linux-kernel - Re: WARNING in unaccount_page_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Fri, 29 Nov 2019 15:41:44 +0100
From:   Vlastimil Babka <vbabka@...e.cz>
To:     syzbot <syzbot+fe601f9e887449d40112@...kaller.appspotmail.com>,
        akpm@...ux-foundation.org, amir73il@...il.com,
        darrick.wong@...cle.com, dchinner@...hat.com, hannes@...xchg.org,
        josef@...icpanda.com, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, syzkaller-bugs@...glegroups.com,
        willy@...radead.org, Jan Kara <jack@...e.cz>
Subject: Re: WARNING in unaccount_page_cache_page

On 11/29/19 9:19 AM, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    089cf7f6 Linux 5.3-rc7

Ugh, why test previous cycle's rc7 now? Typo for 5.4?

> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1210a761600000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=b89bb446a3faaba4
> dashboard link: https://syzkaller.appspot.com/bug?extid=fe601f9e887449d40112
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> 
> Unfortunately, I don't have any reproducer for this crash yet.
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+fe601f9e887449d40112@...kaller.appspotmail.com
> 
> WARNING: CPU: 0 PID: 12560 at mm/filemap.c:220  
> unaccount_page_cache_page+0x65b/0xda0 mm/filemap.c:220

That's this warning:

        /*
         * At this point page must be either written or cleaned by
         * truncate.  Dirty page here signals a bug and loss of
         * unwritten data.
         *
         * This fixes dirty accounting after removing the page entirely
         * but leaves PageDirty set: it has no effect for truncated
         * page and anyway will be cleared before returning page into
         * buddy allocator.
         */
        if (WARN_ON_ONCE(PageDirty(page)))
                account_page_cleaned(page, mapping,
inode_to_wb(mapping->host));

CC Jan

> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 0 PID: 12560 Comm: syz-executor.2 Not tainted 5.3.0-rc7 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
> Google 01/01/2011
> Call Trace:
>   __dump_stack lib/dump_stack.c:77 [inline]
>   dump_stack+0x172/0x1f0 lib/dump_stack.c:113
>   panic+0x2dc/0x755 kernel/panic.c:219
>   __warn.cold+0x20/0x4c kernel/panic.c:576
>   report_bug+0x263/0x2b0 lib/bug.c:186
>   fixup_bug arch/x86/kernel/traps.c:179 [inline]
>   fixup_bug arch/x86/kernel/traps.c:174 [inline]
>   do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
>   do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
>   invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
> RIP: 0010:unaccount_page_cache_page+0x65b/0xda0 mm/filemap.c:220
> Code: 00 0f 85 be 06 00 00 49 8b 5d 00 31 ff 48 c1 eb 03 83 e3 01 48 89 de  
> e8 c3 25 e4 ff 48 85 db 0f 84 c0 fb ff ff e8 15 24 e4 ff <0f> 0b 48 b8 00  
> 00 00 00 00 fc ff df 48 8b 55 d0 48 c1 ea 03 80 3c
> RSP: 0018:ffff888060b7f9b8 EFLAGS: 00010016
> RAX: 0000000000040000 RBX: 0000000000000001 RCX: ffffc9000a781000
> RDX: 0000000000001dcb RSI: ffffffff818e513b RDI: 0000000000000007
> RBP: ffff888060b7f9f8 R08: ffff8880584de400 R09: fffff940003f9169
> R10: fffff940003f9168 R11: ffffea0001fc8b47 R12: ffffea0001fc8b40
> R13: ffffea0001fc8b40 R14: ffffea0001fc8b40 R15: ffffea0001fc8b88
>   delete_from_page_cache_batch+0x1e9/0x1170 mm/filemap.c:350
>   truncate_inode_pages_range+0x622/0x1740 mm/truncate.c:366
>   blkdev_fallocate+0x23a/0x410 fs/block_dev.c:2081
>   vfs_fallocate+0x4aa/0xa50 fs/open.c:309
>   ksys_fallocate+0x58/0xa0 fs/open.c:332
>   __do_sys_fallocate fs/open.c:340 [inline]
>   __se_sys_fallocate fs/open.c:338 [inline]
>   __x64_sys_fallocate+0x97/0xf0 fs/open.c:338
>   do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
>   entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x459879
> Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7  
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
> ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007fd75e4bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
> RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459879
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000004
> RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
> R10: 00000000369e5d84 R11: 0000000000000246 R12: 00007fd75e4c06d4
> R13: 00000000004bffbd R14: 00000000004d1fc0 R15: 00000000ffffffff
> Shutting down cpus with NMI
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
> 
> 
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@...glegroups.com.
> 
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>