syzbot


kernel BUG in workingset_activation (2)

Status: upstream: reported C repro on 2022/11/15 16:23
Reported-by: syzbot+644848628d5e12d5438c@syzkaller.appspotmail.com
First crash: 296d, last: 12d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: kernel BUG in workingset_activation (log)
Repro: C syz .config
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in workingset_activation 1 580d 565d 0/24 auto-closed as invalid on 2021/07/30 16:23

Sample crash report:
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x4f/0x1a0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x184/0x210 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slab.h:737 [inline]
 slab_alloc_node mm/slab.c:3257 [inline]
 slab_alloc mm/slab.c:3265 [inline]
 __kmem_cache_alloc_lru mm/slab.c:3442 [inline]
 kmem_cache_alloc+0x220/0x460 mm/slab.c:3461
 mt_alloc_one lib/maple_tree.c:152 [inline]
 mas_alloc_nodes+0x429/0x810 lib/maple_tree.c:1226
 mas_node_count_gfp lib/maple_tree.c:1310 [inline]
 mas_preallocate+0x1bb/0x360 lib/maple_tree.c:5717
 do_mas_align_munmap+0x129/0x1260 mm/mmap.c:2314
 do_mas_munmap+0x26e/0x2c0 mm/mmap.c:2502
 mmap_region+0x21d/0x1dd0 mm/mmap.c:2550
 do_mmap+0x831/0xf60 mm/mmap.c:1412
 vm_mmap_pgoff+0x1af/0x280 mm/util.c:520
 ksys_mmap_pgoff+0x41f/0x5a0 mm/mmap.c:1458
------------[ cut here ]------------
kernel BUG at include/linux/memcontrol.h:455!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3635 Comm: syz-executor192 Not tainted 6.1.0-rc5-syzkaller-00018-g59d0d52c30d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:folio_memcg_rcu include/linux/memcontrol.h:455 [inline]
RIP: 0010:workingset_activation+0x4cc/0x580 mm/workingset.c:519
Code: 48 89 ef e8 d6 00 00 00 c6 05 8e df 87 0c 01 0f 0b e9 0e fd ff ff e8 13 b4 c9 ff 48 c7 c6 c0 82 57 8a 48 89 ef e8 b4 00 00 00 <0f> 0b e8 fd b3 c9 ff 0f 0b e9 10 fc ff ff e8 f1 b3 c9 ff 48 c7 c6
RSP: 0018:ffffc900033474a0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff88807505c280 RSI: ffffffff81b5881c RDI: 0000000000000000
RBP: ffffea00005f9e00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880b9b35d48 R14: 000000000000000d R15: 0000000000000003
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4ebf5ec3e8 CR3: 000000007d4d4000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 folio_mark_accessed+0x599/0x830 mm/swap.c:502
 kvm_set_page_accessed arch/x86/kvm/../../../virt/kvm/kvm_main.c:2895 [inline]
 kvm_set_pfn_accessed arch/x86/kvm/../../../virt/kvm/kvm_main.c:2967 [inline]
 kvm_set_pfn_accessed+0x23f/0x2b0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2961
 handle_changed_spte_acc_track arch/x86/kvm/mmu/tdp_mmu.c:354 [inline]
 handle_changed_spte_acc_track+0x1bc/0x290 arch/x86/kvm/mmu/tdp_mmu.c:346
 handle_changed_spte arch/x86/kvm/mmu/tdp_mmu.c:620 [inline]
 handle_removed_pt arch/x86/kvm/mmu/tdp_mmu.c:504 [inline]
 __handle_changed_spte+0xdb3/0x1a40 arch/x86/kvm/mmu/tdp_mmu.c:611
 handle_changed_spte arch/x86/kvm/mmu/tdp_mmu.c:618 [inline]
 handle_removed_pt arch/x86/kvm/mmu/tdp_mmu.c:504 [inline]
 __handle_changed_spte+0xda4/0x1a40 arch/x86/kvm/mmu/tdp_mmu.c:611
 __tdp_mmu_set_spte+0x229/0x9d0 arch/x86/kvm/mmu/tdp_mmu.c:743
 _tdp_mmu_set_spte arch/x86/kvm/mmu/tdp_mmu.c:759 [inline]
 tdp_mmu_set_spte arch/x86/kvm/mmu/tdp_mmu.c:768 [inline]
 __tdp_mmu_zap_root+0x7e7/0x860 arch/x86/kvm/mmu/tdp_mmu.c:874
 tdp_mmu_zap_root+0x12e/0x330 arch/x86/kvm/mmu/tdp_mmu.c:910
 kvm_tdp_mmu_zap_all+0x158/0x1b0 arch/x86/kvm/mmu/tdp_mmu.c:1014
 kvm_mmu_zap_all+0x280/0x2d0 arch/x86/kvm/mmu/mmu.c:6514
 kvm_flush_shadow_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:383 [inline]
 kvm_mmu_notifier_release+0x60/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:895
 mn_hlist_release mm/mmu_notifier.c:319 [inline]
 __mmu_notifier_release+0x1ad/0x610 mm/mmu_notifier.c:357
 mmu_notifier_release include/linux/mmu_notifier.h:415 [inline]
 exit_mmap+0x66d/0x7b0 mm/mmap.c:3077
 __mmput+0x128/0x4c0 kernel/fork.c:1185
 mmput+0x60/0x70 kernel/fork.c:1207
 exit_mm kernel/exit.c:516 [inline]
 do_exit+0xa41/0x2a30 kernel/exit.c:807
 do_group_exit+0xd4/0x2a0 kernel/exit.c:950
 __do_sys_exit_group kernel/exit.c:961 [inline]
 __se_sys_exit_group kernel/exit.c:959 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:959
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f4ebf5a8359
Code: Unable to access opcode bytes at 0x7f4ebf5a832f.
RSP: 002b:00007fff9f076cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f4ebf61c290 RCX: 00007f4ebf5a8359
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4ebf61c290
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:folio_memcg_rcu include/linux/memcontrol.h:455 [inline]
RIP: 0010:workingset_activation+0x4cc/0x580 mm/workingset.c:519
Code: 48 89 ef e8 d6 00 00 00 c6 05 8e df 87 0c 01 0f 0b e9 0e fd ff ff e8 13 b4 c9 ff 48 c7 c6 c0 82 57 8a 48 89 ef e8 b4 00 00 00 <0f> 0b e8 fd b3 c9 ff 0f 0b e9 10 fc ff ff e8 f1 b3 c9 ff 48 c7 c6
RSP: 0018:ffffc900033474a0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff88807505c280 RSI: ffffffff81b5881c RDI: 0000000000000000
RBP: ffffea00005f9e00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880b9b35d48 R14: 000000000000000d R15: 0000000000000003
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4ebf5ec3e8 CR3: 000000007d4d4000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2022/06/13 15:30 upstream b13baccc3850 68fc921a .config log report syz C
ci-upstream-kasan-gce 2022/05/13 23:20 upstream d928e8f3af38 68fc921a .config log report syz C
ci-upstream-kasan-gce-selinux-root 2022/03/27 04:09 upstream f022814633e1 0b33604d .config log report syz C
* Struck through repros no longer work on HEAD.
Crashes (39):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2022/11/17 01:17 upstream 59d0d52c30d4 3a127a31 .config log report syz C kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/08/30 00:32 upstream b90cb1053190 5b44472d .config log report syz C kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/07/30 02:00 upstream 6e2c0490769e fef302b1 .config log report syz C kernel BUG in workingset_activation
ci-upstream-kasan-gce 2022/07/14 08:59 upstream 4a57a8400075 5d921b08 .config log report syz C kernel BUG in workingset_activation
ci-upstream-kasan-gce 2022/04/01 09:39 upstream b4a5ea09b293 68fc921a .config log report syz C kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/10 13:55 upstream f4bc5bbb5fef 0b33604d .config log report syz C kernel BUG in workingset_activation
ci-upstream-linux-next-kasan-gce-root 2022/09/24 20:12 linux-next aaa11ce2ffc8 0042f2b4 .config log report syz C kernel BUG in workingset_activation
ci-upstream-linux-next-kasan-gce-root 2022/07/25 07:53 linux-next cb71b93c2dc3 22343af4 .config log report syz C kernel BUG in workingset_activation
ci-upstream-kasan-gce-smack-root 2022/10/16 21:48 upstream 55be6084c8e0 67cb024c .config log report syz C kernel BUG in folio_memcg_rcu
ci-upstream-kasan-gce-smack-root 2022/08/04 18:05 upstream 200e340f2196 1c9013ac .config log report syz C kernel BUG in folio_memcg_rcu
ci-upstream-kasan-gce 2022/11/21 04:51 upstream 894909f95aa1 5bb70014 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/09/27 18:08 upstream a1375562c0a8 87840e00 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/09/26 20:04 upstream f76349cf4145 10323ddf .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/25 09:38 upstream 105a36f3694e 0042f2b4 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/09/22 02:49 upstream 06f7db949993 60af5050 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/09/22 02:02 upstream 06f7db949993 60af5050 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/21 07:22 upstream 60891ec99e14 c4b8ccfd .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/21 07:22 upstream 60891ec99e14 c4b8ccfd .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/09/17 09:55 upstream a335366bad13 dd9a85ff .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/09/16 12:30 upstream 3245cb65fd91 dd9a85ff .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/13 04:11 upstream 6504d82f4440 f371ed7e .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/13 02:09 upstream 6504d82f4440 f371ed7e .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/12 00:59 upstream 4ed9c1e971b1 356d8217 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/10 20:23 upstream b96fbd602d35 356d8217 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/09/10 01:31 upstream ce888220d5c7 356d8217 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/08/19 23:34 upstream 4c2d0b039c5c 26a13b38 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/06/28 06:00 upstream 941e3e791269 ef82eb2c .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/04/13 22:59 upstream a19944809fe9 b17b2923 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/02/25 03:48 upstream 73878e5eb1bd 7c337266 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/02/24 15:02 upstream 23d04328444a b28851a4 .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/02/24 01:52 upstream 23d04328444a 6e821dbf .config log report info kernel BUG in workingset_activation
ci-qemu-upstream 2022/02/23 10:30 upstream 5c1ee569660d 6e821dbf .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/16 08:22 upstream c5d9ae265b10 8b9ca619 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/15 18:26 upstream 705d84a366cf 8b9ca619 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/15 04:00 upstream d567f5db412e 8b9ca619 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/15 03:06 upstream d567f5db412e 8b9ca619 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/14 21:00 upstream 754e0b0e3560 8b9ca619 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/14 13:12 upstream 754e0b0e3560 8b9ca619 .config log report info kernel BUG in workingset_activation
ci-upstream-kasan-gce-selinux-root 2022/02/10 12:45 upstream f4bc5bbb5fef 0b33604d .config log report info kernel BUG in workingset_activation
* Struck through repros no longer work on HEAD.