bisecting cause commit starting from c99b17ac03994525092fd66bed14b4a0c82f0b4d building syzkaller on c88c7b75a4e022b758f4b0f1bf3db8ebb2fb25e6 testing commit c99b17ac03994525092fd66bed14b4a0c82f0b4d with gcc (GCC) 8.1.0 kernel signature: f54df6b35f1ba5825156d3aac78db86051c9f55d1c587cd44bed3e9f41fdeb43 all runs: crashed: KASAN: slab-out-of-bounds Read in cgroup_file_notify testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.1.0 kernel signature: 0c12ffce272de84b33e4588d46fe6e99af37193e18b39402633bec9841eff898 all runs: OK # git bisect start c99b17ac03994525092fd66bed14b4a0c82f0b4d d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 Bisecting: 8306 revisions left to test after this (roughly 13 steps) [9357fd4b0167404f28e21d263c7c4806a1d757be] gfs2: leaf_dealloc needs to allocate one more revoke testing commit 9357fd4b0167404f28e21d263c7c4806a1d757be with gcc (GCC) 8.1.0 kernel signature: ab559e073f25060263a613f2f88cb5f33331532dd1ec24f1fed66e21fb74ac8a all runs: OK # git bisect good 9357fd4b0167404f28e21d263c7c4806a1d757be Bisecting: 4153 revisions left to test after this (roughly 12 steps) [98cb3b4f410426b1d69cebbc8c96031d4210f005] btrfs: sysfs, use btrfs_sysfs_remove_fsid to celanup errors in add_fsid testing commit 98cb3b4f410426b1d69cebbc8c96031d4210f005 with gcc (GCC) 8.1.0 kernel signature: 6256ece1b97d2140c275eb48e3216d19625731552cf2c0cd4ffe1b076c4f83b0 all runs: OK # git bisect good 98cb3b4f410426b1d69cebbc8c96031d4210f005 Bisecting: 2090 revisions left to test after this (roughly 11 steps) [3170c92cf93b807dfb7018788e6c23750864fe23] Merge remote-tracking branch 'crypto/master' testing commit 3170c92cf93b807dfb7018788e6c23750864fe23 with gcc (GCC) 8.1.0 kernel signature: b4602edb3bdae3b81fd243b04fc48167b09ad29f2e13e0b9014cca37c23ba5c5 all runs: OK # git bisect good 3170c92cf93b807dfb7018788e6c23750864fe23 Bisecting: 1046 revisions left to test after this (roughly 10 steps) [3dc5f5d4f325e149c162275322cdc3ef29c69e9c] Merge remote-tracking branch 'selinux/next' testing commit 3dc5f5d4f325e149c162275322cdc3ef29c69e9c with gcc (GCC) 8.1.0 kernel signature: 5d69d75dce23e9f8a50a5636f2af17842c5ec1342549d69d0ebebb61231c094b all runs: OK # git bisect good 3dc5f5d4f325e149c162275322cdc3ef29c69e9c Bisecting: 521 revisions left to test after this (roughly 9 steps) [71290d2ac63eb1b29a6a350f67fe81a87954bcaf] Merge remote-tracking branch 'tty/tty-next' testing commit 71290d2ac63eb1b29a6a350f67fe81a87954bcaf with gcc (GCC) 8.1.0 kernel signature: 55a0d73d606a65da6f63c0bbe2650683baee5d351409f9fe5cb6cad0619772e3 all runs: OK # git bisect good 71290d2ac63eb1b29a6a350f67fe81a87954bcaf Bisecting: 261 revisions left to test after this (roughly 8 steps) [89342750bbc6e48bc43ad64748899b61c5db0584] Merge remote-tracking branch 'gpio-brgl/gpio/for-next' testing commit 89342750bbc6e48bc43ad64748899b61c5db0584 with gcc (GCC) 8.1.0 kernel signature: 0f2393be69311f8464f092a366d8124188f9b0dbaeb856ea91827f94775f762a all runs: OK # git bisect good 89342750bbc6e48bc43ad64748899b61c5db0584 Bisecting: 137 revisions left to test after this (roughly 7 steps) [f8740ac91f9f79259ba8b433082aac38e06de94c] init/Kconfig: clean up ANON_INODES and old IO schedulers options testing commit f8740ac91f9f79259ba8b433082aac38e06de94c with gcc (GCC) 8.1.0 kernel signature: 7f4bc31f308ff5dcb8ede1b8e6286ad8c85cb93fac0fde936c5b6f5afa25029b all runs: crashed: KASAN: slab-out-of-bounds Read in cgroup_file_notify # git bisect bad f8740ac91f9f79259ba8b433082aac38e06de94c Bisecting: 61 revisions left to test after this (roughly 6 steps) [61fee460b8dbb5c0439bdb6ac81a93bf6cbb0467] mm/hugetlb_cgroup: fix hugetlb_cgroup migration testing commit 61fee460b8dbb5c0439bdb6ac81a93bf6cbb0467 with gcc (GCC) 8.1.0 kernel signature: 8eefbbf0377589d9ef7443e220d3cf6b08de78d19833f1d130ba702fd5c67959 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: boot failed: can't ssh into the instance # git bisect good 61fee460b8dbb5c0439bdb6ac81a93bf6cbb0467 Bisecting: 30 revisions left to test after this (roughly 5 steps) [905c004584abe4c734910e67bc2871fd7e1e161f] drivers/base/memory.c: drop pages_correctly_probed() testing commit 905c004584abe4c734910e67bc2871fd7e1e161f with gcc (GCC) 8.1.0 kernel signature: 931c8e5131075ea84c911c0df0d8cacd22b8053d5aac2f472a8ca2fb3cef82f2 all runs: crashed: KASAN: slab-out-of-bounds Read in cgroup_file_notify # git bisect bad 905c004584abe4c734910e67bc2871fd7e1e161f Bisecting: 15 revisions left to test after this (roughly 4 steps) [c2225d79cfea57790fdb78199358f7751eb229ce] mm/migrate.c: unify "not queued for migration" handling in do_pages_move() testing commit c2225d79cfea57790fdb78199358f7751eb229ce with gcc (GCC) 8.1.0 kernel signature: 8dd49ffcfdfc753a0ee0f72b4640f5b1b1a3b51e4a2bcf3dec9b2a8927d1b1b8 all runs: crashed: KASAN: slab-out-of-bounds Read in cgroup_file_notify # git bisect bad c2225d79cfea57790fdb78199358f7751eb229ce Bisecting: 7 revisions left to test after this (roughly 3 steps) [86c9fc7069a5256ec54ae73459f06dd241a0ce1d] hugetlb_cgroup: support noreserve mappings testing commit 86c9fc7069a5256ec54ae73459f06dd241a0ce1d with gcc (GCC) 8.1.0 kernel signature: f30b29f34b5e8d97a4cf9cde6da6820bf13d55d5e9a11b8940ae63ce2fdf0b11 all runs: crashed: KASAN: slab-out-of-bounds Read in cgroup_file_notify # git bisect bad 86c9fc7069a5256ec54ae73459f06dd241a0ce1d Bisecting: 3 revisions left to test after this (roughly 2 steps) [e13cef0bb6330956ff88834b3d27973c75ad3d54] hugetlb: disable region_add file_region coalescing testing commit e13cef0bb6330956ff88834b3d27973c75ad3d54 with gcc (GCC) 8.1.0 kernel signature: eca64f908552e4b17b6de10a8a8ce23b4f505ce6be739ed7efe0e8bab036577e all runs: OK # git bisect good e13cef0bb6330956ff88834b3d27973c75ad3d54 Bisecting: 1 revision left to test after this (roughly 1 step) [6863de00e5400b534cd4e3869ffbc8f94da41dfc] hugetlb_cgroup: add accounting for shared mappings testing commit 6863de00e5400b534cd4e3869ffbc8f94da41dfc with gcc (GCC) 8.1.0 kernel signature: 758f70d8e523151e6c2ca290ed9f6111b6a556601b86380aba48a398b617dfd0 all runs: crashed: KASAN: slab-out-of-bounds Read in cgroup_file_notify # git bisect bad 6863de00e5400b534cd4e3869ffbc8f94da41dfc Bisecting: 0 revisions left to test after this (roughly 0 steps) [e835a56c1b240d6e03648cd6d23d55a903538310] mm/hugetlb: Fix file_region entry allocations testing commit e835a56c1b240d6e03648cd6d23d55a903538310 with gcc (GCC) 8.1.0 kernel signature: afa87c2d0f32876f167318842841e3a2d13755005e1ab15a20594cbb80bfb18f all runs: OK # git bisect good e835a56c1b240d6e03648cd6d23d55a903538310 6863de00e5400b534cd4e3869ffbc8f94da41dfc is the first bad commit commit 6863de00e5400b534cd4e3869ffbc8f94da41dfc Author: Mina Almasry Date: Thu Feb 20 14:55:30 2020 +1100 hugetlb_cgroup: add accounting for shared mappings For shared mappings, the pointer to the hugetlb_cgroup to uncharge lives in the resv_map entries, in file_region->reservation_counter. After a call to region_chg, we charge the approprate hugetlb_cgroup, and if successful, we pass on the hugetlb_cgroup info to a follow up region_add call. When a file_region entry is added to the resv_map via region_add, we put the pointer to that cgroup in file_region->reservation_counter. If charging doesn't succeed, we report the error to the caller, so that the kernel fails the reservation. On region_del, which is when the hugetlb memory is unreserved, we also uncharge the file_region->reservation_counter. Link: http://lkml.kernel.org/r/20200211213128.73302-5-almasrymina@google.com Signed-off-by: Mina Almasry Cc: David Rientjes Cc: Greg Thelen Cc: Mike Kravetz Cc: Sandipan Das Cc: Shakeel Butt Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Stephen Rothwell include/linux/hugetlb.h | 35 ++++++++++ include/linux/hugetlb_cgroup.h | 10 +++ mm/hugetlb.c | 148 ++++++++++++++++++++++++++--------------- mm/hugetlb_cgroup.c | 15 +++++ 4 files changed, 154 insertions(+), 54 deletions(-) culprit signature: 758f70d8e523151e6c2ca290ed9f6111b6a556601b86380aba48a398b617dfd0 parent signature: afa87c2d0f32876f167318842841e3a2d13755005e1ab15a20594cbb80bfb18f revisions tested: 16, total time: 3h57m47.716564558s (build: 1h46m53.383610046s, test: 2h9m39.752489225s) first bad commit: 6863de00e5400b534cd4e3869ffbc8f94da41dfc hugetlb_cgroup: add accounting for shared mappings cc: ["akpm@linux-foundation.org" "almasrymina@google.com" "sfr@canb.auug.org.au"] crash: KASAN: slab-out-of-bounds Read in cgroup_file_notify ================================================================== BUG: KASAN: slab-out-of-bounds in cgroup_file_notify+0x11b/0x160 kernel/cgroup/cgroup.c:4088 Read of size 8 at addr ffff88808f65f4c8 by task syz-executor.1/8396 CPU: 0 PID: 8396 Comm: syz-executor.1 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x12d/0x187 lib/dump_stack.c:118 print_address_description.constprop.8.cold.10+0x9/0x31d mm/kasan/report.c:374 __kasan_report.cold.11+0x1b/0x32 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 cgroup_file_notify+0x11b/0x160 kernel/cgroup/cgroup.c:4088 hugetlb_event mm/hugetlb_cgroup.c:224 [inline] __hugetlb_cgroup_charge_cgroup+0x487/0xa70 mm/hugetlb_cgroup.c:262 hugetlb_cgroup_charge_cgroup_rsvd+0xe/0x10 mm/hugetlb_cgroup.c:286 hugetlb_reserve_pages+0x24b/0xb00 mm/hugetlb.c:4779 hugetlb_file_setup+0x22d/0x5a2 fs/hugetlbfs/inode.c:1423 newseg+0x392/0xd90 ipc/shm.c:652 ipcget_new ipc/util.c:344 [inline] ipcget+0xf6/0xb10 ipc/util.c:643 ksys_shmget ipc/shm.c:742 [inline] __do_sys_shmget ipc/shm.c:747 [inline] __se_sys_shmget ipc/shm.c:745 [inline] __x64_sys_shmget+0x13b/0x1c0 ipc/shm.c:745 do_syscall_64+0xca/0x5f0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c479 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f19780cdc78 EFLAGS: 00000246 ORIG_RAX: 000000000000001d RAX: ffffffffffffffda RBX: 00007f19780ce6d4 RCX: 000000000045c479 RDX: 0000000000004800 RSI: fffffffffeffffff RDI: 0000000000000000 RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020ffc000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000b5a R14: 00000000004cd4ef R15: 000000000076bf2c Allocated by task 8358: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc.constprop.17+0xc7/0xd0 mm/kasan/common.c:515 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 kmem_cache_alloc_trace+0x15b/0x780 mm/slab.c:3551 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] hugetlb_cgroup_css_alloc+0x51/0x2d0 mm/hugetlb_cgroup.c:138 css_create kernel/cgroup/cgroup.c:5093 [inline] cgroup_apply_control_enable+0x334/0xbc0 kernel/cgroup/cgroup.c:3057 cgroup_mkdir+0x4bd/0xef0 kernel/cgroup/cgroup.c:5323 kernfs_iop_mkdir+0x13a/0x1c0 fs/kernfs/dir.c:1127 vfs_mkdir+0x37f/0x5f0 fs/namei.c:3889 do_mkdirat+0x1c2/0x220 fs/namei.c:3912 __do_sys_mkdir fs/namei.c:3928 [inline] __se_sys_mkdir fs/namei.c:3926 [inline] __x64_sys_mkdir+0x57/0x80 fs/namei.c:3926 do_syscall_64+0xca/0x5f0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff88808f65f000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1224 bytes inside of 2048-byte region [ffff88808f65f000, ffff88808f65f800) The buggy address belongs to the page: page:ffffea00023d97c0 refcount:1 mapcount:0 mapping:0000000097cd2b7e index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00027f2d88 ffffea00023abd48 ffff8880aa400e00 raw: 0000000000000000 ffff88808f65f000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808f65f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88808f65f400: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc >ffff88808f65f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88808f65f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808f65f580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================