syzbot


kernel BUG in add_to_swap

Status: upstream: reported on 2024/01/10 22:06
Reported-by: syzbot+26cc85d8e6d446ced995@syzkaller.appspotmail.com
First crash: 114d, last: 58d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in add_to_swap mm 6 75d 136d 0/26 upstream: reported on 2023/12/19 13:09
linux-5.15 kernel BUG in add_to_swap 3 45d 128d 0/3 upstream: reported on 2023/12/27 22:40

Sample crash report:
raw: 05ffc00000480809 dead000000000100 dead000000000122 ffff0000f9d15aa1
raw: 0000000000020001 0000000000000000 00000002ffffffff ffff0000cee8c000
page dumped because: VM_BUG_ON_FOLIO(!folio_test_uptodate(folio))
------------[ cut here ]------------
kernel BUG at mm/swap_state.c:180!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 13177 Comm: syz-executor.2 Not tainted 6.1.81-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : add_to_swap+0x1b4/0x1b8 mm/swap_state.c:180
lr : add_to_swap+0x1b4/0x1b8 mm/swap_state.c:180
sp : ffff80001f046480
x29: ffff80001f046480 x28: fffffc0004073d88 x27: fffffc0004073d98
x26: fffffc0004073d80 x25: dfff800000000000 x24: 05ffc00000480809
x23: 1fffff800080e7b0 x22: 1fffff800080e7b1 x21: dfff800000000000
x20: 05ffc00000480809 x19: fffffc0004073d80 x18: 1fffe0003686bb76
x17: ffff80001582d000 x16: ffff800012149a4c x15: ffff0001b435dbbc
x14: 1ffff00002b060b0 x13: dfff800000000000 x12: 0000000000040000
x11: 000000000003ffff x10: ffff8000218fc000 x9 : ffff8000088370f8
x8 : 0000000000040000 x7 : ffff80000827c5fc x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff80000aa8aa0c
x2 : ffff0001b435dcd0 x1 : 0000000100000000 x0 : 0000000000000041
Call trace:
 add_to_swap+0x1b4/0x1b8 mm/swap_state.c:180
 shrink_folio_list+0x1f18/0x49bc mm/vmscan.c:1838
 evict_folios+0x38b0/0x4e80 mm/vmscan.c:5039
 lru_gen_shrink_lruvec mm/vmscan.c:5223 [inline]
 shrink_lruvec+0xa80/0x3bf4 mm/vmscan.c:5918
 shrink_node_memcgs mm/vmscan.c:6139 [inline]
 shrink_node+0x568/0x212c mm/vmscan.c:6170
 shrink_zones mm/vmscan.c:6408 [inline]
 do_try_to_free_pages+0x59c/0x142c mm/vmscan.c:6470
 try_to_free_mem_cgroup_pages+0x3c0/0xce8 mm/vmscan.c:6785
 try_charge_memcg+0x4b0/0x1478 mm/memcontrol.c:2681
 obj_cgroup_charge_pages mm/memcontrol.c:3096 [inline]
 __memcg_kmem_charge_page+0x330/0x61c mm/memcontrol.c:3122
 __alloc_pages+0x254/0x730 mm/page_alloc.c:5562
 __alloc_pages_node include/linux/gfp.h:237 [inline]
 alloc_pages_node include/linux/gfp.h:260 [inline]
 bpf_ringbuf_area_alloc kernel/bpf/ringbuf.c:130 [inline]
 bpf_ringbuf_alloc+0x100/0x434 kernel/bpf/ringbuf.c:167
 ringbuf_map_alloc+0x19c/0x288 kernel/bpf/ringbuf.c:207
 find_and_alloc_map kernel/bpf/syscall.c:131 [inline]
 map_create+0x48c/0xbc8 kernel/bpf/syscall.c:1128
 __sys_bpf+0x284/0x654 kernel/bpf/syscall.c:4987
 __do_sys_bpf kernel/bpf/syscall.c:5109 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5107 [inline]
 __arm64_sys_bpf+0x80/0x98 kernel/bpf/syscall.c:5107
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: f004d1e1 913d8021 aa1303e0 97fcf681 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/06 15:57 linux-6.1.y 61adba85cc40 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in add_to_swap
2024/01/10 22:05 linux-6.1.y 7c58bfa711cb 04815ef1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in add_to_swap
* Struck through repros no longer work on HEAD.