From: syzbot <syzbot+c6879dc677a017f0a21b@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, jannh@google.com, liam@infradead.org,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
ljs@kernel.org, pfalcato@suse.de,
syzkaller-bugs@googlegroups.com, vbabka@kernel.org
Subject: [syzbot] [mm?] WARNING in vma_add_pgoff
Date: Mon, 07 Sep 2026 18:21:25 -0700 [thread overview]
Message-ID: <6a9f6315.6e6c5f9e.28f11f.0002.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 5445d6419962 arm64: Don't read GMID_EL1 when MTE is disabled
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1517ecf9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=c6879dc677a017f0a21b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=147ad125580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=127ad125580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b70e3bd109/disk-5445d641.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5227e56ac93/vmlinux-5445d641.xz
kernel image: https://storage.googleapis.com/syzbot-assets/54905f78be59/Image-5445d641.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c6879dc677a017f0a21b@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: mm/vma.h:277 at assert_sane_pgoff mm/vma.h:277 [inline], CPU#1: syz.0.17/4912
WARNING: mm/vma.h:277 at vma_set_pgoff mm/vma.h:283 [inline], CPU#1: syz.0.17/4912
WARNING: mm/vma.h:277 at vma_add_pgoff+0x50c/0x700 mm/vma.h:314, CPU#1: syz.0.17/4912
Modules linked in:
CPU: 1 UID: 0 PID: 4912 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : assert_sane_pgoff mm/vma.h:277 [inline]
pc : vma_set_pgoff mm/vma.h:283 [inline]
pc : vma_add_pgoff+0x50c/0x700 mm/vma.h:314
lr : assert_sane_pgoff mm/vma.h:277 [inline]
lr : vma_set_pgoff mm/vma.h:283 [inline]
lr : vma_add_pgoff+0x50c/0x700 mm/vma.h:314
sp : ffff8000963176e0
x29: ffff800096317700 x28: 1fffe00019d174aa x27: 0000000000000001
x26: ffff0000c659b700 x25: dfff800000000000 x24: 1fffe00019d174b0
x23: ffff0000ce8ba580 x22: 0000000000020a97 x21: ffff0000ce8ba548
x20: ffff0000ce8ba500 x19: 0000000020001000 x18: 1fffe00035ba3828
x17: ffff800080adeaf4 x16: ffff800080addecc x15: ffff800080b8bf18
x14: ffff800080b96bac x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000
x8 : 0000000000000000 x7 : ffff800080bee7b0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800080ae89e0
x2 : 0000000000020001 x1 : ffff0000c825bb00 x0 : 0000000000000000
Call trace:
assert_sane_pgoff mm/vma.h:277 [inline] (P)
vma_set_pgoff mm/vma.h:283 [inline] (P)
vma_add_pgoff+0x50c/0x700 mm/vma.h:314 (P)
__split_vma+0x6a8/0x83c mm/vma.c:607
split_vma mm/vma.c:643 [inline]
vma_modify+0x11ac/0x18f0 mm/vma.c:1771
vma_modify_policy+0x210/0x2b8 mm/vma.c:1834
mbind_range+0x160/0x3e4 mm/mempolicy.c:1061
do_mbind mm/mempolicy.c:1563 [inline]
kernel_mbind mm/mempolicy.c:1760 [inline]
__do_sys_mbind mm/mempolicy.c:1834 [inline]
__se_sys_mbind mm/mempolicy.c:1830 [inline]
__arm64_sys_mbind+0x5c8/0x994 mm/mempolicy.c:1830
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
irq event stamp: 928
hardirqs last enabled at (927): [<ffff8000869a9950>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (927): [<ffff8000869a9950>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (928): [<ffff8000869841d4>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445
softirqs last enabled at (208): [<ffff80008013891c>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last enabled at (208): [<ffff80008013891c>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last enabled at (208): [<ffff80008013891c>] do_sve_acc+0x32c/0x4b8 arch/arm64/kernel/fpsimd.c:1349
softirqs last disabled at (206): [<ffff8000801386fc>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (206): [<ffff8000801386fc>] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline]
softirqs last disabled at (206): [<ffff8000801386fc>] do_sve_acc+0x10c/0x4b8 arch/arm64/kernel/fpsimd.c:1325
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2026-09-08 1:21 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-08 1:21 syzbot [this message]
2026-09-08 2:25 ` [syzbot] [mm?] WARNING in vma_add_pgoff Andrew Morton
2026-09-08 4:15 ` syzbot
2026-09-08 9:25 ` Lorenzo Stoakes (ARM)
2026-09-08 9:32 ` Vlastimil Babka (SUSE)
2026-09-08 10:24 ` Lorenzo Stoakes (ARM)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a9f6315.6e6c5f9e.28f11f.0002.GAE@google.com \
--to=syzbot+c6879dc677a017f0a21b@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=jannh@google.com \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=pfalcato@suse.de \
--cc=syzkaller-bugs@googlegroups.com \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.