syzbot


BUG: Bad page state

Status: upstream: reported C repro on 2022/10/03 07:33
Reported-by: syzbot+9f87a6a842302312d3ff@syzkaller.appspotmail.com
First crash: 169d, last: 27d
similar bugs (13):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: Bad page state (3) usb C 3 1898d 1905d 4/24 fixed on 2018/02/02 04:39
upstream BUG: Bad page state (5) C 171 1483d 1497d 0/24 closed as invalid on 2019/02/27 20:53
linux-4.19 BUG: Bad page state 1 485d 485d 0/1 auto-closed as invalid on 2022/03/21 10:57
linux-4.19 BUG: Bad page state (2) 1 295d 295d 0/1 auto-obsoleted due to no activity on 2022/09/26 19:49
upstream BUG: Bad page state (7) 3 933d 990d 0/24 auto-closed as invalid on 2020/12/28 02:44
linux-4.19 BUG: Bad page state (3) C error 1 169d 169d 0/1 upstream: reported C repro on 2022/10/02 20:53
android-49 BUG: Bad page state 3 1265d 1289d 0/3 auto-closed as invalid on 2020/01/30 18:48
android-54 BUG: Bad page state C 9 1086d 1117d 0/2 auto-obsoleted due to no activity on 2022/08/26 22:10
upstream BUG: Bad page state (2) 1 1940d 1936d 0/24 closed as invalid on 2017/12/06 12:57
upstream BUG: Bad page state (4) 1 1703d 1703d 0/24 closed as invalid on 2018/09/05 12:51
upstream BUG: Bad page state (6) C 2 1482d 1482d 0/24 closed as invalid on 2019/03/01 18:38
upstream BUG: Bad page state C 2 2044d 2044d 3/24 fixed on 2017/10/24 06:54
upstream BUG: Bad page state (8) mm C 798 2h21m 778d 1/24 upstream: reported C repro on 2021/02/01 10:07

Sample crash report:
ERROR: (device loop0): txAbort: 
======================================================
WARNING: the mand mount option is being deprecated and
         will be removed in v5.15!
======================================================
BUG: Bad page state in process syz-executor378  pfn:985c5
page:ffffea0002617140 count:0 mapcount:0 mapping:          (null) index:0x2f
flags: 0xfff0000000100c(referenced|uptodate|private)
raw: 00fff0000000100c 0000000000000000 000000000000002f 00000000ffffffff
raw: ffffea00027fa9a0 ffffea000295a460 ffff88809adf83c0 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
bad because of flags: 0x1000(private)
Modules linked in:
CPU: 0 PID: 7978 Comm: syz-executor378 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 bad_page.cold+0xdb/0x100 mm/page_alloc.c:576
 free_hot_cold_page_list+0x93/0x300 mm/page_alloc.c:2663
 release_pages+0x828/0xbf0 mm/swap.c:820
 __pagevec_release+0x84/0xe0 mm/swap.c:837
 pagevec_release include/linux/pagevec.h:78 [inline]
 truncate_inode_pages_range+0x5ce/0x13e0 mm/truncate.c:320
 jfs_remount+0x41f/0x5a0 fs/jfs/super.c:485
 do_remount_sb+0x150/0x530 fs/super.c:868
 do_remount fs/namespace.c:2393 [inline]
 do_mount+0x15f3/0x2a30 fs/namespace.c:2896
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fd8bb1f7e09
RSP: 002b:00007ffdd8e7e9f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8bb1f7e09
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 00007fd8bb1b7670 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000060 R11: 0000000000000246 R12: 00000000f8008000
R13: 0000000000000000 R14: 00080000000000fc R15: 0000000000000000
BUG: Bad page state in process syz-executor378  pfn:9fea6
page:ffffea00027fa980 count:0 mapcount:0 mapping:          (null) index:0x2e
flags: 0xfff0000000100c(referenced|uptodate|private)
raw: 00fff0000000100c 0000000000000000 000000000000002e 00000000ffffffff
raw: ffffea00028c36e0 ffffea0002617160 ffff88809adf84b0 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
bad because of flags: 0x1000(private)
Modules linked in:
CPU: 1 PID: 7978 Comm: syz-executor378 Tainted: G    B           4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 bad_page.cold+0xdb/0x100 mm/page_alloc.c:576
 free_hot_cold_page_list+0x93/0x300 mm/page_alloc.c:2663
 release_pages+0x828/0xbf0 mm/swap.c:820
 __pagevec_release+0x84/0xe0 mm/swap.c:837
 pagevec_release include/linux/pagevec.h:78 [inline]
 truncate_inode_pages_range+0x5ce/0x13e0 mm/truncate.c:320
 jfs_remount+0x41f/0x5a0 fs/jfs/super.c:485
 do_remount_sb+0x150/0x530 fs/super.c:868
 do_remount fs/namespace.c:2393 [inline]
 do_mount+0x15f3/0x2a30 fs/namespace.c:2896
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fd8bb1f7e09
RSP: 002b:00007ffdd8e7e9f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8bb1f7e09
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 00007fd8bb1b7670 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000060 R11: 0000000000000246 R12: 00000000f8008000
R13: 0000000000000000 R14: 00080000000000fc R15: 0000000000000000
BUG: Bad page state in process syz-executor378  pfn:a30db
page:ffffea00028c36c0 count:0 mapcount:0 mapping:          (null) index:0x2d
flags: 0xfff0000000100c(referenced|uptodate|private)
raw: 00fff0000000100c 0000000000000000 000000000000002d 00000000ffffffff
raw: ffffea0002b948e0 ffffea00027fa9a0 ffff88809adf85a0 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
bad because of flags: 0x1000(private)
Modules linked in:
CPU: 1 PID: 7978 Comm: syz-executor378 Tainted: G    B           4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 bad_page.cold+0xdb/0x100 mm/page_alloc.c:576
 free_hot_cold_page_list+0x93/0x300 mm/page_alloc.c:2663
 release_pages+0x828/0xbf0 mm/swap.c:820
 __pagevec_release+0x84/0xe0 mm/swap.c:837
 pagevec_release include/linux/pagevec.h:78 [inline]
 truncate_inode_pages_range+0x5ce/0x13e0 mm/truncate.c:320
 jfs_remount+0x41f/0x5a0 fs/jfs/super.c:485
 do_remount_sb+0x150/0x530 fs/super.c:868
 do_remount fs/namespace.c:2393 [inline]
 do_mount+0x15f3/0x2a30 fs/namespace.c:2896
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fd8bb1f7e09
RSP: 002b:00007ffdd8e7e9f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8bb1f7e09
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 00007fd8bb1b7670 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000060 R11: 0000000000000246 R12: 00000000f8008000
R13: 0000000000000000 R14: 00080000000000fc R15: 00000000

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-linux-4-14 2023/02/22 03:35 linux-4.14.y a8ad60f2af58 feb56351 .config console log report syz C
ci2-linux-4-14 2023/01/23 01:39 linux-4.14.y 97205fccccdc feb56351 .config console log report syz C
ci2-linux-4-14 2022/11/05 21:07 linux-4.14.y a901bb6c7db7 feb56351 .config console log report syz C
* Struck through repros no longer work on HEAD.
Crashes (9):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-linux-4-14 2022/10/03 07:33 linux-4.14.y 9d5c0b3a8e1a feb56351 .config console log report syz C [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/06 20:40 linux-4.14.y 9d5c0b3a8e1a 80b58a42 .config console log report info [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/06 18:46 linux-4.14.y 9d5c0b3a8e1a 80b58a42 .config console log report info [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/06 16:53 linux-4.14.y 9d5c0b3a8e1a 80b58a42 .config console log report info [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/06 05:14 linux-4.14.y 9d5c0b3a8e1a 2c6543ad .config console log report info [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/06 01:45 linux-4.14.y 9d5c0b3a8e1a 2c6543ad .config console log report info [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/05 22:45 linux-4.14.y 9d5c0b3a8e1a 2c6543ad .config console log report info [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/05 03:12 linux-4.14.y 9d5c0b3a8e1a 267e3bb1 .config console log report info [disk image] [vmlinux] BUG: Bad page state
ci2-linux-4-14 2022/10/04 14:51 linux-4.14.y 9d5c0b3a8e1a eab8f949 .config console log report info [disk image] [vmlinux] BUG: Bad page state
* Struck through repros no longer work on HEAD.