* [syzbot] [net?] kernel BUG in filemap_fault (3)
@ 2025-10-29 17:59 syzbot
2025-12-08 7:18 ` syzbot
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2025-10-29 17:59 UTC (permalink / raw)
To: akpm, linux-fsdevel, linux-kernel, linux-mm, netdev,
syzkaller-bugs, willy
Hello,
syzbot found the following issue on:
HEAD commit: 72761a7e3122 Merge tag 'driver-core-6.18-rc3' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10241e7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd5b960ad8a33100
dashboard link: https://syzkaller.appspot.com/bug?extid=85cfa48c1a69a20ba5ed
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7340e06c0904/disk-72761a7e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0391e601c303/vmlinux-72761a7e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7744957ba534/bzImage-72761a7e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+85cfa48c1a69a20ba5ed@syzkaller.appspotmail.com
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
page last free pid 50 tgid 50 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
free_unref_folios+0xdb3/0x14f0 mm/page_alloc.c:2963
folios_put_refs+0x584/0x670 mm/swap.c:1002
release_pages+0x4b4/0x520 mm/swap.c:1042
io_free_region+0xb4/0x270 io_uring/memmap.c:102
io_rings_free io_uring/io_uring.c:2770 [inline]
io_ring_ctx_free+0x287/0x4e0 io_uring/io_uring.c:2864
io_ring_exit_work+0x8c4/0x930 io_uring/io_uring.c:3086
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
------------[ cut here ]------------
kernel BUG at mm/filemap.c:3519!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 9010 Comm: syz.1.736 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:filemap_fault+0x122c/0x12b0 mm/filemap.c:3519
Code: 38 c1 0f 8c 8e fc ff ff 4c 89 e7 e8 8e d8 2c 00 e9 81 fc ff ff e8 94 23 c7 ff 48 89 df 48 c7 c6 60 5b 74 8b e8 b5 0d 2f ff 90 <0f> 0b e8 7d 23 c7 ff 48 8b 3c 24 48 c7 c6 e0 61 74 8b e8 9d 0d 2f
RSP: 0018:ffffc9000ef37a60 EFLAGS: 00010246
RAX: 50465a4911af7d00 RBX: ffffea00012c8500 RCX: 50465a4911af7d00
RDX: 0000000000000000 RSI: ffffffff8d8f29fa RDI: ffff88801fba5ac0
RBP: ffffc9000ef37b98 R08: ffff8880b8924293 R09: 1ffff11017124852
R10: dffffc0000000000 R11: ffffed1017124853 R12: dffffc0000000000
R13: 1ffffd40002590a1 R14: ffffea00012c8518 R15: ffffea00012c8508
FS: 0000000000000000(0000) GS:ffff88812623e000(0063) knlGS:000000005671e440
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080000000 CR3: 00000000301ae000 CR4: 00000000003526f0
Call Trace:
<TASK>
__do_fault+0x138/0x390 mm/memory.c:5280
do_shared_fault mm/memory.c:5762 [inline]
do_fault mm/memory.c:5836 [inline]
do_pte_missing mm/memory.c:4361 [inline]
handle_pte_fault mm/memory.c:6177 [inline]
__handle_mm_fault+0x1847/0x5400 mm/memory.c:6318
handle_mm_fault+0x40a/0x8e0 mm/memory.c:6487
do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0023:0xf704df88
Code: f8 09 f0 74 1d 89 f0 83 f0 01 09 f8 0f 85 3c 02 00 00 8b 44 24 20 0f c8 89 44 24 20 31 c0 89 44 24 24 8b 44 24 1c 8b 4c 24 20 <89> 08 e9 39 fb ff ff 0f b6 4c 24 08 8b 5c 24 28 89 cf c1 ef 05 83
RSP: 002b:00000000f750fa70 EFLAGS: 00010246
RAX: 0000000080000000 RBX: 0000000000000000 RCX: 0000000000000007
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000f750fd98 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:filemap_fault+0x122c/0x12b0 mm/filemap.c:3519
Code: 38 c1 0f 8c 8e fc ff ff 4c 89 e7 e8 8e d8 2c 00 e9 81 fc ff ff e8 94 23 c7 ff 48 89 df 48 c7 c6 60 5b 74 8b e8 b5 0d 2f ff 90 <0f> 0b e8 7d 23 c7 ff 48 8b 3c 24 48 c7 c6 e0 61 74 8b e8 9d 0d 2f
RSP: 0018:ffffc9000ef37a60 EFLAGS: 00010246
RAX: 50465a4911af7d00 RBX: ffffea00012c8500 RCX: 50465a4911af7d00
RDX: 0000000000000000 RSI: ffffffff8d8f29fa RDI: ffff88801fba5ac0
RBP: ffffc9000ef37b98 R08: ffff8880b8924293 R09: 1ffff11017124852
R10: dffffc0000000000 R11: ffffed1017124853 R12: dffffc0000000000
R13: 1ffffd40002590a1 R14: ffffea00012c8518 R15: ffffea00012c8508
FS: 0000000000000000(0000) GS:ffff88812623e000(0063) knlGS:000000005671e440
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080000000 CR3: 00000000301ae000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: f8 clc
1: 09 f0 or %esi,%eax
3: 74 1d je 0x22
5: 89 f0 mov %esi,%eax
7: 83 f0 01 xor $0x1,%eax
a: 09 f8 or %edi,%eax
c: 0f 85 3c 02 00 00 jne 0x24e
12: 8b 44 24 20 mov 0x20(%rsp),%eax
16: 0f c8 bswap %eax
18: 89 44 24 20 mov %eax,0x20(%rsp)
1c: 31 c0 xor %eax,%eax
1e: 89 44 24 24 mov %eax,0x24(%rsp)
22: 8b 44 24 1c mov 0x1c(%rsp),%eax
26: 8b 4c 24 20 mov 0x20(%rsp),%ecx
* 2a: 89 08 mov %ecx,(%rax) <-- trapping instruction
2c: e9 39 fb ff ff jmp 0xfffffb6a
31: 0f b6 4c 24 08 movzbl 0x8(%rsp),%ecx
36: 8b 5c 24 28 mov 0x28(%rsp),%ebx
3a: 89 cf mov %ecx,%edi
3c: c1 ef 05 shr $0x5,%edi
3f: 83 .byte 0x83
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] [net?] kernel BUG in filemap_fault (3)
2025-10-29 17:59 [syzbot] [net?] kernel BUG in filemap_fault (3) syzbot
@ 2025-12-08 7:18 ` syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2025-12-08 7:18 UTC (permalink / raw)
To: akpm, davem, edumazet, horms, kuba, kuniyu, linux-fsdevel,
linux-kernel, linux-mm, netdev, pabeni, syzkaller-bugs, willemb,
willy
syzbot has found a reproducer for the following issue on:
HEAD commit: 67a454e6b1c6 Merge tag 'memblock-6.19-rc1' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=125ee992580000
kernel config: https://syzkaller.appspot.com/x/.config?x=675cacd7a6e90ec3
dashboard link: https://syzkaller.appspot.com/bug?extid=85cfa48c1a69a20ba5ed
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11988a1a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=115ee992580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0720a50dee77/disk-67a454e6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/69f7900759fa/vmlinux-67a454e6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2f0fa3e38fe5/bzImage-67a454e6.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+85cfa48c1a69a20ba5ed@syzkaller.appspotmail.com
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x6c5/0x2310 kernel/exit.c:971
do_group_exit+0x21c/0x2d0 kernel/exit.c:1112
get_signal+0x1285/0x1340 kernel/signal.c:3034
arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x87/0x4f0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at mm/filemap.c:3579!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 7393 Comm: syz.1.310 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:filemap_fault+0x1215/0x1290 mm/filemap.c:3579
Code: 38 c1 0f 8c 8e fc ff ff 4c 89 e7 e8 b5 f2 2c 00 e9 81 fc ff ff e8 1b a1 c6 ff 48 89 df 48 c7 c6 80 a9 74 8b e8 dc f7 2c ff 90 <0f> 0b e8 04 a1 c6 ff 48 8b 3c 24 48 c7 c6 00 b0 74 8b e8 c4 f7 2c
RSP: 0018:ffffc9000c3d7280 EFLAGS: 00010246
RAX: c461c012ec26ac00 RBX: ffffea0001682000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8d7867c7 RDI: 00000000ffffffff
RBP: ffffc9000c3d73b8 R08: ffffffff8f817677 R09: 1ffffffff1f02ece
R10: dffffc0000000000 R11: fffffbfff1f02ecf R12: dffffc0000000000
R13: 1ffffd40002d0401 R14: ffffea0001682018 R15: ffffea0001682008
FS: 00007faedeecb6c0(0000) GS:ffff888125e44000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc2f31bef98 CR3: 000000007da76000 CR4: 00000000003526f0
Call Trace:
<TASK>
__do_fault+0x138/0x390 mm/memory.c:5320
do_shared_fault mm/memory.c:5819 [inline]
do_fault mm/memory.c:5893 [inline]
do_pte_missing+0x6ad/0x3330 mm/memory.c:4401
handle_pte_fault mm/memory.c:6273 [inline]
__handle_mm_fault mm/memory.c:6411 [inline]
handle_mm_fault+0x1b26/0x32b0 mm/memory.c:6580
do_user_addr_fault+0x764/0x1380 arch/x86/mm/fault.c:1387
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0010:__put_user_nocheck_4+0x3/0x10 arch/x86/lib/putuser.S:104
Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca e9 c1 75 03 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000c3d78b8 EFLAGS: 00050202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000020000005f7b0
RDX: ffff88801eb45b80 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc9000c3d7a30 R08: ffffc9000c3d7667 R09: 1ffff9200187aecc
R10: dffffc0000000000 R11: fffff5200187aecd R12: 0000000000000002
R13: dffffc0000000000 R14: 0000000000000000 R15: 000020000005f780
____sys_recvmsg+0x2ab/0x460 net/socket.c:2825
___sys_recvmsg+0x1b5/0x510 net/socket.c:2854
do_recvmmsg+0x307/0x770 net/socket.c:2949
__sys_recvmmsg net/socket.c:3023 [inline]
__do_sys_recvmmsg net/socket.c:3046 [inline]
__se_sys_recvmmsg net/socket.c:3039 [inline]
__x64_sys_recvmmsg+0x190/0x240 net/socket.c:3039
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faeddf8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faedeecb038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007faede1e6090 RCX: 00007faeddf8f749
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007faede013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faede1e6128 R14: 00007faede1e6090 R15: 00007ffe1a004ab8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:filemap_fault+0x1215/0x1290 mm/filemap.c:3579
Code: 38 c1 0f 8c 8e fc ff ff 4c 89 e7 e8 b5 f2 2c 00 e9 81 fc ff ff e8 1b a1 c6 ff 48 89 df 48 c7 c6 80 a9 74 8b e8 dc f7 2c ff 90 <0f> 0b e8 04 a1 c6 ff 48 8b 3c 24 48 c7 c6 00 b0 74 8b e8 c4 f7 2c
RSP: 0018:ffffc9000c3d7280 EFLAGS: 00010246
RAX: c461c012ec26ac00 RBX: ffffea0001682000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8d7867c7 RDI: 00000000ffffffff
RBP: ffffc9000c3d73b8 R08: ffffffff8f817677 R09: 1ffffffff1f02ece
R10: dffffc0000000000 R11: fffffbfff1f02ecf R12: dffffc0000000000
R13: 1ffffd40002d0401 R14: ffffea0001682018 R15: ffffea0001682008
FS: 00007faedeecb6c0(0000) GS:ffff888125f44000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd80c2bd48 CR3: 000000007da76000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: d9 0f (bad) (%rdi)
2: 01 cb add %ecx,%ebx
4: 89 01 mov %eax,(%rcx)
6: 31 c9 xor %ecx,%ecx
8: 0f 01 ca clac
b: c3 ret
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 0f 01 cb stac
* 2a: 89 01 mov %eax,(%rcx) <-- trapping instruction
2c: 31 c9 xor %ecx,%ecx
2e: 0f 01 ca clac
31: e9 c1 75 03 00 jmp 0x375f7
36: 90 nop
37: 90 nop
38: 90 nop
39: 90 nop
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop
3f: 90 nop
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-08 7:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-29 17:59 [syzbot] [net?] kernel BUG in filemap_fault (3) syzbot
2025-12-08 7:18 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).