linux-kernel - Re: [syzbot] [mm?] BUG: Bad page map (8)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00000000000001bf0f061da1f368@google.com>
Date: Fri, 19 Jul 2024 16:21:04 -0700
From: syzbot <syzbot+ec4b7d82bb051330f15a@...kaller.appspotmail.com>
To: hdanton@...a.com, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] BUG: Bad page map (8)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in truncate_inode_folio

------------[ cut here ]------------
kernel BUG at mm/truncate.c:195!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3864 Comm: syz.0.15 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b-dirty #0
Hardware name: linux,dummy-virt (DT)
pstate: 21400009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : truncate_inode_folio mm/truncate.c:195 [inline]
pc : truncate_inode_folio+0x70/0x7c mm/truncate.c:189
lr : truncate_inode_folio+0x28/0x7c mm/truncate.c:194
sp : ffff800089763970
x29: ffff800089763970 x28: 0000000000000000 x27: ffffc1ffc01a0e00
x26: 0000000000000000 x25: ffff800089763a28 x24: ffffffffffffffff
x23: ffff800089763a30 x22: 0000000000000000 x21: f7f0000007441b18
x20: f7f0000007441b10 x19: ffffc1ffc01a0e00 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000005 x7 : f7f0000007441ba8 x6 : ffff800089763950
x5 : 0000000000000000 x4 : f9f0000005f48410 x3 : f7f0000007441ba8
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace:
 truncate_inode_folio+0x70/0x7c mm/truncate.c:195
 shmem_undo_range+0x208/0x620 mm/shmem.c:1012
 shmem_truncate_range mm/shmem.c:1125 [inline]
 shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253
 evict+0xb4/0x198 fs/inode.c:667
 iput_final fs/inode.c:1741 [inline]
 iput fs/inode.c:1767 [inline]
 iput+0x100/0x1b8 fs/inode.c:1753
 dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404
 __dentry_kill+0x7c/0x1d4 fs/dcache.c:607
 dput.part.0+0x30/0xbc fs/dcache.c:849
 dput+0x4c/0x50 fs/dcache.c:860
 __fput+0x110/0x2d4 fs/file_table.c:430
 ____fput+0x10/0x1c fs/file_table.c:450
 task_work_run+0x78/0xd0 kernel/task_work.c:180
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 do_notify_resume+0x134/0x164 arch/arm64/kernel/entry-common.c:151
 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]
 el0_svc+0xc8/0xf8 arch/arm64/kernel/entry-common.c:713
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: b9405260 11000400 7100001f 54fffecd (d4210000) 
---[ end trace 0000000000000000 ]---


Tested on:

commit:         4d145e3f Merge tag 'i2c-for-6.10-rc8' of git://git.ker..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15ef360d980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6b5a15443200e31
dashboard link: https://syzkaller.appspot.com/bug?extid=ec4b7d82bb051330f15a
compiler:       aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16d7443d980000