From: syzbot <syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] BUG: Bad page map (8)
Date: Fri, 19 Jul 2024 06:14:02 -0700 [thread overview]
Message-ID: <0000000000001fa07f061d997826@google.com> (raw)
In-Reply-To: <20240719130043.1621-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: Bad page cache in process syz.NUM.NUM pfn:4a961
BUG: Bad page cache in process syz.0.15 pfn:4a961
page: refcount:4 mapcount:1 mapping:000000007efdb730 index:0x0 pfn:0x4a961
memcg:f8f00000073c6000
aops:shmem_aops ino:401
flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002d ffffc1ffc01bf9c8 ffffc1ffc038adc8 f0f00000061e6ab0
raw: 0000000000000000 0000000000000000 0000000400000000 f8f00000073c6000
page dumped because: still mapped when deleted
CPU: 1 PID: 3851 Comm: syz.0.15 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b-dirty #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
__filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
truncate_inode_folio+0x30/0x4c mm/truncate.c:195
shmem_undo_range+0x208/0x620 mm/shmem.c:1012
shmem_truncate_range mm/shmem.c:1125 [inline]
shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
evict+0xb4/0x198 fs/inode.c:667
iput_final fs/inode.c:1741 [inline]
iput fs/inode.c:1767 [inline]
iput+0x100/0x1b8 fs/inode.c:1753
dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
__dentry_kill+0x7c/0x1d4 fs/dcache.c:607
dput.part.0+0x30/0xbc fs/dcache.c:849
dput+0x4c/0x50 fs/dcache.c:860
__fput+0x110/0x2d4 fs/file_table.c:430
____fput+0x10/0x1c fs/file_table.c:450
task_work_run+0x78/0xd0 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
do_notify_resume+0x134/0x164 arch/arm64/kernel/entry-common.c:151
exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]
el0_svc+0xc8/0xf8 arch/arm64/kernel/entry-common.c:713
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
BUG: Bad page cache in process syz.0.15 pfn:4e2b7
page: refcount:4 mapcount:1 mapping:000000007efdb730 index:0x1 pfn:0x4e2b7
memcg:f8f00000073c6000
aops:shmem_aops ino:401
flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc0000004002d ffffc1ffc02a5848 ffffc1ffc02d1a88 f0f00000061e6ab0
raw: 0000000000000001 0000000000000000 0000000400000000 f8f00000073c6000
page dumped because: still mapped when deleted
CPU: 1 PID: 3851 Comm: syz.0.15 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b-dirty #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
dump_stack+0x18/0x24 lib/dump_stack.c:123
filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167
__filemap_remove_folio+0x3c/0x178 mm/filemap.c:231
filemap_remove_folio+0x48/0xa8 mm/filemap.c:264
truncate_inode_folio+0x30/0x4c mm/truncate.c:195
shmem_undo_range+0x208/0x620 mm/shmem.c:1012
shmem_truncate_range mm/shmem.c:1125 [inline]
shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
evict+0xb4/0x198 fs/inode.c:667
iput_final fs/inode.c:1741 [inline]
iput fs/inode.c:1767 [inline]
iput+0x100/0x1b8 fs/inode.c:1753
dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
__dentry_kill+0x7c/0x1d4 fs/dcache.c:607
dput.part.0+0x30/0xbc fs/dcache.c:849
dput+0x4c/0x50 fs/dcache.c:860
__fput+0x110/0x2d4 fs/file_table.c:430
____fput+0x10/0x1c fs/file_table.c:450
task_work_run+0x78/0xd0 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
do_notify_resume+0x134/0x164 arch/arm64/kernel/entry-common.c:151
exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]
el0_svc+0xc8/0xf8 arch/arm64/kernel/entry-common.c:713
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Tested on:
commit: 4d145e3f Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=14caa0ad980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=10541fe1980000
next prev parent reply other threads:[~2024-07-19 13:14 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-18 22:51 [syzbot] [mm?] BUG: Bad page map (8) syzbot
2024-07-19 11:07 ` Hillf Danton
2024-07-19 11:44 ` syzbot
2024-07-19 11:21 ` David Hildenbrand
2024-07-20 5:02 ` Hillf Danton
2024-07-20 6:30 ` Kasireddy, Vivek
2024-07-22 13:23 ` David Hildenbrand
2024-07-19 13:00 ` Hillf Danton
2024-07-19 13:14 ` syzbot [this message]
2024-07-19 23:08 ` Hillf Danton
2024-07-19 23:21 ` syzbot
2024-07-20 6:32 ` Kasireddy, Vivek
2024-07-20 7:01 ` syzbot
2024-07-23 10:37 ` Hillf Danton
2024-07-23 10:52 ` syzbot
2024-09-30 0:02 ` syzbot
2024-09-30 13:52 ` Matthew Wilcox
2024-12-27 17:02 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000001fa07f061d997826@google.com \
--to=syzbot+ec4b7d82bb051330f15a@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox