syzbot


BUG: Bad page map

Status: auto-closed as invalid on 2021/01/01 08:20
Reported-by: syzbot+95b9ad48ead36a077942@syzkaller.appspotmail.com
First crash: 822d, last: 763d
similar bugs (9):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: Bad page map (3) 1 80d 80d 0/1 upstream: reported on 2022/07/18 21:41
upstream BUG: Bad page map (5) C 25 5h46m 158d 1/24 upstream: reported C repro on 2022/05/01 09:02
linux-4.19 BUG: Bad page map (2) 10 266d 447d 0/1 auto-closed as invalid on 2022/05/13 11:22
upstream BUG: Bad page map (2) syz 127 1492d 1548d 0/24 closed as invalid on 2018/09/05 12:51
upstream BUG: Bad page map 1 1551d 1551d 0/24 closed as invalid on 2018/07/08 13:28
upstream BUG: Bad page map (3) 4 1362d 1487d 0/24 auto-closed as invalid on 2019/07/13 00:02
upstream BUG: Bad page map (4) 39 308d 944d 0/24 auto-closed as invalid on 2022/04/02 04:25
linux-4.14 BUG: Bad page map 1 809d 809d 0/1 auto-closed as invalid on 2020/11/16 16:05
android-54 BUG: Bad page map 1 43d 43d 0/2 upstream: reported on 2022/08/25 04:05

Sample crash report:
xt_CT: No such helper "snmp_trap"
xt_CT: No such helper "snmp_trap"
BUG: Bad page map in process syz-executor.4  pte:707000007 pmd:0010f067
addr:000000001418d971 vm_flags:180400fb anon_vma:          (null) mapping:00000000195c0a31 index:48
file:kcov fault:          (null) mmap:kcov_mmap readpage:          (null)
CPU: 0 PID: 7093 Comm: syz-executor.4 Not tainted 4.19.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 print_bad_pte.cold+0x1c5/0x222 mm/memory.c:773
 _vm_normal_page+0x21e/0x510 mm/memory.c:885
 zap_pte_range mm/memory.c:1311 [inline]
 zap_pmd_range mm/memory.c:1440 [inline]
 zap_pud_range mm/memory.c:1469 [inline]
 zap_p4d_range mm/memory.c:1490 [inline]
 unmap_page_range+0xfba/0x2a70 mm/memory.c:1511
 unmap_single_vma+0x198/0x300 mm/memory.c:1556
 zap_page_range_single+0x247/0x380 mm/memory.c:1635
 unmap_mapping_range_vma mm/memory.c:2806 [inline]
 unmap_mapping_range_tree mm/memory.c:2827 [inline]
 unmap_mapping_pages+0x22d/0x2b0 mm/memory.c:2859
 truncate_pagecache+0x51/0x90 mm/truncate.c:804
 simple_setattr+0xdf/0x100 fs/libfs.c:413
 notify_change+0xd93/0xfc0 fs/attr.c:336
 do_truncate+0x134/0x1f0 fs/open.c:63
 do_sys_ftruncate+0x492/0x560 fs/open.c:194
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f083ea01c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 0000000000003d00 RCX: 000000000045d5b9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000
RBP: 000000000118cf78 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffc9adfb07f R14: 00007f083ea029c0 R15: 000000000118cf4c
BUG: Bad page map in process syz-executor.4  pte:707000707070007 pmd:0010f067
addr:000000009ab40a11 vm_flags:180400fb anon_vma:          (null) mapping:00000000195c0a31 index:16a
file:kcov fault:          (null) mmap:kcov_mmap readpage:          (null)
CPU: 0 PID: 7093 Comm: syz-executor.4 Tainted: G    B             4.19.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 print_bad_pte.cold+0x1c5/0x222 mm/memory.c:773
 _vm_normal_page+0x21e/0x510 mm/memory.c:885
 zap_pte_range mm/memory.c:1311 [inline]
 zap_pmd_range mm/memory.c:1440 [inline]
 zap_pud_range mm/memory.c:1469 [inline]
 zap_p4d_range mm/memory.c:1490 [inline]
 unmap_page_range+0xfba/0x2a70 mm/memory.c:1511
 unmap_single_vma+0x198/0x300 mm/memory.c:1556
 zap_page_range_single+0x247/0x380 mm/memory.c:1635
 unmap_mapping_range_vma mm/memory.c:2806 [inline]
 unmap_mapping_range_tree mm/memory.c:2827 [inline]
 unmap_mapping_pages+0x22d/0x2b0 mm/memory.c:2859
 truncate_pagecache+0x51/0x90 mm/truncate.c:804
 simple_setattr+0xdf/0x100 fs/libfs.c:413
 notify_change+0xd93/0xfc0 fs/attr.c:336
 do_truncate+0x134/0x1f0 fs/open.c:63
 do_sys_ftruncate+0x492/0x560 fs/open.c:194
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f083ea01c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 0000000000003d00 RCX: 000000000045d5b9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000
RBP: 000000000118cf78 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffc9adfb07f R14: 00007f083ea029c0 R15: 000000000118cf4c
BUG: Bad page map in process syz-executor.4  pte:700070700000007 pmd:0010e067
addr:000000001f1aec8d vm_flags:180400fb anon_vma:          (null) mapping:00000000195c0a31 index:b8
file:kcov fault:          (null) mmap:kcov_mmap readpage:          (null)
CPU: 1 PID: 7093 Comm: syz-executor.4 Tainted: G    B             4.19.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 print_bad_pte.cold+0x1c5/0x222 mm/memory.c:773
 _vm_normal_page+0x21e/0x510 mm/memory.c:885
 zap_pte_range mm/memory.c:1311 [inline]
 zap_pmd_range mm/memory.c:1440 [inline]
 zap_pud_range mm/memory.c:1469 [inline]
 zap_p4d_range mm/memory.c:1490 [inline]
 unmap_page_range+0xfba/0x2a70 mm/memory.c:1511
 unmap_single_vma+0x198/0x300 mm/memory.c:1556
 zap_page_range_single+0x247/0x380 mm/memory.c:1635
 unmap_mapping_range_vma mm/memory.c:2806 [inline]
 unmap_mapping_range_tree mm/memory.c:2827 [inline]
 unmap_mapping_pages+0x22d/0x2b0 mm/memory.c:2859
 truncate_pagecache+0x51/0x90 mm/truncate.c:804
 simple_setattr+0xdf/0x100 fs/libfs.c:413
 notify_change+0xd93/0xfc0 fs/attr.c:336
 do_truncate+0x134/0x1f0 fs/open.c:63
 do_sys_ftruncate+0x492/0x560 fs/open.c:194
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f083ea01c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 0000000000003d00 RCX: 000000000045d5b9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000
RBP: 000000000118cf78 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffc9adfb07f R14: 00007f083ea029c0 R15: 000000000118cf4c
page:ffffea0000000000 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x800(reserved)
raw: 0000000000000800 ffffea0000000008 ffffea0000000008 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:519!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7093 Comm: syz-executor.4 Tainted: G    B             4.19.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline]
RIP: 0010:release_pages+0xcd6/0x15a0 mm/swap.c:760
Code: 24 31 ed 4c 8b 28 e9 c4 fd ff ff 4d 8d 75 08 31 ed e9 79 f4 ff ff e8 e9 ab e0 ff 48 c7 c6 60 bc 91 87 4c 89 ef e8 2a 87 08 00 <0f> 0b e8 d3 ab e0 ff 4d 8d 6c 24 ff e9 89 f4 ff ff e8 c4 ab e0 ff
RSP: 0018:ffff888201c3f9c0 EFLAGS: 00010293
RAX: ffff88820845c440 RBX: 0000000000000034 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff818905a6 RDI: ffffea0000000038
RBP: 0000000000000000 R08: 000000000000003e R09: 0000000000000000
R10: 0000000000000005 R11: ffffffff8ad3805b R12: ffffea0000000034
R13: ffffea0000000000 R14: 0000000000000000 R15: dffffc0000000000
FS:  00007f083ea02700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1185e53018 CR3: 00000001fcddc000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tlb_flush_mmu_free mm/memory.c:249 [inline]
 tlb_flush_mmu+0x1dc/0x4f0 mm/memory.c:258
 arch_tlb_finish_mmu mm/memory.c:273 [inline]
 tlb_finish_mmu+0x108/0x200 mm/memory.c:432
 zap_page_range_single+0x288/0x380 mm/memory.c:1637
 unmap_mapping_range_vma mm/memory.c:2806 [inline]
 unmap_mapping_range_tree mm/memory.c:2827 [inline]
 unmap_mapping_pages+0x22d/0x2b0 mm/memory.c:2859
 truncate_pagecache+0x51/0x90 mm/truncate.c:804
 simple_setattr+0xdf/0x100 fs/libfs.c:413
 notify_change+0xd93/0xfc0 fs/attr.c:336
 do_truncate+0x134/0x1f0 fs/open.c:63
 do_sys_ftruncate+0x492/0x560 fs/open.c:194
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f083ea01c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 0000000000003d00 RCX: 000000000045d5b9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000
RBP: 000000000118cf78 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffc9adfb07f R14: 00007f083ea029c0 R15: 000000000118cf4c
Modules linked in:
---[ end trace f1994104357ac8d1 ]---
RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline]
RIP: 0010:release_pages+0xcd6/0x15a0 mm/swap.c:760
Code: 24 31 ed 4c 8b 28 e9 c4 fd ff ff 4d 8d 75 08 31 ed e9 79 f4 ff ff e8 e9 ab e0 ff 48 c7 c6 60 bc 91 87 4c 89 ef e8 2a 87 08 00 <0f> 0b e8 d3 ab e0 ff 4d 8d 6c 24 ff e9 89 f4 ff ff e8 c4 ab e0 ff
RSP: 0018:ffff888201c3f9c0 EFLAGS: 00010293
RAX: ffff88820845c440 RBX: 0000000000000034 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff818905a6 RDI: ffffea0000000038
RBP: 0000000000000000 R08: 000000000000003e R09: 0000000000000000
R10: 0000000000000005 R11: ffffffff8ad3805b R12: ffffea0000000034
R13: ffffea0000000000 R14: 0000000000000000 R15: dffffc0000000000
FS:  00007f083ea02700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1185e53018 CR3: 00000001fcddc000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2020/09/03 08:19 linux-4.19.y f6d5cb9e2c06 abf9ba4f .config log report
ci2-linux-4-19 2020/07/06 19:53 linux-4.19.y 399849e4654e ef278c73 .config log report
* Struck through repros no longer work on HEAD.