WARNING in alloc_page_buffers

* WARNING in alloc_page_buffers
@ 2020-03-21 20:00 syzbot
  2020-03-21 20:07 ` Andrew Morton
  0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2020-03-21 20:00 UTC (permalink / raw)
  To: akpm, hannes, linux-fsdevel, linux-kernel, schatzberg.dan, sfr,
	syzkaller-bugs, viro

Hello,

syzbot found the following crash on:

HEAD commit:    770fbb32 Add linux-next specific files for 20200228
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13507489e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=576314276bce4ad5
dashboard link: https://syzkaller.appspot.com/bug?extid=0985c7ea18137bf0c4ca
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b970e5e00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=178e99f9e00000

The bug was bisected to:

commit c9e1feb96bd90a4b51d440a015ba2f1c0562de59
Author: Dan Schatzberg <schatzberg.dan@gmail.com>
Date:   Tue Feb 25 04:14:08 2020 +0000

    loop: charge i/o to mem and blk cg

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=102199f9e00000
final crash:    https://syzkaller.appspot.com/x/report.txt?x=122199f9e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=142199f9e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0985c7ea18137bf0c4ca@syzkaller.appspotmail.com
Fixes: c9e1feb96bd9 ("loop: charge i/o to mem and blk cg")

------------[ cut here ]------------
WARNING: CPU: 1 PID: 170 at include/linux/sched/mm.h:323 memalloc_use_memcg include/linux/sched/mm.h:323 [inline]
WARNING: CPU: 1 PID: 170 at include/linux/sched/mm.h:323 alloc_page_buffers+0x41f/0x590 fs/buffer.c:866
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 170 Comm: kworker/u4:4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: loop-2074257985 loop_workfn
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:221
 __warn.cold+0x2f/0x35 kernel/panic.c:582
 report_bug+0x27b/0x2f0 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:175 [inline]
 fixup_bug arch/x86/kernel/traps.c:170 [inline]
 do_error_trap+0x12b/0x220 arch/x86/kernel/traps.c:267
 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:memalloc_use_memcg include/linux/sched/mm.h:323 [inline]
RIP: 0010:alloc_page_buffers+0x41f/0x590 fs/buffer.c:866
Code: 39 a9 ff e8 e3 fb 96 ff e8 3e 39 a9 ff 48 c7 c6 33 5c c9 81 48 c7 c7 80 dc 9a 89 e8 9b 9d 8f ff e9 a3 fe ff ff e8 21 39 a9 ff <0f> 0b e9 61 fc ff ff e8 15 39 a9 ff e8 30 41 96 ff 31 ff 89 c3 89
RSP: 0018:ffffc90001607110 EFLAGS: 00010293
RAX: ffff8880a8820440 RBX: ffff8880a8820440 RCX: 1ffff1101510419a
RDX: 0000000000000000 RSI: ffffffff81c95c5f RDI: ffff8880a8821808
RBP: ffffea000239c480 R08: ffff8880a8820440 R09: fffffbfff150c429
R10: fffffbfff150c428 R11: ffffffff8a862147 R12: 0000000000001000
R13: 0000000000001000 R14: 0000000000408c40 R15: ffffea000239c480
 create_empty_buffers+0x2c/0x8c0 fs/buffer.c:1595
 create_page_buffers+0x2b0/0x400 fs/buffer.c:1712
 __block_write_full_page+0xf7/0x11b0 fs/buffer.c:1758
 block_write_full_page+0x21a/0x270 fs/buffer.c:3030
 __writepage+0x62/0x100 mm/page-writeback.c:2303
 write_cache_pages+0x799/0x12f0 mm/page-writeback.c:2238
 generic_writepages mm/page-writeback.c:2329 [inline]
 generic_writepages+0xed/0x160 mm/page-writeback.c:2318
 do_writepages+0xfa/0x2a0 mm/page-writeback.c:2344
 __filemap_fdatawrite_range+0x2aa/0x390 mm/filemap.c:421
 ? 0xffffffff81000000
 filemap_write_and_wait_range mm/filemap.c:654 [inline]
 filemap_write_and_wait_range+0xf7/0x1e0 mm/filemap.c:648
 generic_file_read_iter+0x11bd/0x2a40 mm/filemap.c:2272
 blkdev_read_iter+0x11b/0x180 fs/block_dev.c:2039
 call_read_iter include/linux/fs.h:1895 [inline]
 lo_rw_aio+0xc96/0xf20 drivers/block/loop.c:572
 do_req_filebacked drivers/block/loop.c:620 [inline]
 loop_handle_cmd drivers/block/loop.c:2060 [inline]
 loop_process_work+0x147b/0x29d0 drivers/block/loop.c:2096
 process_one_work+0x94b/0x1690 kernel/workqueue.c:2266
 worker_thread+0x96/0xe20 kernel/workqueue.c:2412
 kthread+0x357/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 3+ messages in thread