* [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
@ 2025-03-02 17:15 syzbot
2025-03-04 1:38 ` Edward Adam Davis
` (11 more replies)
0 siblings, 12 replies; 25+ messages in thread
From: syzbot @ 2025-03-02 17:15 UTC (permalink / raw)
To: akpm, chandan.babu, linux-kernel, linux-mm, linux-xfs,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: e056da87c780 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1206ba97980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=126168b7980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=122265a8580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3d8b1b7cc4c0/disk-e056da87.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b84c04cff235/vmlinux-e056da87.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2ae4d0525881/Image-e056da87.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9d88fc8b2cfc/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=12f4cfb8580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f9f411152c9539f4e59@syzkaller.appspotmail.com
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
=====================================
WARNING: bad unlock balance detected!
6.14.0-rc4-syzkaller-ge056da87c780 #0 Not tainted
-------------------------------------
syz-executor109/6436 is trying to release lock (&mm->mmap_lock) at:
[<ffff800080a63c54>] mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
[<ffff800080a63c54>] __mm_populate+0x328/0x3d8 mm/gup.c:2044
but there are no more locks to release!
other info that might help us debug this:
no locks held by syz-executor109/6436.
stack backtrace:
CPU: 1 UID: 0 PID: 6436 Comm: syz-executor109 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_unlock_imbalance_bug+0x254/0x2ac kernel/locking/lockdep.c:5289
__lock_release kernel/locking/lockdep.c:5518 [inline]
lock_release+0x410/0x9e4 kernel/locking/lockdep.c:5872
up_read+0x24/0x3c kernel/locking/rwsem.c:1619
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x328/0x3d8 mm/gup.c:2044
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffffffffffff00, magic = 0xffff0000d86e4de0, owner = 0x1, curr 0xffff0000c69a0000, list empty
WARNING: CPU: 1 PID: 6436 at kernel/locking/rwsem.c:1346 __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
Modules linked in:
CPU: 1 UID: 0 PID: 6436 Comm: syz-executor109 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
lr : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
sp : ffff80009cdd79e0
x29: ffff80009cdd7a60 x28: 1ffff00011f780cb x27: ffff80008fbc0000
x26: dfff800000000000 x25: ffffffffffffff00 x24: ffff0000d86e4e38
x23: ffff0000d86e4de0 x22: ffffffffffffff00 x21: 0000000000000001
x20: ffff0000c69a0000 x19: ffff0000d86e4de0 x18: 0000000000000008
x17: 0000000000000000 x16: ffff8000832b5180 x15: 0000000000000001
x14: 1ffff000139bae94 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000003 x10: 0000000000ff0100 x9 : aaeea068a75a4000
x8 : aaeea068a75a4000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009cdd7198 x4 : ffff80008fcaf780 x3 : ffff800083247194
x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000000
Call trace:
__up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346 (P)
up_read+0x2c/0x3c kernel/locking/rwsem.c:1620
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x328/0x3d8 mm/gup.c:2044
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
irq event stamp: 64843
hardirqs last enabled at (64843): [<ffff80008b7e75f8>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (64843): [<ffff80008b7e75f8>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (64842): [<ffff80008b7e7428>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (64842): [<ffff80008b7e7428>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162
softirqs last enabled at (64286): [<ffff8000801283e0>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (64284): [<ffff8000801283ac>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
@ 2025-03-04 1:38 ` Edward Adam Davis
2025-03-04 1:54 ` syzbot
2025-03-04 2:01 ` Edward Adam Davis
` (10 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-04 1:38 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..4caa7c635320 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1998,7 +1998,11 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
struct vm_area_struct *vma = NULL;
int locked = 0;
long ret = 0;
+ static poping = 0;
+ if (poping)
+ return 0;
+ poping = 1;
end = start + len;
for (nstart = start; nstart < end; nstart = nend) {
@@ -2042,6 +2046,7 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
}
if (locked)
mmap_read_unlock(mm);
+ poping = 0;
return ret; /* 0 or negative error code */
}
#else /* CONFIG_MMU */
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-04 1:38 ` Edward Adam Davis
@ 2025-03-04 1:54 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-04 1:54 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
mm/gup.c:2001:9: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Werror,-Wimplicit-int]
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=15f8e464580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
2025-03-04 1:38 ` Edward Adam Davis
@ 2025-03-04 2:01 ` Edward Adam Davis
2025-03-04 2:22 ` syzbot
2025-03-04 12:25 ` Edward Adam Davis
` (9 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-04 2:01 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..4caa7c635320 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1998,7 +1998,11 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
struct vm_area_struct *vma = NULL;
int locked = 0;
long ret = 0;
+ static char poping = 0;
+ if (poping)
+ return 0;
+ poping = 1;
end = start + len;
for (nstart = start; nstart < end; nstart = nend) {
@@ -2042,6 +2046,7 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
}
if (locked)
mmap_read_unlock(mm);
+ poping = 0;
return ret; /* 0 or negative error code */
}
#else /* CONFIG_MMU */
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-04 2:01 ` Edward Adam Davis
@ 2025-03-04 2:22 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-04 2:22 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: bad unlock balance in __mm_populate
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
=====================================
WARNING: bad unlock balance detected!
6.14.0-rc4-syzkaller-ge056da87c780-dirty #0 Not tainted
-------------------------------------
syz.0.16/7412 is trying to release lock (&mm->mmap_lock) at:
[<ffff800080a63c80>] mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
[<ffff800080a63c80>] __mm_populate+0x354/0x408 mm/gup.c:2048
but there are no more locks to release!
other info that might help us debug this:
no locks held by syz.0.16/7412.
stack backtrace:
CPU: 0 UID: 0 PID: 7412 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_unlock_imbalance_bug+0x254/0x2ac kernel/locking/lockdep.c:5289
__lock_release kernel/locking/lockdep.c:5518 [inline]
lock_release+0x410/0x9e4 kernel/locking/lockdep.c:5872
up_read+0x24/0x3c kernel/locking/rwsem.c:1619
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x354/0x408 mm/gup.c:2048
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffffffffffff00, magic = 0xffff0000d520abe0, owner = 0x1, curr 0xffff0000c9001e80, list empty
WARNING: CPU: 0 PID: 7412 at kernel/locking/rwsem.c:1346 __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
Modules linked in:
CPU: 0 UID: 0 PID: 7412 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
lr : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
sp : ffff80009c0c79e0
x29: ffff80009c0c7a60 x28: 1ffff00011f780cb x27: ffff80008fbc0000
x26: dfff800000000000 x25: ffffffffffffff00 x24: ffff0000d520ac38
x23: ffff0000d520abe0 x22: ffffffffffffff00 x21: 0000000000000001
x20: ffff0000c9001e80 x19: ffff0000d520abe0 x18: 0000000000000008
x17: 0000000000000000 x16: ffff8000832b81a0 x15: 0000000000000001
x14: 1ffff00013818e94 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000003 x10: 0000000000ff0100 x9 : bdbc827636499100
x8 : bdbc827636499100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009c0c7198 x4 : ffff80008fcaf780 x3 : ffff80008324a1b4
x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000000
Call trace:
__up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346 (P)
up_read+0x2c/0x3c kernel/locking/rwsem.c:1620
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x354/0x408 mm/gup.c:2048
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
irq event stamp: 74469
hardirqs last enabled at (74469): [<ffff80008b7e85f8>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (74469): [<ffff80008b7e85f8>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (74468): [<ffff80008b7e8428>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (74468): [<ffff80008b7e8428>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162
softirqs last enabled at (74288): [<ffff8000801283e0>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (74286): [<ffff8000801283ac>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=125fafb8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=13a598b7980000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
2025-03-04 1:38 ` Edward Adam Davis
2025-03-04 2:01 ` Edward Adam Davis
@ 2025-03-04 12:25 ` Edward Adam Davis
2025-03-04 13:19 ` syzbot
2025-03-04 14:33 ` Edward Adam Davis
` (8 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-04 12:25 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..290fcdb760a1 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2030,6 +2030,7 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* if the vma was already munlocked.
*/
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, mmap lock held: %d, locked: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), locked, __func__);
if (ret < 0) {
if (ignore_errors) {
ret = 0;
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-04 12:25 ` Edward Adam Davis
@ 2025-03-04 13:19 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-04 13:19 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: bad unlock balance in __mm_populate
XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
mm: 000000001ba89fe1, mmap lock held: 0, locked: 1, __mm_populate
=====================================
WARNING: bad unlock balance detected!
6.14.0-rc4-syzkaller-00034-ge056da87c780-dirty #0 Not tainted
-------------------------------------
syz.0.16/7463 is trying to release lock (&mm->mmap_lock) at:
[<ffff800080a63ca4>] mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
[<ffff800080a63ca4>] __mm_populate+0x378/0x42c mm/gup.c:2045
but there are no more locks to release!
other info that might help us debug this:
no locks held by syz.0.16/7463.
stack backtrace:
CPU: 1 UID: 0 PID: 7463 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-00034-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_unlock_imbalance_bug+0x254/0x2ac kernel/locking/lockdep.c:5289
__lock_release kernel/locking/lockdep.c:5518 [inline]
lock_release+0x410/0x9e4 kernel/locking/lockdep.c:5872
up_read+0x24/0x3c kernel/locking/rwsem.c:1619
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x378/0x42c mm/gup.c:2045
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffffffffffff00, magic = 0xffff0000d584dee0, owner = 0x1, curr 0xffff0000c4da5b80, list empty
WARNING: CPU: 1 PID: 7463 at kernel/locking/rwsem.c:1346 __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
Modules linked in:
CPU: 1 UID: 0 PID: 7463 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-00034-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
lr : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
sp : ffff80009e0979e0
x29: ffff80009e097a60 x28: 1ffff00011f760cb x27: ffff80008fbb0000
x26: dfff800000000000 x25: ffffffffffffff00 x24: ffff0000d584df38
x23: ffff0000d584dee0 x22: ffffffffffffff00 x21: 0000000000000001
x20: ffff0000c4da5b80 x19: ffff0000d584dee0 x18: 0000000000000008
x17: 0000000000000000 x16: ffff8000832b41c0 x15: 0000000000000001
x14: 1ffff00013c12e94 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000003 x10: 0000000000ff0100 x9 : 3ef51d0da1723500
x8 : 3ef51d0da1723500 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009e097198 x4 : ffff80008fc9f780 x3 : ffff8000832461d4
x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000000
Call trace:
__up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346 (P)
up_read+0x2c/0x3c kernel/locking/rwsem.c:1620
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x378/0x42c mm/gup.c:2045
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
irq event stamp: 75153
hardirqs last enabled at (75153): [<ffff8000804aebf4>] __up_console_sem kernel/printk/printk.c:344 [inline]
hardirqs last enabled at (75153): [<ffff8000804aebf4>] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2869
hardirqs last disabled at (75152): [<ffff8000804aebdc>] __up_console_sem kernel/printk/printk.c:342 [inline]
hardirqs last disabled at (75152): [<ffff8000804aebdc>] __console_unlock+0x58/0xc4 kernel/printk/printk.c:2869
softirqs last enabled at (74970): [<ffff8000801283e0>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (74968): [<ffff8000801283ac>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11f31464580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=13f51464580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (2 preceding siblings ...)
2025-03-04 12:25 ` Edward Adam Davis
@ 2025-03-04 14:33 ` Edward Adam Davis
2025-03-04 15:09 ` syzbot
2025-03-05 0:55 ` Edward Adam Davis
` (7 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-04 14:33 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..10be47b303a0 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2029,7 +2029,15 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
+ if (!virt_addr_valid((void*)mm)) {
+ return -EFAULT;
+ }
if (ret < 0) {
if (ignore_errors) {
ret = 0;
diff --git a/mm/util.c b/mm/util.c
index b6b9684a1438..f6aa733b9563 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -576,6 +576,7 @@ unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr,
&uf);
mmap_write_unlock(mm);
userfaultfd_unmap_complete(mm, &uf);
+ printk("mm: %p, pop: %lu, %s\n", mm, populate, __func__);
if (populate)
mm_populate(ret, populate);
}
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-04 14:33 ` Edward Adam Davis
@ 2025-03-04 15:09 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-04 15:09 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: bad unlock balance in __mm_populate
mm: 00000000b67e0d34, vma: 00000000f29ded2b, mmap lock held: 0, locked: 1, ret: -14, mm addr is valid: 1, __mm_populate
=====================================
WARNING: bad unlock balance detected!
6.14.0-rc4-syzkaller-ge056da87c780-dirty #0 Not tainted
-------------------------------------
syz.0.16/7282 is trying to release lock (&mm->mmap_lock
) at:
[<ffff800080a62f10>] mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
[<ffff800080a62f10>] __mm_populate+0x5a0/0x670 mm/gup.c:2052
but there are no more locks to release!
other info that might help us debug this:
no locks held by syz.0.16/7282.
stack backtrace:
CPU: 0 UID: 0 PID: 7282 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_unlock_imbalance_bug+0x254/0x2ac kernel/locking/lockdep.c:5289
__lock_release kernel/locking/lockdep.c:5518 [inline]
lock_release+0x410/0x9e4 kernel/locking/lockdep.c:5872
up_read+0x24/0x3c kernel/locking/rwsem.c:1619
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x5a0/0x670 mm/gup.c:2052
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x398/0x408 mm/util.c:581
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffffffffffff00, magic = 0xffff0000d743e760, owner = 0x1, curr 0xffff0000c4563d00, list empty
WARNING: CPU: 0 PID: 7282 at kernel/locking/rwsem.c:1346 __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
Modules linked in:
CPU: 0 UID: 0 PID: 7282 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
lr : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
sp : ffff8000a42a79a0
x29: ffff8000a42a7a20
x28: 1ffff00011f760cb x27: ffff80008fbb0000
x26: dfff800000000000 x25: ffffffffffffff00 x24: ffff0000d743e7b8
x23: ffff0000d743e760 x22: ffffffffffffff00 x21: 0000000000000001
x20: ffff0000c4563d00 x19: ffff0000d743e760
x18: ffff8000a42a7268
x17: 0000000000000000
x16: ffff8000832b3460 x15: 0000000000000001
x14: 1ffff00014854e8c x13: 0000000000000000
x12: 0000000000000000
x11: 0000000000000003
x10: 0000000000ff0100 x9 : 5249a055953baa00
x8 : 5249a055953baa00 x7 : 205b5d3236333836 x6 : ffff8000804a97f4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800083245474
x2 : 0000000000000001
x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
__up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346 (P)
up_read+0x2c/0x3c kernel/locking/rwsem.c:1620
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x5a0/0x670 mm/gup.c:2052
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x398/0x408 mm/util.c:581
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
irq event stamp: 76619
hardirqs last enabled at (76619): [<ffff8000804afb08>] console_emit_next_record kernel/printk/printk.c:3130 [inline]
hardirqs last enabled at (76619): [<ffff8000804afb08>] console_flush_all+0x678/0xb90 kernel/printk/printk.c:3210
hardirqs last disabled at (76618): [<ffff8000804afa44>] console_emit_next_record kernel/printk/printk.c:3115 [inline]
hardirqs last disabled at (76618): [<ffff8000804afa44>] console_flush_all+0x5b4/0xb90 kernel/printk/printk.c:3210
softirqs last enabled at (76520): [<ffff800080311b48>] softirq_handle_end kernel/softirq.c:407 [inline]
softirqs last enabled at (76520): [<ffff800080311b48>] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589
softirqs last disabled at (76395): [<ffff800080020dbc>] __do_softirq+0x14/0x20 kernel/softirq.c:595
---[ end trace 0000000000000000 ]---
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=14d2b5a8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=126b58b7980000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (3 preceding siblings ...)
2025-03-04 14:33 ` Edward Adam Davis
@ 2025-03-05 0:55 ` Edward Adam Davis
2025-03-05 1:17 ` syzbot
2025-03-05 12:08 ` Edward Adam Davis
` (6 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-05 0:55 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..66c28dea091f 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1434,6 +1434,7 @@ static long __get_user_pages(struct mm_struct *mm,
VM_BUG_ON(!!pages != !!(gup_flags & (FOLL_GET | FOLL_PIN)));
+ printk("mm: %p, map lock held: %d, locked: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), *locked, __func__);
do {
struct page *page;
unsigned int page_increm;
@@ -1469,6 +1470,7 @@ static long __get_user_pages(struct mm_struct *mm,
if (!vma) {
ret = -EFAULT;
+ printk("mm1: %p, map held lock: %d, vma: %p, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, __func__);
goto out;
}
ret = check_vma_flags(vma, gup_flags);
@@ -1484,7 +1486,9 @@ static long __get_user_pages(struct mm_struct *mm,
ret = -EINTR;
goto out;
}
+ printk("<before resched> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
cond_resched();
+ printk("<after resched> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
page = follow_page_mask(vma, start, gup_flags, &ctx);
if (!page || PTR_ERR(page) == -EMLINK) {
@@ -1500,6 +1504,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -1552,6 +1557,7 @@ static long __get_user_pages(struct mm_struct *mm,
*/
gup_put_folio(folio, 1, gup_flags);
ret = -EFAULT;
+ printk("mm3: %p, map held lock: %d, folio: %p, %s\n", mm, lockdep_is_held(&mm->mmap_lock), folio, __func__);
goto out;
}
}
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-05 0:55 ` Edward Adam Davis
@ 2025-03-05 1:17 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-05 1:17 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: bad unlock balance in __mm_populate
mm2: 00000000b643f24a, map held lock: 0, vma: 00000000ff43f796, ret: -14, __get_user_pages
mm: 00000000b643f24a, vma: 00000000ff43f796, mmap lock held: 0, locked: 1, ret: -14, mm addr is valid: 1, __mm_populate
=====================================
WARNING: bad unlock balance detected!
6.14.0-rc4-syzkaller-ge056da87c780-dirty #0 Not tainted
-------------------------------------
syz.0.16/7207 is trying to release lock (&mm->mmap_lock) at:
[<ffff800080a640f0>] mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
[<ffff800080a640f0>] __mm_populate+0x4e0/0x590 mm/gup.c:2055
but there are no more locks to release!
other info that might help us debug this:
no locks held by syz.0.16/7207.
stack backtrace:
CPU: 1 UID: 0 PID: 7207 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_unlock_imbalance_bug+0x254/0x2ac kernel/locking/lockdep.c:5289
__lock_release kernel/locking/lockdep.c:5518 [inline]
lock_release+0x410/0x9e4 kernel/locking/lockdep.c:5872
up_read+0x24/0x3c kernel/locking/rwsem.c:1619
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x4e0/0x590 mm/gup.c:2055
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffffffffffff00, magic = 0xffff0000d9a82be0, owner = 0x1, curr 0xffff0000ca89bd00, list empty
WARNING: CPU: 1 PID: 7207 at kernel/locking/rwsem.c:1346 __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
Modules linked in:
CPU: 1 UID: 0 PID: 7207 Comm: syz.0.16 Not tainted 6.14.0-rc4-syzkaller-ge056da87c780-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
lr : __up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346
sp : ffff80009d6379c0
x29: ffff80009d637a40
x28: 1ffff00011f780cb x27: ffff80008fbc0000
x26: dfff800000000000 x25: ffffffffffffff00 x24: ffff0000d9a82c38
x23: ffff0000d9a82be0
x22: ffffffffffffff00
x21: 0000000000000001
x20: ffff0000ca89bd00 x19: ffff0000d9a82be0 x18: ffff80009d637288
x17: 0000000000000000
x16: ffff80008b7c56dc
x15: 0000000000000001
x14: 1ffff00011f8fe00 x13: ffff80009d638000 x12: ffff80009d637490
x11: 0000000000000003 x10: 0000000000ff0100 x9 : ab50c55cae2af500
x8 : ab50c55cae2af500 x7 : 205b5d3439343135 x6 : ffff8000804a97f4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0000ca89bd00 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
__up_read+0x3bc/0x5f8 kernel/locking/rwsem.c:1346 (P)
up_read+0x2c/0x3c kernel/locking/rwsem.c:1620
mmap_read_unlock include/linux/mmap_lock.h:217 [inline]
__mm_populate+0x4e0/0x590 mm/gup.c:2055
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x304/0x3c4 mm/util.c:580
ksys_mmap_pgoff+0x3a4/0x5c8 mm/mmap.c:607
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
irq event stamp: 73577
hardirqs last enabled at (73577): [<ffff8000803d4c78>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1533 [inline]
hardirqs last enabled at (73577): [<ffff8000803d4c78>] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:5132
hardirqs last disabled at (73576): [<ffff80008b7cfc44>] __schedule+0x2bc/0x257c kernel/sched/core.c:6668
softirqs last enabled at (73528): [<ffff800080311b48>] softirq_handle_end kernel/softirq.c:407 [inline]
softirqs last enabled at (73528): [<ffff800080311b48>] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589
softirqs last disabled at (73505): [<ffff800080020dbc>] __do_softirq+0x14/0x20 kernel/softirq.c:595
---[ end trace 0000000000000000 ]---
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11809c64580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=1017bc64580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (4 preceding siblings ...)
2025-03-05 0:55 ` Edward Adam Davis
@ 2025-03-05 12:08 ` Edward Adam Davis
2025-03-05 12:39 ` syzbot
2025-03-05 13:45 ` Edward Adam Davis
` (5 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-05 12:08 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..ecf64fc1e0ce 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1194,6 +1194,7 @@ static int faultin_page(struct vm_area_struct *vma,
}
ret = handle_mm_fault(vma, address, fault_flags, NULL);
+ printk("1mm: %p, map held lock: %d, vma: %p, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, __func__);
if (ret & VM_FAULT_COMPLETED) {
/*
@@ -1216,8 +1217,11 @@ static int faultin_page(struct vm_area_struct *vma,
if (ret & VM_FAULT_ERROR) {
int err = vm_fault_to_errno(ret, flags);
- if (err)
+ printk("mm: %p, map held lock: %d, vma: %p, err: %d, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, err, __func__);
+ if (err) {
+ *locked = 0;
return err;
+ }
BUG();
}
@@ -1487,6 +1491,7 @@ static long __get_user_pages(struct mm_struct *mm,
cond_resched();
page = follow_page_mask(vma, start, gup_flags, &ctx);
+ printk("<after resched and follow page mask> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, gup_flags,
PTR_ERR(page) == -EMLINK, locked);
@@ -1500,6 +1505,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-05 12:08 ` Edward Adam Davis
@ 2025-03-05 12:39 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-05 12:39 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: lock held when returning to user space in __mm_populate
mm2: 00000000b2166d05, map held lock: 1, vma: 0000000029fbeeab, ret: -14, __get_user_pages
mm: 00000000b2166d05, vma: 0000000029fbeeab, mmap lock held: 1, locked: 0, ret: -14, mm addr is valid: 1, __mm_populate
================================================
WARNING: lock held when returning to user space!
6.14.0-rc4-syzkaller-ge056da87c780-dirty #0 Not tainted
------------------------------------------------
syz-executor198/8642 is leaving the kernel with locks still held!
1 lock held by syz-executor198/8642:
#0: ffff0000d544a3d0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:190 [inline]
#0: ffff0000d544a3d0 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x1a0/0x590 mm/gup.c:2017
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1377d7a0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=17448254580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (5 preceding siblings ...)
2025-03-05 12:08 ` Edward Adam Davis
@ 2025-03-05 13:45 ` Edward Adam Davis
2025-03-05 14:09 ` syzbot
2025-03-05 14:15 ` Edward Adam Davis
` (4 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-05 13:45 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..c32c0854dd4f 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1194,6 +1194,7 @@ static int faultin_page(struct vm_area_struct *vma,
}
ret = handle_mm_fault(vma, address, fault_flags, NULL);
+ printk("1mm: %p, map held lock: %d, vma: %p, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, __func__);
if (ret & VM_FAULT_COMPLETED) {
/*
@@ -1216,8 +1217,11 @@ static int faultin_page(struct vm_area_struct *vma,
if (ret & VM_FAULT_ERROR) {
int err = vm_fault_to_errno(ret, flags);
- if (err)
+ printk("mm: %p, map held lock: %d, vma: %p, err: %d, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, err, __func__);
+ if (err) {
+ *locked = err != -EFAULT;
return err;
+ }
BUG();
}
@@ -1487,6 +1491,7 @@ static long __get_user_pages(struct mm_struct *mm,
cond_resched();
page = follow_page_mask(vma, start, gup_flags, &ctx);
+ printk("<after resched and follow page mask> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, gup_flags,
PTR_ERR(page) == -EMLINK, locked);
@@ -1500,6 +1505,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
diff --git a/mm/memory.c b/mm/memory.c
index b4d3d4893267..43e35a0c2841 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6206,10 +6206,14 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
lru_gen_enter_fault(vma);
+ printk("mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
if (unlikely(is_vm_hugetlb_page(vma)))
ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
else
ret = __handle_mm_fault(vma, address, flags);
+ printk("2mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
/*
* Warning: It is no longer safe to dereference vma-> after this point,
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-05 13:45 ` Edward Adam Davis
@ 2025-03-05 14:09 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-05 14:09 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to copy syz-execprog to VM: timedout after 1m0s ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/bin/linux_arm64/syz-execprog" "root@10.128.0.33:./syz-execprog"]
Executing: program /usr/bin/ssh host 10.128.0.33, user root, command sftp
OpenSSH_9.2p1 Debian-2+deb12u4, OpenSSL 3.0.15 3 Sep 2024
debug1: Reading configuration data /dev/null
debug1: Connecting to 10.128.0.33 [10.128.0.33] port 22.
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa_sk type -1
debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: identity file /root/.ssh/id_ed25519_sk type -1
debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /root/.ssh/id_xmss type -1
debug1: identity file /root/.ssh/id_xmss-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u4
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.1
debug1: compat_banner: match: OpenSSH_9.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.128.0.33:22 as 'root'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:JxoRyAn13fCyQtNtBXvSgkCC2njD9yP7DAIyaauX8OU
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
Warning: Permanently added '10.128.0.33' (ED25519) to the list of known hosts.
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /root/.ssh/id_rsa
debug1: Will attempt key: /root/.ssh/id_ecdsa
debug1: Will attempt key: /root/.ssh/id_ecdsa_sk
debug1: Will attempt key: /root/.ssh/id_ed25519
debug1: Will attempt key: /root/.ssh/id_ed25519_sk
debug1: Will attempt key: /root/.ssh/id_xmss
debug1: Will attempt key: /root/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: kex_input_ext_info: publickey-hostbound@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
Authenticated to 10.128.0.33 ([10.128.0.33]:22) using "none".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending subsystem: sftp
debug1: pledge: fork
scp: debug1: stat remote: No such file or directory
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build13460688=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at c390174278
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c3901742785ff25afdc6f470af7b25b69d7c4f2f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250301-144328'" -o ./bin/linux_arm64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_arm64
aarch64-linux-gnu-g++ -o ./bin/linux_arm64/syz-executor executor/executor.cc \
-O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_arm64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c3901742785ff25afdc6f470af7b25b69d7c4f2f\"
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: /tmp/cc16qI3O.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0xd8): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=13674264580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (6 preceding siblings ...)
2025-03-05 13:45 ` Edward Adam Davis
@ 2025-03-05 14:15 ` Edward Adam Davis
2025-03-05 15:22 ` syzbot
2025-03-06 12:52 ` Edward Adam Davis
` (3 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-05 14:15 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..9f740d607919 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1194,6 +1194,7 @@ static int faultin_page(struct vm_area_struct *vma,
}
ret = handle_mm_fault(vma, address, fault_flags, NULL);
+ printk("1mm: %p, map held lock: %d, vma: %p, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, __func__);
if (ret & VM_FAULT_COMPLETED) {
/*
@@ -1216,8 +1217,11 @@ static int faultin_page(struct vm_area_struct *vma,
if (ret & VM_FAULT_ERROR) {
int err = vm_fault_to_errno(ret, flags);
- if (err)
+ printk("mm: %p, map held lock: %d, vma: %p, err: %d, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, err, __func__);
+ if (err) {
+ *locked = *locked ? err != -EFAULT : 0;
return err;
+ }
BUG();
}
@@ -1487,6 +1491,7 @@ static long __get_user_pages(struct mm_struct *mm,
cond_resched();
page = follow_page_mask(vma, start, gup_flags, &ctx);
+ printk("<after resched and follow page mask> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, gup_flags,
PTR_ERR(page) == -EMLINK, locked);
@@ -1500,6 +1505,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
diff --git a/mm/memory.c b/mm/memory.c
index b4d3d4893267..43e35a0c2841 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6206,10 +6206,14 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
lru_gen_enter_fault(vma);
+ printk("mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
if (unlikely(is_vm_hugetlb_page(vma)))
ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
else
ret = __handle_mm_fault(vma, address, flags);
+ printk("2mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
/*
* Warning: It is no longer safe to dereference vma-> after this point,
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-05 14:15 ` Edward Adam Davis
@ 2025-03-05 15:22 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-05 15:22 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to copy syz-execprog to VM: timedout after 1m0s ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_arm64/syz-execprog" "root@10.128.1.159:./syz-execprog"]
Executing: program /usr/bin/ssh host 10.128.1.159, user root, command sftp
OpenSSH_9.2p1 Debian-2+deb12u4, OpenSSL 3.0.15 3 Sep 2024
debug1: Reading configuration data /dev/null
debug1: Connecting to 10.128.1.159 [10.128.1.159] port 22.
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa_sk type -1
debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: identity file /root/.ssh/id_ed25519_sk type -1
debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /root/.ssh/id_xmss type -1
debug1: identity file /root/.ssh/id_xmss-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u4
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.1
debug1: compat_banner: match: OpenSSH_9.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.128.1.159:22 as 'root'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:JxoRyAn13fCyQtNtBXvSgkCC2njD9yP7DAIyaauX8OU
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
Warning: Permanently added '10.128.1.159' (ED25519) to the list of known hosts.
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /root/.ssh/id_rsa
debug1: Will attempt key: /root/.ssh/id_ecdsa
debug1: Will attempt key: /root/.ssh/id_ecdsa_sk
debug1: Will attempt key: /root/.ssh/id_ed25519
debug1: Will attempt key: /root/.ssh/id_ed25519_sk
debug1: Will attempt key: /root/.ssh/id_xmss
debug1: Will attempt key: /root/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: kex_input_ext_info: publickey-hostbound@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
Authenticated to 10.128.1.159 ([10.128.1.159]:22) using "none".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending subsystem: sftp
debug1: pledge: fork
scp: debug1: stat remote: No such file or directory
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build303386079=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at c3901742785
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c3901742785ff25afdc6f470af7b25b69d7c4f2f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250301-144328'" -o ./bin/linux_arm64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_arm64
aarch64-linux-gnu-g++ -o ./bin/linux_arm64/syz-executor executor/executor.cc \
-O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_arm64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c3901742785ff25afdc6f470af7b25b69d7c4f2f\"
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: /tmp/cchp7I18.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0xd8): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=109d75a8580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (7 preceding siblings ...)
2025-03-05 14:15 ` Edward Adam Davis
@ 2025-03-06 12:52 ` Edward Adam Davis
2025-03-06 12:54 ` syzbot
2025-03-06 12:57 ` Edward Adam Davis
` (2 subsequent siblings)
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-06 12:52 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..9f740d607919 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1194,6 +1194,7 @@ static int faultin_page(struct vm_area_struct *vma,
}
ret = handle_mm_fault(vma, address, fault_flags, NULL);
+ printk("1mm: %p, map held lock: %d, vma: %p, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, __func__);
if (ret & VM_FAULT_COMPLETED) {
/*
@@ -1216,8 +1217,11 @@ static int faultin_page(struct vm_area_struct *vma,
if (ret & VM_FAULT_ERROR) {
int err = vm_fault_to_errno(ret, flags);
- if (err)
+ printk("mm: %p, map held lock: %d, vma: %p, err: %d, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, err, __func__);
+ if (err) {
+ *locked = *locked ? err != -EFAULT : 0;
return err;
+ }
BUG();
}
@@ -1487,6 +1491,7 @@ static long __get_user_pages(struct mm_struct *mm,
cond_resched();
page = follow_page_mask(vma, start, gup_flags, &ctx);
+ printk("<after resched and follow page mask> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, gup_flags,
PTR_ERR(page) == -EMLINK, locked);
@@ -1500,6 +1505,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
diff --git a/mm/memory.c b/mm/memory.c
index b4d3d4893267..43e35a0c2841 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6206,10 +6206,14 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
lru_gen_enter_fault(vma);
+ printk("mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
if (unlikely(is_vm_hugetlb_page(vma)))
ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
else
ret = __handle_mm_fault(vma, address, flags);
+ printk("2mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
/*
* Warning: It is no longer safe to dereference vma-> after this point,
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-06 12:52 ` Edward Adam Davis
@ 2025-03-06 12:54 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-06 12:54 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to checkout kernel repo git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/for-kernelci: failed to run ["git" "fetch" "--force" "433dfd5a8a5d80bbf0669b14e9ed908911a52dd6" "for-kernelci"]: exit status 128
fatal: read error: Connection reset by peer
Tested on:
commit: [unknown
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler:
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=17774a54580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (8 preceding siblings ...)
2025-03-06 12:52 ` Edward Adam Davis
@ 2025-03-06 12:57 ` Edward Adam Davis
2025-03-06 13:24 ` syzbot
2025-03-09 3:30 ` Edward Adam Davis
2025-03-16 3:32 ` Edward Adam Davis
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-06 12:57 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git e056da87c780
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..9f740d607919 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1194,6 +1194,7 @@ static int faultin_page(struct vm_area_struct *vma,
}
ret = handle_mm_fault(vma, address, fault_flags, NULL);
+ printk("1mm: %p, map held lock: %d, vma: %p, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, __func__);
if (ret & VM_FAULT_COMPLETED) {
/*
@@ -1216,8 +1217,11 @@ static int faultin_page(struct vm_area_struct *vma,
if (ret & VM_FAULT_ERROR) {
int err = vm_fault_to_errno(ret, flags);
- if (err)
+ printk("mm: %p, map held lock: %d, vma: %p, err: %d, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, err, __func__);
+ if (err) {
+ *locked = *locked ? err != -EFAULT : 0;
return err;
+ }
BUG();
}
@@ -1487,6 +1491,7 @@ static long __get_user_pages(struct mm_struct *mm,
cond_resched();
page = follow_page_mask(vma, start, gup_flags, &ctx);
+ printk("<after resched and follow page mask> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, gup_flags,
PTR_ERR(page) == -EMLINK, locked);
@@ -1500,6 +1505,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
diff --git a/mm/memory.c b/mm/memory.c
index b4d3d4893267..43e35a0c2841 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6206,10 +6206,14 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
lru_gen_enter_fault(vma);
+ printk("mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
if (unlikely(is_vm_hugetlb_page(vma)))
ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
else
ret = __handle_mm_fault(vma, address, flags);
+ printk("2mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
/*
* Warning: It is no longer safe to dereference vma-> after this point,
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-06 12:57 ` Edward Adam Davis
@ 2025-03-06 13:24 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-06 13:24 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to copy syz-execprog to VM: timedout after 1m0s ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/bin/linux_arm64/syz-execprog" "root@10.128.0.30:./syz-execprog"]
Executing: program /usr/bin/ssh host 10.128.0.30, user root, command sftp
OpenSSH_9.2p1 Debian-2+deb12u4, OpenSSL 3.0.15 3 Sep 2024
debug1: Reading configuration data /dev/null
debug1: Connecting to 10.128.0.30 [10.128.0.30] port 22.
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa_sk type -1
debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: identity file /root/.ssh/id_ed25519_sk type -1
debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /root/.ssh/id_xmss type -1
debug1: identity file /root/.ssh/id_xmss-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u4
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.1
debug1: compat_banner: match: OpenSSH_9.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.128.0.30:22 as 'root'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:JxoRyAn13fCyQtNtBXvSgkCC2njD9yP7DAIyaauX8OU
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
Warning: Permanently added '10.128.0.30' (ED25519) to the list of known hosts.
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /root/.ssh/id_rsa
debug1: Will attempt key: /root/.ssh/id_ecdsa
debug1: Will attempt key: /root/.ssh/id_ecdsa_sk
debug1: Will attempt key: /root/.ssh/id_ed25519
debug1: Will attempt key: /root/.ssh/id_ed25519_sk
debug1: Will attempt key: /root/.ssh/id_xmss
debug1: Will attempt key: /root/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: kex_input_ext_info: publickey-hostbound@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
Authenticated to 10.128.0.30 ([10.128.0.30]:22) using "none".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending subsystem: sftp
debug1: pledge: fork
scp: debug1: stat remote: No such file or directory
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build755516551=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at c390174278
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c3901742785ff25afdc6f470af7b25b69d7c4f2f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250301-144328'" -o ./bin/linux_arm64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_arm64
aarch64-linux-gnu-g++ -o ./bin/linux_arm64/syz-executor executor/executor.cc \
-O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_arm64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c3901742785ff25afdc6f470af7b25b69d7c4f2f\"
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: /tmp/ccHH3vyS.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0xd8): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Tested on:
commit: e056da87 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=d6b7e15dc5b5e776
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=120f7da8580000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (9 preceding siblings ...)
2025-03-06 12:57 ` Edward Adam Davis
@ 2025-03-09 3:30 ` Edward Adam Davis
2025-03-09 3:53 ` syzbot
2025-03-16 3:32 ` Edward Adam Davis
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-09 3:30 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..9f740d607919 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1194,6 +1194,7 @@ static int faultin_page(struct vm_area_struct *vma,
}
ret = handle_mm_fault(vma, address, fault_flags, NULL);
+ printk("1mm: %p, map held lock: %d, vma: %p, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, __func__);
if (ret & VM_FAULT_COMPLETED) {
/*
@@ -1216,8 +1217,11 @@ static int faultin_page(struct vm_area_struct *vma,
if (ret & VM_FAULT_ERROR) {
int err = vm_fault_to_errno(ret, flags);
- if (err)
+ printk("mm: %p, map held lock: %d, vma: %p, err: %d, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, err, __func__);
+ if (err) {
+ *locked = *locked ? err != -EFAULT : 0;
return err;
+ }
BUG();
}
@@ -1487,6 +1491,7 @@ static long __get_user_pages(struct mm_struct *mm,
cond_resched();
page = follow_page_mask(vma, start, gup_flags, &ctx);
+ printk("<after resched and follow page mask> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, gup_flags,
PTR_ERR(page) == -EMLINK, locked);
@@ -1500,6 +1505,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
diff --git a/mm/memory.c b/mm/memory.c
index b4d3d4893267..43e35a0c2841 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6206,10 +6206,14 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
lru_gen_enter_fault(vma);
+ printk("mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
if (unlikely(is_vm_hugetlb_page(vma)))
ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
else
ret = __handle_mm_fault(vma, address, flags);
+ printk("2mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
/*
* Warning: It is no longer safe to dereference vma-> after this point,
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-09 3:30 ` Edward Adam Davis
@ 2025-03-09 3:53 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-09 3:53 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to copy syz-execprog to VM: timedout after 1m0s ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/bin/linux_arm64/syz-execprog" "root@10.128.1.50:./syz-execprog"]
Executing: program /usr/bin/ssh host 10.128.1.50, user root, command sftp
OpenSSH_9.2p1 Debian-2+deb12u4, OpenSSL 3.0.15 3 Sep 2024
debug1: Reading configuration data /dev/null
debug1: Connecting to 10.128.1.50 [10.128.1.50] port 22.
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa_sk type -1
debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: identity file /root/.ssh/id_ed25519_sk type -1
debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /root/.ssh/id_xmss type -1
debug1: identity file /root/.ssh/id_xmss-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u4
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.1
debug1: compat_banner: match: OpenSSH_9.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.128.1.50:22 as 'root'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:JxoRyAn13fCyQtNtBXvSgkCC2njD9yP7DAIyaauX8OU
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
Warning: Permanently added '10.128.1.50' (ED25519) to the list of known hosts.
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /root/.ssh/id_rsa
debug1: Will attempt key: /root/.ssh/id_ecdsa
debug1: Will attempt key: /root/.ssh/id_ecdsa_sk
debug1: Will attempt key: /root/.ssh/id_ed25519
debug1: Will attempt key: /root/.ssh/id_ed25519_sk
debug1: Will attempt key: /root/.ssh/id_xmss
debug1: Will attempt key: /root/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: kex_input_ext_info: publickey-hostbound@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
Authenticated to 10.128.1.50 ([10.128.1.50]:22) using "none".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending subsystem: sftp
debug1: pledge: fork
scp: debug1: stat remote: No such file or directory
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build579354154=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at c390174278
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c3901742785ff25afdc6f470af7b25b69d7c4f2f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250301-144328'" -o ./bin/linux_arm64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_arm64
aarch64-linux-gnu-g++ -o ./bin/linux_arm64/syz-executor executor/executor.cc \
-O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_arm64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c3901742785ff25afdc6f470af7b25b69d7c4f2f\"
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: /tmp/cc23BeDc.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0xd8): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Tested on:
commit: 77c95b8c Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
kernel config: https://syzkaller.appspot.com/x/.config?x=afb3000d0159783f
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=132554b7980000
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
` (10 preceding siblings ...)
2025-03-09 3:30 ` Edward Adam Davis
@ 2025-03-16 3:32 ` Edward Adam Davis
2025-03-16 4:29 ` syzbot
11 siblings, 1 reply; 25+ messages in thread
From: Edward Adam Davis @ 2025-03-16 3:32 UTC (permalink / raw)
To: syzbot+8f9f411152c9539f4e59; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..9f740d607919 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1194,6 +1194,7 @@ static int faultin_page(struct vm_area_struct *vma,
}
ret = handle_mm_fault(vma, address, fault_flags, NULL);
+ printk("1mm: %p, map held lock: %d, vma: %p, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, __func__);
if (ret & VM_FAULT_COMPLETED) {
/*
@@ -1216,8 +1217,11 @@ static int faultin_page(struct vm_area_struct *vma,
if (ret & VM_FAULT_ERROR) {
int err = vm_fault_to_errno(ret, flags);
- if (err)
+ printk("mm: %p, map held lock: %d, vma: %p, err: %d, %s\n", vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, err, __func__);
+ if (err) {
+ *locked = *locked ? err != -EFAULT : 0;
return err;
+ }
BUG();
}
@@ -1487,6 +1491,7 @@ static long __get_user_pages(struct mm_struct *mm,
cond_resched();
page = follow_page_mask(vma, start, gup_flags, &ctx);
+ printk("<after resched and follow page mask> mm: %p, map lock held: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), __func__);
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, gup_flags,
PTR_ERR(page) == -EMLINK, locked);
@@ -1500,6 +1505,7 @@ static long __get_user_pages(struct mm_struct *mm,
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
+ printk("mm2: %p, map held lock: %d, vma: %p, ret: %d, %s\n", mm, lockdep_is_held(&mm->mmap_lock), vma, ret, __func__);
goto out;
}
BUG();
@@ -2029,7 +2035,12 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
* double checks the vma flags, so that it won't mlock pages
* if the vma was already munlocked.
*/
+ printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, vma is acc: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, vma_is_accessible(vma), __func__);
ret = populate_vma_page_range(vma, nstart, nend, &locked);
+ printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+ mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
if (ret < 0) {
if (ignore_errors) {
ret = 0;
diff --git a/mm/memory.c b/mm/memory.c
index b4d3d4893267..43e35a0c2841 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6206,10 +6206,14 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
lru_gen_enter_fault(vma);
+ printk("mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
if (unlikely(is_vm_hugetlb_page(vma)))
ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
else
ret = __handle_mm_fault(vma, address, flags);
+ printk("2mm: %p, map held lock: %d, vma: %p, is vm hugetlb page: %d, %s\n",
+ vma->vm_mm, lockdep_is_held(&vma->vm_mm->mmap_lock), vma, is_vm_hugetlb_page(vma), __func__);
/*
* Warning: It is no longer safe to dereference vma-> after this point,
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate
2025-03-16 3:32 ` Edward Adam Davis
@ 2025-03-16 4:29 ` syzbot
0 siblings, 0 replies; 25+ messages in thread
From: syzbot @ 2025-03-16 4:29 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to copy syz-execprog to VM: timedout after 1m0s ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/bin/linux_arm64/syz-execprog" "root@10.128.1.46:./syz-execprog"]
Executing: program /usr/bin/ssh host 10.128.1.46, user root, command sftp
OpenSSH_9.2p1 Debian-2+deb12u4, OpenSSL 3.0.15 3 Sep 2024
debug1: Reading configuration data /dev/null
debug1: Connecting to 10.128.1.46 [10.128.1.46] port 22.
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa_sk type -1
debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: identity file /root/.ssh/id_ed25519_sk type -1
debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /root/.ssh/id_xmss type -1
debug1: identity file /root/.ssh/id_xmss-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u4
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.1
debug1: compat_banner: match: OpenSSH_9.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.128.1.46:22 as 'root'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:JxoRyAn13fCyQtNtBXvSgkCC2njD9yP7DAIyaauX8OU
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
Warning: Permanently added '10.128.1.46' (ED25519) to the list of known hosts.
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /root/.ssh/id_rsa
debug1: Will attempt key: /root/.ssh/id_ecdsa
debug1: Will attempt key: /root/.ssh/id_ecdsa_sk
debug1: Will attempt key: /root/.ssh/id_ed25519
debug1: Will attempt key: /root/.ssh/id_ed25519_sk
debug1: Will attempt key: /root/.ssh/id_xmss
debug1: Will attempt key: /root/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: kex_input_ext_info: publickey-hostbound@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
Authenticated to 10.128.1.46 ([10.128.1.46]:22) using "none".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending subsystem: sftp
debug1: pledge: fork
scp: debug1: stat remote: No such file or directory
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1200752111=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at c390174278
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c3901742785ff25afdc6f470af7b25b69d7c4f2f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250301-144328'" -o ./bin/linux_arm64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_arm64
aarch64-linux-gnu-g++ -o ./bin/linux_arm64/syz-executor executor/executor.cc \
-O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_arm64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c3901742785ff25afdc6f470af7b25b69d7c4f2f\"
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: /tmp/cco8YaUX.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0xd8): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Tested on:
commit: a5618886 Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
kernel config: https://syzkaller.appspot.com/x/.config?x=29061e148cfaa3d3
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9f411152c9539f4e59
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=15333ff8580000
^ permalink raw reply [flat|nested] 25+ messages in thread
end of thread, other threads:[~2025-03-16 4:29 UTC | newest]
Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-02 17:15 [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate syzbot
2025-03-04 1:38 ` Edward Adam Davis
2025-03-04 1:54 ` syzbot
2025-03-04 2:01 ` Edward Adam Davis
2025-03-04 2:22 ` syzbot
2025-03-04 12:25 ` Edward Adam Davis
2025-03-04 13:19 ` syzbot
2025-03-04 14:33 ` Edward Adam Davis
2025-03-04 15:09 ` syzbot
2025-03-05 0:55 ` Edward Adam Davis
2025-03-05 1:17 ` syzbot
2025-03-05 12:08 ` Edward Adam Davis
2025-03-05 12:39 ` syzbot
2025-03-05 13:45 ` Edward Adam Davis
2025-03-05 14:09 ` syzbot
2025-03-05 14:15 ` Edward Adam Davis
2025-03-05 15:22 ` syzbot
2025-03-06 12:52 ` Edward Adam Davis
2025-03-06 12:54 ` syzbot
2025-03-06 12:57 ` Edward Adam Davis
2025-03-06 13:24 ` syzbot
2025-03-09 3:30 ` Edward Adam Davis
2025-03-09 3:53 ` syzbot
2025-03-16 3:32 ` Edward Adam Davis
2025-03-16 4:29 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.