From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DED93C47077 for ; Thu, 11 Jan 2024 18:34:28 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 651496B00A9; Thu, 11 Jan 2024 13:34:28 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 601946B00AA; Thu, 11 Jan 2024 13:34:28 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4A32F6B00AB; Thu, 11 Jan 2024 13:34:28 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 374A86B00A9 for ; Thu, 11 Jan 2024 13:34:28 -0500 (EST) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id E7BB480CDB for ; Thu, 11 Jan 2024 18:34:27 +0000 (UTC) X-FDA: 81667880574.28.E6C3C84 Received: from mail-yb1-f179.google.com (mail-yb1-f179.google.com [209.85.219.179]) by imf12.hostedemail.com (Postfix) with ESMTP id 1716240005 for ; Thu, 11 Jan 2024 18:34:25 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=syzR+o1y; spf=pass (imf12.hostedemail.com: domain of surenb@google.com designates 209.85.219.179 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1704998066; a=rsa-sha256; cv=none; b=QqqY1UZCcVTYkaGwFwawCfkgN8/y7SrkK2OkRsS2JgMqRnDOOrVRUeLiVAITeuSz6C6ngH bZzrntyQbOJkzV71FJjZMqhId3asmTNrhCCW/gZgSzhmeZHU1dQMJfgqC8sLQd7zb7vIRA 7ttE9UdUKgy18NWSkha2xXqLK9O7l5Y= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=syzR+o1y; spf=pass (imf12.hostedemail.com: domain of surenb@google.com designates 209.85.219.179 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1704998066; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=S9/LSxgXbzf5A2fx+kbyMyermt+pVACA5FZfB44Fr/E=; b=KnFniSCd2gI7OpNF4QX1pyR0mV2aV1vU0IkWygAKUhIV9ZQOrQab3HC2ZvNvpEiZxY+0o4 X92BGuoWpGuwSfWlViUEA4kH44krsaFyhiVxAoYI1gpBi28ku67GtNTFmDdtU3d4YHgch7 f8qOTIobrnX5TLXZ4CTMxI9xvaOulQw= Received: by mail-yb1-f179.google.com with SMTP id 3f1490d57ef6-db4364ecd6aso4104916276.2 for ; Thu, 11 Jan 2024 10:34:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1704998065; x=1705602865; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=S9/LSxgXbzf5A2fx+kbyMyermt+pVACA5FZfB44Fr/E=; b=syzR+o1yUAbCNiX9ThhdhnCnvMs8Ynj2kRV+Hyv59EfabS/x/JlFu/Ct2HSlFJ4+n2 8B0tD000N2L3BJPkD/PVTONySEnwdR8xx4tytXC4VJOc9TRzkjN2W1Zt5SSzPHL9nqSt fMmkVnzW3FFjb8BJR946R0AnBSFtQTIenYFovZM5GeFmH6hp0xf0/L0RbhYjFYpWjjkB ldQ+GCPOxk/CzNU9m3nSUXSj74CCQpVeZvUeNn921wr0b+oOC6jesRT+sV+5CbpvWa7i no2L1zBmOuUJELzBdyORd6oaS3VxxZ2VWwxaWUcIPKv6k66aIsvXtym6jwxvrsyzEVV+ m4hA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1704998065; x=1705602865; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=S9/LSxgXbzf5A2fx+kbyMyermt+pVACA5FZfB44Fr/E=; b=GK1FflYsDcQZHKrk0WJPFAzR7aDwUP5yQKV6v00O60EwDk2hv4dPA8fbWVctr/z/Xw Rf8iT6juGAWs7cRJavAk/j8CsvKFAS9zOdnP+mUEpp8AWVQuydM08yGH6vqPzcGNc3L4 pkNmRqFLwe9JK8CvqwvPrFYOJ/jYmzAw/9Ugrv9ev+i5pkMoY9l+TkJdSWYRG+jtHQFN zz0q9dSU86XO/Kg407P8RwEURp1arTyH3hxsORF+/jEjhDQj2z8dCy7q7GIJJNgFwqoh SWvAbTrt18rH0kZN1n6bZm3HQtgg599OHn97zbX2sMePrXszpfa4NrsQFjdUZF436H83 JbcQ== X-Gm-Message-State: AOJu0YwVG7DGozR/ll/Ge+hPGHWRqQbx5Zn3W/5OsYvxbWaf79ypwYMP AkNnrjkO7v7ENf0NJnXKj53LHWvaDLXPXbmIvyxh36dC4ath X-Google-Smtp-Source: AGHT+IGclQ6348ZGqi4qRoksX9ZYj6rpu5oYN3dUpEZNaY7fFXFz3VJbRt+c6yGO48RxgV70QEPOQnaabLEFGuxe5Tw= X-Received: by 2002:a25:8744:0:b0:dbe:aa02:c3c1 with SMTP id e4-20020a258744000000b00dbeaa02c3c1mr79236ybn.0.1704998064904; Thu, 11 Jan 2024 10:34:24 -0800 (PST) MIME-Version: 1.0 References: <00000000000011d709060eadffd3@google.com> In-Reply-To: From: Suren Baghdasaryan Date: Thu, 11 Jan 2024 10:34:13 -0800 Message-ID: Subject: Re: [syzbot] [mm?] kernel BUG in move_pages To: syzbot , David Hildenbrand , Peter Xu Cc: aarcange@redhat.com, akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 1716240005 X-Stat-Signature: rk6ai9npbxn5dwgj6gc1wn4qz7rfcozj X-Rspam-User: X-HE-Tag: 1704998065-590801 X-HE-Meta: U2FsdGVkX18YLElP8JVCLRnwUQxXdy1xVf1nU5uNHDkTwAiDfjErsCjFSGcHMRzrOKWHRWVk9w+0Ayn+j3OPUqF32WtNKz9ozl6+U3XPhIK5gWlz4kJnfCY5uAYiHn+/hQWW6JtEuGYTHVSTVUlHDjdJwIcYTGd66AjMtzcNEQ22+o1Ny7BPyCO+pAppp59Vbx7fe43JpwC7ObEpJmTibrffwYnWopOL/aATzSBue7FsKjIycqtD+bqd8CPM9s3zSJlMrrpnByVQtpxELWAJ+lUM/JLPBXta8u70hnsS7fGLiFcnvWE5MXeMRduEVTQjqrS6KYT7goP4Mvr70gqrnOIiuSoXk+GZWeUVelRXxpHr/9CD29YXag6wBRlRj+xBDC1HZcPWEh65EY0ENfJBxsCXs70WGrB45ceYIAccQAeeC5S1q5PdFMYb9ZmI+18WiqiFSG7+JYSUowtst6FoFkaJW8GoyfF1xFLv79UKR/wOoapw0ErAVBvDfYnDtcuay40HbgVbTnjJdZ5GxdjyLnnKVkQl9rsm8kRPyfT6Of4cULmDjD1XMXbIZlD4ofE1encxFkRJoRGQO0AXmBkjXflQymrb+BziiSw6cjIBMeocQYo1+4YG3v/bVIUPwSmRVm0DAnGHqkiq/Aq9MI2BKslTOiZbjr8z370YRHuLZSBmCIIIRSrRP2/A1NG7aAmPFK5Y3OZ+w+qM2m6hf/Ngp8m8F7DgbBZzFyc1NGYPVAWT8Rgtt83/J5YHFrCXvtvhfosHtDTt6rHi/Y+Ht636yMUxoHdBe2+lD8fFSQ+Dcmw0sYS4z1oGigmYK47HhfsiMsFvCD7KzMe3NH2/UYDi1Fqw6X2sSDzIVFUorEUgCjJ/pLAZl4LDGnmCzeo19wk6C2qKnpJS9OR8td/pK7NTWyPmJFLmm97V1HfaaxTPeeY7HjyOVZjcHW7VtnXpdkbG3CDstiMPxnKNdXl9yJT 4NFJt4Zw SddvugaG7ZT0KRPgKpHKcGproGgoE6CyiAR/KCnFI8PJXnFoXCUbEu/ycYw8vfY8rbvhMb0lmejpMNB87cYQDgKpM+WB7t0Wa6bSFikJSQ+BKf5izXGyQEIh8n6jIY3afKhDpPNrIGUXBYT04Ek2uWpVY23FipuguB6Vn/piH8bQA4gJ7nIuEVrGNMETnVkIWIP12aJfHBde/0+v39t8Vofy1W9OeUkn7UFoUievQsYVQRe44jy90FnLIg1eVZwAswqrIxmQiO0PZBYXuCNWoXW85e6dttooMBwcoEz5jrEFKUQny4pPg5fXnJeD2sIZLdGy/MEG/CvuTQYnNesKr+e1ffYXEtmCTTc5jCGFsLzm5349uJ/PJwmIPPk6GYr47JIeWfStuimEwBVttBJahkkUDMAJ5zaYrp0zgdz4h+Iu44nIXCDXg/A00kBiZ+S5kDUi483xm1grZTxQoLBbs/SagLYgVEDqe+C+xDy5aok6NiDgEoLklIjvvpynjpHOmMWzkJD/xjV6PlADz5GWqrGqDZllHDuF1HrkZ73ZkxPBIuw2jL+U7xmaEcvnn/eBeBiVNOnC5S/EEVK2DnyKnP56EtF2lX428YcjbZc1KbEpT/ZrM9T80wfXBkDq4n8KBsnTeZwh4Vf6AJHoEYD3vqk3FM3Nq1DjQXXQvShUa8a87Hm75IKDkNLVFvP3tjtf5c7ybGAdLhoT8yfybXVJEd08STxrMDFWTCIbAYX6ukL/FZ5HPVazaluzXSCUxmuYJ5RhX6l9Rt2z/2G+IGh4cxLzb+OOF8SvVKSiYQlb5UM44yH01RIXdesTa3ODs/rVOEoMkrT+fU5yxFcrkzHgu3lHmjioIyWxhq83kKmIMLFUhmQdSC/iQi36TTJ1OaUtQnF/3agyYc0z0b0nTR1O0ecjudvjeqarUdWwaBRYPTTPU9tborvc1/A+LtEVAnt6Bls0+AqDVIq0TJISv2sQjtrcDoOdk 4vnWciNH dLE2+0LWlJ0dWS00OTuRjJZ4GpfKCDf6SDjirAECk46FIRwNNf6JOGDZuYKjk7pbAotqcOyZvjA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Jan 11, 2024 at 8:44=E2=80=AFAM Suren Baghdasaryan wrote: > > On Thu, Jan 11, 2024 at 8:40=E2=80=AFAM Suren Baghdasaryan wrote: > > > > On Thu, Jan 11, 2024 at 8:25=E2=80=AFAM syzbot > > wrote: > > > > > > Hello, > > > > > > syzbot found the following issue on: > > > > > > HEAD commit: e2425464bc87 Add linux-next specific files for 202401= 05 > > > git tree: linux-next > > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=3D14941cdee= 80000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=3D4056b9349= f3da8c9 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=3D705209281e3= 6404998f6 > > > compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils f= or Debian) 2.40 > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D125d0a0= 9e80000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=3D15bc7331e= 80000 > > > > > > Downloadable assets: > > > disk image: https://storage.googleapis.com/syzbot-assets/2f738185e2cf= /disk-e2425464.raw.xz > > > vmlinux: https://storage.googleapis.com/syzbot-assets/b248fcf4ea46/vm= linux-e2425464.xz > > > kernel image: https://storage.googleapis.com/syzbot-assets/a9945c8223= f4/bzImage-e2425464.xz > > > > > > The issue was bisected to: > > > > > > commit adef440691bab824e39c1b17382322d195e1fab0 > > > Author: Andrea Arcangeli > > > Date: Wed Dec 6 10:36:56 2023 +0000 > > > > > > userfaultfd: UFFDIO_MOVE uABI > > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=3D11cb6e= a9e80000 > > > final oops: https://syzkaller.appspot.com/x/report.txt?x=3D13cb6e= a9e80000 > > > console output: https://syzkaller.appspot.com/x/log.txt?x=3D15cb6ea9e= 80000 > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the = commit: > > > Reported-by: syzbot+705209281e36404998f6@syzkaller.appspotmail.com > > > Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") > > > > > > do_one_initcall+0x128/0x680 init/main.c:1237 > > > do_initcall_level init/main.c:1299 [inline] > > > do_initcalls init/main.c:1315 [inline] > > > do_basic_setup init/main.c:1334 [inline] > > > kernel_init_freeable+0x692/0xc30 init/main.c:1552 > > > kernel_init+0x1c/0x2a0 init/main.c:1442 > > > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 > > > ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 > > > ------------[ cut here ]------------ > > > kernel BUG at include/linux/page-flags.h:1035! > > > invalid opcode: 0000 [#1] PREEMPT SMP KASAN > > > CPU: 0 PID: 5068 Comm: syz-executor191 Not tainted 6.7.0-rc8-next-202= 40105-syzkaller #0 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BI= OS Google 11/17/2023 > > > RIP: 0010:PageAnonExclusive include/linux/page-flags.h:1035 [inline] > > > > From a quick look, I think the new ioctl is being used against a > > file-backed page and that's why PageAnonExclusive() throws this error. > > I'll confirm if this is indeed the case and will add checks for that > > case. Thanks! > > Hmm. Looking at the reproducer it does not look like a file-backed > memory... Anyways, I'm on it. Looks like the test is trying to move the huge_zero_page. Wonder how we should handle this. Just fail or do something else? Adding David and Peter for feedback. > > > > > > RIP: 0010:move_pages+0x1697/0x3d40 mm/userfaultfd.c:1402 > > > Code: 00 00 48 c1 e8 0c 48 21 d0 48 c1 e0 06 48 01 c3 e9 b6 f7 ff ff = e8 79 c6 9c ff 48 c7 c6 e0 7e dc 8a 48 89 df e8 0a 20 dc ff 90 <0f> 0b e8 6= 2 c6 9c ff 48 89 da b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 > > > RSP: 0018:ffffc90003aefa98 EFLAGS: 00010293 > > > RAX: 0000000000000000 RBX: ffffea0001e40000 RCX: ffffffff81687599 > > > RDX: ffff88802a155940 RSI: ffffffff81eb5d46 RDI: 0000000000000000 > > > RBP: ffff88802abab810 R08: 0000000000000000 R09: fffffbfff1e75fda > > > R10: ffffffff8f3afed7 R11: 0000000000000001 R12: 0000000000000000 > > > R13: 0000000000000000 R14: 0000000020518000 R15: 0000000000000000 > > > FS: 00005555562cf380(0000) GS:ffff8880b9800000(0000) knlGS:000000000= 0000000 > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > CR2: 00000000204f8000 CR3: 000000006a725000 CR4: 00000000003506f0 > > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > > Call Trace: > > > > > > userfaultfd_move fs/userfaultfd.c:2047 [inline] > > > userfaultfd_ioctl+0x683/0x6420 fs/userfaultfd.c:2169 > > > vfs_ioctl fs/ioctl.c:51 [inline] > > > __do_sys_ioctl fs/ioctl.c:871 [inline] > > > __se_sys_ioctl fs/ioctl.c:857 [inline] > > > __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857 > > > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > > > do_syscall_64+0xd0/0x250 arch/x86/entry/common.c:83 > > > entry_SYSCALL_64_after_hwframe+0x62/0x6a > > > RIP: 0033:0x7f4bada9b3e9 > > > Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 = 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f= 0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > > > RSP: 002b:00007fff2c1d6998 EFLAGS: 00000246 ORIG_RAX: 000000000000001= 0 > > > RAX: ffffffffffffffda RBX: 00007fff2c1d6b68 RCX: 00007f4bada9b3e9 > > > RDX: 00000000200000c0 RSI: 00000000c028aa05 RDI: 0000000000000003 > > > RBP: 00007f4badb0e610 R08: 00007fff2c1d6b68 R09: 00007fff2c1d6b68 > > > R10: 00007fff2c1d6b68 R11: 0000000000000246 R12: 0000000000000001 > > > R13: 00007fff2c1d6b58 R14: 0000000000000001 R15: 0000000000000001 > > > > > > Modules linked in: > > > ---[ end trace 0000000000000000 ]--- > > > RIP: 0010:PageAnonExclusive include/linux/page-flags.h:1035 [inline] > > > RIP: 0010:move_pages+0x1697/0x3d40 mm/userfaultfd.c:1402 > > > Code: 00 00 48 c1 e8 0c 48 21 d0 48 c1 e0 06 48 01 c3 e9 b6 f7 ff ff = e8 79 c6 9c ff 48 c7 c6 e0 7e dc 8a 48 89 df e8 0a 20 dc ff 90 <0f> 0b e8 6= 2 c6 9c ff 48 89 da b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 > > > RSP: 0018:ffffc90003aefa98 EFLAGS: 00010293 > > > RAX: 0000000000000000 RBX: ffffea0001e40000 RCX: ffffffff81687599 > > > RDX: ffff88802a155940 RSI: ffffffff81eb5d46 RDI: 0000000000000000 > > > RBP: ffff88802abab810 R08: 0000000000000000 R09: fffffbfff1e75fda > > > R10: ffffffff8f3afed7 R11: 0000000000000001 R12: 0000000000000000 > > > R13: 0000000000000000 R14: 0000000020518000 R15: 0000000000000000 > > > FS: 00005555562cf380(0000) GS:ffff8880b9800000(0000) knlGS:000000000= 0000000 > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > CR2: 00000000204f8000 CR3: 000000006a725000 CR4: 00000000003506f0 > > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > > > > > > > > --- > > > This report is generated by a bot. It may contain errors. > > > See https://goo.gl/tpsmEJ for more information about syzbot. > > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > > > syzbot will keep track of this issue. See: > > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > > For information about bisection process see: https://goo.gl/tpsmEJ#bi= section > > > > > > If the report is already addressed, let syzbot know by replying with: > > > #syz fix: exact-commit-title > > > > > > If you want syzbot to run the reproducer, reply with: > > > #syz test: git://repo/address.git branch-or-commit-hash > > > If you attach or paste a git patch, syzbot will apply it before testi= ng. > > > > > > If you want to overwrite report's subsystems, reply with: > > > #syz set subsystems: new-subsystem > > > (See the list of subsystem names on the web dashboard) > > > > > > If the report is a duplicate of another one, reply with: > > > #syz dup: exact-subject-of-another-report > > > > > > If you want to undo deduplication, reply with: > > > #syz undup