[syzbot] [mm?] WARNING in swap_put_entries_direct

[syzbot] [mm?] WARNING in swap_put_entries_direct

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    8ab1afb2eb24 Merge tag 'for-7.3/dm-fixes' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1034a125580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=23b25ba3c6bf971f9c57
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8ab1afb2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4767b33b6704/vmlinux-8ab1afb2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aa0bdf390bbc/bzImage-8ab1afb2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+23b25ba3c6bf971f9c57@syzkaller.appspotmail.com

get_swap_device: Bad swap file entry 7c00000000000002
------------[ cut here ]------------
!si
WARNING: mm/swapfile.c:2130 at swap_put_entries_direct+0x17d/0x1b0 mm/swapfile.c:2130, CPU#1: udevd/13167
Modules linked in:
CPU: 1 UID: 0 PID: 13167 Comm: udevd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:swap_put_entries_direct+0x17d/0x1b0 mm/swapfile.c:2130
Code: 00 00 00 00 48 8b 44 24 58 65 48 2b 05 64 fa 15 12 75 3b 48 83 c4 60 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc e8 74 a6 95 ff 90 <0f> 0b 90 eb be e8 69 a6 95 ff 90 0f 0b 90 eb a6 e8 5e bf 07 00 e9
RSP: 0018:ffffc90004d9f628 EFLAGS: 00010293
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: ffff888049448000 RSI: ffffffff827595bc RDI: fffff520009b3ea4
RBP: 0000000000000003 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000000 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: 1ffff920009b3ec5 R15: ffffc90004d9f6e0
FS:  00007fcd01ba2880(0000) GS:ffff888096a67000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f740d2a8 CR3: 00000000703ea000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 shmem_free_swap+0x1f4/0x200 mm/shmem.c:996
 shmem_undo_range+0x3fd/0x1570 mm/shmem.c:1151
 shmem_truncate_range mm/shmem.c:1289 [inline]
 shmem_evict_inode+0x3b1/0xca0 mm/shmem.c:1420
 evict+0x3c2/0xad0 fs/inode.c:822
 iput_final fs/inode.c:2015 [inline]
 iput.part.0+0x989/0x1050 fs/inode.c:2064
 iput+0x35/0x40 fs/inode.c:2030
 filename_unlinkat+0x466/0x730 fs/namei.c:5723
 __do_sys_unlink fs/namei.c:5754 [inline]
 __se_sys_unlink fs/namei.c:5751 [inline]
 __x64_sys_unlink+0x46/0x70 fs/namei.c:5751
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcd01515937
Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007ffc4214fcf8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 00007ffc4214fd00 RCX: 00007fcd01515937
RDX: 0000000000000000 RSI: 00000000000003ed RDI: 00007ffc4214fd00
RBP: 000055f191cfee00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 000000000aba9500
R13: 0000000003938700 R14: 000055f18779e100 R15: 000055f18779e140
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] WARNING in swap_put_entries_direct

[Andrew Morton]

On Mon, 07 Sep 2026 18:22:24 -0700 syzbot <syzbot+23b25ba3c6bf971f9c57@syzkaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8ab1afb2eb24 Merge tag 'for-7.3/dm-fixes' of git://git.ker..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1034a125580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
> dashboard link: https://syzkaller.appspot.com/bug?extid=23b25ba3c6bf971f9c57
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> userspace arch: i386
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8ab1afb2.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/4767b33b6704/vmlinux-8ab1afb2.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/aa0bdf390bbc/bzImage-8ab1afb2.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+23b25ba3c6bf971f9c57@syzkaller.appspotmail.com
> 
> get_swap_device: Bad swap file entry 7c00000000000002

hm, thanks.

https://syzkaller.appspot.com/x/log.txt?x=1034a125580000 reveals a huge
storm of I/O errors:

[ 1175.396574][ T1132] ata2: SATA link down (SStatus 0 SControl 300)
[ 1175.417415][ T1123] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 1175.421618][ T1123] ata1.00: configured for UDMA/100
[ 1175.447991][ T1137] ata3: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 1175.456823][ T1137] ata3.00: configured for UDMA/100
[ 1175.614247][ T5836] usb usb50-port1: unable to enumerate USB device
[ 1175.647906][ T5108] Aborting journal on device sda1-8.
[ 1175.651011][T12337] buffer_io_error: 18 callbacks suppressed
[ 1175.651033][T12337] Buffer I/O error on dev sda1, logical block 131072, lost sync page write
[ 1175.657294][T20237] EXT4-fs error (device sda1): ext4_journal_check_start:94: comm syz.5.3709: Detected aborted journal
[ 1175.665579][ T5108] JBD2: I/O error when updating journal superblock for sda1-8.
[ 1175.673842][T20239] EXT4-fs error (device sda1): ext4_journal_check_start:94: comm syz.6.3710: Detected aborted journal
[ 1175.721163][ T5923] Buffer I/O error on dev sda1, logical block 0, lost sync page write
[ 1175.723567][T20239] EXT4-fs (sda1): previous I/O error to superblock detected
[ 1175.730930][ T5923] Buffer I/O error on dev sda1, logical block 0, lost sync page write
[ 1175.731190][T20239] EXT4-fs (sda1): I/O error while writing superblock
[ 1175.731223][T20239] EXT4-fs (sda1): Remounting filesystem read-only
[ 1175.791874][T11112] Read-error on swap-device (8:0:516182)
[ 1175.863539][T10850] Read-error on swap-device (8:0:364134)
[ 1175.888507][T20241] EXT4-fs (sda1): shut down requested (2)
[ 1175.908145][ T5726] Read-error on swap-device (8:0:332990)
[ 1175.908919][ T5923] Read-error on swap-device (8:0:333014)
[ 1175.909235][ T5923] Read-error on swap-device (8:0:313854)
[ 1175.939843][T11112] Read-error on swap-device (8:0:356918)
[ 1175.967225][ T5148] Read-error on swap-device (8:0:364766)
[ 1175.979645][ T5724] Read-error on sw


So I suspect something's wrong with shmem/swap error handling.  ie, the
code which doesn't get tested :(

> ------------[ cut here ]------------
> !si
> WARNING: mm/swapfile.c:2130 at swap_put_entries_direct+0x17d/0x1b0 mm/swapfile.c:2130, CPU#1: udevd/13167