general protection fault in unmap_page

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: use-after-free Read in unmap_page_range (2) mm	C	unreliable		4	1111d	1129d	20/28	fixed on 2022/03/08 16:11
upstream	BUG: Bad page map (5) mm io-uring	C			35	689d	947d	22/28	fixed on 2023/02/24 13:50

general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 32242 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:unmap_page_range+0xe9/0x2c50 mm/memory.c:1529 Code: e8 03 80 3c 18 00 0f 85 0f 26 00 00 48 8b 44 24 20 48 8b 58 40 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 25 00 00 49 be 00 00 00 00 00 fc ff df 4c 89 RSP: 0018:ffff88820827f770 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 000000001f5e92c0 RCX: ffffffff818b8ca3 RDX: 0000000003ebd262 RSI: ffffffff818b8cb1 RDI: 000000001f5e9310 RBP: ffff88800010e568 R08: 0000000000000000 R09: 00007fbe99e56000 R10: 0000000000000006 R11: 0000000000000000 R12: 00007fbe99e56000 R13: 00007fbe99e56000 R14: 00007fbe9a056000 R15: 00007fbe99e56000 FS: 00007fbe98433700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f528f29d718 CR3: 0000000053f7f000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: unmap_single_vma+0x198/0x300 mm/memory.c:1579 unmap_vmas+0xa9/0x180 mm/memory.c:1609 exit_mmap+0x2b9/0x530 mm/mmap.c:3093 __mmput kernel/fork.c:1016 [inline] mmput+0x14e/0x4a0 kernel/fork.c:1037 exit_mm kernel/exit.c:549 [inline] do_exit+0xaec/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fbe9aedeae9 Code: Bad RIP value. RSP: 002b:00007fbe98433218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007fbe9aff2028 RCX: 00007fbe9aedeae9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbe9aff202c RBP: 00007fbe9aff2020 R08: 000000000000000e R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbe9aff202c R13: 00007ffcad6574ef R14: 00007fbe98433300 R15: 0000000000022000 Modules linked in: ---[ end trace 9005a4c7b5962b34 ]--- RIP: 0010:unmap_page_range+0xe9/0x2c50 mm/memory.c:1529 Code: e8 03 80 3c 18 00 0f 85 0f 26 00 00 48 8b 44 24 20 48 8b 58 40 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 25 00 00 49 be 00 00 00 00 00 fc ff df 4c 89 RSP: 0018:ffff88820827f770 EFLAGS: 00010202 f2fs_msg: 64 callbacks suppressed F2FS-fs (loop3): invalid crc value RAX: dffffc0000000000 RBX: 000000001f5e92c0 RCX: ffffffff818b8ca3 RDX: 0000000003ebd262 RSI: ffffffff818b8cb1 RDI: 000000001f5e9310 RBP: ffff88800010e568 R08: 0000000000000000 R09: 00007fbe99e56000 dccp_v6_rcv: dropped packet with invalid checksum F2FS-fs (loop5): invalid crc value F2FS-fs (loop3): Failed to initialize F2FS segment manager F2FS-fs (loop5): invalid crc value F2FS-fs (loop5): Failed to get valid F2FS checkpoint R10: 0000000000000006 R11: 0000000000000000 R12: 00007fbe99e56000 F2FS-fs (loop5): invalid crc value F2FS-fs (loop5): invalid crc value F2FS-fs (loop5): Failed to get valid F2FS checkpoint F2FS-fs (loop3): invalid crc value F2FS-fs (loop3): Failed to initialize F2FS segment manager R13: 00007fbe99e56000 R14: 00007fbe9a056000 R15: 00007fbe99e56000 FS: 00007fbe98433700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 audit: type=1804 audit(1636189286.149:533): pid=32289 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir714957059/syzkaller.2iITUX/1295/bus" dev="sda1" ino=15716 res=1 CR2: 0000000020014000 CR3: 000000009e7e6000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 audit: type=1804 audit(1636189286.199:534): pid=32289 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir714957059/syzkaller.2iITUX/1295/bus" dev="sda1" ino=15716 res=1 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: e8 03 80 3c 18 callq 0x183c8008 5: 00 0f add %cl,(%rdi) 7: 85 0f test %ecx,(%rdi) 9: 26 00 00 add %al,%es:(%rax) c: 48 8b 44 24 20 mov 0x20(%rsp),%rax 11: 48 8b 58 40 mov 0x40(%rax),%rbx 15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 1c: fc ff df 1f: 48 8d 7b 50 lea 0x50(%rbx),%rdi 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 dd 25 00 00 jne 0x2611 34: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14 3b: fc ff df 3e: 4c rex.WR 3f: 89 .byte 0x89

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2021/11/06 09:01	linux-4.19.y	3f8a27f9e27b	4c1be0be	.config	console log	report			info		ci2-linux-4-19	general protection fault in unmap_page_range
2021/12/19 12:44	linux-4.19.y	3f8a27f9e27b	44068e19	.config	console log	report			info		ci2-linux-4-19	KASAN: wild-memory-access Write in unmap_page_range

Crashes (2):

Assets (help?)