syzbot


kernel BUG at include/linux/page-flags.h:LINE!

Status: auto-closed as invalid on 2019/09/14 22:37
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+5373a556df9f9fec7e90@syzkaller.appspotmail.com
First crash: 2045d, last: 1862d
Discussions (1)
Title Replies (including bot) Last reply
kernel BUG at include/linux/page-flags.h:LINE! 1 (2) 2018/09/19 12:25
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in __page_mapcount kernel C error 45 824d 1058d 22/26 fixed on 2023/02/24 13:50

Sample crash report:
page:ffff88812fffc9b8 count:-30591 mapcount:805292513 mapping:ffff88812fffc9d0 index:0xffff88812fffc9d0
0xffff88812fffcad0 
name:"//$" 
flags: 0xffffea0001960008(dirty|mappedtodisk|reclaim|unevictable|young|idle)
raw: ffffea0001960008 dead000000000100 dead000000000200 ffff88812fffc9d0
raw: ffff88812fffc9d0 ffff88812fffc9e0 ffff88812fffc9e0 ffff88812fffc9f0
page dumped because: VM_BUG_ON_PAGE(!PageBuddy(page))
page->mem_cgroup:ffff88812fffc9f0
------------[ cut here ]------------
kernel BUG at include/linux/page-flags.h:735!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 18701 Comm: udevd Not tainted 5.1.0-rc1 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__ClearPageBuddy include/linux/page-flags.h:735 [inline]
RIP: 0010:rmv_page_order mm/page_alloc.c:747 [inline]
RIP: 0010:rmv_page_order mm/page_alloc.c:745 [inline]
RIP: 0010:__rmqueue_smallest mm/page_alloc.c:2056 [inline]
RIP: 0010:__rmqueue mm/page_alloc.c:2592 [inline]
RIP: 0010:rmqueue_bulk mm/page_alloc.c:2619 [inline]
RIP: 0010:__rmqueue_pcplist mm/page_alloc.c:3090 [inline]
RIP: 0010:rmqueue_pcplist mm/page_alloc.c:3119 [inline]
RIP: 0010:rmqueue mm/page_alloc.c:3141 [inline]
RIP: 0010:get_page_from_freelist+0x1aff/0x4170 mm/page_alloc.c:3556
Code: 65 ff 0d c4 03 74 7e 0f 85 ee fd ff ff e8 ea 7c 72 ff e9 e4 fd ff ff 48 8b bd 40 ff ff ff 48 c7 c6 e0 0b 72 87 e8 31 e3 0b 00 <0f> 0b 83 bd 58 ff ff ff 0b 0f 84 a1 1d 00 00 44 8b a5 58 ff ff ff
RSP: 0000:ffff88805b4577c8 EFLAGS: 00010093
RAX: ffff8880a95f0480 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8199dda2 RDI: ffffed100b68aedd
RBP: ffff88805b457978 R08: 0000000000000021 R09: fffffbfff11335f5
R10: fffffbfff11335f4 R11: ffffffff8899afa3 R12: ffff88812fffc9c0
R13: 00000000000000d0 R14: ffff88812fffc9c8 R15: 0000000000000002
FS:  00007fe3c682d7a0(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffa21e75f8 CR3: 00000000972a0000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __alloc_pages_nodemask+0x248/0x7e0 mm/page_alloc.c:4602
 alloc_pages_vma+0xdd/0x540 mm/mempolicy.c:2070
 wp_page_copy+0x21c/0x1740 mm/memory.c:2269
 do_wp_page+0x5d8/0x16c0 mm/memory.c:2570
 handle_pte_fault mm/memory.c:3825 [inline]
 __handle_mm_fault+0x22e8/0x3ec0 mm/memory.c:3933
 handle_mm_fault+0x43f/0xb30 mm/memory.c:3970
 do_user_addr_fault arch/x86/mm/fault.c:1475 [inline]
 __do_page_fault+0x5ef/0xda0 arch/x86/mm/fault.c:1541
 do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
RIP: 0033:0x7fe3c5f110ae
Code: 8b 15 8e 8d 2d 00 f7 d8 41 83 cc ff 64 89 02 0f 1f 44 00 00 64 8b 04 25 d0 02 00 00 41 39 c1 75 7a 64 44 89 04 25 d4 02 00 00 <e8> 0d 60 fc ff 48 85 db 74 bb 41 bd ca 00 00 00 41 be 81 00 00 00
RSP: 002b:00007fffa21e7600 EFLAGS: 00010246
RAX: 000000000000490d RBX: 00007fffa21e7600 RCX: 00007fe3c5f10f46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007fffa21e7660 R08: 000000000000490d R09: 000000000000490d
R10: 00007fe3c682da70 R11: 0000000000000246 R12: 0000000000006ed6
R13: 00007fffa21e7620 R14: 0000000000000005 R15: 0000000000000005
Modules linked in:
---[ end trace 4261919086322e69 ]---
RIP: 0010:__ClearPageBuddy include/linux/page-flags.h:735 [inline]
RIP: 0010:rmv_page_order mm/page_alloc.c:747 [inline]
RIP: 0010:rmv_page_order mm/page_alloc.c:745 [inline]
RIP: 0010:__rmqueue_smallest mm/page_alloc.c:2056 [inline]
RIP: 0010:__rmqueue mm/page_alloc.c:2592 [inline]
RIP: 0010:rmqueue_bulk mm/page_alloc.c:2619 [inline]
RIP: 0010:__rmqueue_pcplist mm/page_alloc.c:3090 [inline]
RIP: 0010:rmqueue_pcplist mm/page_alloc.c:3119 [inline]
RIP: 0010:rmqueue mm/page_alloc.c:3141 [inline]
RIP: 0010:get_page_from_freelist+0x1aff/0x4170 mm/page_alloc.c:3556
Code: 65 ff 0d c4 03 74 7e 0f 85 ee fd ff ff e8 ea 7c 72 ff e9 e4 fd ff ff 48 8b bd 40 ff ff ff 48 c7 c6 e0 0b 72 87 e8 31 e3 0b 00 <0f> 0b 83 bd 58 ff ff ff 0b 0f 84 a1 1d 00 00 44 8b a5 58 ff ff ff
RSP: 0000:ffff88805b4577c8 EFLAGS: 00010093
RAX: ffff8880a95f0480 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8199dda2 RDI: ffffed100b68aedd
RBP: ffff88805b457978 R08: 0000000000000021 R09: fffffbfff11335f5
R10: fffffbfff11335f4 R11: ffffffff8899afa3 R12: ffff88812fffc9c0
R13: 00000000000000d0 R14: ffff88812fffc9c8 R15: 0000000000000002
FS:  00007fe3c682d7a0(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffa21e75f8 CR3: 00000000972a0000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/18 22:36 upstream 9e98c678c2d6 4656beca .config console log report ci-upstream-kasan-gce-root
2019/03/16 10:08 upstream 6c83d0d5eb62 bab43553 .config console log report ci-upstream-kasan-gce-root
2018/09/17 10:24 upstream c0747ad363ff 7f125108 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/03 18:21 linux-next dc4c89997735 c198d5dd .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.