From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55775C48BC3 for ; Mon, 19 Feb 2024 23:22:49 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B4EAA6B0074; Mon, 19 Feb 2024 18:22:48 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id AFEF36B0078; Mon, 19 Feb 2024 18:22:48 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9C6176B007B; Mon, 19 Feb 2024 18:22:48 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 8CC896B0074 for ; Mon, 19 Feb 2024 18:22:48 -0500 (EST) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 5761BA0522 for ; Mon, 19 Feb 2024 23:22:48 +0000 (UTC) X-FDA: 81810130416.13.9B162C3 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf28.hostedemail.com (Postfix) with ESMTP id EE0D9C0009 for ; Mon, 19 Feb 2024 23:22:44 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b="EaJ+0C/c"; dmarc=none; spf=pass (imf28.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1708384965; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=dS4/ZIqd5bPp7HguR2CoeymoYj6OUnoJBfnWAWRYEHg=; b=EG4l+9oGr2AaNcH46qx5xldr1X7jIBJoIyM/7+whxw1TmFY7p97QHGbRVog3uemld9/Dtj TPQ0x0t6ugg9qrT0uyWZ6D1Yf7R73hDXEEGXFmr4fsh/cqOAzUhSAM32RcXUKdcsK2gW+w i01cIgPUcbXywkBhdVAwlSx+poC2qT4= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b="EaJ+0C/c"; dmarc=none; spf=pass (imf28.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1708384965; a=rsa-sha256; cv=none; b=oaLGExF2MiywVum3Dr9yJSOcwypZH26fGz0sIYZxcfAZfKSeGnWmoAfh/s4erjMgCxBrDt WQdSwuDKKLG6cqmbIN4GBvxsPPhrNsgIMHTi3XyglIBCHMgrc0DhIc22bJ5aQhAg6smw5H GX32fkS/veybPtjIAf9xuq21AEXdwGY= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id DDA69CE1748; Mon, 19 Feb 2024 23:22:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA7CCC433F1; Mon, 19 Feb 2024 23:22:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1708384960; bh=FWpOBCkODHabkJO/2Ou8aa2AzNh5BEcl7n0oV56Fg6I=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=EaJ+0C/cEo6UVze4RUQGwKFJgNpO8UmXvSGW6lbK+7OHYWMujxiCpHYry3kLZrm7R /qv5sNQdPs+ftbGleMvMDWz30WC8x5xjzyROERVRnVce32Sk1lEBFPcnhKg18tQmZt FU4nutJtr81rBgvMzuJ3pOv9yUmRjneixVpyBw0Y= Date: Mon, 19 Feb 2024 15:22:39 -0800 From: Andrew Morton To: "Michael S. Tsirkin" Cc: syzbot , jasowang@redhat.com, linux-kernel@vger.kernel.org, linux-next@vger.kernel.org, sfr@canb.auug.org.au, syzkaller-bugs@googlegroups.com, virtualization@lists.linux.dev, xuanzhuo@linux.alibaba.com, linux-mm@kvack.org Subject: Re: [syzbot] [virtualization?] linux-next boot error: WARNING: refcount bug in __free_pages_ok Message-Id: <20240219152239.e281ca98f06cb71276db7791@linux-foundation.org> In-Reply-To: <20240219022853-mutt-send-email-mst@kernel.org> References: <000000000000d305050611b50d09@google.com> <20240219022853-mutt-send-email-mst@kernel.org> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: EE0D9C0009 X-Rspam-User: X-Rspamd-Server: rspam02 X-Stat-Signature: rt48gr73nwnupysahar1cd5tw6m51yzt X-HE-Tag: 1708384964-950306 X-HE-Meta: U2FsdGVkX18zRRKQMp9cpoSpizOStl2zkAcqd7LNwzHq2LuryrB8HclhBdP3pgc6PdRyofpupaOSBgrZN2rzb1UwDQcZY0jf4/YpZyMfT86/FldlWyuL/e+T8hCMHmoGhnkuj9Hs4ZcL9paucuv7WuRSvz7IfYEEZKm7HnlpLZ14ZHmg3g6mD8V5a7+uSvd8A93lNvs1hbxPU2FM3HHR8VROJgfErGIsD6rrBc5lpU0pax/7g9hYtxbd5B7fy3BpUwU/Z9INaHW6Q4AudFHIlQY+q1Ol56Am7ym4Y1t35XvPLX7nWi12cCVe+YwwQ7wFs3kQ0gQM/RTLLENFfoSx05BqGSEjAHbnW6XGCwO2y769EqBcwd0UGAZg4OKmjXbFQqYFFIEnJTIu60IgCrCKnDah44MM1Xz6VPzlJPq83tjLr/wGlz3f/Y1JiX8Luf0dOhhQHG4Py3ECL+u60ftj9fnhUiwCMwFmTyypTqBsUeNku0uC+W/9cN7L+00hTQEc3mYCSoPpR/cpP0F/IS6lY4zdLRDl/URSyIHsDm1XGmZ+hpmeqlF4xZvgY/EUXqzkr7rT2VNj0+jAsSGkO2nKN9FgBIpRXPEnI5q1ao01U8DiBtolBpT9wTru8QpF/UIZUVE4qWH1SiLz5JiLlcBa6joCTQiamaT1V/tLogYjEBeX4ntYF4POmmIqDKHeJ5PZ/DXmh7AWIXBYbXTLJpjcpEsp4LGAj6f23NUKKztenxa3sBMWemNa3Gx92vIuPpnf5pndP1Nzpz57+fI0y15pwwOMM7I4x4w38j3hc6piVqWCb8YwC1sgDcZu+l3IZwLzdh09tto83eB/ydHhghY2kwWWHV9mwSCiOtk+hdUe8mBoU7SllebUmQUTyfR6PTx37d/AqdO7jjl86k8rgENz0hszRxTX+VAcn/xzrsdbufagQ08PPtvpAO0uNe1163LsTLIUbVIc10KpysbZz/U wsLtQFwL NvNMJ8NQ2dD6iBZmFKVqNtWIpPxtKN/y9lsszZKHarhgO0WWp4YKZONGG4hyUwkA/+rzFNpGsdgxaaonv900HFAj1a8XfKDnGnP2U6JqOexSosv3XJF22HzFEYaNrYGQGXORtDcd8ADryTJFsJY65RsnyKjFN3/fsNKUgRObBgQ4aGkEt7GGLW1QydNWbjiIBZ66lRi2ZK/x0jyl9xxL9UjAm7vJe/mvhsvCVxubbv2/xmnKxxIY1GzbU3qX12SJI8UGZoAGg9/lgobfJ3/A8JGwtYk5n0RqUmNmj6v6V/bVc8S8OKmu3l0IXaMGty3SRj+83A1FuJCNgxk/T+pLcM1saB56hvXXKLTCYDyJ9BL08mLIkQqCJc74gi3o5ps3v4V0IjtVBpMFEr1cyPoL3LpPagImS9Iq99KzzXxpoZTsK10D47nkaU7DU6dkFlDnr4/smUgZxf6Q2bL9ne+tslOjHN6mY8TWJerySamFo/ETcJZnA91T2+W9aFa9+ShsFsaWjo10DnJIMeuP39ewz79csXAsRHAcC+zlA3unH4NuBhGHwtIk22yrkMgRYSvlb98XPLHk+PbkMQlMrFv2ik6xUgLz2/kERpIWv45whLt7Oj2EBqPBn2jGDyUWDJE+eUgynBFJ7rFU26/mVo+FtzfZNQXP2DCxJcC2D4+IIXpjv0yru4x61dQ9vVUC2pgyIhaRdxerX78sUfKeHJy14SVBe5Uu6DoyZyJafakf6Zl/1GjiYzFn9RQqU9jfL23yUn5q2VdP4mTS4xN733qJk0ZhySGzMPqVwiNncSwwcvh/PO900IZtsCvkaFTXOmeklVXGV5oVhVsFCxb2Wb4o47cb6oi7lo2chn39QvicNuQypL5NQhvsBJC1oXQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, 19 Feb 2024 02:35:20 -0500 "Michael S. Tsirkin" wrote: > On Sun, Feb 18, 2024 at 09:06:18PM -0800, syzbot wrote: > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: d37e1e4c52bc Add linux-next specific files for 20240216 > > git tree: linux-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=171ca652180000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=4bc446d42a7d56c0 > > dashboard link: https://syzkaller.appspot.com/bug?extid=6f3c38e8a6a0297caa5a > > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > > > > Downloadable assets: > > disk image: https://storage.googleapis.com/syzbot-assets/14d0894504b9/disk-d37e1e4c.raw.xz > > vmlinux: https://storage.googleapis.com/syzbot-assets/6cda61e084ee/vmlinux-d37e1e4c.xz > > kernel image: https://storage.googleapis.com/syzbot-assets/720c85283c05/bzImage-d37e1e4c.xz > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+6f3c38e8a6a0297caa5a@syzkaller.appspotmail.com > > > > ... > > > usbcore: registered new interface driver port100 > > usbcore: registered new interface driver nfcmrvl > > Loading iSCSI transport class v2.0-870. > > virtio_scsi virtio0: 1/0/0 default/read/poll queues > > ------------[ cut here ]------------ > > refcount_t: decrement hit 0; leaking memory. > > WARNING: CPU: 0 PID: 1 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31 > > Modules linked in: > > CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-rc4-next-20240216-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 > > RIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31 > > Code: b2 00 00 00 e8 b7 94 f0 fc 5b 5d c3 cc cc cc cc e8 ab 94 f0 fc c6 05 c6 16 ce 0a 01 90 48 c7 c7 a0 5a fe 8b e8 67 69 b4 fc 90 <0f> 0b 90 90 eb d9 e8 8b 94 f0 fc c6 05 a3 16 ce 0a 01 90 48 c7 c7 > > RSP: 0000:ffffc90000066e10 EFLAGS: 00010246 > > RAX: 15c2c224c9b50400 RBX: ffff888020827d2c RCX: ffff8880162d8000 > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > > RBP: 0000000000000004 R08: ffffffff8157b942 R09: fffffbfff1bf95cc > > R10: dffffc0000000000 R11: fffffbfff1bf95cc R12: ffffea000502fdc0 > > R13: ffffea000502fdc8 R14: 1ffffd4000a05fb9 R15: 0000000000000000 > > FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: ffff88823ffff000 CR3: 000000000df32000 CR4: 00000000003506f0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > Call Trace: > > > > reset_page_owner include/linux/page_owner.h:24 [inline] > > free_pages_prepare mm/page_alloc.c:1140 [inline] > > __free_pages_ok+0xc42/0xd70 mm/page_alloc.c:1269 > > make_alloc_exact+0xc4/0x140 mm/page_alloc.c:4847 > > vring_alloc_queue drivers/virtio/virtio_ring.c:319 [inline] > > Wow this seems to be breakage deep in mm/ - all virtio does is > call alloc_pages_exact and that corrupts the refcounts? > Will the bot be performing a bisection? If not, can one please be performed?