kernel BUG in __page_table_check_zero

Status: upstream: reported C repro on 2023/06/18 21:38
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+6d55afadbe7f713502a2@syzkaller.appspotmail.com
First crash: 1133d, last: 672d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2024/09/21 linux-6.1.y (ToT) e526b12bf916 C [report] kernel BUG in __page_table_check_zero
2024/09/21 upstream (ToT) 88264981f208 C Didn't crash
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in __page_table_check_zero (2) mm -1 C error done 32 623d 633d 0/29 auto-obsoleted due to no activity on 2025/01/19 02:16
upstream kernel BUG in __page_table_check_zero usb -1 C error done 213 674d 1162d 28/29 fixed on 2024/10/22 13:24
upstream kernel BUG in __page_table_check_zero (3) prio:high mm -1 283 6d09h 157d 0/29 upstream: reported on 2026/02/18 21:59
▶ ▼ Fix bisection attempts (11)
Created Duration User Patch Repo Result
2024/10/05 16:19 2h24m fix candidate upstream OK (0) job log
2024/08/14 23:27 1m bisect fix linux-6.1.y error job log
2024/07/05 05:50 1h16m bisect fix linux-6.1.y OK (0) job log log
2024/05/26 00:28 58m bisect fix linux-6.1.y OK (0) job log log
2024/04/21 06:44 1h24m bisect fix linux-6.1.y OK (0) job log log
2024/03/19 02:58 1h08m bisect fix linux-6.1.y OK (0) job log log
2024/01/07 19:24 1h00m bisect fix linux-6.1.y OK (0) job log log
2023/12/08 15:21 1h02m bisect fix linux-6.1.y OK (0) job log log
2023/11/07 18:36 1h16m bisect fix linux-6.1.y OK (0) job log log
2023/10/05 23:10 1h22m bisect fix linux-6.1.y OK (0) job log log
2023/08/07 10:29 4h57m (2) bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
kernel BUG at mm/page_table_check.c:146!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4225 Comm: syz-executor173 Not tainted 6.1.77-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __page_table_check_zero+0x280/0x2bc mm/page_table_check.c:146
lr : __page_table_check_zero+0x280/0x2bc mm/page_table_check.c:146
sp : ffff80001dd175f0
x29: ffff80001dd175f0 x28: ffff800015b0e000 x27: 0000000000000000
x26: dfff800000000000 x25: 0000000000000000 x24: ffff0000c199210c
x23: 1ffff00002b61c58 x22: dfff800000000000 x21: 0000000000000001
x20: ffff0000c1992100 x19: 0000000000000001 x18: ffff80001dd16c20
x17: 0000000000000000 x16: ffff800008302f58 x15: 0000000000000000
x14: 1ffff00002b080b0 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff800008a0aa7c
x8 : ffff0000d5420000 x7 : ffff800008a0a538 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800008a0a9a0
x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
 __page_table_check_zero+0x280/0x2bc mm/page_table_check.c:146
 page_table_check_free include/linux/page_table_check.h:46 [inline]
 free_pages_prepare mm/page_alloc.c:1441 [inline]
 free_pcp_prepare mm/page_alloc.c:1490 [inline]
 free_unref_page_prepare+0xe8c/0x1070 mm/page_alloc.c:3358
 free_unref_page+0x80/0x420 mm/page_alloc.c:3453
 free_the_page mm/page_alloc.c:750 [inline]
 __free_pages+0x1a0/0x1cc mm/page_alloc.c:5634
 free_pages+0xa0/0xb8 mm/page_alloc.c:5645
 hcd_buffer_free_pages+0xf0/0x15c drivers/usb/core/buffer.c:210
 dec_usb_memory_use_count+0x250/0x330 drivers/usb/core/devio.c:198
 usbdev_vm_close+0x44/0x54 drivers/usb/core/devio.c:222
 mmap_region+0x1110/0x1a98 mm/mmap.c:2889
 do_mmap+0xa00/0x1108 mm/mmap.c:1425
 vm_mmap_pgoff+0x1a4/0x2b4 mm/util.c:520
 ksys_mmap_pgoff+0x3c8/0x5b0 mm/mmap.c:1471
 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
 __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
 __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: d4210000 97ebb883 d4210000 97ebb881 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/16 18:36 linux-6.1.y f1bb70486c9c 578f7538 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in __page_table_check_zero
2023/06/18 21:37 linux-6.1.y ca87e77a2ef8 f3921d4d .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan kernel BUG in __page_table_check_zero
2024/02/16 15:50 linux-6.1.y f1bb70486c9c 578f7538 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in __page_table_check_zero
* Struck through repros no longer work on HEAD.