syzbot

 sign-in | mailing list | source | docs
🐞 Open [955] ≡ Subsystems 🐞 Fixed [4573] 🐞 Invalid [10554] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

kernel BUG in __page_mapcount

Status: fixed on 2023/02/24 13:50
Labels: kernel (incorrect?)
Reported-by: syzbot+1f52b3a18d5633fa7f82@syzkaller.appspotmail.com
Fix commit: 24d7275ce279 fs/proc: task_mmu.c: don't read mapcount for migration entry
First crash: 742d, last: 504d

Cause bisection: failed (error log, bisect log)
▶ ▼ Discussions (11)
Title Replies (including bot) Last reply
[v4 PATCH] fs/proc: task_mmu.c: don't read mapcount for migration entry 11 (11) 2023/04/04 00:50
[PATCH 5.15 000/196] 5.15.25-rc1 review 209 (209) 2022/02/23 02:54
[PATCH 5.10 000/121] 5.10.102-rc1 review 131 (131) 2022/02/22 12:06
[stable-5.15 PATCH] fs/proc: task_mmu.c: don't read mapcount for migration entry 2 (2) 2022/02/17 18:56
[stable-5.10 PATCH] fs/proc: task_mmu.c: don't read mapcount for migration entry 1 (1) 2022/02/15 22:16
[PATCH 5.16 000/203] 5.16.10-rc1 review 221 (221) 2022/02/15 17:29
[patch 2/5] fs/proc: task_mmu.c: don't read mapcount for migration entry 1 (1) 2022/02/12 00:32
[v3 PATCH] fs/proc: task_mmu.c: don't read mapcount for migration entry 3 (3) 2022/02/03 18:18
[v2 PATCH] fs/proc: task_mmu.c: don't read mapcount for migration entry 17 (17) 2022/01/28 16:53
[PATCH] fs/proc: task_mmu.c: don't read mapcount for migration entry 3 (3) 2022/01/13 19:02
[syzbot] kernel BUG in __page_mapcount 11 (13) 2022/01/11 23:14
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at include/linux/page-flags.h:LINE! 4 1542d 1724d 0/24 auto-closed as invalid on 2019/09/14 22:37
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2021/06/07 15:13 19m jannh@google.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 7ac3a1c1 OK
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2022/01/20 17:25 20m bisect fix upstream job log (0) log
2021/06/26 07:29 32m bisect fix upstream job log (0) log

Sample crash report:
 __mmput+0x122/0x4b0 kernel/fork.c:1113
 mmput+0x56/0x60 kernel/fork.c:1134
 exit_mm kernel/exit.c:507 [inline]
 do_exit+0xb27/0x2b40 kernel/exit.c:819
 do_group_exit+0x125/0x310 kernel/exit.c:929
 get_signal+0x47d/0x2220 kernel/signal.c:2852
 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
 exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
------------[ cut here ]------------
kernel BUG at include/linux/page-flags.h:785!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline]
RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744
Code: e8 d3 16 d1 ff 48 c7 c6 c0 00 b6 89 48 89 ef e8 94 4e 04 00 0f 0b e8 bd 16 d1 ff 48 c7 c6 60 01 b6 89 48 89 ef e8 7e 4e 04 00 <0f> 0b e8 a7 16 d1 ff 48 c7 c6 a0 01 b6 89 4c 89 f7 e8 68 4e 04 00
RSP: 0018:ffffc90002b6f7b8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888019619d00 RSI: ffffffff81a68c12 RDI: 0000000000000003
RBP: ffffea0001bdc2c0 R08: 0000000000000029 R09: 00000000ffffffff
R10: ffffffff8903e29f R11: 00000000ffffffff R12: 00000000ffffffff
R13: 00000000ffffea00 R14: ffffc90002b6fb30 R15: ffffea0001bd8001
FS:  00007faa2aefd700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff7e663318 CR3: 0000000018c6e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 page_mapcount include/linux/mm.h:837 [inline]
 smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466
 smaps_pte_entry fs/proc/task_mmu.c:538 [inline]
 smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601
 walk_pmd_range mm/pagewalk.c:128 [inline]
 walk_pud_range mm/pagewalk.c:205 [inline]
 walk_p4d_range mm/pagewalk.c:240 [inline]
 walk_pgd_range mm/pagewalk.c:277 [inline]
 __walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379
 walk_page_vma+0x277/0x350 mm/pagewalk.c:530
 smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768
 smap_gather_stats fs/proc/task_mmu.c:741 [inline]
 show_smap+0xc6/0x440 fs/proc/task_mmu.c:822
 seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272
 seq_read+0x3e0/0x5b0 fs/seq_file.c:162
 vfs_read+0x1b5/0x600 fs/read_write.c:479
 ksys_read+0x12d/0x250 fs/read_write.c:619
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7faa2af6c969
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa2aefd288 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007faa2aff4418 RCX: 00007faa2af6c969
RDX: 0000000000002025 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00007faa2aff4410 R08: 00007faa2aefd700 R09: 0000000000000000
R10: 00007faa2aefd700 R11: 0000000000000246 R12: 00007faa2afc20ac
R13: 00007fff7e6632bf R14: 00007faa2aefd400 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 24ec93ff95e4ac3d ]---
RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline]
RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744
Code: e8 d3 16 d1 ff 48 c7 c6 c0 00 b6 89 48 89 ef e8 94 4e 04 00 0f 0b e8 bd 16 d1 ff 48 c7 c6 60 01 b6 89 48 89 ef e8 7e 4e 04 00 <0f> 0b e8 a7 16 d1 ff 48 c7 c6 a0 01 b6 89 4c 89 f7 e8 68 4e 04 00
RSP: 0018:ffffc90002b6f7b8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888019619d00 RSI: ffffffff81a68c12 RDI: 0000000000000003
RBP: ffffea0001bdc2c0 R08: 0000000000000029 R09: 00000000ffffffff
R10: ffffffff8903e29f R11: 00000000ffffffff R12: 00000000ffffffff
R13: 00000000ffffea00 R14: ffffc90002b6fb30 R15: ffffea0001bd8001
FS:  00007faa2aefd700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff7e663318 CR3: 0000000018c6e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (45):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2021/12/21 17:23 upstream 6e0567b73052 a938f0b8 .config console log report syz C ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/07/29 08:13 upstream 4010a528219e 9a4781d4 .config console log report syz ci-upstream-kasan-gce-selinux-root kernel BUG in __page_mapcount
2021/05/27 07:29 upstream 7ac3a1c1ae51 858ea628 .config console log report syz ci-upstream-kasan-gce-smack-root kernel BUG in __page_mapcount
2021/11/28 15:23 upstream 3498e7f2bb41 63eeac02 .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/11/27 23:38 upstream 741392771338 63eeac02 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in __page_mapcount
2021/11/16 05:13 upstream 8ab774587903 83f5c9b5 .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/11/12 18:06 upstream 5833291ab6de 83f5c9b5 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in __page_mapcount
2021/11/10 19:30 upstream 89d714ab6043 75b04091 .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/11/09 14:14 upstream d2f38a3c6507 59bcaf9a .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/11/04 18:54 upstream 7ddb58cb0eca 4c1be0be .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/11/02 10:54 upstream e66435936756 098b5d53 .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/10/28 04:51 upstream 1fc596a56b33 be531bb4 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in __page_mapcount
2021/10/27 12:05 upstream d25f27432f80 373bf66b .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in __page_mapcount
2021/10/20 11:17 upstream d9abdee5fd5a 418a00eb .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in __page_mapcount
2021/10/12 16:03 upstream fa5878760579 838e7e2c .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/10/08 14:00 upstream 1da38549dd64 efe0f24d .config console log report info ci-upstream-kasan-gce kernel BUG in __page_mapcount
2021/09/24 13:36 upstream f9e36107ec70 8cac236e .config console log report info ci-upstream-kasan-gce-root kernel BUG in __page_mapcount
2021/07/29 07:23 upstream 4010a528219e 9a4781d4 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in __page_mapcount
2021/05/27 00:37 upstream 7ac3a1c1ae51 858ea628 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in __page_mapcount
2021/11/01 08:13 linux-next bdcc9f6a5682 098b5d53 .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in __page_mapcount
2021/10/19 20:00 linux-next 60e8840126bd 466b7db1 .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in __page_mapcount
2021/10/01 16:42 upstream 4de593fb965f cc80db95 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in do_read_cache_page
2021/09/26 21:23 upstream 996148ee05d0 78494d16 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in do_read_cache_page
2021/09/20 16:29 upstream e4e737bb5c17 af796c18 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in do_read_cache_page
2021/09/13 12:40 upstream 6880fa6c5660 3ce60af8 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in do_read_cache_page
2021/09/11 03:19 upstream 926de8c4326c 5ae8508a .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in do_read_cache_page
2021/09/05 22:27 upstream 0319b848b155 d236a457 .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/26 19:49 upstream 73f3af7b4611 b318694d .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/23 10:40 upstream e22ce8eb631b b599f2fc .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/23 00:50 upstream 1bdc3d5be7e1 b599f2fc .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in do_read_cache_page
2021/08/23 00:23 upstream 1bdc3d5be7e1 b599f2fc .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in do_read_cache_page
2021/08/21 07:22 upstream fa54d366a6e4 b599f2fc .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in do_read_cache_page
2021/08/20 17:37 upstream d992fe5318d8 b599f2fc .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in do_read_cache_page
2021/08/20 17:24 upstream d992fe5318d8 b599f2fc .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in do_read_cache_page
2021/08/20 15:29 upstream d992fe5318d8 b599f2fc .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/20 01:51 upstream f87d64319e6f b599f2fc .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in do_read_cache_page
2021/08/19 18:33 upstream d6d09a694205 b599f2fc .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/19 17:37 upstream d6d09a694205 b599f2fc .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/18 11:29 upstream 614cb2751d31 a2fe1cb5 .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/16 22:07 upstream a2824f19e606 33c26cb7 .config console log report info ci-upstream-kasan-gce-root kernel BUG in do_read_cache_page
2021/08/15 13:12 upstream 0aa78d17099b 2489ab88 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in do_read_cache_page
2021/08/12 23:57 upstream f8fbb47c6e86 3fd2ea69 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in do_read_cache_page
2021/08/10 11:20 upstream 9a73fa375d58 6972b106 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in do_read_cache_page
2021/08/26 19:48 linux-next 88fac11862d3 b318694d .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in do_read_cache_page
2021/07/08 03:14 linux-next ee268dee405b 95793bce .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in do_read_cache_page
* Struck through repros no longer work on HEAD.