[syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    8867bbd4a056 mm: arm64: Fix the out-of-bounds issue in con..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=146b3d96980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3b4350cf56c61c80
dashboard link: https://syzkaller.appspot.com/bug?extid=0b56d6ed0d0c0c9a79dc
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6ea21f50498b/disk-8867bbd4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e2fed09364aa/vmlinux-8867bbd4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4860173c7a18/Image-8867bbd4.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0b56d6ed0d0c0c9a79dc@syzkaller.appspotmail.com

Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: CMTP (CAPI Emulation) ver 1.0
Bluetooth: CMTP socket layer initialized
Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
NET: Registered PF_RXRPC protocol family
Key type rxrpc registered
Key type rxrpc_s registered
NET: Registered PF_KCM protocol family
lec:lane_module_init: lec.c: initialized
mpoa:atm_mpoa_init: mpc.c: initialized
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
l2tp_ip: L2TP IP encapsulation support (L2TPv3)
l2tp_netlink: L2TP netlink interface
l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
NET: Registered PF_PHONET protocol family
8021q: 802.1Q VLAN Support v1.8
DCCP: Activated CCID 2 (TCP-like)
DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
sctp: Hash tables configured (bind 32/56)
NET: Registered PF_RDS protocol family
Registered RDS/infiniband transport
Registered RDS/tcp transport
tipc: Activated (version 2.0.0)
NET: Registered PF_TIPC protocol family
tipc: Started in single node mode
NET: Registered PF_SMC protocol family
9pnet: Installing 9P2000 support
NET: Registered PF_CAIF protocol family
NET: Registered PF_IEEE802154 protocol family
Key type dns_resolver registered
Key type ceph registered
libceph: loaded (mon/osd proto 15/24)
batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
openvswitch: Open vSwitch switching datapath
NET: Registered PF_VSOCK protocol family
mpls_gso: MPLS GSO support
Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
registered taskstats version 1
Loading compiled-in X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: 79e1c0a63a233d95d926db3e542dc8d9e342ab6b'
zswap: loaded using pool lzo/zsmalloc
Demotion targets for Node 0: null
debug_vm_pgtable: [debug_vm_pgtable         ]: Validating architecture page table helpers
------------[ cut here ]------------
WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 page_table_check_pte_flags mm/page_table_check.c:198 [inline]
WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
Modules linked in:
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc2-syzkaller-g8867bbd4a056 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : page_table_check_pte_flags mm/page_table_check.c:198 [inline]
pc : __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
lr : page_table_check_pte_flags mm/page_table_check.c:198 [inline]
lr : __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
sp : ffff800093d57520
x29: ffff800093d575a0 x28: ffff7000127aaec8 x27: dfff800000000000
x26: 0000000000000001 x25: bfeffffffffffff3 x24: 1ffff000127aaea8
x23: 0408000000000000 x22: 0000000000000001 x21: ffff0000d38131b8
x20: ffff800093d57540 x19: 0408000000000000 x18: ffff800093d57300
x17: 00000000000074be x16: ffff800080b0d2d4 x15: ffff7000127aaeb0
x14: 1ffff000127aaeb0 x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff80008eb6e78c x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000c1968000 x7 : ffff80008096b550 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
x2 : bfeffffffffffff3 x1 : 0408000000000000 x0 : 0408000000000000
Call trace:
 page_table_check_pte_flags mm/page_table_check.c:198 [inline]
 __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
 page_table_check_ptes_set include/linux/page_table_check.h:74 [inline]
 __set_ptes arch/arm64/include/asm/pgtable.h:404 [inline]
 set_ptes arch/arm64/include/asm/pgtable.h:1586 [inline]
 pte_clear_tests+0x510/0x538 mm/debug_vm_pgtable.c:640
 debug_vm_pgtable+0x268/0x590 mm/debug_vm_pgtable.c:1392
 do_one_initcall+0x254/0x9e4 init/main.c:1267
 do_initcall_level+0x154/0x214 init/main.c:1329
 do_initcalls+0x58/0xac init/main.c:1345
 do_basic_setup+0x8c/0xa0 init/main.c:1364
 kernel_init_freeable+0x324/0x478 init/main.c:1578
 kernel_init+0x24/0x2a0 init/main.c:1467
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 1342246
hardirqs last  enabled at (1342245): [<ffff8000809ba500>] seqcount_lockdep_reader_access+0x6c/0xd4 include/linux/seqlock.h:74
hardirqs last disabled at (1342246): [<ffff80008af10a10>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:470
softirqs last  enabled at (1342178): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last  enabled at (1342178): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582
softirqs last disabled at (1341257): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588
---[ end trace 0000000000000000 ]---
page_owner is disabled
Key type .fscrypt registered
Key type fscrypt-provisioning registered
kAFS: Red Hat AFS client v0.1 registering.
Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
Key type big_key registered
Key type encrypted registered
ima: No TPM chip found, activating TPM-bypass!
Loading compiled-in module X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: 79e1c0a63a233d95d926db3e542dc8d9e342ab6b'
ima: Allocated hash algorithm: sha256
ima: No architecture policies found
evm: Initialising EVM extended attributes:
evm: security.selinux (disabled)
evm: security.SMACK64
evm: security.SMACK64EXEC
evm: security.SMACK64TRANSMUTE
evm: security.SMACK64MMAP
evm: security.apparmor (disabled)
evm: security.ima
evm: security.capability
evm: HMAC attrs: 0x1
printk: legacy console [netcon0] enabled
netconsole: network logging started
gtp: GTP module loaded (pdp ctx size 128 bytes)
rdma_rxe: loaded
cfg80211: Loading compiled-in X.509 certificates for regulatory database
Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
clk: Disabling unused clocks
PM: genpd: Disabling unused power domains
ALSA device list:
  #0: Dummy 1
  #1: Loopback 1
  #2: Virtual MIDI Card 1
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
EXT4-fs (nvme0n1p2): mounted filesystem 126e38a5-b482-40da-8f06-bd78886e02c1 ro with ordered data mode. Quota mode: none.
VFS: Mounted root (ext4 filesystem) readonly on device 259:2.
devtmpfs: mounted
Freeing unused kernel memory: 4416K
Run /sbin/init as init process


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[Andrew Morton]

On Wed, 12 Jun 2024 10:18:21 -0700 syzbot <syzbot+0b56d6ed0d0c0c9a79dc@syzkaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8867bbd4a056 mm: arm64: Fix the out-of-bounds issue in con..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=146b3d96980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3b4350cf56c61c80
> dashboard link: https://syzkaller.appspot.com/bug?extid=0b56d6ed0d0c0c9a79dc
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> 
> Unfortunately, I don't have any reproducer for this issue yet.
>
> ...
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211

	if (pte_present(pte) && pte_uffd_wp(pte))
		WARN_ON_ONCE(pte_write(pte));

Let me optimistically cc Peter ;)

> Modules linked in:
> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc2-syzkaller-g8867bbd4a056 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
> pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> pc : __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
> lr : page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> lr : __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
> sp : ffff800093d57520
> x29: ffff800093d575a0 x28: ffff7000127aaec8 x27: dfff800000000000
> x26: 0000000000000001 x25: bfeffffffffffff3 x24: 1ffff000127aaea8
> x23: 0408000000000000 x22: 0000000000000001 x21: ffff0000d38131b8
> x20: ffff800093d57540 x19: 0408000000000000 x18: ffff800093d57300
> x17: 00000000000074be x16: ffff800080b0d2d4 x15: ffff7000127aaeb0
> x14: 1ffff000127aaeb0 x13: 0000000000000004 x12: ffffffffffffffff
> x11: ffff80008eb6e78c x10: 0000000000ff0100 x9 : 0000000000000000
> x8 : ffff0000c1968000 x7 : ffff80008096b550 x6 : 0000000000000000
> x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
> x2 : bfeffffffffffff3 x1 : 0408000000000000 x0 : 0408000000000000
> Call trace:
>  page_table_check_pte_flags mm/page_table_check.c:198 [inline]
>  __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
>  page_table_check_ptes_set include/linux/page_table_check.h:74 [inline]
>  __set_ptes arch/arm64/include/asm/pgtable.h:404 [inline]
>  set_ptes arch/arm64/include/asm/pgtable.h:1586 [inline]
>  pte_clear_tests+0x510/0x538 mm/debug_vm_pgtable.c:640
>  debug_vm_pgtable+0x268/0x590 mm/debug_vm_pgtable.c:1392
>  do_one_initcall+0x254/0x9e4 init/main.c:1267
>  do_initcall_level+0x154/0x214 init/main.c:1329
>  do_initcalls+0x58/0xac init/main.c:1345
>  do_basic_setup+0x8c/0xa0 init/main.c:1364
>  kernel_init_freeable+0x324/0x478 init/main.c:1578
>  kernel_init+0x24/0x2a0 init/main.c:1467
>  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
> irq event stamp: 1342246
> hardirqs last  enabled at (1342245): [<ffff8000809ba500>] seqcount_lockdep_reader_access+0x6c/0xd4 include/linux/seqlock.h:74
> hardirqs last disabled at (1342246): [<ffff80008af10a10>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:470
> softirqs last  enabled at (1342178): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline]
> softirqs last  enabled at (1342178): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582
> softirqs last disabled at (1341257): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588
> ---[ end trace 0000000000000000 ]---
> page_owner is disabled
> Key type .fscrypt registered
> Key type fscrypt-provisioning registered
> kAFS: Red Hat AFS client v0.1 registering.
> Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
> Key type big_key registered
> Key type encrypted registered
> ima: No TPM chip found, activating TPM-bypass!
> Loading compiled-in module X.509 certificates
> Loaded X.509 cert 'Build time autogenerated kernel key: 79e1c0a63a233d95d926db3e542dc8d9e342ab6b'
> ima: Allocated hash algorithm: sha256
> ima: No architecture policies found
> evm: Initialising EVM extended attributes:
> evm: security.selinux (disabled)
> evm: security.SMACK64
> evm: security.SMACK64EXEC
> evm: security.SMACK64TRANSMUTE
> evm: security.SMACK64MMAP
> evm: security.apparmor (disabled)
> evm: security.ima
> evm: security.capability
> evm: HMAC attrs: 0x1
> printk: legacy console [netcon0] enabled
> netconsole: network logging started
> gtp: GTP module loaded (pdp ctx size 128 bytes)
> rdma_rxe: loaded
> cfg80211: Loading compiled-in X.509 certificates for regulatory database
> Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
> Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
> clk: Disabling unused clocks
> PM: genpd: Disabling unused power domains
> ALSA device list:
>   #0: Dummy 1
>   #1: Loopback 1
>   #2: Virtual MIDI Card 1
> md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
> EXT4-fs (nvme0n1p2): mounted filesystem 126e38a5-b482-40da-8f06-bd78886e02c1 ro with ordered data mode. Quota mode: none.
> VFS: Mounted root (ext4 filesystem) readonly on device 259:2.
> devtmpfs: mounted
> Freeing unused kernel memory: 4416K
> Run /sbin/init as init process
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup

Re: [syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[Peter Xu]

Hi, Andrew,

On Wed, Jun 12, 2024 at 10:47:35AM -0700, Andrew Morton wrote:
> On Wed, 12 Jun 2024 10:18:21 -0700 syzbot <syzbot+0b56d6ed0d0c0c9a79dc@syzkaller.appspotmail.com> wrote:
> 
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    8867bbd4a056 mm: arm64: Fix the out-of-bounds issue in con..
> > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> > console output: https://syzkaller.appspot.com/x/log.txt?x=146b3d96980000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=3b4350cf56c61c80
> > dashboard link: https://syzkaller.appspot.com/bug?extid=0b56d6ed0d0c0c9a79dc
> > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> > userspace arch: arm64
> > 
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > ...
> >
> > ------------[ cut here ]------------
> > WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> > WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
> 
> 	if (pte_present(pte) && pte_uffd_wp(pte))
> 		WARN_ON_ONCE(pte_write(pte));
> 
> Let me optimistically cc Peter ;)

Looks like this is the same issue that the other patch wanted to fix:

[PATCH] mm/debug_vm_pgtable: Drop RANDOM_ORVALUE trick
https://lore.kernel.org/r/20240523132139.289719-1-peterx@redhat.com

I had a look, and indeed that patch hasn't reached arm64/for-kernelci
branch.

Thanks,

-- 
Peter Xu

Re: [syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[Andrew Morton]

On Wed, 12 Jun 2024 14:17:26 -0400 Peter Xu <peterx@redhat.com> wrote:

> Hi, Andrew,
> 
> On Wed, Jun 12, 2024 at 10:47:35AM -0700, Andrew Morton wrote:
> > On Wed, 12 Jun 2024 10:18:21 -0700 syzbot <syzbot+0b56d6ed0d0c0c9a79dc@syzkaller.appspotmail.com> wrote:
> > 
> > > Hello,
> > > 
> > > syzbot found the following issue on:
> > > 
> > > HEAD commit:    8867bbd4a056 mm: arm64: Fix the out-of-bounds issue in con..
> > > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=146b3d96980000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=3b4350cf56c61c80
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=0b56d6ed0d0c0c9a79dc
> > > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> > > userspace arch: arm64
> > > 
> > > Unfortunately, I don't have any reproducer for this issue yet.
> > >
> > > ...
> > >
> > > ------------[ cut here ]------------
> > > WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> > > WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
> > 
> > 	if (pte_present(pte) && pte_uffd_wp(pte))
> > 		WARN_ON_ONCE(pte_write(pte));
> > 
> > Let me optimistically cc Peter ;)
> 
> Looks like this is the same issue that the other patch wanted to fix:
> 
> [PATCH] mm/debug_vm_pgtable: Drop RANDOM_ORVALUE trick
> https://lore.kernel.org/r/20240523132139.289719-1-peterx@redhat.com
> 
> I had a look, and indeed that patch hasn't reached arm64/for-kernelci
> branch.

Thanks.

I currently have that patch queued for 6.11-rc1.  I'm thinking it
should have Fixes: 8430557fc5846 ("mm/page_table_check: support
userfault wr-protect entries") and that it should be moved to hotfixes
for 6.10-rcX, yes?

Re: [syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[Peter Xu]

On Wed, Jun 12, 2024 at 12:30:05PM -0700, Andrew Morton wrote:
> > Looks like this is the same issue that the other patch wanted to fix:
> > 
> > [PATCH] mm/debug_vm_pgtable: Drop RANDOM_ORVALUE trick
> > https://lore.kernel.org/r/20240523132139.289719-1-peterx@redhat.com
> > 
> > I had a look, and indeed that patch hasn't reached arm64/for-kernelci
> > branch.
> 
> Thanks.
> 
> I currently have that patch queued for 6.11-rc1.  I'm thinking it
> should have Fixes: 8430557fc5846 ("mm/page_table_check: support
> userfault wr-protect entries") and that it should be moved to hotfixes
> for 6.10-rcX, yes?

It looks like I kept forgetting the tags in a few patches..  And yes, that
looks all sane to me, thanks.

-- 
Peter Xu

Re: [syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    3efc57369a0c Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=177e0127980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a4fcb065287cdb84
dashboard link: https://syzkaller.appspot.com/bug?extid=0b56d6ed0d0c0c9a79dc
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17a7de80580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b67507980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b5a4faec7a99/disk-3efc5736.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/971adf9a5295/vmlinux-3efc5736.xz
kernel image: https://storage.googleapis.com/syzbot-assets/49516da34e16/bzImage-3efc5736.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0b56d6ed0d0c0c9a79dc@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 5229 at mm/page_table_check.c:209 page_table_check_pte_flags mm/page_table_check.c:209 [inline]
WARNING: CPU: 1 PID: 5229 at mm/page_table_check.c:209 __page_table_check_ptes_set+0x3bf/0x410 mm/page_table_check.c:220
Modules linked in:
CPU: 1 UID: 0 PID: 5229 Comm: syz-executor342 Not tainted 6.11.0-syzkaller-11993-g3efc57369a0c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:page_table_check_pte_flags mm/page_table_check.c:209 [inline]
RIP: 0010:__page_table_check_ptes_set+0x3bf/0x410 mm/page_table_check.c:220
Code: 00 6c 49 39 c4 74 1d 48 b8 00 00 00 00 00 00 00 68 49 39 c4 75 1c e8 60 6b 89 ff eb 0c e8 59 6b 89 ff eb 05 e8 52 6b 89 ff 90 <0f> 0b 90 e9 98 fd ff ff e8 44 6b 89 ff e9 8e fd ff ff e8 da b9 b9
RSP: 0018:ffffc90002fe7000 EFLAGS: 00010293
RAX: ffffffff820b7ac0 RBX: d7ffe7fff1ed7c06 RCX: ffff88801cba3c00
RDX: 0000000000000000 RSI: ffffffff8ea73b20 RDI: 6800000000000000
RBP: ffffc90002fe70b0 R08: 0000000000000007 R09: ffffffff820b7a8e
R10: 0000000000000003 R11: ffff88801cba3c00 R12: 6800000000000000
R13: 0000000000000000 R14: 1ffff920005fce04 R15: 0000000000000001
FS:  00005555848eb380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 0000000076e54000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 page_table_check_ptes_set include/linux/page_table_check.h:74 [inline]
 set_ptes include/linux/pgtable.h:267 [inline]
 try_to_migrate_one+0x2683/0x4240 mm/rmap.c:2300
 rmap_walk_anon+0x4cd/0x8a0 mm/rmap.c:2638
 try_to_migrate+0x3de/0x4b0
 migrate_folio_unmap mm/migrate.c:1326 [inline]
 migrate_pages_batch+0x113d/0x36d0 mm/migrate.c:1797
 migrate_pages_sync mm/migrate.c:1963 [inline]
 migrate_pages+0x2062/0x3560 mm/migrate.c:2072
 migrate_to_node mm/mempolicy.c:1095 [inline]
 do_migrate_pages+0x7ef/0xa30 mm/mempolicy.c:1194
 kernel_migrate_pages mm/mempolicy.c:1709 [inline]
 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline]
 __se_sys_migrate_pages+0x6c4/0x740 mm/mempolicy.c:1723
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd4c1b123e9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc3a5f83d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000100
RAX: ffffffffffffffda RBX: 00007ffc3a5f85b8 RCX: 00007fd4c1b123e9
RDX: 0000000020000040 RSI: 0000000000000003 RDI: 0000000000000000
RBP: 00007fd4c1b85610 R08: 00000000ffffc000 R09: 00000000ffffc000
R10: 0000000020000300 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc3a5f85a8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[syzbot]

syzbot has bisected this issue to:

commit a1b92a3f14984c96ace381f204b5d72c0805296e
Author: Muhammad Usama Anjum <usama.anjum@collabora.com>
Date:   Fri Feb 17 10:55:58 2023 +0000

    mm/userfaultfd: support WP on multiple VMAs

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=15d9cea9980000
start commit:   3efc57369a0c Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=17d9cea9980000
console output: https://syzkaller.appspot.com/x/log.txt?x=13d9cea9980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a4fcb065287cdb84
dashboard link: https://syzkaller.appspot.com/bug?extid=0b56d6ed0d0c0c9a79dc
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17a7de80580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b67507980000

Reported-by: syzbot+0b56d6ed0d0c0c9a79dc@syzkaller.appspotmail.com
Fixes: a1b92a3f1498 ("mm/userfaultfd: support WP on multiple VMAs")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection