syzbot


WARNING in untrack_pfn

Status: public: reported syz repro on 2019/04/13 00:01
Reported-by: syzbot+c9ed87b5e704273da74d@syzkaller.appspotmail.com
First crash: 1922d, last: 1922d
Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in untrack_pfn kernel C done error 128 2d16h 2074d 0/26 upstream: reported C repro on 2018/07/23 16:59
android-49 WARNING in untrack_pfn syz 35 1576d 1809d 0/3 public: reported syz repro on 2019/04/14 09:28
linux-5.15 WARNING in untrack_pfn origin:lts-only C done 7 110d 253d 0/3 upstream: reported C repro on 2023/07/19 07:05
linux-4.19 WARNING in untrack_pfn C error 24 435d 1696d 0/1 upstream: reported C repro on 2019/08/05 09:38
linux-4.14 WARNING in untrack_pfn C inconclusive 27 428d 1688d 0/1 upstream: reported C repro on 2019/08/13 08:40
android-44 WARNING in untrack_pfn C 211 1842d 2215d 0/2 closed as invalid on 2019/03/16 01:21
linux-6.1 WARNING in untrack_pfn (2) origin:lts-only C done 4 82d 206d 0/3 upstream: reported C repro on 2023/09/04 06:46
linux-6.1 WARNING in untrack_pfn 2 340d 348d 0/3 auto-obsoleted due to no activity on 2023/08/21 02:48
android-44 WARNING in untrack_pfn (2) C 71 1576d 1812d 0/2 public: reported C repro on 2019/04/11 08:44

Sample crash report:
ip (3239) used greatest stack depth: 23744 bytes left
audit: type=1400 audit(1545523373.967:10): avc:  denied  { map } for  pid=4474 comm="syz-executor0" path="/selinux/status" dev="selinuxfs" ino=19 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1
------------[ cut here ]------------
WARNING: CPU: 1 PID: 10290 at arch/x86/mm/pat.c:1020 untrack_pfn+0x200/0x250 arch/x86/mm/pat.c:1020
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 10290 Comm: syz-executor4 Not tainted 4.14.90+ #29
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 panic+0x1bf/0x3a4 kernel/panic.c:181
 __warn.cold.7+0x2f/0x35 kernel/panic.c:542
 report_bug+0x1f7/0x26c lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:177 [inline]
 do_error_trap+0x1ba/0x2c0 arch/x86/kernel/traps.c:295
 invalid_op+0x18/0x40 arch/x86/entry/entry_64.S:944
RIP: 0010:untrack_pfn+0x200/0x250 arch/x86/mm/pat.c:1020
RSP: 0018:ffff8881d43877f8 EFLAGS: 00010297
RAX: ffff8881d669de00 RBX: 1ffff1103a870eff RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff98bd8560
RBP: ffff8881d6bef0f8 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8881d669e630 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
 unmap_single_vma+0x13b/0x170 mm/memory.c:1539
 unmap_vmas+0x7c/0xd0 mm/memory.c:1590
 exit_mmap+0x1f9/0x420 mm/mmap.c:3068
 __mmput kernel/fork.c:929 [inline]
 mmput+0xc8/0x350 kernel/fork.c:950
 exit_mm kernel/exit.c:544 [inline]
 do_exit+0x843/0x28c0 kernel/exit.c:852
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 get_signal+0x4e5/0x1470 kernel/signal.c:2348
 do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
 do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457669
RSP: 002b:00007fb5c158fcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 000000000072bfa8 RCX: 0000000000457669
RDX: 00000000004c35b7 RSI: 0000000000000081 RDI: 000000000072bfac
RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bfac
R13: 00007ffd609685ef R14: 00007fb5c15909c0 R15: 000000000072bfac
Kernel Offset: 0x14200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/23 00:14 android-4.14 815e34f802d8 e3bd7ab8 .config console log report syz ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.