* WARNING in try_grab_page @ 2023-08-03 8:56 Yikebaer Aizezi 2023-08-03 12:50 ` Matthew Wilcox 2023-08-03 13:19 ` Matthew Wilcox 0 siblings, 2 replies; 8+ messages in thread From: Yikebaer Aizezi @ 2023-08-03 8:56 UTC (permalink / raw) To: akpm, linux-mm; +Cc: linux-kernel Hello, When using Healer to fuzz the Linux kernel, the following crash was triggered on: HEAD commit: fdf0eaf11452d72945af31804e2a1048ee1b574c (tag: v6.5-rc2) git tree: upstream I tried to reproduce this bug on v6.5-rc3(HEAD commit: 6eaae198076080886b9e7d57f4ae06fa782f90ef), it still exists. console output: https://drive.google.com/file/d/1Lq71bFwtEDix82PEf_193CLG6uh1Pjj9/view?usp=drive_link kernel config: https://drive.google.com/file/d/1dApy7OR4KDYdhF96ZUowZQ1r-uLYTd-0/view?usp=drive_link C reproducer: https://drive.google.com/file/d/1Dkj31wwYP7p-AEJeemD3yrIUr7-VdBqF/view?usp=drive_link Syzlang reproducer: https://drive.google.com/file/d/1ib6zTs4srKI1RnUcHG3mSZ5HeW7rZhnd/view?usp=drive_link If you fix this issue, please add the following tag to the commit: Reported-by: Yikebaer Aizezi <yikebaer61@gmail.com> WARNING: CPU: 0 PID: 10232 at mm/gup.c:229 try_grab_page+0x2dd/0x3a0 mm/gup.c:229 Modules linked in: CPU: 0 PID: 10232 Comm: syz-executor Tainted: G B 6.5.0-rc2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:try_grab_page+0x2dd/0x3a0 mm/gup.c:229 Code: ff be 04 00 00 00 4c 89 e7 e8 cf fa 13 00 f0 41 ff 04 24 e8 65 96 cb ff 45 31 e4 5b 44 89 e0 5d 41 5c 41 5d c3 e8 53 96 cb ff <0f> 0b e8 4c 96 cb ff 41 bc f4 ff ff ff 5b 44 89 e0 5d 41 5c 41 5d RSP: 0018:ffffc9000e99f268 EFLAGS: 00010202 RAX: 0000000000002f80 RBX: ffffea00003ae340 RCX: ffffc90002d79000 RDX: 0000000000040000 RSI: ffffffff81ad81ed RDI: ffffea00003ae374 RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffff94000075c6e R10: ffffea00003ae377 R11: 0000000000000000 R12: ffffea00003ae374 R13: 0000000000210052 R14: ffffea00003ae340 R15: 000000000eb8d225 FS: 00007fc6339a4640(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000002c3ea000 CR4: 0000000000752ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> follow_page_pte+0x18c/0x1610 mm/gup.c:651 follow_pmd_mask mm/gup.c:727 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 __get_user_pages_locked mm/gup.c:1487 [inline] get_user_pages_unlocked+0x183/0x580 mm/gup.c:2387 hva_to_pfn_slow arch/x86/kvm/../../../virt/kvm/kvm_main.c:2536 [inline] hva_to_pfn+0x198/0xbc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2674 __gfn_to_pfn_memslot+0x202/0x3e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2736 __kvm_faultin_pfn arch/x86/kvm/mmu/mmu.c:4329 [inline] kvm_faultin_pfn+0x21b/0x12d0 arch/x86/kvm/mmu/mmu.c:4365 kvm_tdp_mmu_page_fault arch/x86/kvm/mmu/mmu.c:4503 [inline] kvm_tdp_page_fault+0x167/0x4d0 arch/x86/kvm/mmu/mmu.c:4549 kvm_mmu_do_page_fault arch/x86/kvm/mmu/mmu_internal.h:320 [inline] kvm_mmu_page_fault+0x2f4/0x1a40 arch/x86/kvm/mmu/mmu.c:5756 handle_ept_violation+0x20a/0x620 arch/x86/kvm/vmx/vmx.c:5760 __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6539 [inline] vmx_handle_exit+0x4a1/0x18d0 arch/x86/kvm/vmx/vmx.c:6556 vcpu_enter_guest arch/x86/kvm/x86.c:10848 [inline] vcpu_run+0x24b6/0x44b0 arch/x86/kvm/x86.c:10951 kvm_arch_vcpu_ioctl_run+0x416/0x1830 arch/x86/kvm/x86.c:11172 kvm_vcpu_ioctl+0x4de/0xcc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x173/0x1e0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x47959d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6339a4068 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000059c0a0 RCX: 000000000047959d RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 RBP: 000000000059c0a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000059c0ac R13: 000000000000000b R14: 0000000000437250 R15: 00007fc633984000 </TASK> Modules linked in: CPU: 0 PID: 10232 Comm: syz-executor Tainted: G B 6.5.0-rc2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:try_grab_page+0x2dd/0x3a0 mm/gup.c:229 Code: ff be 04 00 00 00 4c 89 e7 e8 cf fa 13 00 f0 41 ff 04 24 e8 65 96 cb ff 45 31 e4 5b 44 89 e0 5d 41 5c 41 5d c3 e8 53 96 cb ff <0f> 0b e8 4c 96 cb ff 41 bc f4 ff ff ff 5b 44 89 e0 5d 41 5c 41 5d RSP: 0018:ffffc9000e99f268 EFLAGS: 00010202 RAX: 0000000000002f80 RBX: ffffea00003ae340 RCX: ffffc90002d79000 RDX: 0000000000040000 RSI: ffffffff81ad81ed RDI: ffffea00003ae374 RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffff94000075c6e R10: ffffea00003ae377 R11: 0000000000000000 R12: ffffea00003ae374 R13: 0000000000210052 R14: ffffea00003ae340 R15: 000000000eb8d225 FS: 00007fc6339a4640(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000002c3ea000 CR4: 0000000000752ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> follow_page_pte+0x18c/0x1610 mm/gup.c:651 follow_pmd_mask mm/gup.c:727 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 __get_user_pages_locked mm/gup.c:1487 [inline] get_user_pages_unlocked+0x183/0x580 mm/gup.c:2387 hva_to_pfn_slow arch/x86/kvm/../../../virt/kvm/kvm_main.c:2536 [inline] hva_to_pfn+0x198/0xbc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2674 __gfn_to_pfn_memslot+0x202/0x3e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2736 __kvm_faultin_pfn arch/x86/kvm/mmu/mmu.c:4329 [inline] kvm_faultin_pfn+0x21b/0x12d0 arch/x86/kvm/mmu/mmu.c:4365 kvm_tdp_mmu_page_fault arch/x86/kvm/mmu/mmu.c:4503 [inline] kvm_tdp_page_fault+0x167/0x4d0 arch/x86/kvm/mmu/mmu.c:4549 kvm_mmu_do_page_fault arch/x86/kvm/mmu/mmu_internal.h:320 [inline] kvm_mmu_page_fault+0x2f4/0x1a40 arch/x86/kvm/mmu/mmu.c:5756 handle_ept_violation+0x20a/0x620 arch/x86/kvm/vmx/vmx.c:5760 __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6539 [inline] vmx_handle_exit+0x4a1/0x18d0 arch/x86/kvm/vmx/vmx.c:6556 vcpu_enter_guest arch/x86/kvm/x86.c:10848 [inline] vcpu_run+0x24b6/0x44b0 arch/x86/kvm/x86.c:10951 kvm_arch_vcpu_ioctl_run+0x416/0x1830 arch/x86/kvm/x86.c:11172 kvm_vcpu_ioctl+0x4de/0xcc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x173/0x1e0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x47959d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6339a4068 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000059c0a0 RCX: 000000000047959d RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 RBP: 000000000059c0a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000059c0ac R13: 000000000000000b R14: 0000000000437250 R15: 00007fc633984000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 0 PID: 10232 Comm: syz-executor Tainted: G B 6.5.0-rc2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x92/0xf0 lib/dump_stack.c:106 panic+0x570/0x620 kernel/panic.c:340 check_panic_on_warn+0x8e/0x90 kernel/panic.c:236 __warn+0xee/0x340 kernel/panic.c:673 __report_bug lib/bug.c:199 [inline] report_bug+0x25d/0x460 lib/bug.c:219 handle_bug+0x3c/0x70 arch/x86/kernel/traps.c:324 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:345 asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:568 RIP: 0010:try_grab_page+0x2dd/0x3a0 mm/gup.c:229 Code: ff be 04 00 00 00 4c 89 e7 e8 cf fa 13 00 f0 41 ff 04 24 e8 65 96 cb ff 45 31 e4 5b 44 89 e0 5d 41 5c 41 5d c3 e8 53 96 cb ff <0f> 0b e8 4c 96 cb ff 41 bc f4 ff ff ff 5b 44 89 e0 5d 41 5c 41 5d RSP: 0018:ffffc9000e99f268 EFLAGS: 00010202 RAX: 0000000000002f80 RBX: ffffea00003ae340 RCX: ffffc90002d79000 RDX: 0000000000040000 RSI: ffffffff81ad81ed RDI: ffffea00003ae374 RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffff94000075c6e R10: ffffea00003ae377 R11: 0000000000000000 R12: ffffea00003ae374 R13: 0000000000210052 R14: ffffea00003ae340 R15: 000000000eb8d225 follow_page_pte+0x18c/0x1610 mm/gup.c:651 follow_pmd_mask mm/gup.c:727 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 __get_user_pages_locked mm/gup.c:1487 [inline] get_user_pages_unlocked+0x183/0x580 mm/gup.c:2387 hva_to_pfn_slow arch/x86/kvm/../../../virt/kvm/kvm_main.c:2536 [inline] hva_to_pfn+0x198/0xbc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2674 __gfn_to_pfn_memslot+0x202/0x3e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2736 __kvm_faultin_pfn arch/x86/kvm/mmu/mmu.c:4329 [inline] kvm_faultin_pfn+0x21b/0x12d0 arch/x86/kvm/mmu/mmu.c:4365 kvm_tdp_mmu_page_fault arch/x86/kvm/mmu/mmu.c:4503 [inline] kvm_tdp_page_fault+0x167/0x4d0 arch/x86/kvm/mmu/mmu.c:4549 kvm_mmu_do_page_fault arch/x86/kvm/mmu/mmu_internal.h:320 [inline] kvm_mmu_page_fault+0x2f4/0x1a40 arch/x86/kvm/mmu/mmu.c:5756 handle_ept_violation+0x20a/0x620 arch/x86/kvm/vmx/vmx.c:5760 __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6539 [inline] vmx_handle_exit+0x4a1/0x18d0 arch/x86/kvm/vmx/vmx.c:6556 vcpu_enter_guest arch/x86/kvm/x86.c:10848 [inline] vcpu_run+0x24b6/0x44b0 arch/x86/kvm/x86.c:10951 kvm_arch_vcpu_ioctl_run+0x416/0x1830 arch/x86/kvm/x86.c:11172 kvm_vcpu_ioctl+0x4de/0xcc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x173/0x1e0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x47959d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6339a4068 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000059c0a0 RCX: 000000000047959d RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 RBP: 000000000059c0a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000059c0ac R13: 000000000000000b R14: 0000000000437250 R15: 00007fc633984000 </TASK> Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 1 seconds.. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: WARNING in try_grab_page 2023-08-03 8:56 WARNING in try_grab_page Yikebaer Aizezi @ 2023-08-03 12:50 ` Matthew Wilcox 2023-08-03 13:19 ` Matthew Wilcox 1 sibling, 0 replies; 8+ messages in thread From: Matthew Wilcox @ 2023-08-03 12:50 UTC (permalink / raw) To: Yikebaer Aizezi; +Cc: akpm, linux-mm, linux-kernel On Thu, Aug 03, 2023 at 04:56:03PM +0800, Yikebaer Aizezi wrote: > console output: > https://drive.google.com/file/d/1Lq71bFwtEDix82PEf_193CLG6uh1Pjj9/view?usp=drive_link > kernel config: https://drive.google.com/file/d/1dApy7OR4KDYdhF96ZUowZQ1r-uLYTd-0/view?usp=drive_link > C reproducer: https://drive.google.com/file/d/1Dkj31wwYP7p-AEJeemD3yrIUr7-VdBqF/view?usp=drive_link Are you sure this is right? The below stack trace shows something coming in through the ioctl() path, but nothing in this reproducer calls ioctl(). It's just socket(), bind(), accept4() and sendmsg(). I don't see a way to come up with this stack backtrace from that program. > Call Trace: > <TASK> > follow_page_pte+0x18c/0x1610 mm/gup.c:651 > follow_pmd_mask mm/gup.c:727 [inline] > follow_pud_mask mm/gup.c:765 [inline] > follow_p4d_mask mm/gup.c:782 [inline] > follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 > __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 > __get_user_pages_locked mm/gup.c:1487 [inline] > get_user_pages_unlocked+0x183/0x580 mm/gup.c:2387 > hva_to_pfn_slow arch/x86/kvm/../../../virt/kvm/kvm_main.c:2536 [inline] > hva_to_pfn+0x198/0xbc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2674 > __gfn_to_pfn_memslot+0x202/0x3e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2736 > __kvm_faultin_pfn arch/x86/kvm/mmu/mmu.c:4329 [inline] > kvm_faultin_pfn+0x21b/0x12d0 arch/x86/kvm/mmu/mmu.c:4365 > kvm_tdp_mmu_page_fault arch/x86/kvm/mmu/mmu.c:4503 [inline] > kvm_tdp_page_fault+0x167/0x4d0 arch/x86/kvm/mmu/mmu.c:4549 > kvm_mmu_do_page_fault arch/x86/kvm/mmu/mmu_internal.h:320 [inline] > kvm_mmu_page_fault+0x2f4/0x1a40 arch/x86/kvm/mmu/mmu.c:5756 > handle_ept_violation+0x20a/0x620 arch/x86/kvm/vmx/vmx.c:5760 > __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6539 [inline] > vmx_handle_exit+0x4a1/0x18d0 arch/x86/kvm/vmx/vmx.c:6556 > vcpu_enter_guest arch/x86/kvm/x86.c:10848 [inline] > vcpu_run+0x24b6/0x44b0 arch/x86/kvm/x86.c:10951 > kvm_arch_vcpu_ioctl_run+0x416/0x1830 arch/x86/kvm/x86.c:11172 > kvm_vcpu_ioctl+0x4de/0xcc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:870 [inline] > __se_sys_ioctl fs/ioctl.c:856 [inline] > __x64_sys_ioctl+0x173/0x1e0 fs/ioctl.c:856 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x47959d > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007fc6339a4068 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > RAX: ffffffffffffffda RBX: 000000000059c0a0 RCX: 000000000047959d > RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 > RBP: 000000000059c0a0 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 000000000059c0ac > R13: 000000000000000b R14: 0000000000437250 R15: 00007fc633984000 > </TASK> ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: WARNING in try_grab_page 2023-08-03 8:56 WARNING in try_grab_page Yikebaer Aizezi 2023-08-03 12:50 ` Matthew Wilcox @ 2023-08-03 13:19 ` Matthew Wilcox 2023-08-04 3:14 ` Yikebaer Aizezi 1 sibling, 1 reply; 8+ messages in thread From: Matthew Wilcox @ 2023-08-03 13:19 UTC (permalink / raw) To: Yikebaer Aizezi; +Cc: akpm, linux-mm On Thu, Aug 03, 2023 at 04:56:03PM +0800, Yikebaer Aizezi wrote: > console output: > https://drive.google.com/file/d/1Lq71bFwtEDix82PEf_193CLG6uh1Pjj9/view?usp=drive_link I dug through this, and what I found troubles me. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13067 at mm/gup.c:229 try_grab_page+0x2dd/0x3a0 Modules linked in: CPU: 0 PID: 13067 Comm: syz-executor Tainted: G B 6.5.0-rc2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:try_grab_page+0x2dd/0x3a0 Code: ff be 04 00 00 00 4c 89 e7 e8 cf fa 13 00 f0 41 ff 04 24 e8 65 96 cb ff 45 31 e4 5b 44 89 e0 5d 41 5c 41 5d c3 e8 53 96 cb ff <0f> 0b e8 4c 96 cb ff 41 bc f4 ff ff ff 5b 44 89 e0 5d 41 5c 41 5d RSP: 0018:ffffc9000c2777e0 EFLAGS: 00010212 RAX: 0000000000000247 RBX: ffffea00003ae340 RCX: ffffc90002bb1000 RDX: 0000000000040000 RSI: ffffffff81ad81ed RDI: ffffea00003ae374 RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffff94000075c6e R10: ffffea00003ae377 R11: 0000000000084001 R12: ffffea00003ae374 R13: 0000000000210002 R14: ffffea00003ae340 R15: 000000000eb8d225 FS: 00007f5841a13640(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000500310 CR3: 0000000018d0c000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0xe2/0x340 ? try_grab_page+0x2dd/0x3a0 ? report_bug+0x25d/0x460 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x40 ? asm_exc_invalid_op+0x16/0x20 ? try_grab_page+0x2dd/0x3a0 ? try_grab_page+0x2dd/0x3a0 follow_page_pte+0x18c/0x1610 ? try_grab_page+0x3a0/0x3a0 ? rcu_is_watching+0xe/0xb0 follow_page_mask+0x2e4/0xbd0 __get_user_pages+0x3fa/0xcf0 ? follow_page_mask+0xbd0/0xbd0 ? down_read_killable+0x146/0x4f0 ? down_read_interruptible+0x4f0/0x4f0 ? rcu_is_watching+0xe/0xb0 __gup_longterm_locked+0x5fa/0x1ec0 ? io_schedule_timeout+0x150/0x150 ? rcu_is_watching+0xe/0xb0 ? get_user_pages_unlocked+0x580/0x580 ? lock_release+0x4f7/0x670 ? internal_get_user_pages_fast+0xe27/0x2690 ? lock_downgrade+0x690/0x690 ? preempt_schedule_common+0x45/0xb0 ? pud_huge+0x9c/0xe0 ? pmd_huge+0xe0/0xe0 internal_get_user_pages_fast+0x119b/0x2690 ? mtree_load+0x1df/0x980 ? __gup_device_huge+0x530/0x530 ? rcu_is_watching+0xe/0xb0 ? lock_release+0x4f7/0x670 get_user_pages_fast+0x95/0xe0 ? get_user_pages_fast_only+0xe0/0xe0 do_get_mempolicy+0x50c/0xd20 ? sp_delete+0xf0/0xf0 ? seccomp_notify_ioctl+0xd80/0xd80 __x64_sys_get_mempolicy+0x187/0x2a0 ? __ia32_sys_migrate_pages+0xf0/0xf0 ? __secure_computing+0x1ff/0x360 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x47959d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5841a13068 EFLAGS: 00000246 ORIG_RAX: 00000000000000ef RAX: ffffffffffffffda RBX: 000000000059c0a0 RCX: 000000000047959d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 000000000059c0a0 R08: 0000000000000003 R09: 0000000000000000 R10: 0000000020ff9000 R11: 0000000000000246 R12: 000000000059c0ac R13: 000000000000000b R14: 0000000000437250 R15: 00007f58419f3000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... > WARNING: CPU: 0 PID: 13067 at mm/gup.c:229 try_grab_page+0x2dd/0x3a0 That's this line: if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) Called from: follow_page_pte+0x18c/0x1610 That did: ptep = pte_offset_map_lock(mm, pmd, address, &ptl); pte = ptep_get(ptep); page = vm_normal_page(vma, address, pte); ret = try_grab_page(page, flags); So we grabbed the PTE lock, looked up the PTE, translated that into a page ... and found a page with a zero (or negative) refcount. That's Really Bad. I think it was a zero refcount because r08 is 0 and I don't see any other registers which have a plausible negative 32-bit number in them. Yikebaer, could I trouble you to add this: +++ b/mm/gup.c @@ -226,7 +226,7 @@ int __must_check try_grab_page(struct page *page, unsigned int flags) { struct folio *folio = page_folio(page); - if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) + if (VM_WARN_ON_ONCE_FOLIO(folio_ref_count(folio) <= 0, folio)) return -ENOMEM; if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page))) and rerun the syzkaller? That'll give us some more information about what has happened, although it won't tell us why it happened. We might need to catch someone decrementing the refcount to lower than the mapcount to catch this ... which will be tricky, given the other things we reuse the mapcount for. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: WARNING in try_grab_page 2023-08-03 13:19 ` Matthew Wilcox @ 2023-08-04 3:14 ` Yikebaer Aizezi 2023-08-04 3:42 ` Matthew Wilcox 2023-08-04 13:35 ` David Howells 0 siblings, 2 replies; 8+ messages in thread From: Yikebaer Aizezi @ 2023-08-04 3:14 UTC (permalink / raw) To: Matthew Wilcox; +Cc: akpm, linux-mm Just patched it, then I rerun the reproduce program, and I got this output from console: BUG: Bad page state in process POC pfn:0eb8d page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xeb8d flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner info is not present (never set?) Modules linked in: CPU: 0 PID: 7959 Comm: POC Not tainted 6.5.0-rc2 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd4/0xf0 lib/dump_stack.c:106 bad_page+0x71/0x1a0 mm/page_alloc.c:533 free_page_is_bad_report mm/page_alloc.c:974 [inline] free_page_is_bad mm/page_alloc.c:984 [inline] free_pages_prepare mm/page_alloc.c:1153 [inline] free_unref_page_prepare+0x5f3/0xb50 mm/page_alloc.c:2348 free_unref_page+0x2f/0x3c0 mm/page_alloc.c:2443 __folio_put_small mm/swap.c:106 [inline] __folio_put+0xa2/0x110 mm/swap.c:129 folio_put include/linux/mm.h:1423 [inline] put_page include/linux/mm.h:1492 [inline] extract_user_to_sg lib/scatterlist.c:1151 [inline] extract_iter_to_sg lib/scatterlist.c:1349 [inline] extract_iter_to_sg+0x11ec/0x1570 lib/scatterlist.c:1339 hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xcf/0x170 net/socket.c:748 ____sys_sendmsg+0x676/0x860 net/socket.c:2494 ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbd79539f29 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xeb8d flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_WARN_ON_ONCE_FOLIO(folio_ref_count(folio) <= 0) page_owner info is not present (never set?) ------------[ cut here ]------------ WARNING: CPU: 0 PID: 7962 at mm/gup.c:229 try_grab_page+0x307/0x3c0 mm/gup.c:229 Modules linked in: CPU: 0 PID: 7962 Comm: POC Tainted: G B 6.5.0-rc2 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:try_grab_page+0x307/0x3c0 mm/gup.c:229 Code: 80 3d 61 0e 82 0b 00 41 bc f4 ff ff ff 75 b4 e8 3f 96 cb ff 48 c7 c6 40 83 57 89 48 89 ef e8 60 a7 ff ff c6 05 3e 0e 82 0b 01 <0f> 0b eb 95 e8 20 96 cb ff be 04 00 00 00 4c 89 e7 e8 93 fa 13 00 RSP: 0018:ffffc90002927178 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffea00003ae340 RCX: 0000000000000000 RDX: ffff88801ab18000 RSI: ffffffff81ad81e0 RDI: ffffffff8af7ea00 RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffffbfff1a8a74a R10: ffffffff8d453a57 R11: 6e776f5f65676170 R12: 00000000fffffff4 R13: 0000000000290000 R14: ffffea00003ae340 R15: ffffea00003ae340 FS: 00007fbd7961a540(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbd794d03d0 CR3: 0000000019855000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> follow_page_pte+0x18c/0x1610 mm/gup.c:651 follow_pmd_mask mm/gup.c:727 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 __get_user_pages_locked mm/gup.c:1487 [inline] __gup_longterm_locked+0x5fa/0x1ec0 mm/gup.c:2181 internal_get_user_pages_fast+0x119b/0x2690 mm/gup.c:3179 pin_user_pages_fast+0x95/0xe0 mm/gup.c:3285 iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] iov_iter_extract_pages+0x24c/0x1600 lib/iov_iter.c:1831 extract_user_to_sg lib/scatterlist.c:1123 [inline] extract_iter_to_sg lib/scatterlist.c:1349 [inline] extract_iter_to_sg+0x21a/0x1570 lib/scatterlist.c:1339 hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xcf/0x170 net/socket.c:748 ____sys_sendmsg+0x676/0x860 net/socket.c:2494 ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbd79539f29 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Modules linked in: CPU: 0 PID: 7962 Comm: POC Tainted: G B 6.5.0-rc2 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:try_grab_page+0x307/0x3c0 mm/gup.c:229 Code: 80 3d 61 0e 82 0b 00 41 bc f4 ff ff ff 75 b4 e8 3f 96 cb ff 48 c7 c6 40 83 57 89 48 89 ef e8 60 a7 ff ff c6 05 3e 0e 82 0b 01 <0f> 0b eb 95 e8 20 96 cb ff be 04 00 00 00 4c 89 e7 e8 93 fa 13 00 RSP: 0018:ffffc90002927178 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffea00003ae340 RCX: 0000000000000000 RDX: ffff88801ab18000 RSI: ffffffff81ad81e0 RDI: ffffffff8af7ea00 RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffffbfff1a8a74a R10: ffffffff8d453a57 R11: 6e776f5f65676170 R12: 00000000fffffff4 R13: 0000000000290000 R14: ffffea00003ae340 R15: ffffea00003ae340 FS: 00007fbd7961a540(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbd794d03d0 CR3: 0000000019855000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> follow_page_pte+0x18c/0x1610 mm/gup.c:651 follow_pmd_mask mm/gup.c:727 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 __get_user_pages_locked mm/gup.c:1487 [inline] __gup_longterm_locked+0x5fa/0x1ec0 mm/gup.c:2181 internal_get_user_pages_fast+0x119b/0x2690 mm/gup.c:3179 pin_user_pages_fast+0x95/0xe0 mm/gup.c:3285 iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] iov_iter_extract_pages+0x24c/0x1600 lib/iov_iter.c:1831 extract_user_to_sg lib/scatterlist.c:1123 [inline] extract_iter_to_sg lib/scatterlist.c:1349 [inline] extract_iter_to_sg+0x21a/0x1570 lib/scatterlist.c:1339 hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xcf/0x170 net/socket.c:748 ____sys_sendmsg+0x676/0x860 net/socket.c:2494 ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbd79539f29 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 0 PID: 7962 Comm: POC Tainted: G B 6.5.0-rc2 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x92/0xf0 lib/dump_stack.c:106 panic+0x570/0x620 kernel/panic.c:340 check_panic_on_warn+0x8e/0x90 kernel/panic.c:236 __warn+0xee/0x340 kernel/panic.c:673 __report_bug lib/bug.c:199 [inline] report_bug+0x25d/0x460 lib/bug.c:219 handle_bug+0x3c/0x70 arch/x86/kernel/traps.c:324 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:345 asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:568 RIP: 0010:try_grab_page+0x307/0x3c0 mm/gup.c:229 Code: 80 3d 61 0e 82 0b 00 41 bc f4 ff ff ff 75 b4 e8 3f 96 cb ff 48 c7 c6 40 83 57 89 48 89 ef e8 60 a7 ff ff c6 05 3e 0e 82 0b 01 <0f> 0b eb 95 e8 20 96 cb ff be 04 00 00 00 4c 89 e7 e8 93 fa 13 00 RSP: 0018:ffffc90002927178 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffea00003ae340 RCX: 0000000000000000 RDX: ffff88801ab18000 RSI: ffffffff81ad81e0 RDI: ffffffff8af7ea00 RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffffbfff1a8a74a R10: ffffffff8d453a57 R11: 6e776f5f65676170 R12: 00000000fffffff4 R13: 0000000000290000 R14: ffffea00003ae340 R15: ffffea00003ae340 follow_page_pte+0x18c/0x1610 mm/gup.c:651 follow_pmd_mask mm/gup.c:727 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 __get_user_pages_locked mm/gup.c:1487 [inline] __gup_longterm_locked+0x5fa/0x1ec0 mm/gup.c:2181 internal_get_user_pages_fast+0x119b/0x2690 mm/gup.c:3179 pin_user_pages_fast+0x95/0xe0 mm/gup.c:3285 iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] iov_iter_extract_pages+0x24c/0x1600 lib/iov_iter.c:1831 extract_user_to_sg lib/scatterlist.c:1123 [inline] extract_iter_to_sg lib/scatterlist.c:1349 [inline] extract_iter_to_sg+0x21a/0x1570 lib/scatterlist.c:1339 hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xcf/0x170 net/socket.c:748 ____sys_sendmsg+0x676/0x860 net/socket.c:2494 ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbd79539f29 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 1 seconds.. --------------------------------------------------------------------------------------------- I think the previous question you mentioned about ioctl() is triggered because of another crash WARNING in kvm_arch_vcpu_ioctl_run, I think somehow these two crashes triggered at one time. But I cannot figure out why it happened. after I tried to fixed that problem, and rerun C reproducer on this issue, I got different output from console as above. Matthew Wilcox <willy@infradead.org> 于2023年8月3日周四 21:19写道： > > On Thu, Aug 03, 2023 at 04:56:03PM +0800, Yikebaer Aizezi wrote: > > console output: > > https://drive.google.com/file/d/1Lq71bFwtEDix82PEf_193CLG6uh1Pjj9/view?usp=drive_link > > I dug through this, and what I found troubles me. > > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 13067 at mm/gup.c:229 try_grab_page+0x2dd/0x3a0 > Modules linked in: > CPU: 0 PID: 13067 Comm: syz-executor Tainted: G B 6.5.0-rc2 #1 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > RIP: 0010:try_grab_page+0x2dd/0x3a0 > Code: ff be 04 00 00 00 4c 89 e7 e8 cf fa 13 00 f0 41 ff 04 24 e8 65 96 cb ff 45 31 e4 5b 44 89 e0 5d 41 5c 41 5d c3 e8 53 96 cb ff <0f> 0b e8 4c 96 cb ff 41 bc f4 ff ff ff 5b 44 89 e0 5d 41 5c 41 5d > RSP: 0018:ffffc9000c2777e0 EFLAGS: 00010212 > RAX: 0000000000000247 RBX: ffffea00003ae340 RCX: ffffc90002bb1000 > RDX: 0000000000040000 RSI: ffffffff81ad81ed RDI: ffffea00003ae374 > RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffff94000075c6e > R10: ffffea00003ae377 R11: 0000000000084001 R12: ffffea00003ae374 > R13: 0000000000210002 R14: ffffea00003ae340 R15: 000000000eb8d225 > FS: 00007f5841a13640(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000500310 CR3: 0000000018d0c000 CR4: 0000000000750ef0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: > <TASK> > ? __warn+0xe2/0x340 > ? try_grab_page+0x2dd/0x3a0 > ? report_bug+0x25d/0x460 > ? handle_bug+0x3c/0x70 > ? exc_invalid_op+0x14/0x40 > ? asm_exc_invalid_op+0x16/0x20 > ? try_grab_page+0x2dd/0x3a0 > ? try_grab_page+0x2dd/0x3a0 > follow_page_pte+0x18c/0x1610 > ? try_grab_page+0x3a0/0x3a0 > ? rcu_is_watching+0xe/0xb0 > follow_page_mask+0x2e4/0xbd0 > __get_user_pages+0x3fa/0xcf0 > ? follow_page_mask+0xbd0/0xbd0 > ? down_read_killable+0x146/0x4f0 > ? down_read_interruptible+0x4f0/0x4f0 > ? rcu_is_watching+0xe/0xb0 > __gup_longterm_locked+0x5fa/0x1ec0 > ? io_schedule_timeout+0x150/0x150 > ? rcu_is_watching+0xe/0xb0 > ? get_user_pages_unlocked+0x580/0x580 > ? lock_release+0x4f7/0x670 > ? internal_get_user_pages_fast+0xe27/0x2690 > ? lock_downgrade+0x690/0x690 > ? preempt_schedule_common+0x45/0xb0 > ? pud_huge+0x9c/0xe0 > ? pmd_huge+0xe0/0xe0 > internal_get_user_pages_fast+0x119b/0x2690 > ? mtree_load+0x1df/0x980 > ? __gup_device_huge+0x530/0x530 > ? rcu_is_watching+0xe/0xb0 > ? lock_release+0x4f7/0x670 > get_user_pages_fast+0x95/0xe0 > ? get_user_pages_fast_only+0xe0/0xe0 > do_get_mempolicy+0x50c/0xd20 > ? sp_delete+0xf0/0xf0 > ? seccomp_notify_ioctl+0xd80/0xd80 > __x64_sys_get_mempolicy+0x187/0x2a0 > ? __ia32_sys_migrate_pages+0xf0/0xf0 > ? __secure_computing+0x1ff/0x360 > do_syscall_64+0x35/0xb0 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x47959d > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007f5841a13068 EFLAGS: 00000246 ORIG_RAX: 00000000000000ef > RAX: ffffffffffffffda RBX: 000000000059c0a0 RCX: 000000000047959d > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 000000000059c0a0 R08: 0000000000000003 R09: 0000000000000000 > R10: 0000000020ff9000 R11: 0000000000000246 R12: 000000000059c0ac > R13: 000000000000000b R14: 0000000000437250 R15: 00007f58419f3000 > </TASK> > Kernel panic - not syncing: kernel: panic_on_warn set ... > > > WARNING: CPU: 0 PID: 13067 at mm/gup.c:229 try_grab_page+0x2dd/0x3a0 > > That's this line: > if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) > Called from: > follow_page_pte+0x18c/0x1610 > > That did: > ptep = pte_offset_map_lock(mm, pmd, address, &ptl); > pte = ptep_get(ptep); > page = vm_normal_page(vma, address, pte); > ret = try_grab_page(page, flags); > > So we grabbed the PTE lock, looked up the PTE, translated that into > a page ... and found a page with a zero (or negative) refcount. > That's Really Bad. I think it was a zero refcount because r08 is 0 > and I don't see any other registers which have a plausible negative > 32-bit number in them. > > Yikebaer, could I trouble you to add this: > > +++ b/mm/gup.c > @@ -226,7 +226,7 @@ int __must_check try_grab_page(struct page *page, unsigned int flags) > { > struct folio *folio = page_folio(page); > > - if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) > + if (VM_WARN_ON_ONCE_FOLIO(folio_ref_count(folio) <= 0, folio)) > return -ENOMEM; > > if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page))) > > and rerun the syzkaller? That'll give us some more information about > what has happened, although it won't tell us why it happened. > > We might need to catch someone decrementing the refcount to lower than > the mapcount to catch this ... which will be tricky, given the other > things we reuse the mapcount for. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: WARNING in try_grab_page 2023-08-04 3:14 ` Yikebaer Aizezi @ 2023-08-04 3:42 ` Matthew Wilcox 2023-08-04 13:32 ` Matthew Wilcox 2023-08-04 13:35 ` David Howells 1 sibling, 1 reply; 8+ messages in thread From: Matthew Wilcox @ 2023-08-04 3:42 UTC (permalink / raw) To: Yikebaer Aizezi; +Cc: akpm, linux-mm, David Howells On Fri, Aug 04, 2023 at 11:14:45AM +0800, Yikebaer Aizezi wrote: > Just patched it, then I rerun the reproduce program, and I got this > output from console: > > BUG: Bad page state in process POC pfn:0eb8d > page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 > index:0x0 pfn:0xeb8d > flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) > page_type: 0xffffffff() > raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set > page_owner info is not present (never set?) > Modules linked in: > CPU: 0 PID: 7959 Comm: POC Not tainted 6.5.0-rc2 #2 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0xd4/0xf0 lib/dump_stack.c:106 > bad_page+0x71/0x1a0 mm/page_alloc.c:533 > free_page_is_bad_report mm/page_alloc.c:974 [inline] > free_page_is_bad mm/page_alloc.c:984 [inline] > free_pages_prepare mm/page_alloc.c:1153 [inline] > free_unref_page_prepare+0x5f3/0xb50 mm/page_alloc.c:2348 > free_unref_page+0x2f/0x3c0 mm/page_alloc.c:2443 > __folio_put_small mm/swap.c:106 [inline] > __folio_put+0xa2/0x110 mm/swap.c:129 > folio_put include/linux/mm.h:1423 [inline] > put_page include/linux/mm.h:1492 [inline] > extract_user_to_sg lib/scatterlist.c:1151 [inline] Ohh. I think this is something Dave Howells has a patch for. > extract_iter_to_sg lib/scatterlist.c:1349 [inline] > extract_iter_to_sg+0x11ec/0x1570 lib/scatterlist.c:1339 > hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 > sock_sendmsg_nosec net/socket.c:725 [inline] > sock_sendmsg+0xcf/0x170 net/socket.c:748 > ____sys_sendmsg+0x676/0x860 net/socket.c:2494 > ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 > __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7fbd79539f29 > Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 > RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 > RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 > RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 > R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 > </TASK> > > page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 > index:0x0 pfn:0xeb8d > flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) > page_type: 0xffffffff() > raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > page dumped because: VM_WARN_ON_ONCE_FOLIO(folio_ref_count(folio) <= 0) > page_owner info is not present (never set?) > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 7962 at mm/gup.c:229 try_grab_page+0x307/0x3c0 mm/gup.c:229 > Modules linked in: > CPU: 0 PID: 7962 Comm: POC Tainted: G B 6.5.0-rc2 #2 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > RIP: 0010:try_grab_page+0x307/0x3c0 mm/gup.c:229 > Code: 80 3d 61 0e 82 0b 00 41 bc f4 ff ff ff 75 b4 e8 3f 96 cb ff 48 > c7 c6 40 83 57 89 48 89 ef e8 60 a7 ff ff c6 05 3e 0e 82 0b 01 <0f> 0b > eb 95 e8 20 96 cb ff be 04 00 00 00 4c 89 e7 e8 93 fa 13 00 > RSP: 0018:ffffc90002927178 EFLAGS: 00010293 > RAX: 0000000000000000 RBX: ffffea00003ae340 RCX: 0000000000000000 > RDX: ffff88801ab18000 RSI: ffffffff81ad81e0 RDI: ffffffff8af7ea00 > RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffffbfff1a8a74a > R10: ffffffff8d453a57 R11: 6e776f5f65676170 R12: 00000000fffffff4 > R13: 0000000000290000 R14: ffffea00003ae340 R15: ffffea00003ae340 > FS: 00007fbd7961a540(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007fbd794d03d0 CR3: 0000000019855000 CR4: 0000000000750ef0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: > <TASK> > follow_page_pte+0x18c/0x1610 mm/gup.c:651 > follow_pmd_mask mm/gup.c:727 [inline] > follow_pud_mask mm/gup.c:765 [inline] > follow_p4d_mask mm/gup.c:782 [inline] > follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 > __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 > __get_user_pages_locked mm/gup.c:1487 [inline] > __gup_longterm_locked+0x5fa/0x1ec0 mm/gup.c:2181 > internal_get_user_pages_fast+0x119b/0x2690 mm/gup.c:3179 > pin_user_pages_fast+0x95/0xe0 mm/gup.c:3285 > iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] > iov_iter_extract_pages+0x24c/0x1600 lib/iov_iter.c:1831 > extract_user_to_sg lib/scatterlist.c:1123 [inline] > extract_iter_to_sg lib/scatterlist.c:1349 [inline] > extract_iter_to_sg+0x21a/0x1570 lib/scatterlist.c:1339 > hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 > sock_sendmsg_nosec net/socket.c:725 [inline] > sock_sendmsg+0xcf/0x170 net/socket.c:748 > ____sys_sendmsg+0x676/0x860 net/socket.c:2494 > ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 > __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7fbd79539f29 > Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 > RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 > RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 > RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 > R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 > </TASK> > > Modules linked in: > CPU: 0 PID: 7962 Comm: POC Tainted: G B 6.5.0-rc2 #2 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > RIP: 0010:try_grab_page+0x307/0x3c0 mm/gup.c:229 > Code: 80 3d 61 0e 82 0b 00 41 bc f4 ff ff ff 75 b4 e8 3f 96 cb ff 48 > c7 c6 40 83 57 89 48 89 ef e8 60 a7 ff ff c6 05 3e 0e 82 0b 01 <0f> 0b > eb 95 e8 20 96 cb ff be 04 00 00 00 4c 89 e7 e8 93 fa 13 00 > RSP: 0018:ffffc90002927178 EFLAGS: 00010293 > RAX: 0000000000000000 RBX: ffffea00003ae340 RCX: 0000000000000000 > RDX: ffff88801ab18000 RSI: ffffffff81ad81e0 RDI: ffffffff8af7ea00 > RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffffbfff1a8a74a > R10: ffffffff8d453a57 R11: 6e776f5f65676170 R12: 00000000fffffff4 > R13: 0000000000290000 R14: ffffea00003ae340 R15: ffffea00003ae340 > FS: 00007fbd7961a540(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007fbd794d03d0 CR3: 0000000019855000 CR4: 0000000000750ef0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: > <TASK> > follow_page_pte+0x18c/0x1610 mm/gup.c:651 > follow_pmd_mask mm/gup.c:727 [inline] > follow_pud_mask mm/gup.c:765 [inline] > follow_p4d_mask mm/gup.c:782 [inline] > follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 > __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 > __get_user_pages_locked mm/gup.c:1487 [inline] > __gup_longterm_locked+0x5fa/0x1ec0 mm/gup.c:2181 > internal_get_user_pages_fast+0x119b/0x2690 mm/gup.c:3179 > pin_user_pages_fast+0x95/0xe0 mm/gup.c:3285 > iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] > iov_iter_extract_pages+0x24c/0x1600 lib/iov_iter.c:1831 > extract_user_to_sg lib/scatterlist.c:1123 [inline] > extract_iter_to_sg lib/scatterlist.c:1349 [inline] > extract_iter_to_sg+0x21a/0x1570 lib/scatterlist.c:1339 > hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 > sock_sendmsg_nosec net/socket.c:725 [inline] > sock_sendmsg+0xcf/0x170 net/socket.c:748 > ____sys_sendmsg+0x676/0x860 net/socket.c:2494 > ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 > __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7fbd79539f29 > Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 > RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 > RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 > RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 > R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 > </TASK> > Kernel panic - not syncing: kernel: panic_on_warn set ... > CPU: 0 PID: 7962 Comm: POC Tainted: G B 6.5.0-rc2 #2 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x92/0xf0 lib/dump_stack.c:106 > panic+0x570/0x620 kernel/panic.c:340 > check_panic_on_warn+0x8e/0x90 kernel/panic.c:236 > __warn+0xee/0x340 kernel/panic.c:673 > __report_bug lib/bug.c:199 [inline] > report_bug+0x25d/0x460 lib/bug.c:219 > handle_bug+0x3c/0x70 arch/x86/kernel/traps.c:324 > exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:345 > asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:568 > RIP: 0010:try_grab_page+0x307/0x3c0 mm/gup.c:229 > Code: 80 3d 61 0e 82 0b 00 41 bc f4 ff ff ff 75 b4 e8 3f 96 cb ff 48 > c7 c6 40 83 57 89 48 89 ef e8 60 a7 ff ff c6 05 3e 0e 82 0b 01 <0f> 0b > eb 95 e8 20 96 cb ff be 04 00 00 00 4c 89 e7 e8 93 fa 13 00 > RSP: 0018:ffffc90002927178 EFLAGS: 00010293 > RAX: 0000000000000000 RBX: ffffea00003ae340 RCX: 0000000000000000 > RDX: ffff88801ab18000 RSI: ffffffff81ad81e0 RDI: ffffffff8af7ea00 > RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffffbfff1a8a74a > R10: ffffffff8d453a57 R11: 6e776f5f65676170 R12: 00000000fffffff4 > R13: 0000000000290000 R14: ffffea00003ae340 R15: ffffea00003ae340 > follow_page_pte+0x18c/0x1610 mm/gup.c:651 > follow_pmd_mask mm/gup.c:727 [inline] > follow_pud_mask mm/gup.c:765 [inline] > follow_p4d_mask mm/gup.c:782 [inline] > follow_page_mask+0x2e4/0xbd0 mm/gup.c:839 > __get_user_pages+0x3fa/0xcf0 mm/gup.c:1256 > __get_user_pages_locked mm/gup.c:1487 [inline] > __gup_longterm_locked+0x5fa/0x1ec0 mm/gup.c:2181 > internal_get_user_pages_fast+0x119b/0x2690 mm/gup.c:3179 > pin_user_pages_fast+0x95/0xe0 mm/gup.c:3285 > iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] > iov_iter_extract_pages+0x24c/0x1600 lib/iov_iter.c:1831 > extract_user_to_sg lib/scatterlist.c:1123 [inline] > extract_iter_to_sg lib/scatterlist.c:1349 [inline] > extract_iter_to_sg+0x21a/0x1570 lib/scatterlist.c:1339 > hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 > sock_sendmsg_nosec net/socket.c:725 [inline] > sock_sendmsg+0xcf/0x170 net/socket.c:748 > ____sys_sendmsg+0x676/0x860 net/socket.c:2494 > ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 > __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7fbd79539f29 > Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48 > RSP: 002b:00007ffeed5b63d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbd79539f29 > RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 > RBP: 00007ffeed5b63f0 R08: 00007ffeed5b63f0 R09: 00007ffeed5b63f0 > R10: 00007ffeed5b63f0 R11: 0000000000000246 R12: 000055d8a44b91a0 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 > </TASK> > Dumping ftrace buffer: > (ftrace buffer empty) > Kernel Offset: disabled > Rebooting in 1 seconds.. > > --------------------------------------------------------------------------------------------- > > I think the previous question you mentioned about ioctl() is triggered > because of > another crash WARNING in kvm_arch_vcpu_ioctl_run, I think somehow these > two crashes triggered at one time. But I cannot figure out why it happened. > > after I tried to fixed that problem, and rerun C reproducer on this > issue, I got > different output from console as above. > > > Matthew Wilcox <willy@infradead.org> 于2023年8月3日周四 21:19写道： > > > > > > On Thu, Aug 03, 2023 at 04:56:03PM +0800, Yikebaer Aizezi wrote: > > > console output: > > > https://drive.google.com/file/d/1Lq71bFwtEDix82PEf_193CLG6uh1Pjj9/view?usp=drive_link > > > > I dug through this, and what I found troubles me. > > > > ------------[ cut here ]------------ > > WARNING: CPU: 0 PID: 13067 at mm/gup.c:229 try_grab_page+0x2dd/0x3a0 > > Modules linked in: > > CPU: 0 PID: 13067 Comm: syz-executor Tainted: G B 6.5.0-rc2 #1 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > > RIP: 0010:try_grab_page+0x2dd/0x3a0 > > Code: ff be 04 00 00 00 4c 89 e7 e8 cf fa 13 00 f0 41 ff 04 24 e8 65 96 cb ff 45 31 e4 5b 44 89 e0 5d 41 5c 41 5d c3 e8 53 96 cb ff <0f> 0b e8 4c 96 cb ff 41 bc f4 ff ff ff 5b 44 89 e0 5d 41 5c 41 5d > > RSP: 0018:ffffc9000c2777e0 EFLAGS: 00010212 > > RAX: 0000000000000247 RBX: ffffea00003ae340 RCX: ffffc90002bb1000 > > RDX: 0000000000040000 RSI: ffffffff81ad81ed RDI: ffffea00003ae374 > > RBP: ffffea00003ae340 R08: 0000000000000000 R09: fffff94000075c6e > > R10: ffffea00003ae377 R11: 0000000000084001 R12: ffffea00003ae374 > > R13: 0000000000210002 R14: ffffea00003ae340 R15: 000000000eb8d225 > > FS: 00007f5841a13640(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000000000500310 CR3: 0000000018d0c000 CR4: 0000000000750ef0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > PKRU: 55555554 > > Call Trace: > > <TASK> > > ? __warn+0xe2/0x340 > > ? try_grab_page+0x2dd/0x3a0 > > ? report_bug+0x25d/0x460 > > ? handle_bug+0x3c/0x70 > > ? exc_invalid_op+0x14/0x40 > > ? asm_exc_invalid_op+0x16/0x20 > > ? try_grab_page+0x2dd/0x3a0 > > ? try_grab_page+0x2dd/0x3a0 > > follow_page_pte+0x18c/0x1610 > > ? try_grab_page+0x3a0/0x3a0 > > ? rcu_is_watching+0xe/0xb0 > > follow_page_mask+0x2e4/0xbd0 > > __get_user_pages+0x3fa/0xcf0 > > ? follow_page_mask+0xbd0/0xbd0 > > ? down_read_killable+0x146/0x4f0 > > ? down_read_interruptible+0x4f0/0x4f0 > > ? rcu_is_watching+0xe/0xb0 > > __gup_longterm_locked+0x5fa/0x1ec0 > > ? io_schedule_timeout+0x150/0x150 > > ? rcu_is_watching+0xe/0xb0 > > ? get_user_pages_unlocked+0x580/0x580 > > ? lock_release+0x4f7/0x670 > > ? internal_get_user_pages_fast+0xe27/0x2690 > > ? lock_downgrade+0x690/0x690 > > ? preempt_schedule_common+0x45/0xb0 > > ? pud_huge+0x9c/0xe0 > > ? pmd_huge+0xe0/0xe0 > > internal_get_user_pages_fast+0x119b/0x2690 > > ? mtree_load+0x1df/0x980 > > ? __gup_device_huge+0x530/0x530 > > ? rcu_is_watching+0xe/0xb0 > > ? lock_release+0x4f7/0x670 > > get_user_pages_fast+0x95/0xe0 > > ? get_user_pages_fast_only+0xe0/0xe0 > > do_get_mempolicy+0x50c/0xd20 > > ? sp_delete+0xf0/0xf0 > > ? seccomp_notify_ioctl+0xd80/0xd80 > > __x64_sys_get_mempolicy+0x187/0x2a0 > > ? __ia32_sys_migrate_pages+0xf0/0xf0 > > ? __secure_computing+0x1ff/0x360 > > do_syscall_64+0x35/0xb0 > > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > RIP: 0033:0x47959d > > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 > > RSP: 002b:00007f5841a13068 EFLAGS: 00000246 ORIG_RAX: 00000000000000ef > > RAX: ffffffffffffffda RBX: 000000000059c0a0 RCX: 000000000047959d > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > > RBP: 000000000059c0a0 R08: 0000000000000003 R09: 0000000000000000 > > R10: 0000000020ff9000 R11: 0000000000000246 R12: 000000000059c0ac > > R13: 000000000000000b R14: 0000000000437250 R15: 00007f58419f3000 > > </TASK> > > Kernel panic - not syncing: kernel: panic_on_warn set ... > > > > > WARNING: CPU: 0 PID: 13067 at mm/gup.c:229 try_grab_page+0x2dd/0x3a0 > > > > That's this line: > > if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) > > Called from: > > follow_page_pte+0x18c/0x1610 > > > > That did: > > ptep = pte_offset_map_lock(mm, pmd, address, &ptl); > > pte = ptep_get(ptep); > > page = vm_normal_page(vma, address, pte); > > ret = try_grab_page(page, flags); > > > > So we grabbed the PTE lock, looked up the PTE, translated that into > > a page ... and found a page with a zero (or negative) refcount. > > That's Really Bad. I think it was a zero refcount because r08 is 0 > > and I don't see any other registers which have a plausible negative > > 32-bit number in them. > > > > Yikebaer, could I trouble you to add this: > > > > +++ b/mm/gup.c > > @@ -226,7 +226,7 @@ int __must_check try_grab_page(struct page *page, unsigned int flags) > > { > > struct folio *folio = page_folio(page); > > > > - if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) > > + if (VM_WARN_ON_ONCE_FOLIO(folio_ref_count(folio) <= 0, folio)) > > return -ENOMEM; > > > > if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page))) > > > > and rerun the syzkaller? That'll give us some more information about > > what has happened, although it won't tell us why it happened. > > > > We might need to catch someone decrementing the refcount to lower than > > the mapcount to catch this ... which will be tricky, given the other > > things we reuse the mapcount for. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: WARNING in try_grab_page 2023-08-04 3:42 ` Matthew Wilcox @ 2023-08-04 13:32 ` Matthew Wilcox 0 siblings, 0 replies; 8+ messages in thread From: Matthew Wilcox @ 2023-08-04 13:32 UTC (permalink / raw) To: Yikebaer Aizezi; +Cc: akpm, linux-mm, David Howells On Fri, Aug 04, 2023 at 04:42:27AM +0100, Matthew Wilcox wrote: > On Fri, Aug 04, 2023 at 11:14:45AM +0800, Yikebaer Aizezi wrote: > > Just patched it, then I rerun the reproduce program, and I got this > > output from console: > > > > BUG: Bad page state in process POC pfn:0eb8d > > page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 > > index:0x0 pfn:0xeb8d > > flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) > > page_type: 0xffffffff() > > raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 > > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > > page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set > > page_owner info is not present (never set?) > > Modules linked in: > > CPU: 0 PID: 7959 Comm: POC Not tainted 6.5.0-rc2 #2 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > > Call Trace: > > <TASK> > > __dump_stack lib/dump_stack.c:88 [inline] > > dump_stack_lvl+0xd4/0xf0 lib/dump_stack.c:106 > > bad_page+0x71/0x1a0 mm/page_alloc.c:533 > > free_page_is_bad_report mm/page_alloc.c:974 [inline] > > free_page_is_bad mm/page_alloc.c:984 [inline] > > free_pages_prepare mm/page_alloc.c:1153 [inline] > > free_unref_page_prepare+0x5f3/0xb50 mm/page_alloc.c:2348 > > free_unref_page+0x2f/0x3c0 mm/page_alloc.c:2443 > > __folio_put_small mm/swap.c:106 [inline] > > __folio_put+0xa2/0x110 mm/swap.c:129 > > folio_put include/linux/mm.h:1423 [inline] > > put_page include/linux/mm.h:1492 [inline] > > extract_user_to_sg lib/scatterlist.c:1151 [inline] > > Ohh. I think this is something Dave Howells has a patch for. Can you try https://lore.kernel.org/mm-commits/20230726204730.B89D8C433C7@smtp.kernel.org/ ? ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: WARNING in try_grab_page 2023-08-04 3:14 ` Yikebaer Aizezi 2023-08-04 3:42 ` Matthew Wilcox @ 2023-08-04 13:35 ` David Howells 2023-08-06 7:51 ` Yikebaer Aizezi 1 sibling, 1 reply; 8+ messages in thread From: David Howells @ 2023-08-04 13:35 UTC (permalink / raw) To: Matthew Wilcox; +Cc: dhowells, Yikebaer Aizezi, akpm, linux-mm, Herbert Xu Matthew Wilcox <willy@infradead.org> wrote: > On Fri, Aug 04, 2023 at 11:14:45AM +0800, Yikebaer Aizezi wrote: > > Just patched it, then I rerun the reproduce program, and I got this > > output from console: > > > > BUG: Bad page state in process POC pfn:0eb8d > > page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 > > index:0x0 pfn:0xeb8d > > flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) > > page_type: 0xffffffff() > > raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 > > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > > page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set > > page_owner info is not present (never set?) > > Modules linked in: > > CPU: 0 PID: 7959 Comm: POC Not tainted 6.5.0-rc2 #2 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > > Call Trace: > > <TASK> > > __dump_stack lib/dump_stack.c:88 [inline] > > dump_stack_lvl+0xd4/0xf0 lib/dump_stack.c:106 > > bad_page+0x71/0x1a0 mm/page_alloc.c:533 > > free_page_is_bad_report mm/page_alloc.c:974 [inline] > > free_page_is_bad mm/page_alloc.c:984 [inline] > > free_pages_prepare mm/page_alloc.c:1153 [inline] > > free_unref_page_prepare+0x5f3/0xb50 mm/page_alloc.c:2348 > > free_unref_page+0x2f/0x3c0 mm/page_alloc.c:2443 > > __folio_put_small mm/swap.c:106 [inline] > > __folio_put+0xa2/0x110 mm/swap.c:129 > > folio_put include/linux/mm.h:1423 [inline] > > put_page include/linux/mm.h:1492 [inline] > > extract_user_to_sg lib/scatterlist.c:1151 [inline] > > Ohh. I think this is something Dave Howells has a patch for. > > > extract_iter_to_sg lib/scatterlist.c:1349 [inline] > > extract_iter_to_sg+0x11ec/0x1570 lib/scatterlist.c:1339 > > hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 > > sock_sendmsg_nosec net/socket.c:725 [inline] > > sock_sendmsg+0xcf/0x170 net/socket.c:748 > > ____sys_sendmsg+0x676/0x860 net/socket.c:2494 > > ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 > > __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 > > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > > entry_SYSCALL_64_after_hwframe+0x63/0xcd This might be the fix you're looking for. https://lore.kernel.org/linux-crypto/20571.1690369076@warthog.procyon.org.uk/ Andrew has it in mm-hotfixes-unstable. David ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: WARNING in try_grab_page 2023-08-04 13:35 ` David Howells @ 2023-08-06 7:51 ` Yikebaer Aizezi 0 siblings, 0 replies; 8+ messages in thread From: Yikebaer Aizezi @ 2023-08-06 7:51 UTC (permalink / raw) To: David Howells, linux-mm, Matthew Wilcox, akpm; +Cc: Herbert Xu I just tried this patch, it worked and the bug was not triggered. David Howells <dhowells@redhat.com> 于2023年8月4日周五 21:35写道： > > Matthew Wilcox <willy@infradead.org> wrote: > > > On Fri, Aug 04, 2023 at 11:14:45AM +0800, Yikebaer Aizezi wrote: > > > Just patched it, then I rerun the reproduce program, and I got this > > > output from console: > > > > > > BUG: Bad page state in process POC pfn:0eb8d > > > page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 > > > index:0x0 pfn:0xeb8d > > > flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) > > > page_type: 0xffffffff() > > > raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 > > > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > > > page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set > > > page_owner info is not present (never set?) > > > Modules linked in: > > > CPU: 0 PID: 7959 Comm: POC Not tainted 6.5.0-rc2 #2 > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > > > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > > > Call Trace: > > > <TASK> > > > __dump_stack lib/dump_stack.c:88 [inline] > > > dump_stack_lvl+0xd4/0xf0 lib/dump_stack.c:106 > > > bad_page+0x71/0x1a0 mm/page_alloc.c:533 > > > free_page_is_bad_report mm/page_alloc.c:974 [inline] > > > free_page_is_bad mm/page_alloc.c:984 [inline] > > > free_pages_prepare mm/page_alloc.c:1153 [inline] > > > free_unref_page_prepare+0x5f3/0xb50 mm/page_alloc.c:2348 > > > free_unref_page+0x2f/0x3c0 mm/page_alloc.c:2443 > > > __folio_put_small mm/swap.c:106 [inline] > > > __folio_put+0xa2/0x110 mm/swap.c:129 > > > folio_put include/linux/mm.h:1423 [inline] > > > put_page include/linux/mm.h:1492 [inline] > > > extract_user_to_sg lib/scatterlist.c:1151 [inline] > > > > Ohh. I think this is something Dave Howells has a patch for. > > > > > extract_iter_to_sg lib/scatterlist.c:1349 [inline] > > > extract_iter_to_sg+0x11ec/0x1570 lib/scatterlist.c:1339 > > > hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 > > > sock_sendmsg_nosec net/socket.c:725 [inline] > > > sock_sendmsg+0xcf/0x170 net/socket.c:748 > > > ____sys_sendmsg+0x676/0x860 net/socket.c:2494 > > > ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 > > > __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 > > > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > > > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > > > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > This might be the fix you're looking for. > > https://lore.kernel.org/linux-crypto/20571.1690369076@warthog.procyon.org.uk/ > > Andrew has it in mm-hotfixes-unstable. > > David > ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2023-08-06 7:51 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2023-08-03 8:56 WARNING in try_grab_page Yikebaer Aizezi 2023-08-03 12:50 ` Matthew Wilcox 2023-08-03 13:19 ` Matthew Wilcox 2023-08-04 3:14 ` Yikebaer Aizezi 2023-08-04 3:42 ` Matthew Wilcox 2023-08-04 13:32 ` Matthew Wilcox 2023-08-04 13:35 ` David Howells 2023-08-06 7:51 ` Yikebaer Aizezi
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox