syzbot


linux-next boot error: WARNING in kfence_protect

Status: fixed on 2023/02/24 13:50
Subsystems: kasan mm
[Documentation on labels]
Fix commit: 3e844d842d49 x86/mm: Ensure forced page table splitting
First crash: 689d, last: 688d

Sample crash report:
ACPI: PM-Timer IO Port: 0xb008
ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
ACPI: Using ACPI (MADT) for SMP configuration information
smpboot: Allowing 2 CPUs, 0 hotplug CPUs
PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff]
PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x0009ffff]
PM: hibernation: Registered nosave memory: [mem 0x000a0000-0x000effff]
PM: hibernation: Registered nosave memory: [mem 0x000f0000-0x000fffff]
PM: hibernation: Registered nosave memory: [mem 0xbfffd000-0xbfffffff]
PM: hibernation: Registered nosave memory: [mem 0xc0000000-0xfffbbfff]
PM: hibernation: Registered nosave memory: [mem 0xfffbc000-0xffffffff]
[mem 0xc0000000-0xfffbbfff] available for PCI devices
Booting paravirtualized kernel on KVM
clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
setup_percpu: NR_CPUS:8 nr_cpumask_bits:2 nr_cpu_ids:2 nr_node_ids:2
percpu: Embedded 70 pages/cpu s248968 r8192 d29560 u1048576
kvm-guest: PV spinlocks enabled
PV qspinlock hash table entries: 256 (order: 0, 4096 bytes, linear)
Fallback order for Node 0: 0 1 
Fallback order for Node 1: 1 0 
Built 2 zonelists, mobility grouping on.  Total pages: 2064125
Policy zone: Normal
Kernel command line: earlyprintk=serial net.ifnames=0 sysctl.kernel.hung_task_all_cpu_backtrace=1 ima_policy=tcb nf-conntrack-ftp.ports=20000 nf-conntrack-tftp.ports=20000 nf-conntrack-sip.ports=20000 nf-conntrack-irc.ports=20000 nf-conntrack-sane.ports=20000 binder.debug_mask=0 rcupdate.rcu_expedited=1 no_hash_pointers page_owner=on sysctl.vm.nr_hugepages=4 sysctl.vm.nr_overcommit_hugepages=4 secretmem.enable=1 sysctl.max_rcu_stall_to_panic=1 msr.allow_writes=off coredump_filter=0xffff root=/dev/sda console=ttyS0 vsyscall=native numa=fake=2 kvm-intel.nested=1 spec_store_bypass_disable=prctl nopcid vivid.n_devs=16 vivid.multiplanar=1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2 netrom.nr_ndevs=16 rose.rose_ndevs=16 smp.csd_lock_timeout=100000 watchdog_thresh=55 workqueue.watchdog_thresh=140 sysctl.net.core.netdev_unregister_timeout_secs=140 dummy_hcd.num=8 panic_on_warn=1 BOOT_IMAGE=/boot/bzImage root=/dev/sda1 console=ttyS0
Unknown kernel command line parameters "spec_store_bypass_disable=prctl BOOT_IMAGE=/boot/bzImage", will be passed to user space.
random: crng init done
mem auto-init: stack:off, heap alloc:on, heap free:off
stackdepot hash table entries: 1048576 (order: 11, 8388608 bytes, linear)
software IO TLB: area num 2.
Memory: 6816864K/8388204K available (151552K kernel code, 36308K rwdata, 31528K rodata, 2900K init, 33472K bss, 1571084K reserved, 0K cma-reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=2
Dynamic Preempt: full
Running RCU self tests
rcu: Preemptible hierarchical RCU implementation.
rcu: 	RCU lockdep checking is enabled.
rcu: 	RCU restricting CPUs from NR_CPUS=8 to nr_cpu_ids=2.
rcu: 	RCU callback double-/use-after-free debug is enabled.
rcu: 	RCU debug extended QS entry/exit.
	All grace periods are expedited (rcu_expedited).
	Trampoline variant of Tasks RCU enabled.
	Tracing variant of Tasks RCU enabled.
rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
NR_IRQS: 4352, nr_irqs: 440, preallocated irqs: 16
rcu: srcu_init: Setting srcu_struct sizes based on contention.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/kfence.h:46 kfence_protect_page arch/x86/include/asm/kfence.h:46 [inline]
WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/kfence.h:46 kfence_protect+0x9e/0x190 mm/kfence/core.c:234
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rc5-next-20221118-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:kfence_protect_page arch/x86/include/asm/kfence.h:46 [inline]
RIP: 0010:kfence_protect+0x9e/0x190 mm/kfence/core.c:234
Code: 48 85 c0 74 20 48 89 c3 e8 8f 3f b2 ff 44 8b 74 24 20 bf 01 00 00 00 44 89 f6 e8 2d 3c b2 ff 41 83 fe 01 74 55 e8 72 3f b2 ff <0f> 0b 0f 0b c6 05 00 d0 a6 0c 00 45 31 ed c6 05 f5 cf a6 0c 01 e8
RSP: 0000:ffffffff8c407da8 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffff888012001040 RCX: 0000000000000000
RDX: ffffffff8c4bc980 RSI: ffffffff81ce6aee RDI: 0000000000000005
RBP: ffff88823bc00000 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000003 R11: 0000000000000000 R12: 1ffffffff1880fb5
R13: dffffc0000000000 R14: 0000000000000003 R15: ffff88823bc00000
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000000406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kfence_init_pool+0x387/0x620 mm/kfence/core.c:582
 kfence_init_pool_early mm/kfence/core.c:615 [inline]
 kfence_init+0x56/0x2db mm/kfence/core.c:852
 start_kernel+0x26e/0x470 init/main.c:1059
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/11/18 14:42 linux-next 147307c69ba4 5bb70014 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/18 14:42 linux-next 147307c69ba4 5bb70014 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/18 14:42 linux-next 147307c69ba4 5bb70014 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/18 12:04 linux-next 147307c69ba4 4ba8ab94 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/18 12:04 linux-next 147307c69ba4 4ba8ab94 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/18 12:03 linux-next 147307c69ba4 4ba8ab94 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/17 18:04 linux-next af37ad1e01c7 4ba8ab94 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/17 18:03 linux-next af37ad1e01c7 4ba8ab94 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/17 18:03 linux-next af37ad1e01c7 4ba8ab94 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/17 10:40 linux-next af37ad1e01c7 3a127a31 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/17 10:40 linux-next af37ad1e01c7 3a127a31 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
2022/11/17 10:40 linux-next af37ad1e01c7 3a127a31 .config console log report ci-upstream-linux-next-kasan-gce-root linux-next boot error: WARNING in kfence_protect
* Struck through repros no longer work on HEAD.