From: Mark Rutland <mark.rutland@arm.com>
To: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
syzkaller@googlegroups.com
Cc: Ingo Molnar <mingo@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Michal Hocko <mhocko@suse.com>,
Peter Zijlstra <peterz@infradead.org>
Subject: "BUG: Bad rss-counter state" in v4.13 / arm64
Date: Thu, 7 Sep 2017 11:36:16 +0100 [thread overview]
Message-ID: <20170907103616.GC1990@leverpostej> (raw)
Hi,
I'm hitting splats like below when fuzzing v4.13 on arm64:
BUG: Bad rss-counter state mm:ffff80002fa35f00 idx:1 val:1
BUG: Bad rss-counter state mm:ffff80002fa35f00 idx:3 val:-1
It looks like we're mis-accounting shared memory pages as anonymous
pages somewhere, or vice-versa.
Syzkaller came up with the two reproducers, which trigger the issue
intermittently:
Reproducer 1
----
# {Threaded:false Collide:false Repeat:true Procs:2 Sandbox:setuid Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:false}
mmap(&(0x7f0000000000/0x5b2000)=nil, 0x5b2000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000000b000-0x78)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7ffffffe, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, &(0x7f0000d18000-0x2)="", &(0x7f00006b5000-0x4)=0x0, &(0x7f00002c2000-0x4)=0x0, &(0x7f0000415000)="")
move_pages(0x0, 0x1, &(0x7f00002f8000-0x38)=[&(0x7f00000b9000/0x2000)=nil], 0x0, &(0x7f00002f6000-0x4)=[], 0x0)
shmat(0x0, &(0x7f000000a000/0x4000)=nil, 0x5ffe)
pivot_root(&(0x7f00003f7000-0x8)="2e2f66696c653000", &(0x7f00005b1000)="2e2f66696c653000")
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00002eb000)={0x0, 0x80000, 0xffffffffffffff9c})
----
Reproducer 2
----
# {Threaded:true Collide:false Repeat:true Procs:2 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:false}
mmap(&(0x7f0000000000/0x592000)=nil, 0x592000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608)
io_setup(0x80, &(0x7f00002ea000-0x8)=0x0)
shmat(0x0, &(0x7f0000193000/0x3000)=nil, 0x6000)
rt_sigtimedwait(&(0x7f00002fa000)={0xae}, 0x0, &(0x7f0000045000-0x10)={0x0, 0x989680}, 0x8)
clone(0x0, &(0x7f0000d18000-0x2)="", &(0x7f00006b5000-0x4)=0x0, &(0x7f00002c2000-0x4)=0x0, &(0x7f0000415000)="")
move_pages(0x0, 0x1, &(0x7f00002f8000-0x38)=[&(0x7f00000b9000/0x2000)=nil], 0x0, &(0x7f00002f6000-0x4)=[], 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f000000d000)="2f6465762f70746d7800", 0x0, 0x0)
syz_extract_tcp_res$synack(&(0x7f0000591000-0x8)={0x0, 0x0}, 0x1, 0x0)
syz_open_dev$vcsn(&(0x7f0000591000)="2f6465762f7663732300", 0x2, 0x0)
----
I haven't yet had the time to investigate this or run a bisect.
Thanks,
Mark.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
reply other threads:[~2017-09-07 10:37 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170907103616.GC1990@leverpostej \
--to=mark.rutland@arm.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).