ci starts bisection 2022-07-27 14:05:08.284562393 +0000 UTC m=+29935.790378786 bisecting cause commit starting from cb71b93c2dc36d18a8b05245973328d018272cdf building syzkaller on da9d03669ac84e25e303cf11114203051e1454da testing commit cb71b93c2dc36d18a8b05245973328d018272cdf compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 11d8e32c0143119a1a160f4c7c7e7404e803e89a2fe0b7ed8aa0eee907052b29 all runs: crashed: KASAN: use-after-free Read in exit_mmap testing release v5.18 testing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c95b6b3442b9e65d920f024714f8205cb2a85a3304d897a8d7d32ecedd2a24a6 all runs: OK # git bisect start cb71b93c2dc36d18a8b05245973328d018272cdf 4b0986a3613c92f4ec1bdc7f60ec66fea135991f Bisecting: 10621 revisions left to test after this (roughly 13 steps) [9d004b2f4fea97cde123e7f1939b80e77bf2e695] Merge tag 'cxl-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl testing commit 9d004b2f4fea97cde123e7f1939b80e77bf2e695 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6178435ab433f20fab1e372b79dcb83e2c8f75f5f215008ccdb814e24c4e04c7 all runs: OK # git bisect good 9d004b2f4fea97cde123e7f1939b80e77bf2e695 Bisecting: 5301 revisions left to test after this (roughly 12 steps) [b4c48ce837dc0122ed62b423c334b620cf8ff81b] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux.git testing commit b4c48ce837dc0122ed62b423c334b620cf8ff81b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8f9b9598e3112f36ab3040ced9f7bd1b9cc4172946b6f7143f0fd80de895a8e6 all runs: OK # git bisect good b4c48ce837dc0122ed62b423c334b620cf8ff81b Bisecting: 2582 revisions left to test after this (roughly 11 steps) [c2e609e496f8195af2b789511f24a00546bb976e] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git testing commit c2e609e496f8195af2b789511f24a00546bb976e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 1797ea3b86e626356a4abadd9c2d385bb44f57e36324b99fc5fffed0c0271b3e all runs: OK # git bisect good c2e609e496f8195af2b789511f24a00546bb976e Bisecting: 1245 revisions left to test after this (roughly 10 steps) [f38c55f14bf7f4b2abc621e53d4f2ec05693b8d9] Merge branch 'tty-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git testing commit f38c55f14bf7f4b2abc621e53d4f2ec05693b8d9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 28507cb6dea3b697437a78eaa7c77303b4353b4780bb78bf58d6c7465f09f89d all runs: OK # git bisect good f38c55f14bf7f4b2abc621e53d4f2ec05693b8d9 Bisecting: 621 revisions left to test after this (roughly 9 steps) [f0b534a439397a673ea84327da9a89b557417d20] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git testing commit f0b534a439397a673ea84327da9a89b557417d20 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: df4f5f0ef76c8d7cc030110f76b66e39001b00478184c0fae5c6efbdf075c747 all runs: OK # git bisect good f0b534a439397a673ea84327da9a89b557417d20 Bisecting: 307 revisions left to test after this (roughly 8 steps) [ee8804b7b3e6c5f45ddeafa3273f673bd4524110] Merge branch 'mm-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm testing commit ee8804b7b3e6c5f45ddeafa3273f673bd4524110 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a93fb22993c0cb2b77d711acabc7eeac25d55f43fcf27bf2b62b454f80c5c8b5 all runs: OK # git bisect good ee8804b7b3e6c5f45ddeafa3273f673bd4524110 Bisecting: 153 revisions left to test after this (roughly 7 steps) [e6369794355535a6ede873c3633dfc91bf1932b9] mm/damon/schemes: add 'LRU_PRIO' DAMOS action testing commit e6369794355535a6ede873c3633dfc91bf1932b9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 070530c0d96b7316d08147fb65120cb2cd13259526879f18906610330736d1fa all runs: crashed: KASAN: use-after-free Read in exit_mmap # git bisect bad e6369794355535a6ede873c3633dfc91bf1932b9 Bisecting: 76 revisions left to test after this (roughly 6 steps) [e23cb70bcbef5c189790042d1d6d89e33308c386] mm: remove the vma linked list testing commit e23cb70bcbef5c189790042d1d6d89e33308c386 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e603d7dd8abf2d3f736fed3080722288ebb5eb247d6534f7090b26534384ae3a all runs: crashed: KASAN: use-after-free Read in exit_mmap # git bisect bad e23cb70bcbef5c189790042d1d6d89e33308c386 Bisecting: 38 revisions left to test after this (roughly 5 steps) [392e35bc64f10697f255c7ed6548cd5a480f37d0] mm/mmap: reorganize munmap to use maple states testing commit 392e35bc64f10697f255c7ed6548cd5a480f37d0 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 85df3662b024dc38204ae25b92a67b1c0626c4a7fe2d8d3bc6617217165873c9 all runs: OK # git bisect good 392e35bc64f10697f255c7ed6548cd5a480f37d0 Bisecting: 19 revisions left to test after this (roughly 4 steps) [c7c1dd40694ab8d5c547bd45b5a582b332f9d502] perf: use VMA iterator testing commit c7c1dd40694ab8d5c547bd45b5a582b332f9d502 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 31390ae9514be8c3279971c5347c65e55af7ccb4eac0022c28fe2f0598a484c3 all runs: OK # git bisect good c7c1dd40694ab8d5c547bd45b5a582b332f9d502 Bisecting: 9 revisions left to test after this (roughly 3 steps) [98d178da90346dbb56c1aecc40be05d85b0a62a8] mm/mlock: use vma iterator and maple state instead of vma linked list testing commit 98d178da90346dbb56c1aecc40be05d85b0a62a8 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 15f4dc7bdec9827332ad6b0acdae7ea991f98bf80c9eb8f30d88a9282db27f7c run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 98d178da90346dbb56c1aecc40be05d85b0a62a8 Bisecting: 4 revisions left to test after this (roughly 2 steps) [62f893983ecd293fdd750c0aa0661311cb624439] mm/pagewalk: use vma_find() instead of vma linked list testing commit 62f893983ecd293fdd750c0aa0661311cb624439 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 935878fea9aaa6bbba23cc6839a778f0e01ad47ab1e451eb49e12751429e27e5 all runs: OK # git bisect good 62f893983ecd293fdd750c0aa0661311cb624439 Bisecting: 2 revisions left to test after this (roughly 1 step) [fba1bf8a56c518af8d526b49df5a717062ab3450] i915: use the VMA iterator testing commit fba1bf8a56c518af8d526b49df5a717062ab3450 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: dde78ec53dd23f9adb2f03f273a82eb12f0f26a8d276ec27cff18f6ce81ac8f3 all runs: OK # git bisect good fba1bf8a56c518af8d526b49df5a717062ab3450 Bisecting: 0 revisions left to test after this (roughly 1 step) [e2d28ff7f811afb7f4837780e2ada65bc2d6df16] riscv: use vma iterator for vdso testing commit e2d28ff7f811afb7f4837780e2ada65bc2d6df16 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b06116828c51251e63acbf109627ac0ffd6c1d944f4f1676146dfe4187a60092 all runs: OK # git bisect good e2d28ff7f811afb7f4837780e2ada65bc2d6df16 e23cb70bcbef5c189790042d1d6d89e33308c386 is the first bad commit commit e23cb70bcbef5c189790042d1d6d89e33308c386 Author: Liam R. Howlett Date: Tue Jun 21 20:47:14 2022 +0000 mm: remove the vma linked list Replace any vm_next use with vma_find(). Update free_pgtables(), unmap_vmas(), and zap_page_range() to use the maple tree. Use the new free_pgtables() and unmap_vmas() in do_mas_align_munmap(). At the same time, alter the loop to be more compact. Now that free_pgtables() and unmap_vmas() take a maple tree as an argument, rearrange do_mas_align_munmap() to use the new tree to hold the vmas to remove. Remove __vma_link_list() and __vma_unlink_list() as they are exclusively used to update the linked list Drop linked list update from __insert_vm_struct(). Rework validation of tree as it was depending on the linked list. Link: https://lkml.kernel.org/r/20220504011345.662299-52-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20220513141548.2019143-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20220621204632.3370049-68-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Catalin Marinas Cc: David Howells Cc: "Matthew Wilcox (Oracle)" Cc: SeongJae Park Cc: Vlastimil Babka Cc: Will Deacon Cc: Davidlohr Bueso Cc: Hulk Robot Cc: Yang Yingliang Signed-off-by: Andrew Morton include/linux/mm.h | 5 +- include/linux/mm_types.h | 4 - kernel/fork.c | 19 +- mm/debug.c | 14 +- mm/internal.h | 8 +- mm/memory.c | 33 +++- mm/mmap.c | 447 ++++++++++++++++++++--------------------------- mm/nommu.c | 6 - mm/util.c | 40 ----- 9 files changed, 229 insertions(+), 347 deletions(-) culprit signature: e603d7dd8abf2d3f736fed3080722288ebb5eb247d6534f7090b26534384ae3a parent signature: b06116828c51251e63acbf109627ac0ffd6c1d944f4f1676146dfe4187a60092 revisions tested: 16, total time: 3h56m25.440291804s (build: 1h51m35.275663544s, test: 2h2m58.280770155s) first bad commit: e23cb70bcbef5c189790042d1d6d89e33308c386 mm: remove the vma linked list recipients (to): ["akpm@linux-foundation.org" "akpm@linux-foundation.org" "liam.howlett@oracle.com" "linux-mm@kvack.org"] recipients (cc): ["arnd@arndb.de" "bigeasy@linutronix.de" "ccross@google.com" "david@redhat.com" "ebiederm@xmission.com" "linux-kernel@vger.kernel.org" "tglx@linutronix.de" "vbabka@suse.cz" "willy@infradead.org"] crash: KASAN: use-after-free Read in exit_mmap ================================================================== BUG: KASAN: use-after-free in exit_mmap+0x517/0x590 mm/mmap.c:3269 Read of size 8 at addr ffff88801b4b3530 by task syz-executor.0/4089 CPU: 1 PID: 4089 Comm: syz-executor.0 Not tainted 5.19.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 exit_mmap+0x517/0x590 mm/mmap.c:3269 __mmput+0xf3/0x440 kernel/fork.c:1180 exit_mm kernel/exit.c:510 [inline] do_exit+0x8ef/0x2480 kernel/exit.c:782 do_group_exit+0xb2/0x2a0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x35/0x40 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f5da1089209 Code: Unable to access opcode bytes at RIP 0x7f5da10891df. RSP: 002b:00007ffe9bec6bb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5da1089209 RDX: 00007f5da103be4b RSI: ffffffffffffffb8 RDI: 0000000000000000 RBP: 0000000000000000 R08: 00007f5da11a02e0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffe9bec6ca0 Allocated by task 4070: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:750 [inline] slab_alloc_node mm/slub.c:3243 [inline] slab_alloc mm/slub.c:3251 [inline] __kmem_cache_alloc_lru mm/slub.c:3258 [inline] kmem_cache_alloc+0x204/0x3b0 mm/slub.c:3268 vm_area_dup+0x7c/0x310 kernel/fork.c:466 dup_mmap+0x525/0xdf0 kernel/fork.c:640 dup_mm+0x83/0x340 kernel/fork.c:1520 copy_mm kernel/fork.c:1569 [inline] copy_process+0x3482/0x6670 kernel/fork.c:2233 kernel_clone+0xb8/0x7f0 kernel/fork.c:2648 __do_sys_clone+0xa1/0xe0 kernel/fork.c:2782 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 4089: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1754 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780 slab_free mm/slub.c:3536 [inline] kmem_cache_free+0xdd/0x5a0 mm/slub.c:3553 exit_mmap+0x22e/0x590 mm/mmap.c:3271 __mmput+0xf3/0x440 kernel/fork.c:1180 exit_mm kernel/exit.c:510 [inline] do_exit+0x8ef/0x2480 kernel/exit.c:782 do_group_exit+0xb2/0x2a0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x35/0x40 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff88801b4b3510 which belongs to the cache vm_area_struct of size 152 The buggy address is located 32 bytes inside of 152-byte region [ffff88801b4b3510, ffff88801b4b35a8) The buggy address belongs to the physical page: page:ffffea00006d2cc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b4b3 memcg:ffff888020199901 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0001cd4700 dead000000000002 ffff888140006b40 raw: 0000000000000000 0000000000120012 00000001ffffffff ffff888020199901 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 3813, tgid 3813 (dhcpcd-run-hook), ts 54517551010, free_ts 54491234758 prep_new_page mm/page_alloc.c:2456 [inline] get_page_from_freelist+0x19d2/0x3b30 mm/page_alloc.c:4198 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5415 alloc_slab_page mm/slub.c:1824 [inline] allocate_slab+0x26c/0x3c0 mm/slub.c:1969 new_slab mm/slub.c:2029 [inline] ___slab_alloc+0x9bc/0xe10 mm/slub.c:3031 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118 slab_alloc_node mm/slub.c:3209 [inline] slab_alloc mm/slub.c:3251 [inline] __kmem_cache_alloc_lru mm/slub.c:3258 [inline] kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3268 vm_area_dup+0x7c/0x310 kernel/fork.c:466 dup_mmap+0x525/0xdf0 kernel/fork.c:640 dup_mm+0x83/0x340 kernel/fork.c:1520 copy_mm kernel/fork.c:1569 [inline] copy_process+0x3482/0x6670 kernel/fork.c:2233 kernel_clone+0xb8/0x7f0 kernel/fork.c:2648 __do_sys_clone+0xa1/0xe0 kernel/fork.c:2782 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1371 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421 free_unref_page_prepare mm/page_alloc.c:3343 [inline] free_unref_page_list+0x16f/0xf80 mm/page_alloc.c:3475 release_pages+0x6f1/0x1780 mm/swap.c:980 tlb_batch_pages_flush+0x85/0x160 mm/mmu_gather.c:58 tlb_flush_mmu_free mm/mmu_gather.c:255 [inline] tlb_flush_mmu mm/mmu_gather.c:262 [inline] tlb_finish_mmu+0x110/0x6c0 mm/mmu_gather.c:353 exit_mmap+0x1d0/0x590 mm/mmap.c:3261 __mmput+0xf3/0x440 kernel/fork.c:1180 exit_mm kernel/exit.c:510 [inline] do_exit+0x8ef/0x2480 kernel/exit.c:782 do_group_exit+0xb2/0x2a0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x35/0x40 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Memory state around the buggy address: ffff88801b4b3400: fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 ffff88801b4b3480: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc >ffff88801b4b3500: fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801b4b3580: fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb ffff88801b4b3600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================