[syzbot] [mm?] WARNING in vma_modify

[syzbot] [mm?] WARNING in vma_modify

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    cd2e103d57e5 Merge tag 'hardening-v6.16-rc1-fix1-take2' of..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=107c7970580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6acfdd5e5c8ef3d0
dashboard link: https://syzkaller.appspot.com/bug?extid=d16409ea9ecc16ed261a
compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d3f00c580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13c781d4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4f3c020d1cfe/disk-cd2e103d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f67c698d4603/vmlinux-cd2e103d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4a3974b951f8/bzImage-cd2e103d.xz

The issue was bisected to:

commit 47b16d0462a460000b8f05dfb1292377ac48f3ca
Author: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Date:   Sat Feb 22 16:19:52 2025 +0000

    mm: abort vma_modify() on merge out of memory failure

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=15b5580c580000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=17b5580c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=13b5580c580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d16409ea9ecc16ed261a@syzkaller.appspotmail.com
Fixes: 47b16d0462a4 ("mm: abort vma_modify() on merge out of memory failure")

    7f83ee71a000-7f83ee71ffff: ffff8880117713c0
    7f83ee720000-7fff07f51fff: 0000000000000000
    7fff07f52000-7fff07f72fff: ffff88801182e500
    7fff07f73000-ffffffffffffffff: 0000000000000000
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5825 at mm/vma.c:808 vma_merge_existing_range mm/vma.c:808 [inline]
WARNING: CPU: 1 PID: 5825 at mm/vma.c:808 vma_modify+0x1540/0x1970 mm/vma.c:1604
Modules linked in:
CPU: 1 UID: 0 PID: 5825 Comm: syz-executor396 Not tainted 6.15.0-syzkaller-10820-gcd2e103d57e5 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:vma_merge_existing_range mm/vma.c:808 [inline]
RIP: 0010:vma_modify+0x1540/0x1970 mm/vma.c:1604
Code: 0b 90 e9 9a ed ff ff e8 4e 56 ab ff 90 0f 0b 90 e9 a3 ec ff ff e8 40 56 ab ff 4c 89 f7 48 c7 c6 20 8c 96 8b e8 f1 05 f3 ff 90 <0f> 0b 90 e9 4c ed ff ff e8 23 56 ab ff e9 4f ee ff ff e8 19 56 ab
RSP: 0018:ffffc90003797b38 EFLAGS: 00010286
RAX: ffffffff8b5d28cd RBX: ffff8880246ea780 RCX: ffff88802c93bc00
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff
RBP: 0000200000000000 R08: ffffc900037976a7 R09: 1ffff920006f2ed4
R10: dffffc0000000000 R11: fffff520006f2ed5 R12: 0000200000000000
R13: ffffc90003797c60 R14: ffffc90003797c40 R15: 1ffff920006f2f8c
FS:  0000555582b74380(0000) GS:ffff888125d5f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c124e6b168 CR3: 000000007547b000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 vma_modify_flags+0x1e8/0x230 mm/vma.c:1645
 mlock_fixup+0x22a/0x360 mm/mlock.c:483
 apply_mlockall_flags+0x2f0/0x3c0 mm/mlock.c:736
 __ia32_sys_munlockall+0x10a/0x220 mm/mlock.c:782
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f83ee6a76a9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff07f72138 EFLAGS: 00000246 ORIG_RAX: 0000000000000098
RAX: ffffffffffffffda RBX: 00007fff07f72150 RCX: 00007f83ee6a76a9
RDX: 00007f83ee6a68e0 RSI: 00007fff07f72150 RDI: 00007fff07f72150
RBP: 0000000000000001 R08: 00007fff07f71ed7 R09: 00000000000000a0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] WARNING in vma_modify

[Lorenzo Stoakes]

On Fri, Jun 06, 2025 at 04:09:27AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:

Thanks.

This is because of the never-really-possible-in-pratice 'too small to fail'
preallocation issue that logic in vma_modify() addresses (a fault injection
makes this possible, however).

It stems from mlockall(), which is doing a loop of the below in
apply_mlockall_flags():

	for_each_vma(vmi, vma) {
		...

		error = mlock_fixup(&vmi, vma, &prev, vma->vm_start, vma->vm_end,
				    newflags);
		/* Ignore errors, but prev needs fixing up. */
		if (error)
			prev = vma;
		...
	}

However, in the fault-injected path in question in vma_merge_existing_range() we
have an inconsistency - in the case that an abort occurs due to duplication of
anon_vma data, we execute this branch:

abort:
	vma_iter_set(vmg->vmi, start);
	vma_iter_load(vmg->vmi);

But in the case here, where commit_merge() fails, we do not:

	if (err) {
		VM_WARN_ON(err != -ENOMEM);

		if (anon_dup)
			unlink_anon_vmas(anon_dup);

		/*
		 * We've cleaned up any cloned anon_vma's, no VMAs have been
		 * modified, no harm no foul if the user requests that we not
		 * report this and just give up, leaving the VMAs unmerged.
		 */
		if (!vmg->give_up_on_oom)
			vmg->state = VMA_MERGE_ERROR_NOMEM;
		return NULL;
	}

So this means that the iterator, which will have been set to the prior VMA prior
to this failure occurring (since wre're trying to merge with prev here), doesn't
get changed.

So in the mlockall loop, we set prev = vma, then advance to the next VMA, which
is vma (since the iterator was set to the VMA prior to vma), then we are
essentially trying to merge with ourselves... whoops!

This triggers the assert:

	VM_WARN_ON_VMG(prev && start <= prev->vm_start, vmg);

Which is why this report occurred.

The solution is to consistently reset the VMA iterator in this case, I'll send a
patch for this in a second, I've tested this and it fixes it locally.

Thanks, Lorenzo

>
> HEAD commit:    cd2e103d57e5 Merge tag 'hardening-v6.16-rc1-fix1-take2' of..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=107c7970580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=6acfdd5e5c8ef3d0
> dashboard link: https://syzkaller.appspot.com/bug?extid=d16409ea9ecc16ed261a
> compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d3f00c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13c781d4580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/4f3c020d1cfe/disk-cd2e103d.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/f67c698d4603/vmlinux-cd2e103d.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/4a3974b951f8/bzImage-cd2e103d.xz
>
> The issue was bisected to:
>
> commit 47b16d0462a460000b8f05dfb1292377ac48f3ca
> Author: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
> Date:   Sat Feb 22 16:19:52 2025 +0000
>
>     mm: abort vma_modify() on merge out of memory failure
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=15b5580c580000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=17b5580c580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=13b5580c580000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d16409ea9ecc16ed261a@syzkaller.appspotmail.com
> Fixes: 47b16d0462a4 ("mm: abort vma_modify() on merge out of memory failure")
>
>     7f83ee71a000-7f83ee71ffff: ffff8880117713c0
>     7f83ee720000-7fff07f51fff: 0000000000000000
>     7fff07f52000-7fff07f72fff: ffff88801182e500
>     7fff07f73000-ffffffffffffffff: 0000000000000000
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 5825 at mm/vma.c:808 vma_merge_existing_range mm/vma.c:808 [inline]

This is

	VM_WARN_ON_VMG(prev && start <= prev->vm_start, vmg);

See analysis above.

> WARNING: CPU: 1 PID: 5825 at mm/vma.c:808 vma_modify+0x1540/0x1970 mm/vma.c:1604
> Modules linked in:
> CPU: 1 UID: 0 PID: 5825 Comm: syz-executor396 Not tainted 6.15.0-syzkaller-10820-gcd2e103d57e5 #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
> RIP: 0010:vma_merge_existing_range mm/vma.c:808 [inline]
> RIP: 0010:vma_modify+0x1540/0x1970 mm/vma.c:1604
> Code: 0b 90 e9 9a ed ff ff e8 4e 56 ab ff 90 0f 0b 90 e9 a3 ec ff ff e8 40 56 ab ff 4c 89 f7 48 c7 c6 20 8c 96 8b e8 f1 05 f3 ff 90 <0f> 0b 90 e9 4c ed ff ff e8 23 56 ab ff e9 4f ee ff ff e8 19 56 ab
> RSP: 0018:ffffc90003797b38 EFLAGS: 00010286
> RAX: ffffffff8b5d28cd RBX: ffff8880246ea780 RCX: ffff88802c93bc00
> RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff
> RBP: 0000200000000000 R08: ffffc900037976a7 R09: 1ffff920006f2ed4
> R10: dffffc0000000000 R11: fffff520006f2ed5 R12: 0000200000000000
> R13: ffffc90003797c60 R14: ffffc90003797c40 R15: 1ffff920006f2f8c
> FS:  0000555582b74380(0000) GS:ffff888125d5f000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055c124e6b168 CR3: 000000007547b000 CR4: 0000000000350ef0
> Call Trace:
>  <TASK>
>  vma_modify_flags+0x1e8/0x230 mm/vma.c:1645
>  mlock_fixup+0x22a/0x360 mm/mlock.c:483
>  apply_mlockall_flags+0x2f0/0x3c0 mm/mlock.c:736
>  __ia32_sys_munlockall+0x10a/0x220 mm/mlock.c:782
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f83ee6a76a9
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fff07f72138 EFLAGS: 00000246 ORIG_RAX: 0000000000000098
> RAX: ffffffffffffffda RBX: 00007fff07f72150 RCX: 00007f83ee6a76a9
> RDX: 00007f83ee6a68e0 RSI: 00007fff07f72150 RDI: 00007fff07f72150
> RBP: 0000000000000001 R08: 00007fff07f71ed7 R09: 00000000000000a0
> R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
> R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
>  </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup