From: syzbot <syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] BUG: Bad page map (8)
Date: Fri, 19 Jul 2024 06:14:02 -0700 [thread overview]
Message-ID: <0000000000001fa07f061d997826@google.com> (raw)
In-Reply-To: <20240719130043.1621-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: Bad page cache in process syz.NUM.NUM pfn:4a961
BUG: Bad page cache in process syz.0.15 pfn:4a961
page: refcount:4 mapcount:1 mapping:000000007efdb730 index:0x0 pfn:0x4a961
memcg:f8f00000073c6000
aops:shmem_aops ino:401
flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002d ffffc1ffc01bf9c8 ffffc1ffc038adc8 f0f00000061e6ab0
raw: 0000000000000000 0000000000000000 0000000400000000 f8f00000073c6000
page dumped because: still mapped when deleted
CPU: 1 PID: 3851 Comm: syz.0.15 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b-dirty #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
__filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
truncate_inode_folio+0x30/0x4c mm/truncate.c:195
shmem_undo_range+0x208/0x620 mm/shmem.c:1012
shmem_truncate_range mm/shmem.c:1125 [inline]
shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
evict+0xb4/0x198 fs/inode.c:667
iput_final fs/inode.c:1741 [inline]
iput fs/inode.c:1767 [inline]
iput+0x100/0x1b8 fs/inode.c:1753
dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
__dentry_kill+0x7c/0x1d4 fs/dcache.c:607
dput.part.0+0x30/0xbc fs/dcache.c:849
dput+0x4c/0x50 fs/dcache.c:860
__fput+0x110/0x2d4 fs/file_table.c:430
____fput+0x10/0x1c fs/file_table.c:450
task_work_run+0x78/0xd0 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
do_notify_resume+0x134/0x164 arch/arm64/kernel/entry-common.c:151
exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]
el0_svc+0xc8/0xf8 arch/arm64/kernel/entry-common.c:713
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
BUG: Bad page cache in process syz.0.15 pfn:4e2b7
page: refcount:4 mapcount:1 mapping:000000007efdb730 index:0x1 pfn:0x4e2b7
memcg:f8f00000073c6000
aops:shmem_aops ino:401
flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002d ffffc1ffc02a5848 ffffc1ffc02d1a88 f0f00000061e6ab0
raw: 0000000000000001 0000000000000000 0000000400000000 f8f00000073c6000
page dumped because: still mapped when deleted
CPU: 1 PID: 3851 Comm: syz.0.15 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b-dirty #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
__filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
truncate_inode_folio+0x30/0x4c mm/truncate.c:195
shmem_undo_range+0x208/0x620 mm/shmem.c:1012
shmem_truncate_range mm/shmem.c:1125 [inline]
shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
evict+0xb4/0x198 fs/inode.c:667
iput_final fs/inode.c:1741 [inline]
iput fs/inode.c:1767 [inline]
iput+0x100/0x1b8 fs/inode.c:1753
dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
__dentry_kill+0x7c/0x1d4 fs/dcache.c:607
dput.part.0+0x30/0xbc fs/dcache.c:849
dput+0x4c/0x50 fs/dcache.c:860
__fput+0x110/0x2d4 fs/file_table.c:430
____fput+0x10/0x1c fs/file_table.c:450
task_work_run+0x78/0xd0 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
do_notify_resume+0x134/0x164 arch/arm64/kernel/entry-common.c:151
exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]
el0_svc+0xc8/0xf8 arch/arm64/kernel/entry-common.c:713
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Tested on:
commit: 4d145e3f Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=14caa0ad980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=10541fe1980000
next prev parent reply other threads:[~2024-07-19 13:14 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-18 22:51 [syzbot] [mm?] BUG: Bad page map (8) syzbot
2024-07-19 11:07 ` Hillf Danton
2024-07-19 11:44 ` syzbot
2024-07-19 11:21 ` David Hildenbrand
2024-07-20 5:02 ` Hillf Danton
2024-07-20 6:30 ` Kasireddy, Vivek
2024-07-22 13:23 ` David Hildenbrand
2024-07-19 13:00 ` Hillf Danton
2024-07-19 13:14 ` syzbot [this message]
2024-07-19 23:08 ` Hillf Danton
2024-07-19 23:21 ` syzbot
2024-07-20 6:32 ` Kasireddy, Vivek
2024-07-20 7:01 ` syzbot
2024-07-23 10:37 ` Hillf Danton
2024-07-23 10:52 ` syzbot
2024-09-30 0:02 ` syzbot
2024-09-30 13:52 ` Matthew Wilcox
2024-12-27 17:02 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000001fa07f061d997826@google.com \
--to=syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.