From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E404C369B4 for ; Mon, 14 Apr 2025 15:15:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7E2C0280061; Mon, 14 Apr 2025 11:15:23 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 792D728002A; Mon, 14 Apr 2025 11:15:23 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5E580280061; Mon, 14 Apr 2025 11:15:23 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 30B8528002A for ; Mon, 14 Apr 2025 11:15:23 -0400 (EDT) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 46926140210 for ; Mon, 14 Apr 2025 15:15:24 +0000 (UTC) X-FDA: 83332998168.15.74F081D Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by imf02.hostedemail.com (Postfix) with ESMTP id 4BB998000C for ; Mon, 14 Apr 2025 15:15:22 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=3see5XSs; spf=pass (imf02.hostedemail.com: domain of nogikh@google.com designates 209.85.216.42 as permitted sender) smtp.mailfrom=nogikh@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1744643722; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Gy8LtRusG3LlBq4PRwJCXbC0Gt2r1lIPvShAadKH+1Y=; b=r0Tkh9rbpMKkTdyTCSUPtTeKAB1ggVMghI1VHiQfYW8GJcsbvtK3SEN5duc+N5O1q4ek1J DLRvLEFR27aSHaEfX3APRCcBdEtEylpKFjUT6doUku1wc98xq5g4N/P8P1Dmr1qsVZaxHn TausKhHz+UiNZUApzgX9LMarVrkw4Qw= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=3see5XSs; spf=pass (imf02.hostedemail.com: domain of nogikh@google.com designates 209.85.216.42 as permitted sender) smtp.mailfrom=nogikh@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1744643722; a=rsa-sha256; cv=none; b=mhfDGL2qsyfd6YsIrmb2XPXn9uSw1WOXsixXJLi2Fuyn6JVRrCkrpspuWj/X6kLIcgf16s IKLHvhJU3lCFdYfKzar9hYS84XqDw0ZqAkUlV2ZhDfyWkeUHDJHA5vcJUEm85YnhmYeXdY Dsz1BL7+iJ4qONGN/jz9VmMMhSyjWEw= Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3054ef26da3so3583552a91.3 for ; Mon, 14 Apr 2025 08:15:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1744643721; x=1745248521; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=Gy8LtRusG3LlBq4PRwJCXbC0Gt2r1lIPvShAadKH+1Y=; b=3see5XSsY+iokJy1WcHjU4qwlP+T2ZmsPD8JknloSkwxGBaS606OQ1NT8dI/fvL8+9 NFSimJGWf1ZgUGKAtkNwVwbY6aJtqbyzLkVeeZkErRWhexlv3ZaUVM4rr8AZULSnIXop aqBhEPj4N+jfJPU9Ad2iJtxfLAn5dNIw/Q5xcpFTSUz4M3abFNKAV653tIrZv/oLdJrL mS8QLUO6sW4ELT5OEyNmDVHHDCEEVLHHunRQhf5I8H39RXbiVpi4s+rvrQD/GsLMoAYf tLNAlYiTq+KiX1F3AyFOE5+gxMsEq12ZoDaox+NfswXDo5VHhIVFSdJF71UR9GgOowSL JQVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1744643721; x=1745248521; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Gy8LtRusG3LlBq4PRwJCXbC0Gt2r1lIPvShAadKH+1Y=; b=AH7oX1ZvXDgIpIFRY8BwJQqAMuz6qOrojtfzEiqN9OBFrnYktEWWtdAIv79u7/NlKd eVPR0clso+9l+JG8W5Gy2NdVmpDny4tBFRQbHCQLAUKzGeSA0DWTvYUyQESeMaX+McQn elRk0qkJ6xLn/lIymvPUBb6AwoQzyRTja48BNLsJsrCZH5Kw70s90+bpdbSx0BJ1lPA3 j9djx7Pg4IrGjMV/DYfuy93XT7yv8ilCMDFpDftn12qGQTpKu3kEabqpZvZ9Zu2DS/wX vz3nVMbIfDar34ddg1XN8taWh4+7duMhQjy0pl4QJr9prq8J3ZE3ig8Cv/iagWuFHeuf xeoA== X-Forwarded-Encrypted: i=1; AJvYcCW2aVlEwOslBLmZAjxZAOwD+DbvaYHDL127djC6sYXDvh2fyaqjDpCYpPAGmErnbK9WCb1fpSCcgw==@kvack.org X-Gm-Message-State: AOJu0YxfJT4I8LdVUjC+I0CPgDdTebJJgpsFbwmcGhaJiVhB6odm5XgU dNdElrjBo4FmqjRjAMdAknstR8r5PT1eFYyLYu1yQhKxgXAOmrZ8u3zo2t1RgpzhMDlbvgLDL2e 2VSZzsCBYm8BXU59UtYjNyFSByX1oOEpnUL0r X-Gm-Gg: ASbGncsX6zRMxlohcdXixPYLt6Mym40tND3ZgG2WUCZkOWmPgFHqB4e2gDcbMuJXzTQ t4NVLvtpDADuZOsPjOzCm+B0C8N24pcIVSVD7A7iHYCXLmqKU9vKUplVQDV3BqVbDhkxeM7xJqh rBiZl784HCuwQOsOtVOSwW/A/o5Srtq3lnbRVzrz+okJ5Q+WsAOpc= X-Google-Smtp-Source: AGHT+IEyN9umKvcvvG9jl+UGRWtP+jSDs7xgWa5bCPLWbQU5lgk8rlLVjeQRX34opmLIjhMCnyLgpfJ0YerGivWS8Ng= X-Received: by 2002:a17:90b:2246:b0:2fa:228d:5af2 with SMTP id 98e67ed59e1d1-3082367cc9amr20123354a91.15.1744643720629; Mon, 14 Apr 2025 08:15:20 -0700 (PDT) MIME-Version: 1.0 References: <67f1c7df.050a0220.0a13.0256.GAE@google.com> <07a22812-4f5b-44e2-a4ce-ad0537934041@lucifer.local> <6efd1c14-2253-4b7d-a647-dce471ffff6f@lucifer.local> In-Reply-To: From: Aleksandr Nogikh Date: Mon, 14 Apr 2025 17:15:09 +0200 X-Gm-Features: ATxdqUGzTCtEoElu44Fv1yOe0ciF6LR2a2GwQlbUWnuf4NnPKVe4sOBeqep7vxs Message-ID: Subject: Re: [syzbot] [mm?] general protection fault in mremap To: Lorenzo Stoakes Cc: syzbot , Liam.Howlett@oracle.com, akpm@linux-foundation.org, jannh@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com, vbabka@suse.cz, syzkaller Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 4BB998000C X-Stat-Signature: 8rp5bqsc4o566jwhb4ui193pihzmiggh X-Rspam-User: X-Rspamd-Server: rspam12 X-HE-Tag: 1744643722-223346 X-HE-Meta: U2FsdGVkX18MftIx6hRcE/yRn/loECGEOtJ9KOTCsMPuFjDbrgxELYSJeRgviFe96LfAtEVUdKHlhoRxAmtNMg37eAjT+8vvyXDu1EgzMzfLVkD+kzp8gvxxYg0KuiBUvADGYVRD/DMOkgKzZe4COp63NvB3Dfu/nzu4b2byyJfW0unhlbEbZT3oOUsytqqiU5U2h03yGGuGFN7FWmwybqFG014JdPKC7/6CkK1vorYn4CrPA5wBmocmJH7fFuggUunoNlI6QfouyhPmTDYrSZGJmhai/i75HgpOLfyIuG0RgoZEPzth5Y19BIwcRELq4QD4XTyar6tBGPI+hKGguoUEUyFbebJotnsnnQkfR22SzmJCo3dwxp3dFpfaLjP9qBfKS8MdUCaJTW6iTWLA/GfRQvS2QcDWk6fmKy/z6UJq1Zo3ec78BqM/C6IsWfjJMYbW4t2Da+6WTUqGp/zzgUvKJkq4yerJaQh4OKBSd9yzazOB/8BVfO3+e07BB7Acj26v6BJyGsnjp7Ir5BFB/B4tW3WfYvoRQndxnz3fcppkTNHiO9k9w0EJGc5IBTnpKWfRb24OGrImRtkhBUm9lb1oaM+8jUtCXICkA8LzWvJJKVvgTMT/OkzMUCiW2PdMICFvqHgRGOETQGb3G7CpMN6D+oVSsPMGxiF428C92UaOZ6hA7HSmaEbBPkPNdByWVK7GxgpkdnqxTz26LNDmchaAWCmBYHndSoQvMtxkZsT3nMej5I1a06Wdj7ggm56p/PhsmWRdLMhwVW6X4icJEpYItee6GxIWYldcD+gRNl4oRSuiigJli63Bh4Sbt4Yb/jFZfDRz8vYX2eVT3eVKcMVpcFtarPB3CZVUMMVyaNrKA5l0DuwFO8sfEORlIW6Wp3bl6twa48CMU59aEEO6CkKq0Sz8f5WlwGTxfWQxyiWUIrvsGyKTghGEsgVlrlY4IMKztGttcCuQ3DzfvJ0 hU/ZOBz6 N4Xw09gKB5+2z2W7VlSFgmotiSAMKrsqifD4WOJNdjHmKoa1JUhL/1qLr6iSJ9kmxAYzyygMUcH/Tjgyztkue9dtLIxDPMQn1s7bW0iNf4ECVWY/I1NR3BQpCXyreZfj5h28843DVo2rgtcklUm4WTIZBh1XR1anacAH/KxA8Nnjw8wibesQg4KDfck0cUGiCQL/SS0icjwb+SJG/xZtHQ/HXZ3wqlmqOV/l1m2S4JY9p3YR8ZjsiULS5Uft1hNzKPFhwKCJqKWXK+hZ4LBySDX+ayRUU4Et/vwFhv7Ma8rfykgsTCtz060GqevETVXRpoDKUDgp3Q26U4AgRWJ82IgdWKinyq5It77yS+VmMYzr6Osh45fvfqzF2oxVYEykffDTW7lDoN6snPlNSc14vSFFlg+REgEd//dViPVTBiX9c9Cftw1abIPB13JYfy3+aaZ6mulr43dKO7FIgsP9s+Ag9HfLa5ZugohjNxho4q/azK7DBV2fOTPljn1/KW/QFoHXVYNI+3CZT+rXQtqDWYJdfQvCZdWOqwnvFEdA4XTjklwzrODXWlGMnCX1gt/1IGP0EKhqOrGIV/r+Z4mQlkH7P9aZcljrvrYRAOGZr+2Qn8zZhsf27CAUkIs4TmOsF4LtPJNnHBbhETlIV7y9HFe5UwgNpU8M61VYBy5WI5ye73mFZAOwFxYpNpCz/ow8G6/pOlOrn85bAVO9rWx11ic+NpcJg00GQTIhJet1rPfN2TcLW5qyzhASwO2yC4IfDsRXEjhdueh1ImxTlBS4Ot7jd3CAkhAo1SVYIXwhwZeD3p4HDyiSprooT/R4PCOCCpyL9V2woljtF9gsg64v/kl/Hha1/l5U/bQEB80yAeOctNI0+gqfEmu/CTIiHGoQ6F2Lnx8tEVvQxGl1IJavvPLM5zvo4calqvw3pB6GB5PO7WAJe/j4jb3Zdz5ZfQ3sJlLpb4OOpmi/4GfKqTwePpvQTRr+j cF4Rqvg/ g2JlIBdTjiZy+F0Af9nu+DYZ63XP1wrfdMXk/0jB/pmz3QVrlLAZL8lApq1C/UKlwkYGvBSKYJXhZ3Mn3esbT+XnLBZmfZ/YEQ0h7cYuXxs= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, Apr 9, 2025 at 7:30=E2=80=AFPM Lorenzo Stoakes wrote: > > On Wed, Apr 09, 2025 at 04:57:48PM +0200, Aleksandr Nogikh wrote: > > On Mon, Apr 7, 2025 at 12:28=E2=80=AFPM Lorenzo Stoakes > > wrote: > > > > > > On Mon, Apr 07, 2025 at 12:13:19PM +0200, Aleksandr Nogikh wrote: > > > > Hi Lorenzo, > > > > > > > > Thanks for looking at the report! > > > > > > > > On Mon, Apr 7, 2025 at 12:09=E2=80=AFPM 'Lorenzo Stoakes' via syzka= ller-bugs > > > > wrote: > > > > > > > > > > I did actually try to mark this fixed, but apparently syz fix doe= sn't work or > > > > > doesn't prevent other syzbots from duplicating reports. > > > > > > > > This part is not very clear - why would #syz fix: title not work we= ll here? > > > > > > Sorry for not being clear. What I mean is that I already did this on > > > another thread with the same, duplicate, report - and then received t= his > > > one afterwards. > > > > > > This suggests to me that this does nothing, or does nothing useful at= least > > > if other bots will just keep on reporting the same thing. > > > > When syzbot receives the #syz fix command, it keeps the bug open until > > the fixing commit has reached all the kernel trees it fuzzes. After > > that, if the bug is seen again, it's reported as a separate issue with > > the (2) suffix, then (3), etc. > > > > If the bug manifested itself with different crash titles, marking just > > one report as fixed won't affect others indeed - if syzbot knew they > > were related, it would not have reported them separately. > > Yeah this is what I suspected. I mean you could take file/line, but then > that'll vary at different merge commits potentially and it's clearly a > non-trivial problem. > > > > > What was the other thread/bug in this case? Maybe we could adjust our > > kernel crash log parsing rules to prevent similar duplicates. > > The [0] referenced below. But not sure how easy it'd be to recognise. Ah, right, it was already referenced in your email. Sorry, I didn't notice. So I've taken a closer look at these two reports - it turns out that the essential difference is that one was found on syzbot's gcc-based instances and another was found on the clang-based ones. That leads to slightly different function names, which confused syzbot. I've filed https://github.com/google/syzkaller/issues/5940 to discuss how to best address it. > > > > > > > > > I appreciate that recognising that it is the same issue might not be > > > trivial, but obviously it's not a hugely great use of my time to repe= atedly > > > chase this stuff up when the fix is already upstream and I've already > > > -manually- confirmed it works. > > > > > > My patience with it was somewhat eroded from my experience of telling > > > syzbot in the previous thread [0] to re-test, twice, and it failing t= o do > > > so due to broken presumably VM images, leading to me having to manual= ly > > > test the same fix I already tested and fixed a while ago etc. etc. > > > > > > [0]: https://lore.kernel.org/all/bee2d5f5-db93-42f1-829e-3fd250649ca8= @lucifer.local/ > > > > FWIW the "unregister_netdevice: waiting for batadv0 to become free. > > Usage count =3D 3" bug is discussed here: > > > > https://lore.kernel.org/all/CANp29Y5RjJD3FK8zciRL92f0+tXEaZ=3DDbzSF3Jrn= VRGyDmag2A@mail.gmail.com/t/#u > > > > This is an actual bug in v6.15-rc1 that's plaguing Linux kernel > > fuzzing on syzbot at the moment. > > Ugh well in that case apologies, I assumed some VM setup issue :) > > > > > > > > > We do very much appreciate syzbot reports, don't get me wrong here, b= ut I > > > do also have to partition my time somewhat :) > > > > > > So I'm afraid I can't promise to always do syz fix updates on this ba= sis. > > > > Sure. > > > > Also please feel free to ping us whenever syzbot's behavior is annoying= you :) > > Cheers, you guys have always been responsive even when I grumble inanely = :) > > Though you might get quite a few emails :P > > Mostly syzbot is really useful and has caught multiple very real things, > but when it is noisy it can be pretty noisy :) > > Hopefully we can help sort out tractable problems, I guess we have to > accept a certain amount of noise though as a biproduct. Yes, we will unlikely ever reach 0% noise, but we could at least address the most repetitive problems. > > But sure, will raise issues moving forward also! Thanks! > > Cheers, Lorenzo > > > > > -- > > Aleksandr > > > > > > > > Cheers, Lorenzo > > > > > > > > > > > > > > > > > Anyway, this is fixed in commit 36eed5400805 ("mm/mremap: do not = set > > > > > vrm->vma NULL immediately prior to checking it"), was fixed a lon= g time > > > > > ago, as soon as reported, and it's been a matter of waiting for t= his to > > > > > land in Linus's tree. > > > > > > > > > > This is now fixed, upstream, and this report is - as a result - r= edundant. > > > > > > > > > > Thanks, Lorenzo > > > > > > > > -- > > > > Aleksandr > > > > > > > > > > > > > > On Sat, Apr 05, 2025 at 05:16:31PM -0700, syzbot wrote: > > > > > > Hello, > > > > > > > > > > > > syzbot found the following issue on: > > > > > > > > > > > > HEAD commit: a2cc6ff5ec8f Merge tag 'firewire-updates-6.15' = of git://gi.. > > > > > > git tree: upstream > > > > > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=3D11a= b27cf980000 > > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=3Dadf= febefc9feb9d6 > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=3D5250c= 4727db03e3436cc > > > > > > compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binu= tils for Debian) 2.40 > > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D1= 693d404580000 > > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=3D178= ac94c580000 > > > > > > > > > > > > Downloadable assets: > > > > > > disk image: https://storage.googleapis.com/syzbot-assets/8ecd23= 18067e/disk-a2cc6ff5.raw.xz > > > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/05691b820= 62c/vmlinux-a2cc6ff5.xz > > > > > > kernel image: https://storage.googleapis.com/syzbot-assets/4698= 994e99d4/bzImage-a2cc6ff5.xz > > > > > > > > > > > > The issue was bisected to: > > > > > > > > > > > > commit d5c8aec0542e2d79b64de9089b88fabdebe05c1e > > > > > > Author: Lorenzo Stoakes > > > > > > Date: Mon Mar 10 20:50:37 2025 +0000 > > > > > > > > > > > > mm/mremap: initial refactor of move_vma() > > > > > > > > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=3D= 11ff2a74580000 > > > > > > final oops: https://syzkaller.appspot.com/x/report.txt?x=3D= 13ff2a74580000 > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=3D15f= f2a74580000 > > > > > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag t= o the commit: > > > > > > Reported-by: syzbot+5250c4727db03e3436cc@syzkaller.appspotmail.= com > > > > > > Fixes: d5c8aec0542e ("mm/mremap: initial refactor of move_vma()= ") > > > > > > > > > > > > Code: 48 83 c4 28 c3 e8 17 1a 00 00 0f 1f 80 00 00 00 00 48 89 = f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3= d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > > > > > > RSP: 002b:00007fff0b8738c8 EFLAGS: 00000246 ORIG_RAX: 000000000= 0000019 > > > > > > RAX: ffffffffffffffda RBX: 00007fff0b8738d0 RCX: 00007f46ffb182= e9 > > > > > > RDX: 0000000000003000 RSI: 0000000000001000 RDI: 0000200000ffc0= 00 > > > > > > RBP: 0000000000000001 R08: 0000200000ffa000 R09: 00007f46ffb800= 31 > > > > > > R10: 0000000000000000 R11: 0000000000000246 R12: 00007f46ffb836= 18 > > > > > > R13: 00007fff0b873aa8 R14: 0000000000000001 R15: 00000000000000= 01 > > > > > > > > > > > > Oops: general protection fault, probably for non-canonical addr= ess 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI > > > > > > KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000= 000027] > > > > > > CPU: 0 UID: 0 PID: 5820 Comm: syz-executor115 Not tainted 6.14.= 0-syzkaller-12966-ga2cc6ff5ec8f #0 PREEMPT(full) > > > > > > Hardware name: Google Google Compute Engine/Google Compute Engi= ne, BIOS Google 02/12/2025 > > > > > > RIP: 0010:vrm_uncharge mm/mremap.c:964 [inline] > > > > > > RIP: 0010:expand_vma_in_place mm/mremap.c:1566 [inline] > > > > > > RIP: 0010:expand_vma mm/mremap.c:1621 [inline] > > > > > > RIP: 0010:mremap_at mm/mremap.c:1682 [inline] > > > > > > RIP: 0010:do_mremap mm/mremap.c:1727 [inline] > > > > > > RIP: 0010:__do_sys_mremap+0x1392/0x15c0 mm/mremap.c:1784 > > > > > > Code: 0f 85 45 02 00 00 48 8b 04 24 c6 84 24 70 01 00 00 01 48 = 01 85 68 02 00 00 eb 9a e8 18 34 af ff 48 b8 04 00 00 00 00 fc ff df <80> 3= 8 00 0f 85 a7 01 00 00 48 8b 2c 25 20 00 00 00 31 ff 81 e5 00 > > > > > > RSP: 0018:ffffc900039dfd20 EFLAGS: 00010293 > > > > > > RAX: dffffc0000000004 RBX: ffff88802b765a00 RCX: ffffffff821183= c6 > > > > > > RDX: ffff88805c7b8000 RSI: ffffffff820c0cb8 RDI: 00000000000000= 05 > > > > > > RBP: ffff8880341fb780 R08: 0000000000000005 R09: 00000000000000= 00 > > > > > > R10: 00000000fffffff4 R11: 0000000000000001 R12: 00000000000020= 00 > > > > > > R13: 1ffff9200073bfaa R14: 0000200000ffc000 R15: ffff88802b765b= 70 > > > > > > FS: 00005555814db380(0000) GS:ffff8881249b8000(0000) knlGS:000= 0000000000000 > > > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > > > > CR2: 00007fff0b8728e0 CR3: 000000007802e000 CR4: 00000000003526= f0 > > > > > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000= 00 > > > > > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000004= 00 > > > > > > Call Trace: > > > > > > > > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > > > > > > do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 > > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > > > > > RIP: 0033:0x7f46ffb182e9 > > > > > > Code: 48 83 c4 28 c3 e8 17 1a 00 00 0f 1f 80 00 00 00 00 48 89 = f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3= d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > > > > > > RSP: 002b:00007fff0b8738c8 EFLAGS: 00000246 ORIG_RAX: 000000000= 0000019 > > > > > > RAX: ffffffffffffffda RBX: 00007fff0b8738d0 RCX: 00007f46ffb182= e9 > > > > > > RDX: 0000000000003000 RSI: 0000000000001000 RDI: 0000200000ffc0= 00 > > > > > > RBP: 0000000000000001 R08: 0000200000ffa000 R09: 00007f46ffb800= 31 > > > > > > R10: 0000000000000000 R11: 0000000000000246 R12: 00007f46ffb836= 18 > > > > > > R13: 00007fff0b873aa8 R14: 0000000000000001 R15: 00000000000000= 01 > > > > > > > > > > > > Modules linked in: > > > > > > ---[ end trace 0000000000000000 ]--- > > > > > > RIP: 0010:vrm_uncharge mm/mremap.c:964 [inline] > > > > > > RIP: 0010:expand_vma_in_place mm/mremap.c:1566 [inline] > > > > > > RIP: 0010:expand_vma mm/mremap.c:1621 [inline] > > > > > > RIP: 0010:mremap_at mm/mremap.c:1682 [inline] > > > > > > RIP: 0010:do_mremap mm/mremap.c:1727 [inline] > > > > > > RIP: 0010:__do_sys_mremap+0x1392/0x15c0 mm/mremap.c:1784 > > > > > > Code: 0f 85 45 02 00 00 48 8b 04 24 c6 84 24 70 01 00 00 01 48 = 01 85 68 02 00 00 eb 9a e8 18 34 af ff 48 b8 04 00 00 00 00 fc ff df <80> 3= 8 00 0f 85 a7 01 00 00 48 8b 2c 25 20 00 00 00 31 ff 81 e5 00 > > > > > > RSP: 0018:ffffc900039dfd20 EFLAGS: 00010293 > > > > > > RAX: dffffc0000000004 RBX: ffff88802b765a00 RCX: ffffffff821183= c6 > > > > > > RDX: ffff88805c7b8000 RSI: ffffffff820c0cb8 RDI: 00000000000000= 05 > > > > > > RBP: ffff8880341fb780 R08: 0000000000000005 R09: 00000000000000= 00 > > > > > > R10: 00000000fffffff4 R11: 0000000000000001 R12: 00000000000020= 00 > > > > > > R13: 1ffff9200073bfaa R14: 0000200000ffc000 R15: ffff88802b765b= 70 > > > > > > FS: 00005555814db380(0000) GS:ffff8881249b8000(0000) knlGS:000= 0000000000000 > > > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > > > > CR2: 00007fff0b8728e0 CR3: 000000007802e000 CR4: 00000000003526= f0 > > > > > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000= 00 > > > > > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000004= 00 > > > > > > ---------------- > > > > > > Code disassembly (best guess): > > > > > > 0: 48 83 c4 28 add $0x28,%rsp > > > > > > 4: c3 ret > > > > > > 5: e8 17 1a 00 00 call 0x1a21 > > > > > > a: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) > > > > > > 11: 48 89 f8 mov %rdi,%rax > > > > > > 14: 48 89 f7 mov %rsi,%rdi > > > > > > 17: 48 89 d6 mov %rdx,%rsi > > > > > > 1a: 48 89 ca mov %rcx,%rdx > > > > > > 1d: 4d 89 c2 mov %r8,%r10 > > > > > > 20: 4d 89 c8 mov %r9,%r8 > > > > > > 23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 > > > > > > 28: 0f 05 syscall > > > > > > * 2a: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <= -- trapping instruction > > > > > > 30: 73 01 jae 0x33 > > > > > > 32: c3 ret > > > > > > 33: 48 c7 c1 b8 ff ff ff mov $0xffffffffffffffb8,%rcx > > > > > > 3a: f7 d8 neg %eax > > > > > > 3c: 64 89 01 mov %eax,%fs:(%rcx) > > > > > > 3f: 48 rex.W > > > > > > > > > > > > > > > > > > --- > > > > > > This report is generated by a bot. It may contain errors. > > > > > > See https://goo.gl/tpsmEJ for more information about syzbot. > > > > > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > > > > > > > > > syzbot will keep track of this issue. See: > > > > > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot= . > > > > > > For information about bisection process see: https://goo.gl/tps= mEJ#bisection > > > > > > > > > > > > If the report is already addressed, let syzbot know by replying= with: > > > > > > #syz fix: exact-commit-title > > > > > > > > > > > > If you want syzbot to run the reproducer, reply with: > > > > > > #syz test: git://repo/address.git branch-or-commit-hash > > > > > > If you attach or paste a git patch, syzbot will apply it before= testing. > > > > > > > > > > > > If you want to overwrite report's subsystems, reply with: > > > > > > #syz set subsystems: new-subsystem > > > > > > (See the list of subsystem names on the web dashboard) > > > > > > > > > > > > If the report is a duplicate of another one, reply with: > > > > > > #syz dup: exact-subject-of-another-report > > > > > > > > > > > > If you want to undo deduplication, reply with: > > > > > > #syz undup > > > > > > > > > > -- > > > >