syzbot


BUG: scheduling while atomic in f2fs_register_inmem_page

Status: closed as invalid on 2023/05/12 10:24
Reported-by: syzbot+96e77b0409a141ac58a9@syzkaller.appspotmail.com
First crash: 377d, last: 377d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 BUG: scheduling while atomic in f2fs_register_inmem_page origin:lts C error done 4 145d 400d 0/2 auto-obsoleted due to no activity on 2024/03/04 10:27
android-5-10 BUG: scheduling while atomic in f2fs_register_inmem_page C error inconclusive 1 400d 400d 0/2 closed as invalid on 2023/05/12 10:22

Sample crash report:
BUG: scheduling while atomic: syz-executor.2/17466/0x00000002
Modules linked in:
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 PID: 17466 Comm: syz-executor.2 Not tainted 5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 __schedule_bug+0x194/0x1f0 kernel/sched/core.c:4093
 schedule_debug kernel/sched/core.c:4117 [inline]
 __schedule+0xc8c/0x12a0 kernel/sched/core.c:4236
 schedule+0x12c/0x1d0 kernel/sched/core.c:4372
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4431
 __mutex_lock_common kernel/locking/mutex.c:1050 [inline]
 __mutex_lock+0x7e5/0x1060 kernel/locking/mutex.c:1114
 mutex_lock+0xd6/0x110 kernel/locking/mutex.c:296
 f2fs_register_inmem_page+0x217/0x4c0 fs/f2fs/segment.c:199
 f2fs_set_data_page_dirty+0x4c5/0x6a0 fs/f2fs/data.c:3830
 zap_pte_range mm/memory.c:1097 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0x94c/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_node_page_state+0x4c/0xc0 mm/vmstat.c:344
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_node_page_state+0x4c/0xc0 mm/vmstat.c:344
 __mod_lruvec_state+0x51/0x260 mm/memcontrol.c:744
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_node_page_state+0x65/0xc0 mm/vmstat.c:346
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_node_page_state+0x65/0xc0 mm/vmstat.c:346
 __mod_lruvec_state+0x51/0x260 mm/memcontrol.c:744
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_write() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_node_page_state+0x8d/0xc0 mm/vmstat.c:352
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_node_page_state+0x8d/0xc0 mm/vmstat.c:352
 __mod_lruvec_state+0x51/0x260 mm/memcontrol.c:744
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_memcg_state+0x2f/0x170 mm/memcontrol.c:698
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_memcg_state+0x2f/0x170 mm/memcontrol.c:698
 __mod_lruvec_state+0x81/0x260 mm/memcontrol.c:753
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_write() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_memcg_state+0x87/0x170 mm/memcontrol.c:711
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_memcg_state+0x87/0x170 mm/memcontrol.c:711
 __mod_lruvec_state+0x81/0x260 mm/memcontrol.c:753
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_lruvec_state+0x8d/0x260 mm/memcontrol.c:756
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_lruvec_state+0x8d/0x260 mm/memcontrol.c:756
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_lruvec_state+0xc1/0x260 mm/memcontrol.c:758
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_lruvec_state+0xc1/0x260 mm/memcontrol.c:758
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
BUG: using __this_cpu_write() in preemptible [00000000] code: syz-executor.2/17466
caller is __mod_lruvec_state+0x117/0x260 mm/memcontrol.c:766
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 check_preemption_disabled+0x2d9/0x320 lib/smp_processor_id.c:47
 __mod_lruvec_state+0x117/0x260 mm/memcontrol.c:766
 __mod_lruvec_page_state include/linux/memcontrol.h:770 [inline]
 page_remove_file_rmap mm/rmap.c:1257 [inline]
 page_remove_rmap+0x19a/0x420 mm/rmap.c:1313
 zap_pte_range mm/memory.c:1104 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0xb1a/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(val > preempt_count())
WARNING: CPU: 0 PID: 17466 at kernel/sched/core.c:4037 preempt_count_sub+0xa3/0x160 kernel/sched/core.c:4037
Modules linked in:
CPU: 0 PID: 17466 Comm: syz-executor.2 Tainted: G        W         5.4.233-syzkaller-00032-g21086923c1e6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
RIP: 0010:preempt_count_sub+0xa3/0x160 kernel/sched/core.c:4037
Code: 03 42 0f b6 04 30 84 c0 0f 85 86 00 00 00 83 3d 86 d2 c1 04 00 75 d2 48 c7 c7 c0 c1 87 84 48 c7 c6 60 c2 87 84 e8 2d 3d f6 ff <0f> 0b eb bb e8 e4 9e d9 00 85 c0 74 b2 48 c7 c0 e4 af 06 86 48 c1
RSP: 0018:ffff8881eab1f5b8 EFLAGS: 00010246
RAX: 2aca0fc6e7b06e00 RBX: 0000000000000001 RCX: ffff8881e899bf00
RDX: 0000000000000000 RSI: 0000000000009652 RDI: 0000000000000001
RBP: ffff8881eab1f790 R08: ffffffff814ca252 R09: fffffbfff0d47206
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881eab1f920 R14: dffffc0000000000 R15: 1ffff1103d563f24
FS:  00005555557eb400(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3d526e8000 CR3: 00000001b378d000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock+0x49/0x60 kernel/locking/spinlock.c:183
 spin_unlock include/linux/spinlock.h:378 [inline]
 zap_pte_range mm/memory.c:1162 [inline]
 zap_pmd_range mm/memory.c:1221 [inline]
 zap_pud_range mm/memory.c:1250 [inline]
 zap_p4d_range mm/memory.c:1271 [inline]
 unmap_page_range+0x1582/0x1760 mm/memory.c:1292
 unmap_single_vma mm/memory.c:1337 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1369
 exit_mmap+0x2bc/0x520 mm/mmap.c:3186
 __mmput+0x34/0x250 kernel/fork.c:1090
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xd94/0x13f0 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
---[ end trace 98714d84747ff244 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/04/07 18:21 android12-5.4 21086923c1e6 f7ba566d .config console log report info ci2-android-5-4-kasan BUG: scheduling while atomic in f2fs_register_inmem_page
* Struck through repros no longer work on HEAD.