From: syzbot <syzbot+609c80047e3e808b465c@syzkaller.appspotmail.com>
To: lenb@kernel.org, linux-kernel@vger.kernel.org,
linux-pm@vger.kernel.org, pavel@kernel.org, rafael@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [pm?] kernel BUG in mark_free_pages
Date: Sun, 04 Oct 2026 22:28:22 -0700 [thread overview]
Message-ID: <6ac33576.53659fcc.25f34.0004.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 6addb4f38557 Merge tag 'edac_urgent_for_v7.3_rc6' of git:/..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16d3d7f5580000
kernel config: https://syzkaller.appspot.com/x/.config?x=23e5acac5c98285f
dashboard link: https://syzkaller.appspot.com/bug?extid=609c80047e3e808b465c
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=121d2835580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=161d2835580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/484fafd2304b/disk-6addb4f3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3a897e82997f/vmlinux-6addb4f3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/57fc9f6de4c3/bzImage-6addb4f3.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+609c80047e3e808b465c@syzkaller.appspotmail.com
Freezing user space processes
Freezing user space processes completed (elapsed 0.009 seconds)
OOM killer disabled.
PM: hibernation: Preallocating image memory
page:ffffea0005400000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page))
There is not page extension available.
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:2402!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5632 Comm: syz-executor292 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026
RIP: 0010:page_to_nid include/linux/mm.h:2402 [inline]
RIP: 0010:page_zone include/linux/mm.h:2622 [inline]
RIP: 0010:mark_free_pages+0x49a/0x4b0 kernel/power/snapshot.c:1266
Code: 5d e9 3a b9 44 0a e8 15 c9 22 00 90 0f 0b e8 0d fe 41 0a e8 08 c9 22 00 48 8b 7c 24 08 48 c7 c6 64 6c 48 8e e8 97 db 82 ff 90 <0f> 0b e8 ef c8 22 00 90 0f 0b e8 e7 c8 22 00 90 0f 0b 0f 1f 40 00
RSP: 0018:ffffc900035a7ad8 EFLAGS: 00010046
RAX: 26156de6b9890800 RBX: 0000000000010000 RCX: 26156de6b9890800
RDX: 0000000000000000 RSI: 8000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f6917a3 R09: 1ffffffff1ed22f4
R10: dffffc0000000000 R11: fffffbfff1ed22f5 R12: ffff88823fff8100
R13: 0000000000150000 R14: ffffffffffffffff R15: 0300000000000000
FS: 00007f23975186c0(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe53995418 CR3: 0000000021bc3000 CR4: 0000000000350ef0
Call Trace:
<TASK>
count_data_pages kernel/power/snapshot.c:1417 [inline]
hibernate_preallocate_memory+0x14f/0x750 kernel/power/snapshot.c:1859
hibernation_snapshot+0xd5/0x3d0 kernel/power/hibernate.c:416
hibernate+0x28f/0x680 kernel/power/hibernate.c:813
state_store+0x234/0x290 kernel/power/main.c:821
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f23975400a9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f23975181d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f23975f0b48 RCX: 00007f23975400a9
RDX: 0000000000000005 RSI: 0000200000000100 RDI: 0000000000000003
RBP: 00007f23975f0b40 R08: 35203a6b63617473 R09: 35203a6b63617473
R10: 35203a6b63617473 R11: 0000000000000246 R12: 00007f23975c2378
R13: 0000200000000500 R14: 0000200000000600 R15: 00656e696c66666f
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:page_to_nid include/linux/mm.h:2402 [inline]
RIP: 0010:page_zone include/linux/mm.h:2622 [inline]
RIP: 0010:mark_free_pages+0x49a/0x4b0 kernel/power/snapshot.c:1266
Code: 5d e9 3a b9 44 0a e8 15 c9 22 00 90 0f 0b e8 0d fe 41 0a e8 08 c9 22 00 48 8b 7c 24 08 48 c7 c6 64 6c 48 8e e8 97 db 82 ff 90 <0f> 0b e8 ef c8 22 00 90 0f 0b e8 e7 c8 22 00 90 0f 0b 0f 1f 40 00
RSP: 0018:ffffc900035a7ad8 EFLAGS: 00010046
RAX: 26156de6b9890800 RBX: 0000000000010000 RCX: 26156de6b9890800
RDX: 0000000000000000 RSI: 8000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f6917a3 R09: 1ffffffff1ed22f4
R10: dffffc0000000000 R11: fffffbfff1ed22f5 R12: ffff88823fff8100
R13: 0000000000150000 R14: ffffffffffffffff R15: 0300000000000000
FS: 00007f23975186c0(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe53995418 CR3: 0000000021bc3000 CR4: 0000000000350ef0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-10-05 5:28 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ac33576.53659fcc.25f34.0004.GAE@google.com \
--to=syzbot+609c80047e3e808b465c@syzkaller.appspotmail.com \
--cc=lenb@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=pavel@kernel.org \
--cc=rafael@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.