syzbot


kernel BUG in clear_page_mlock

Status: upstream: reported C repro on 2025/03/06 05:05
Reported-by: syzbot+d520f32b2c8561ac1d17@syzkaller.appspotmail.com
First crash: 8d00h, last: 7d22h
Bug presence (1)
Date Name Commit Repro Result
2025/03/06 upstream (ToT) 7f0e9ee5e448 C Failed due to an error; will retry later

Sample crash report:
head: 05ffc0000029080c ffff800020047c50 ffff800020047c50 ffff0000d23a6001
head: 0000000400000200 0000000000000000 00000154ffffffff ffff0000c08a4000
page dumped because: VM_BUG_ON_PAGE(1 && PageTail(page))
------------[ cut here ]------------
kernel BUG at include/linux/page-flags.h:431!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4026 Comm: syz-executor960 Not tainted 5.15.178-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : TestClearPageMlocked include/linux/page-flags.h:431 [inline]
pc : clear_page_mlock+0x57c/0x64c mm/mlock.c:64
lr : TestClearPageMlocked include/linux/page-flags.h:431 [inline]
lr : clear_page_mlock+0x57c/0x64c mm/mlock.c:64
sp : ffff80001ff771e0
x29: ffff80001ff771e0 x28: 1ffff00003feeec0 x27: 1fffff800070b579
x26: 1fffff800070b579 x25: dfff800000000000 x24: ffff0000c80fcac0
x23: fffffc0003858001 x22: 0000000000000001 x21: fffffc0003858001
x20: fffffc000385abc8 x19: fffffc000385abc0 x18: 0000000000000002
x17: 0000000000000000 x16: ffff800008336568 x15: 00000000ffffffff
x14: ffff0000db130000 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000001 x10: 0000000000000000 x9 : fc82c5234b78e000
x8 : fc82c5234b78e000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001ff76658 x4 : ffff800014c50660 x3 : ffff8000083366b4
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000038
Call trace:
 TestClearPageMlocked include/linux/page-flags.h:431 [inline]
 clear_page_mlock+0x57c/0x64c mm/mlock.c:64
 page_remove_rmap+0xbf8/0xfe8 mm/rmap.c:1375
 wp_page_copy+0x94c/0x12b8 mm/memory.c:3146
 do_wp_page+0x6c4/0x9c4
 handle_pte_fault mm/memory.c:4666 [inline]
 __handle_mm_fault mm/memory.c:4783 [inline]
 handle_mm_fault+0x1bdc/0x33a8 mm/memory.c:4881
 faultin_page mm/gup.c:976 [inline]
 __get_user_pages+0x39c/0x92c mm/gup.c:1197
 __get_user_pages_locked mm/gup.c:1382 [inline]
 __get_user_pages_remote+0x194/0x66c mm/gup.c:2007
 pin_user_pages_remote+0x70/0x9c mm/gup.c:3104
 process_vm_rw_single_vec mm/process_vm_access.c:105 [inline]
 process_vm_rw_core mm/process_vm_access.c:215 [inline]
 process_vm_rw+0x574/0xa38 mm/process_vm_access.c:283
 __do_sys_process_vm_writev mm/process_vm_access.c:303 [inline]
 __se_sys_process_vm_writev mm/process_vm_access.c:298 [inline]
 __arm64_sys_process_vm_writev+0xdc/0xf8 mm/process_vm_access.c:298
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: d004aa61 912f8021 aa1303e0 97ff47b5 (d4210000) 
---[ end trace eaaab2f76308118f ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/06 07:51 linux-5.15.y c16c81c81336 831e3629 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 kernel BUG in clear_page_mlock
2025/03/06 07:23 linux-5.15.y c16c81c81336 831e3629 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 kernel BUG in clear_page_mlock
2025/03/06 05:05 linux-5.15.y c16c81c81336 831e3629 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 kernel BUG in clear_page_mlock
* Struck through repros no longer work on HEAD.