mapping >>>>> Modules linked in: >>>>> CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 >>>>> #45 >>>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS >>>>> Google 01/01/2011 >>>>> Call Trace: >>>>> __dump_stack lib/dump_stack.c:77 [inline] >>>>> dump_stack+0x172/0x1f0 lib/dump_stack.c:113 >>>>> bad_page.cold+0xda/0xff mm/page_alloc.c:586 >>>>> free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 >>>>> free_pages_check mm/page_alloc.c:1022 [inline] >>>>> free_pages_prepare mm/page_alloc.c:1112 [inline] >>>>> free_pcp_prepare mm/page_alloc.c:1137 [inline] >>>>> free_unref_page_prepare mm/page_alloc.c:3001 [inline] >>>>> free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 >>>>> release_pages+0x60d/0x1940 mm/swap.c:794 >>>>> pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 >>>>> activate_page_drain mm/swap.c:297 [inline] >>>>> lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 >>>>> lru_add_drain+0x20/0x60 mm/swap.c:647 >>>>> exit_mmap+0x290/0x530 mm/mmap.c:3134 >>>>> __mmput kernel/fork.c:1047 [inline] >>>>> mmput+0x15f/0x4c0 kernel/fork.c:1068 >>>>> exit_mm kernel/exit.c:546 [inline] >>>>> do_exit+0x816/0x2fa0 kernel/exit.c:863 >>>>> do_group_exit+0x135/0x370 kernel/exit.c:980 >>>>> __do_sys_exit_group kernel/exit.c:991 [inline] >>>>> __se_sys_exit_group kernel/exit.c:989 [inline] >>>>> __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 >>>>> do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 >>>>> entry_SYSCALL_64_after_hwframe+0x49/0xbe >>>>> RIP: 0033:0x442a58 >>>>> Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 >>>>> 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff >>>>> ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 >>>>> RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >>>>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 >>>>> RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 >>>>> RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 >>>>> R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 >>>>> R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 >>>>> >>>>> >>>>> --- >>>>> This bug is generated by a bot. It may contain errors. >>>>> See https://goo.gl/tpsmEJ for more information about syzbot. >>>>> syzbot engineers can be reached at syzkaller@googlegroups.com. >>>>> >>>>> syzbot will keep track of this bug report. See: >>>>> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with >>>>> syzbot. >>>>> syzbot can test patches for this bug, for details see: >>>>> https://goo.gl/tpsmEJ#testing-patches >>>>> >>>>> -- >>>>> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. >>>>> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000024b3aa0582f1cde7%40google.com. >>>>> For more options, visit https://groups.google.com/d/optout. >>>> >>>> -- >>>> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. >>>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. >>>> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CACT4Y%2BbyrcaasUaEJj%3DhcemEEBBkon%3DVC24gPwGXHzfeRP0E3w%40mail.gmail.com. >>>> For more options, visit https://groups.google.com/d/optout. >>> >>> It bisects down to the same patch ("block: implement bio helper to add iter bvec >>> pages to bio") so apparently it's just still broken despite Jens' fix. >>> >>> BTW, as this is trivially bisectable with the reproducer, I still don't see why >>> syzbot can't do the bisection itself and use get_maintainer.pl on the broken >>> patch to actually send the report to the right person: >>> >>> $ ./scripts/get_maintainer.pl 0001-block-implement-bio-helper-to-add-iter-bvec-pages-to.patch >>> Jens Axboe <axboe@kernel.dk> (maintainer:BLOCK LAYER) >>> linux-block@vger.kernel.org (open list:BLOCK LAYER) >>> linux-kernel@vger.kernel.org (open list) >>> >>> Spamming unrelated lists and maintainers not only prevents the bug from being >>> fixed, but it also reduces the average usefulness of syzbot reports which >>> teaches people to ignore them. >> >> Huh, weird. Where's the reproducer for this one? > > Under the "C reproducer" link. This doesn't reproduce for me, but I think that's because there was a bug in the mp_bvec_for_each_page() helper. I merged a fix for it this morning, should be fine after that. -- Jens Axboe ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: BUG: Bad page state (6) 2019-02-28 17:42 ` Eric Biggers 2019-02-28 17:51 ` Jens Axboe @ 2019-02-28 18:04 ` Dmitry Vyukov 1 sibling, 0 replies; 8+ messages in thread From: Dmitry Vyukov @ 2019-02-28 18:04 UTC (permalink / raw) To: Eric Biggers Cc: syzbot, Jens Axboe, Andrew Morton, arunks, Dan Williams, Lance Roy, LKML, Linux-MM, Michal Hocko, nborisov, Mike Rapoport, syzkaller-bugs, Vlastimil Babka, Matthew Wilcox, yuehaibing On Thu, Feb 28, 2019 at 6:42 PM Eric Biggers <ebiggers@kernel.org> wrote: > > On Thu, Feb 28, 2019 at 11:36:21AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: > > On Thu, Feb 28, 2019 at 11:32 AM syzbot > > <syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com> wrote: > > > > > > Hello, > > > > > > syzbot found the following crash on: > > > > > > HEAD commit: 42fd8df9d1d9 Add linux-next specific files for 20190228 > > > git tree: linux-next > > > console output: https://syzkaller.appspot.com/x/log.txt?x=179ba9e0c00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=c0f38652d28b522f > > > dashboard link: https://syzkaller.appspot.com/bug?extid=6f5a9b79b75b66078bf0 > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ed6bd0c00000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10690c8ac00000 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+6f5a9b79b75b66078bf0@syzkaller.appspotmail.com > > > > +Jens, Eric, > > > > Looks similar to: > > https://groups.google.com/forum/#!msg/syzkaller-bugs/E3v3XQweVBw/6BPrkIYJIgAJ > > Perhaps the fixing commit is not in the build yet? > > > > > > > BUG: Bad page state in process syz-executor193 pfn:9225a > > > page:ffffea0002489680 count:0 mapcount:0 mapping:ffff88808652fd80 index:0x81 > > > shmem_aops > > > name:"memfd:cgroup2" > > > flags: 0x1fffc000008000e(referenced|uptodate|dirty|swapbacked) > > > raw: 01fffc000008000e ffff88809277fac0 ffff88809277fac0 ffff88808652fd80 > > > raw: 0000000000000081 0000000000000000 00000000ffffffff 0000000000000000 > > > page dumped because: non-NULL mapping > > > Modules linked in: > > > CPU: 0 PID: 7659 Comm: syz-executor193 Not tainted 5.0.0-rc8-next-20190228 > > > #45 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > Google 01/01/2011 > > > Call Trace: > > > __dump_stack lib/dump_stack.c:77 [inline] > > > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > > > bad_page.cold+0xda/0xff mm/page_alloc.c:586 > > > free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1013 > > > free_pages_check mm/page_alloc.c:1022 [inline] > > > free_pages_prepare mm/page_alloc.c:1112 [inline] > > > free_pcp_prepare mm/page_alloc.c:1137 [inline] > > > free_unref_page_prepare mm/page_alloc.c:3001 [inline] > > > free_unref_page_list+0x31d/0xc40 mm/page_alloc.c:3070 > > > release_pages+0x60d/0x1940 mm/swap.c:794 > > > pagevec_lru_move_fn+0x218/0x2a0 mm/swap.c:213 > > > activate_page_drain mm/swap.c:297 [inline] > > > lru_add_drain_cpu+0x3b1/0x520 mm/swap.c:596 > > > lru_add_drain+0x20/0x60 mm/swap.c:647 > > > exit_mmap+0x290/0x530 mm/mmap.c:3134 > > > __mmput kernel/fork.c:1047 [inline] > > > mmput+0x15f/0x4c0 kernel/fork.c:1068 > > > exit_mm kernel/exit.c:546 [inline] > > > do_exit+0x816/0x2fa0 kernel/exit.c:863 > > > do_group_exit+0x135/0x370 kernel/exit.c:980 > > > __do_sys_exit_group kernel/exit.c:991 [inline] > > > __se_sys_exit_group kernel/exit.c:989 [inline] > > > __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989 > > > do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 > > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > > RIP: 0033:0x442a58 > > > Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 > > > 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff > > > ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 > > > RSP: 002b:00007ffe99e2faf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > > > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442a58 > > > RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 > > > RBP: 00000000004c2468 R08: 00000000000000e7 R09: ffffffffffffffd0 > > > R10: 0000000002000005 R11: 0000000000000246 R12: 0000000000000001 > > > R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 > > > > > > > > > --- > > > This bug is generated by a bot. It may contain errors. > > > See https://goo.gl/tpsmEJ for more information about syzbot. > > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > > > syzbot will keep track of this bug report. See: > > > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with > > > syzbot. > > > syzbot can test patches for this bug, for details see: > > > https://goo.gl/tpsmEJ#testing-patches > > > > > > -- > > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000024b3aa0582f1cde7%40google.com. > > > For more options, visit https://groups.google.com/d/optout. > > > > -- > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CACT4Y%2BbyrcaasUaEJj%3DhcemEEBBkon%3DVC24gPwGXHzfeRP0E3w%40mail.gmail.com. > > For more options, visit https://groups.google.com/d/optout. > > It bisects down to the same patch ("block: implement bio helper to add iter bvec > pages to bio") so apparently it's just still broken despite Jens' fix. > > BTW, as this is trivially bisectable with the reproducer, I still don't see why > syzbot can't do the bisection itself and use get_maintainer.pl on the broken > patch to actually send the report to the right person: > > $ ./scripts/get_maintainer.pl 0001-block-implement-bio-helper-to-add-iter-bvec-pages-to.patch > Jens Axboe <axboe@kernel.dk> (maintainer:BLOCK LAYER) > linux-block@vger.kernel.org (open list:BLOCK LAYER) > linux-kernel@vger.kernel.org (open list) > > Spamming unrelated lists and maintainers not only prevents the bug from being > fixed, but it also reduces the average usefulness of syzbot reports which > teaches people to ignore them. It can. It's just lots of work to code generic logic that can reliably handle all possible cases in fully automated fashion, build production pipeline that will schedule and execute all of this, built in necessary introspection, design persistent data formats, etc. ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2019-02-28 19:51 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-02-28 10:32 BUG: Bad page state (6) syzbot 2019-02-28 10:36 ` Dmitry Vyukov 2019-02-28 17:42 ` Eric Biggers 2019-02-28 17:51 ` Jens Axboe 2019-02-28 17:53 ` Dmitry Vyukov 2019-02-28 17:54 ` Jens Axboe 2019-02-28 19:51 ` Jens Axboe 2019-02-28 18:04 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox