* [syzbot] [mm?] BUG: Bad page map (8)
@ 2024-07-18 22:51 syzbot
2024-07-19 11:21 ` David Hildenbrand
` (3 more replies)
0 siblings, 4 replies; 10+ messages in thread
From: syzbot @ 2024-07-18 22:51 UTC (permalink / raw)
To: akpm, hughd, linux-kernel, linux-mm, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4d145e3f830b Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11321495980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113e054e980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1366ab85980000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-4d145e3f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/28dead26b828/vmlinux-4d145e3f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/079a7ff04a12/Image-4d145e3f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com
BUG: Bad page cache in process syz-executor356 pfn:ba081
page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x0 pfn:0xba081
memcg:f7f0000002c3a000
aops:shmem_aops ino:3
flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002d ffffc1ffc01cd7c8 ffffc1ffc1e86288 f9f000000749ba50
raw: 0000000000000000 0000000000000000 0000000400000000 f7f0000002c3a000
page dumped because: still mapped when deleted
CPU: 0 PID: 3196 Comm: syz-executor356 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
__filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
truncate_inode_folio+0x30/0x4c mm/truncate.c:195
shmem_undo_range+0x208/0x620 mm/shmem.c:1012
shmem_truncate_range mm/shmem.c:1125 [inline]
shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
evict+0xb4/0x198 fs/inode.c:667
iput_final fs/inode.c:1741 [inline]
iput fs/inode.c:1767 [inline]
iput+0x100/0x1b8 fs/inode.c:1753
dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
__dentry_kill+0x7c/0x1d4 fs/dcache.c:607
dput.part.0+0x30/0xbc fs/dcache.c:849
dput+0x4c/0x50 fs/dcache.c:860
__fput+0x110/0x2d4 fs/file_table.c:430
__fput_sync+0x50/0x5c fs/file_table.c:507
__do_sys_close fs/open.c:1563 [inline]
__se_sys_close fs/open.c:1548 [inline]
__arm64_sys_close+0x38/0x7c fs/open.c:1548
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
BUG: Bad page cache in process syz-executor356 pfn:ba18a
page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x1 pfn:0xba18a
memcg:f7f0000002c3a000
aops:shmem_aops ino:3
flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002d ffffc1ffc1e82048 ffffc1ffc028a2c8 f9f000000749ba50
raw: 0000000000000001 0000000000000000 0000000400000000 f7f0000002c3a000
page dumped because: still mapped when deleted
CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
__filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
truncate_inode_folio+0x30/0x4c mm/truncate.c:195
shmem_undo_range+0x208/0x620 mm/shmem.c:1012
shmem_truncate_range mm/shmem.c:1125 [inline]
shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
evict+0xb4/0x198 fs/inode.c:667
iput_final fs/inode.c:1741 [inline]
iput fs/inode.c:1767 [inline]
iput+0x100/0x1b8 fs/inode.c:1753
dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
__dentry_kill+0x7c/0x1d4 fs/dcache.c:607
dput.part.0+0x30/0xbc fs/dcache.c:849
dput+0x4c/0x50 fs/dcache.c:860
__fput+0x110/0x2d4 fs/file_table.c:430
__fput_sync+0x50/0x5c fs/file_table.c:507
__do_sys_close fs/open.c:1563 [inline]
__se_sys_close fs/open.c:1548 [inline]
__arm64_sys_close+0x38/0x7c fs/open.c:1548
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
BUG: Bad page map in process syz-executor356 pte:600000ba0818c3 pmd:800000047670003
page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081
memcg:f7f0000002c3a000
flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002c ffffc1ffc028c708 ffffc1ffc1e86288 0000000000000000
raw: 0000000000000000 0000000000000000 00000001fffffffe f7f0000002c3a000
page dumped because: bad pte
addr:00000000209a0000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:0
file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0
CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
print_bad_pte+0x1c8/0x258 mm/memory.c:538
zap_present_folio_ptes mm/memory.c:1508 [inline]
zap_present_ptes mm/memory.c:1564 [inline]
zap_pte_range mm/memory.c:1606 [inline]
zap_pmd_range mm/memory.c:1724 [inline]
zap_pud_range mm/memory.c:1753 [inline]
zap_p4d_range mm/memory.c:1774 [inline]
unmap_page_range+0x904/0x1190 mm/memory.c:1795
unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841
unmap_vmas+0x7c/0x170 mm/memory.c:1885
exit_mmap+0xc0/0x288 mm/mmap.c:3341
__mmput+0x3c/0x170 kernel/fork.c:1346
mmput+0x50/0x5c kernel/fork.c:1368
exit_mm kernel/exit.c:567 [inline]
do_exit+0x270/0x98c kernel/exit.c:863
do_group_exit+0x34/0x90 kernel/exit.c:1025
__do_sys_exit_group kernel/exit.c:1036 [inline]
__se_sys_exit_group kernel/exit.c:1034 [inline]
pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
BUG: Bad page map in process syz-executor356 pte:600000ba18a8c3 pmd:800000047670003
page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a
memcg:f7f0000002c3a000
flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002c ffffc1ffc1e82048 ffffc1ffc028a2c8 0000000000000000
raw: 0000000000000001 0000000000000000 00000001fffffffe f7f0000002c3a000
page dumped because: bad pte
addr:00000000209a1000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:1
file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0
CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
print_bad_pte+0x1c8/0x258 mm/memory.c:538
zap_present_folio_ptes mm/memory.c:1508 [inline]
zap_present_ptes mm/memory.c:1564 [inline]
zap_pte_range mm/memory.c:1606 [inline]
zap_pmd_range mm/memory.c:1724 [inline]
zap_pud_range mm/memory.c:1753 [inline]
zap_p4d_range mm/memory.c:1774 [inline]
unmap_page_range+0x904/0x1190 mm/memory.c:1795
unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841
unmap_vmas+0x7c/0x170 mm/memory.c:1885
exit_mmap+0xc0/0x288 mm/mmap.c:3341
__mmput+0x3c/0x170 kernel/fork.c:1346
mmput+0x50/0x5c kernel/fork.c:1368
exit_mm kernel/exit.c:567 [inline]
do_exit+0x270/0x98c kernel/exit.c:863
do_group_exit+0x34/0x90 kernel/exit.c:1025
__do_sys_exit_group kernel/exit.c:1036 [inline]
__se_sys_exit_group kernel/exit.c:1034 [inline]
pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
BUG: Bad page state in process syz-executor356 pfn:ba081
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081
flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: nonzero mapcount
Modules linked in:
CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
bad_page+0x84/0x11c mm/page_alloc.c:498
free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904
free_page_is_bad mm/page_alloc.c:914 [inline]
free_pages_prepare mm/page_alloc.c:1085 [inline]
free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637
folios_put_refs+0x108/0x284 mm/swap.c:1024
free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332
__tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu mm/mmu_gather.c:373 [inline]
tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465
exit_mmap+0x13c/0x288 mm/mmap.c:3354
__mmput+0x3c/0x170 kernel/fork.c:1346
mmput+0x50/0x5c kernel/fork.c:1368
exit_mm kernel/exit.c:567 [inline]
do_exit+0x270/0x98c kernel/exit.c:863
do_group_exit+0x34/0x90 kernel/exit.c:1025
__do_sys_exit_group kernel/exit.c:1036 [inline]
__se_sys_exit_group kernel/exit.c:1034 [inline]
pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
BUG: Bad page state in process syz-executor356 pfn:ba18a
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a
flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000001 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: nonzero mapcount
Modules linked in:
CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
bad_page+0x84/0x11c mm/page_alloc.c:498
free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904
free_page_is_bad mm/page_alloc.c:914 [inline]
free_pages_prepare mm/page_alloc.c:1085 [inline]
free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637
folios_put_refs+0x108/0x284 mm/swap.c:1024
free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332
__tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu mm/mmu_gather.c:373 [inline]
tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465
exit_mmap+0x13c/0x288 mm/mmap.c:3354
__mmput+0x3c/0x170 kernel/fork.c:1346
mmput+0x50/0x5c kernel/fork.c:1368
exit_mm kernel/exit.c:567 [inline]
do_exit+0x270/0x98c kernel/exit.c:863
do_group_exit+0x34/0x90 kernel/exit.c:1025
__do_sys_exit_group kernel/exit.c:1036 [inline]
__se_sys_exit_group kernel/exit.c:1034 [inline]
pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-18 22:51 [syzbot] [mm?] BUG: Bad page map (8) syzbot
@ 2024-07-19 11:21 ` David Hildenbrand
2024-07-20 5:02 ` Hillf Danton
2024-07-20 6:32 ` Kasireddy, Vivek
` (2 subsequent siblings)
3 siblings, 1 reply; 10+ messages in thread
From: David Hildenbrand @ 2024-07-19 11:21 UTC (permalink / raw)
To: syzbot, akpm, hughd, linux-kernel, linux-mm, syzkaller-bugs,
Vivek Kasireddy
On 19.07.24 00:51, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 4d145e3f830b Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11321495980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
> dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
> compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113e054e980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1366ab85980000
>
The reproducer involves udmabuf. I suspect it has to do with it.
But I'm curius, does the reproducer not trigger before 4d145e3f830b on
mainliny?
Viveks changes are not upstream yet, but I can only speculate that we
have some issue similar to the one we had with hugetlb: udmabuf doing
things with memfd/shmem pages that it shouldn't do, because it doesn't
"own" these pages.
"udmabuf: Use vmf_insert_pfn and VM_PFNMAP for handling mmap" might help.
--
Cheers,
David / dhildenb
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-19 11:21 ` David Hildenbrand
@ 2024-07-20 5:02 ` Hillf Danton
2024-07-20 6:30 ` Kasireddy, Vivek
2024-07-22 13:23 ` David Hildenbrand
0 siblings, 2 replies; 10+ messages in thread
From: Hillf Danton @ 2024-07-20 5:02 UTC (permalink / raw)
To: David Hildenbrand
Cc: syzbot, hughd, linux-kernel, linux-mm, syzkaller-bugs,
Matthew Wilcox, Vivek Kasireddy
On Fri, 19 Jul 2024 13:21:30 +0200 David Hildenbrand <david@redhat.com>
> On 19.07.24 00:51, syzbot wrote:
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: 4d145e3f830b Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11321495980000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
> > dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
> > compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > userspace arch: arm64
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113e054e980000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1366ab85980000
> >
>
> The reproducer involves udmabuf. I suspect it has to do with it.
>
> But I'm curius, does the reproducer not trigger before 4d145e3f830b on
> mainliny?
>
> Viveks changes are not upstream yet, but I can only speculate that we
> have some issue similar to the one we had with hugetlb: udmabuf doing
> things with memfd/shmem pages that it shouldn't do, because it doesn't
> "own" these pages.
>
> "udmabuf: Use vmf_insert_pfn and VM_PFNMAP for handling mmap" might help.
cpu1 cpu2
--- ---
evict() find folio2 in page cache
truncate_inode_folio()
truncate_cleanup_folio();
// unmap folio2 from mmA
unmap_mapping_folio(folio2);
mmap folio2 to mmB
filemap_remove_folio(folio2);
If the window exists for mapping folio to userspace while indoe is evicted,
is this report false positive?
^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-20 5:02 ` Hillf Danton
@ 2024-07-20 6:30 ` Kasireddy, Vivek
2024-07-22 13:23 ` David Hildenbrand
1 sibling, 0 replies; 10+ messages in thread
From: Kasireddy, Vivek @ 2024-07-20 6:30 UTC (permalink / raw)
To: Hillf Danton, David Hildenbrand
Cc: syzbot, hughd, linux-kernel, linux-mm, syzkaller-bugs, Matthew Wilcox
Hi Hillf, David,
>
> On Fri, 19 Jul 2024 13:21:30 +0200 David Hildenbrand <david@redhat.com>
> > On 19.07.24 00:51, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit: 4d145e3f830b Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
> > > git tree: upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=11321495980000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
> > > dashboard link:
> https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
> > > compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU
> Binutils for Debian) 2.40
> > > userspace arch: arm64
> > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113e054e980000
> > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1366ab85980000
> > >
> >
> > The reproducer involves udmabuf. I suspect it has to do with it.
> >
> > But I'm curius, does the reproducer not trigger before 4d145e3f830b on
> > mainliny?
> >
> > Viveks changes are not upstream yet, but I can only speculate that we
> > have some issue similar to the one we had with hugetlb: udmabuf doing
> > things with memfd/shmem pages that it shouldn't do, because it doesn't
> > "own" these pages.
> >
> > "udmabuf: Use vmf_insert_pfn and VM_PFNMAP for handling mmap" might
> help.
Thank you for taking a look. The above patch or other associated patches may be
fixing this bug as I cannot reproduce this issue with a few weeks old mm-unstable.
>
> cpu1 cpu2
> --- ---
> evict() find folio2 in page cache
> truncate_inode_folio()
> truncate_cleanup_folio();
> // unmap folio2 from mmA
> unmap_mapping_folio(folio2);
> mmap folio2 to mmB
> filemap_remove_folio(folio2);
>
>
> If the window exists for mapping folio to userspace while indoe is evicted,
> is this report false positive?
Yeah, this situation is possible as udmabuf currently does not handle truncation
or hole punch of the memfd after a dmabuf is created. I have tried addressing this
issue some time ago but the solution was not elegant. Need to revisit this when
time permits.
Thanks,
Vivek
^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-18 22:51 [syzbot] [mm?] BUG: Bad page map (8) syzbot
2024-07-19 11:21 ` David Hildenbrand
@ 2024-07-20 6:32 ` Kasireddy, Vivek
2024-07-20 7:01 ` syzbot
2024-09-30 0:02 ` syzbot
2024-12-27 17:02 ` syzbot
3 siblings, 1 reply; 10+ messages in thread
From: Kasireddy, Vivek @ 2024-07-20 6:32 UTC (permalink / raw)
To: syzbot, akpm, hughd, linux-kernel, linux-mm, syzkaller-bugs
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 4d145e3f830b Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11321495980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
> compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU
> Binutils for Debian) 2.40
> userspace arch: arm64
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113e054e980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1366ab85980000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-
> assets/384ffdcca292/non_bootable_disk-4d145e3f.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/28dead26b828/vmlinux-
> 4d145e3f.xz
> kernel image: https://storage.googleapis.com/syzbot-
> assets/079a7ff04a12/Image-4d145e3f.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com
>
> BUG: Bad page cache in process syz-executor356 pfn:ba081
> page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x0
> pfn:0xba081
> memcg:f7f0000002c3a000
> aops:shmem_aops ino:3
> flags:
> 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zon
> e=0|lastcpupid=0x7ff|kasantag=0x0)
> raw: 01ffc0000004002d ffffc1ffc01cd7c8 ffffc1ffc1e86288 f9f000000749ba50
> raw: 0000000000000000 0000000000000000 0000000400000000
> f7f0000002c3a000
> page dumped because: still mapped when deleted
> CPU: 0 PID: 3196 Comm: syz-executor356 Not tainted 6.10.0-rc7-syzkaller-
> 00266-g4d145e3f830b #0
> Hardware name: linux,dummy-virt (DT)
> Call trace:
> dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
> show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
> dump_stack+0x18/0x24 lib/dump_stack.c:123
> filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
> __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
> filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
> truncate_inode_folio+0x30/0x4c mm/truncate.c:195
> shmem_undo_range+0x208/0x620 mm/shmem.c:1012
> shmem_truncate_range mm/shmem.c:1125 [inline]
> shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
> evict+0xb4/0x198 fs/inode.c:667
> iput_final fs/inode.c:1741 [inline]
> iput fs/inode.c:1767 [inline]
> iput+0x100/0x1b8 fs/inode.c:1753
> dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
> __dentry_kill+0x7c/0x1d4 fs/dcache.c:607
> dput.part.0+0x30/0xbc fs/dcache.c:849
> dput+0x4c/0x50 fs/dcache.c:860
> __fput+0x110/0x2d4 fs/file_table.c:430
> __fput_sync+0x50/0x5c fs/file_table.c:507
> __do_sys_close fs/open.c:1563 [inline]
> __se_sys_close fs/open.c:1548 [inline]
> __arm64_sys_close+0x38/0x7c fs/open.c:1548
> __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
> invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
> el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
> do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
> el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
> el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
> el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
> BUG: Bad page cache in process syz-executor356 pfn:ba18a
> page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x1
> pfn:0xba18a
> memcg:f7f0000002c3a000
> aops:shmem_aops ino:3
> flags:
> 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zon
> e=0|lastcpupid=0x7ff|kasantag=0x0)
> raw: 01ffc0000004002d ffffc1ffc1e82048 ffffc1ffc028a2c8 f9f000000749ba50
> raw: 0000000000000001 0000000000000000 0000000400000000
> f7f0000002c3a000
> page dumped because: still mapped when deleted
> CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-
> syzkaller-00266-g4d145e3f830b #0
> Hardware name: linux,dummy-virt (DT)
> Call trace:
> dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
> show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
> dump_stack+0x18/0x24 lib/dump_stack.c:123
> filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
> __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
> filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
> truncate_inode_folio+0x30/0x4c mm/truncate.c:195
> shmem_undo_range+0x208/0x620 mm/shmem.c:1012
> shmem_truncate_range mm/shmem.c:1125 [inline]
> shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
> evict+0xb4/0x198 fs/inode.c:667
> iput_final fs/inode.c:1741 [inline]
> iput fs/inode.c:1767 [inline]
> iput+0x100/0x1b8 fs/inode.c:1753
> dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
> __dentry_kill+0x7c/0x1d4 fs/dcache.c:607
> dput.part.0+0x30/0xbc fs/dcache.c:849
> dput+0x4c/0x50 fs/dcache.c:860
> __fput+0x110/0x2d4 fs/file_table.c:430
> __fput_sync+0x50/0x5c fs/file_table.c:507
> __do_sys_close fs/open.c:1563 [inline]
> __se_sys_close fs/open.c:1548 [inline]
> __arm64_sys_close+0x38/0x7c fs/open.c:1548
> __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
> invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
> el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
> do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
> el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
> el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
> el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
> BUG: Bad page map in process syz-executor356 pte:600000ba0818c3
> pmd:800000047670003
> page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x0
> pfn:0xba081
> memcg:f7f0000002c3a000
> flags:
> 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|last
> cpupid=0x7ff|kasantag=0x0)
> raw: 01ffc0000004002c ffffc1ffc028c708 ffffc1ffc1e86288 0000000000000000
> raw: 0000000000000000 0000000000000000 00000001fffffffe
> f7f0000002c3a000
> page dumped because: bad pte
> addr:00000000209a0000 vm_flags:400000f9 anon_vma:0000000000000000
> mapping:f3f0000006dcee48 index:0
> file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal
> read_folio:0x0
> CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-
> syzkaller-00266-g4d145e3f830b #0
> Hardware name: linux,dummy-virt (DT)
> Call trace:
> dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
> show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
> dump_stack+0x18/0x24 lib/dump_stack.c:123
> print_bad_pte+0x1c8/0x258 mm/memory.c:538
> zap_present_folio_ptes mm/memory.c:1508 [inline]
> zap_present_ptes mm/memory.c:1564 [inline]
> zap_pte_range mm/memory.c:1606 [inline]
> zap_pmd_range mm/memory.c:1724 [inline]
> zap_pud_range mm/memory.c:1753 [inline]
> zap_p4d_range mm/memory.c:1774 [inline]
> unmap_page_range+0x904/0x1190 mm/memory.c:1795
> unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841
> unmap_vmas+0x7c/0x170 mm/memory.c:1885
> exit_mmap+0xc0/0x288 mm/mmap.c:3341
> __mmput+0x3c/0x170 kernel/fork.c:1346
> mmput+0x50/0x5c kernel/fork.c:1368
> exit_mm kernel/exit.c:567 [inline]
> do_exit+0x270/0x98c kernel/exit.c:863
> do_group_exit+0x34/0x90 kernel/exit.c:1025
> __do_sys_exit_group kernel/exit.c:1036 [inline]
> __se_sys_exit_group kernel/exit.c:1034 [inline]
> pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
> __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
> invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
> el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
> do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
> el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
> el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
> el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
> BUG: Bad page map in process syz-executor356 pte:600000ba18a8c3
> pmd:800000047670003
> page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x1
> pfn:0xba18a
> memcg:f7f0000002c3a000
> flags:
> 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|last
> cpupid=0x7ff|kasantag=0x0)
> raw: 01ffc0000004002c ffffc1ffc1e82048 ffffc1ffc028a2c8 0000000000000000
> raw: 0000000000000001 0000000000000000 00000001fffffffe
> f7f0000002c3a000
> page dumped because: bad pte
> addr:00000000209a1000 vm_flags:400000f9 anon_vma:0000000000000000
> mapping:f3f0000006dcee48 index:1
> file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal
> read_folio:0x0
> CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-
> syzkaller-00266-g4d145e3f830b #0
> Hardware name: linux,dummy-virt (DT)
> Call trace:
> dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
> show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
> dump_stack+0x18/0x24 lib/dump_stack.c:123
> print_bad_pte+0x1c8/0x258 mm/memory.c:538
> zap_present_folio_ptes mm/memory.c:1508 [inline]
> zap_present_ptes mm/memory.c:1564 [inline]
> zap_pte_range mm/memory.c:1606 [inline]
> zap_pmd_range mm/memory.c:1724 [inline]
> zap_pud_range mm/memory.c:1753 [inline]
> zap_p4d_range mm/memory.c:1774 [inline]
> unmap_page_range+0x904/0x1190 mm/memory.c:1795
> unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841
> unmap_vmas+0x7c/0x170 mm/memory.c:1885
> exit_mmap+0xc0/0x288 mm/mmap.c:3341
> __mmput+0x3c/0x170 kernel/fork.c:1346
> mmput+0x50/0x5c kernel/fork.c:1368
> exit_mm kernel/exit.c:567 [inline]
> do_exit+0x270/0x98c kernel/exit.c:863
> do_group_exit+0x34/0x90 kernel/exit.c:1025
> __do_sys_exit_group kernel/exit.c:1036 [inline]
> __se_sys_exit_group kernel/exit.c:1034 [inline]
> pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
> __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
> invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
> el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
> do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
> el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
> el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
> el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
> BUG: Bad page state in process syz-executor356 pfn:ba081
> page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x0
> pfn:0xba081
> flags:
> 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpu
> pid=0x7ff|kasantag=0x0)
> raw: 01ffc0000004000c dead000000000100 dead000000000122
> 0000000000000000
> raw: 0000000000000000 0000000000000000 00000000fffffffe
> 0000000000000000
> page dumped because: nonzero mapcount
> Modules linked in:
> CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-
> syzkaller-00266-g4d145e3f830b #0
> Hardware name: linux,dummy-virt (DT)
> Call trace:
> dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
> show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
> dump_stack+0x18/0x24 lib/dump_stack.c:123
> bad_page+0x84/0x11c mm/page_alloc.c:498
> free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904
> free_page_is_bad mm/page_alloc.c:914 [inline]
> free_pages_prepare mm/page_alloc.c:1085 [inline]
> free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637
> folios_put_refs+0x108/0x284 mm/swap.c:1024
> free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332
> __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136
> tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
> tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
> tlb_flush_mmu mm/mmu_gather.c:373 [inline]
> tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465
> exit_mmap+0x13c/0x288 mm/mmap.c:3354
> __mmput+0x3c/0x170 kernel/fork.c:1346
> mmput+0x50/0x5c kernel/fork.c:1368
> exit_mm kernel/exit.c:567 [inline]
> do_exit+0x270/0x98c kernel/exit.c:863
> do_group_exit+0x34/0x90 kernel/exit.c:1025
> __do_sys_exit_group kernel/exit.c:1036 [inline]
> __se_sys_exit_group kernel/exit.c:1034 [inline]
> pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
> __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
> invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
> el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
> do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
> el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
> el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
> el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
> BUG: Bad page state in process syz-executor356 pfn:ba18a
> page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x1
> pfn:0xba18a
> flags:
> 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpu
> pid=0x7ff|kasantag=0x0)
> raw: 01ffc0000004000c dead000000000100 dead000000000122
> 0000000000000000
> raw: 0000000000000001 0000000000000000 00000000fffffffe
> 0000000000000000
> page dumped because: nonzero mapcount
> Modules linked in:
> CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-
> syzkaller-00266-g4d145e3f830b #0
> Hardware name: linux,dummy-virt (DT)
> Call trace:
> dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
> show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
> dump_stack+0x18/0x24 lib/dump_stack.c:123
> bad_page+0x84/0x11c mm/page_alloc.c:498
> free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904
> free_page_is_bad mm/page_alloc.c:914 [inline]
> free_pages_prepare mm/page_alloc.c:1085 [inline]
> free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637
> folios_put_refs+0x108/0x284 mm/swap.c:1024
> free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332
> __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136
> tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
> tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
> tlb_flush_mmu mm/mmu_gather.c:373 [inline]
> tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465
> exit_mmap+0x13c/0x288 mm/mmap.c:3354
> __mmput+0x3c/0x170 kernel/fork.c:1346
> mmput+0x50/0x5c kernel/fork.c:1368
> exit_mm kernel/exit.c:567 [inline]
> do_exit+0x270/0x98c kernel/exit.c:863
> do_group_exit+0x34/0x90 kernel/exit.c:1025
> __do_sys_exit_group kernel/exit.c:1036 [inline]
> __se_sys_exit_group kernel/exit.c:1034 [inline]
> pid_child_should_wake+0x0/0x5c kernel/exit.c:1034
> __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
> invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
> el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131
> do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150
> el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
> el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
> el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
#syz test: https://gitlab.freedesktop.org/Vivek/drm-tip.git syzbot_fix_remove_inode
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-20 6:32 ` Kasireddy, Vivek
@ 2024-07-20 7:01 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-07-20 7:01 UTC (permalink / raw)
To: akpm, hughd, linux-kernel, linux-mm, syzkaller-bugs, vivek.kasireddy
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com
Tested-by: syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com
Tested on:
commit: 581a87b1 fixup! mm/gup: introduce memfd_pin_folios() f..
git tree: https://gitlab.freedesktop.org/Vivek/drm-tip.git syzbot_fix_remove_inode
console output: https://syzkaller.appspot.com/x/log.txt?x=142f1179980000
kernel config: https://syzkaller.appspot.com/x/.config?x=16fdddce5d38a1c8
dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-20 5:02 ` Hillf Danton
2024-07-20 6:30 ` Kasireddy, Vivek
@ 2024-07-22 13:23 ` David Hildenbrand
1 sibling, 0 replies; 10+ messages in thread
From: David Hildenbrand @ 2024-07-22 13:23 UTC (permalink / raw)
To: Hillf Danton
Cc: syzbot, hughd, linux-kernel, linux-mm, syzkaller-bugs,
Matthew Wilcox, Vivek Kasireddy
On 20.07.24 07:02, Hillf Danton wrote:
> On Fri, 19 Jul 2024 13:21:30 +0200 David Hildenbrand <david@redhat.com>
>> On 19.07.24 00:51, syzbot wrote:
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit: 4d145e3f830b Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
>>> git tree: upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=11321495980000
>>> kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
>>> compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>>> userspace arch: arm64
>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113e054e980000
>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1366ab85980000
>>>
>>
>> The reproducer involves udmabuf. I suspect it has to do with it.
>>
>> But I'm curius, does the reproducer not trigger before 4d145e3f830b on
>> mainliny?
>>
>> Viveks changes are not upstream yet, but I can only speculate that we
>> have some issue similar to the one we had with hugetlb: udmabuf doing
>> things with memfd/shmem pages that it shouldn't do, because it doesn't
>> "own" these pages.
>>
>> "udmabuf: Use vmf_insert_pfn and VM_PFNMAP for handling mmap" might help.
>
> cpu1 cpu2
> --- ---
> evict() find folio2 in page cache
> truncate_inode_folio()
> truncate_cleanup_folio();
> // unmap folio2 from mmA
> unmap_mapping_folio(folio2);
> mmap folio2 to mmB
> filemap_remove_folio(folio2);
>
>
> If the window exists for mapping folio to userspace while indoe is evicted,
> is this report false positive?
I think what happens here is that filemap_unaccount_folio() will force
the mapcount to be logically 0 (value -1).
And if we then actually go ahead and unmap that folio from our udmabuf
page tables, we will let it go negative (and also free up the refcount
too early) resulting in all kinds of issues.
filemap_unaccount_folio() was written under the assumption that the
mapcount will only get modified when we map something via the pagecache,
not when some other code (udmabuf) looked up something from the
pagecache and then maps it to user space itself.
"Fortunately", the issue only exists with CONFIG_DEBUG_VM.
The right fix is probably to stop udmabuf from touching the mapcount
(use a PFNMAP as that patch does). Another fix would be removing that
debugging code from filemap_unaccount_folio().
I do see value in part of that debugging code. The refcount+mapcount
modifications, not so much. But the "BUG: Bad page cache in process ..."
message sounds helpful.
--
Cheers,
David / dhildenb
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-18 22:51 [syzbot] [mm?] BUG: Bad page map (8) syzbot
2024-07-19 11:21 ` David Hildenbrand
2024-07-20 6:32 ` Kasireddy, Vivek
@ 2024-09-30 0:02 ` syzbot
2024-09-30 13:52 ` Matthew Wilcox
2024-12-27 17:02 ` syzbot
3 siblings, 1 reply; 10+ messages in thread
From: syzbot @ 2024-09-30 0:02 UTC (permalink / raw)
To: Liam.Howlett, Liam.Howlett, akpm, david, hdanton, hughd,
liam.howlett, linux-kernel, linux-mm, lorenzo.stoakes,
syzkaller-bugs, vbabka, vivek.kasireddy, willy
syzbot has bisected this issue to:
commit f8d112a4e657c65c888e6b8a8435ef61a66e4ab8
Author: Liam R. Howlett <Liam.Howlett@Oracle.com>
Date: Fri Aug 30 04:00:54 2024 +0000
mm/mmap: avoid zeroing vma tree in mmap_region()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13a44127980000
start commit: 3efc57369a0c Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=10644127980000
console output: https://syzkaller.appspot.com/x/log.txt?x=17a44127980000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fcb065287cdb84
dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113acd9f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14cc0127980000
Reported-by: syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com
Fixes: f8d112a4e657 ("mm/mmap: avoid zeroing vma tree in mmap_region()")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [mm?] BUG: Bad page map (8)
2024-09-30 0:02 ` syzbot
@ 2024-09-30 13:52 ` Matthew Wilcox
0 siblings, 0 replies; 10+ messages in thread
From: Matthew Wilcox @ 2024-09-30 13:52 UTC (permalink / raw)
To: syzbot
Cc: Liam.Howlett, akpm, david, hdanton, hughd, linux-kernel,
linux-mm, lorenzo.stoakes, syzkaller-bugs, vbabka,
vivek.kasireddy
On Sun, Sep 29, 2024 at 05:02:02PM -0700, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit f8d112a4e657c65c888e6b8a8435ef61a66e4ab8
> Author: Liam R. Howlett <Liam.Howlett@Oracle.com>
> Date: Fri Aug 30 04:00:54 2024 +0000
>
> mm/mmap: avoid zeroing vma tree in mmap_region()
This is almost certainly a bogus bisection. See
https://lore.kernel.org/all/00000000000020f6f8061da86023@google.com/
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [mm?] BUG: Bad page map (8)
2024-07-18 22:51 [syzbot] [mm?] BUG: Bad page map (8) syzbot
` (2 preceding siblings ...)
2024-09-30 0:02 ` syzbot
@ 2024-12-27 17:02 ` syzbot
3 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-12-27 17:02 UTC (permalink / raw)
To: Liam.Howlett, Liam.Howlett, akpm, david, hdanton, hughd, jannh,
liam.howlett, linux-kernel, linux-mm, lorenzo.stoakes,
syzkaller-bugs, vbabka, vivek.kasireddy, willy
syzbot suspects this issue was fixed by commit:
commit 79f3d123caedbac30a6fd75f9597b2a60a89d513
Author: Liam R. Howlett <Liam.Howlett@Oracle.com>
Date: Wed Oct 16 01:34:55 2024 +0000
mm/mmap: fix race in mmap_region() with ftruncate()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17d2d018580000
start commit: 3efc57369a0c Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fcb065287cdb84
dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113acd9f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14cc0127980000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: mm/mmap: fix race in mmap_region() with ftruncate()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2024-12-27 17:02 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-07-18 22:51 [syzbot] [mm?] BUG: Bad page map (8) syzbot
2024-07-19 11:21 ` David Hildenbrand
2024-07-20 5:02 ` Hillf Danton
2024-07-20 6:30 ` Kasireddy, Vivek
2024-07-22 13:23 ` David Hildenbrand
2024-07-20 6:32 ` Kasireddy, Vivek
2024-07-20 7:01 ` syzbot
2024-09-30 0:02 ` syzbot
2024-09-30 13:52 ` Matthew Wilcox
2024-12-27 17:02 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox