kernel BUG in rmap_walk

kernel BUG in rmap_walk_file
Status: moderation: reported on 2021/08/02 09:28
Reported-by: syzbot+f38817d1b5a023cba3ae@syzkaller.appspotmail.com
First crash: 49d, last: 44d

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.14	kernel BUG in rmap_walk_file				1	183d	183d	0/1	auto-closed as invalid on 2021/07/15 10:56
linux-4.19	kernel BUG in do_page_add_anon_rmap				1	100d	100d	0/1	upstream: reported on 2021/06/08 19:06

Sample crash report:

------------[ cut here ]------------
kernel BUG at mm/rmap.c:2343!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 220 Comm: kworker/u4:4 Not tainted 5.14.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
RIP: 0010:rmap_walk_file+0x44d/0x700 mm/rmap.c:2343
Code: ff 48 c7 c7 f2 ff ff ff 49 89 c5 48 89 c6 e8 ba 96 c6 ff 49 83 fd f2 0f 85 b0 fe ff ff e8 4b 91 c6 ff 48 89 ef e8 6e 81 3a 07 <0f> 0b e8 3c 91 c6 ff 8b 5c 24 24 31 ff 89 de e8 6f 97 c6 ff 84 db
RSP: 0018:ffffc9000104f068 EFLAGS: 00010287
RAX: 0000000000000102 RBX: ffffc9000104f128 RCX: 0000000000000000
RDX: ffff8880131c54c0 RSI: ffffffff815d7935 RDI: fffff52000209de8
RBP: ffff888000103000 R08: 0000000000000102 R09: 0000000000000000
R10: ffffffff815d176e R11: 0000000000000000 R12: ffffea0001cd2040
R13: fffffffffffffff2 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004e4b43 CR3: 000000014a23e000 CR4: 0000000000350ef0
Call Trace:
 rmap_walk+0x10d/0x190 mm/rmap.c:2367
 page_mkclean+0x222/0x2c0 mm/rmap.c:1002
 clear_page_dirty_for_io+0x325/0xa40 mm/page-writeback.c:2710
 mpage_submit_page+0x80/0x2a0 fs/ext4/inode.c:2080
 mpage_process_page_bufs+0x681/0x7a0 fs/ext4/inode.c:2214
 mpage_prepare_extent_to_map+0x945/0xe50 fs/ext4/inode.c:2626
 ext4_writepages+0x928/0x3ba0 fs/ext4/inode.c:2754
 do_writepages+0xec/0x290 mm/page-writeback.c:2355
 __writeback_single_inode+0x126/0xff0 fs/fs-writeback.c:1613
 writeback_sb_inodes+0x53d/0xf00 fs/fs-writeback.c:1878
 wb_writeback+0x2a7/0xc50 fs/fs-writeback.c:2051
 wb_do_writeback fs/fs-writeback.c:2196 [inline]
 wb_workfn+0x2e8/0x12d0 fs/fs-writeback.c:2237
 process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Modules linked in:
---[ end trace d6a5b30e84e15be2 ]---
RIP: 0010:rmap_walk_file+0x44d/0x700 mm/rmap.c:2343
Code: ff 48 c7 c7 f2 ff ff ff 49 89 c5 48 89 c6 e8 ba 96 c6 ff 49 83 fd f2 0f 85 b0 fe ff ff e8 4b 91 c6 ff 48 89 ef e8 6e 81 3a 07 <0f> 0b e8 3c 91 c6 ff 8b 5c 24 24 31 ff 89 de e8 6f 97 c6 ff 84 db
RSP: 0018:ffffc9000104f068 EFLAGS: 00010287
RAX: 0000000000000102 RBX: ffffc9000104f128 RCX: 0000000000000000
RDX: ffff8880131c54c0 RSI: ffffffff815d7935 RDI: fffff52000209de8
RBP: ffff888000103000 R08: 0000000000000102 R09: 0000000000000000
R10: ffffffff815d176e R11: 0000000000000000 R12: ffffea0001cd2040
R13: fffffffffffffff2 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001380 CR3: 0000000146d55000 CR4: 0000000000350ef0

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kasan-gce-root	2021/08/04 05:42	upstream	d5ad8ec3cfb5	6c236867	.config	log	report			info	kernel BUG in rmap_walk_file
ci-upstream-kasan-gce	2021/07/29 09:20	upstream	4010a528219e	9a4781d4	.config	log	report			info	kernel BUG in rmap_walk_file