syzbot


BUG: unable to handle kernel paging request in unmap_page_range

Status: auto-obsoleted due to no activity on 2025/07/11 07:35
First crash: 155d, last: 105d
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel paging request in unmap_page_range 8 1 1796d 1796d 0/1 auto-closed as invalid on 2020/12/23 06:48
upstream BUG: unable to handle kernel paging request in unmap_page_range mm 8 5 2516d 2540d 0/29 closed as invalid on 2018/09/05 12:51
upstream BUG: unable to handle kernel paging request in unmap_page_range (2) mm 8 1 1921d 1917d 0/29 auto-closed as invalid on 2020/07/20 23:14
upstream BUG: Bad page map (5) mm 19 C 35 923d 1181d 22/29 fixed on 2023/02/24 13:50
upstream KASAN: use-after-free Read in unmap_page_range (2) mm 19 C unreliable 4 1345d 1363d 20/29 fixed on 2022/03/08 16:11
linux-4.19 general protection fault in unmap_page_range 23 2 1314d 1357d 0/1 auto-closed as invalid on 2022/04/18 12:45

Sample crash report:
BUG: unable to handle page fault for address: ffffea000f416a48
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 237ff3067 P4D 237ff3067 PUD 237ff2067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 541 Comm: syz.1.44 Not tainted 5.4.290-syzkaller-00002-g41adfeb3d639 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:migration_entry_to_page include/linux/swapops.h:195 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1146 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1222 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1251 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1272 [inline]
RIP: 0010:unmap_page_range+0x1210/0x2620 mm/memory.c:1293
Code: 84 24 f0 00 00 00 42 80 3c 20 00 74 08 4c 89 ef e8 25 55 09 00 48 b8 00 00 00 00 00 ea ff ff 48 01 c3 4c 89 ac 24 f8 00 00 00 <4d> 8b 6d 00 44 89 ee 83 e6 01 31 ff e8 2f 6e d9 ff 41 f6 c5 01 48
RSP: 0018:ffff8881e7997880 EFLAGS: 00010282
RAX: ffffea0000000000 RBX: ffffea000f416a40 RCX: 0000000000000000
RDX: ffff8881e85b6e40 RSI: ffffffff85f4ac10 RDI: f000000000000000
RBP: ffff8881e7997a70 R08: ffffffff818adcd9 R09: ffffed103d0b6dc9
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffea000f416a48 R14: 1ffff1103d05de39 R15: ffffffff85f4ac10
FS:  000055558357f500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea000f416a48 CR3: 00000001e7b94000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 unmap_single_vma mm/memory.c:1338 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1370
 exit_mmap+0x2bc/0x520 mm/mmap.c:3191
 __mmput+0x8e/0x2c0 kernel/fork.c:1101
 exit_mm kernel/exit.c:538 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:848
 do_group_exit+0x138/0x300 kernel/exit.c:984
 __do_sys_exit_group kernel/exit.c:995 [inline]
 __se_sys_exit_group kernel/exit.c:993 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:993
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f41fe1b9169
Code: Bad RIP value.
RSP: 002b:00007ffffd84b778 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f41fe1b9169
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffffd84b7dc R08: 0000001efd84b86f R09: 00000000000927c0
R10: 0000000000000234 R11: 0000000000000246 R12: 0000000000000009
R13: 00000000000927c0 R14: 00000000000090e2 R15: 00007ffffd84b830
Modules linked in:
CR2: ffffea000f416a48
---[ end trace 1af2da23dff050a5 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:migration_entry_to_page include/linux/swapops.h:195 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1146 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1222 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1251 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1272 [inline]
RIP: 0010:unmap_page_range+0x1210/0x2620 mm/memory.c:1293
Code: 84 24 f0 00 00 00 42 80 3c 20 00 74 08 4c 89 ef e8 25 55 09 00 48 b8 00 00 00 00 00 ea ff ff 48 01 c3 4c 89 ac 24 f8 00 00 00 <4d> 8b 6d 00 44 89 ee 83 e6 01 31 ff e8 2f 6e d9 ff 41 f6 c5 01 48
RSP: 0018:ffff8881e7997880 EFLAGS: 00010282
RAX: ffffea0000000000 RBX: ffffea000f416a40 RCX: 0000000000000000
RDX: ffff8881e85b6e40 RSI: ffffffff85f4ac10 RDI: f000000000000000
RBP: ffff8881e7997a70 R08: ffffffff818adcd9 R09: ffffed103d0b6dc9
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffea000f416a48 R14: 1ffff1103d05de39 R15: ffffffff85f4ac10
FS:  000055558357f500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f41fe1b913f CR3: 00000001e7b94000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0:	84 24 f0             	test   %ah,(%rax,%rsi,8)
   3:	00 00                	add    %al,(%rax)
   5:	00 42 80             	add    %al,-0x80(%rdx)
   8:	3c 20                	cmp    $0x20,%al
   a:	00 74 08 4c          	add    %dh,0x4c(%rax,%rcx,1)
   e:	89 ef                	mov    %ebp,%edi
  10:	e8 25 55 09 00       	call   0x9553a
  15:	48 b8 00 00 00 00 00 	movabs $0xffffea0000000000,%rax
  1c:	ea ff ff
  1f:	48 01 c3             	add    %rax,%rbx
  22:	4c 89 ac 24 f8 00 00 	mov    %r13,0xf8(%rsp)
  29:	00
* 2a:	4d 8b 6d 00          	mov    0x0(%r13),%r13 <-- trapping instruction
  2e:	44 89 ee             	mov    %r13d,%esi
  31:	83 e6 01             	and    $0x1,%esi
  34:	31 ff                	xor    %edi,%edi
  36:	e8 2f 6e d9 ff       	call   0xffd96e6a
  3b:	41 f6 c5 01          	test   $0x1,%r13b
  3f:	48                   	rex.W

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/12 07:27 android12-5.4 41adfeb3d639 0bd6db41 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel paging request in unmap_page_range
2025/02/21 05:20 android12-5.4 39762b7a60e9 0808a665 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel paging request in unmap_page_range
* Struck through repros no longer work on HEAD.