linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
From: Matthew Wilcox <willy@infradead.org>
To: syzbot <syzbot+c87be4f669d920c76330@syzkaller.appspotmail.com>
Cc: akpm@linux-foundation.org, bp@alien8.de, frederic@kernel.org,
	hpa@zytor.com, jmattson@google.com, joro@8bytes.org,
	kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-mm@kvack.org, mark.rutland@arm.com, masahiroy@kernel.org,
	mingo@redhat.com, npiggin@gmail.com, pbonzini@redhat.com,
	peterz@infradead.org, rafael.j.wysocki@intel.com,
	rostedt@goodmis.org, seanjc@google.com, sedat.dilek@gmail.com,
	syzkaller-bugs@googlegroups.com, tglx@linutronix.de,
	vitor@massaru.org, vkuznets@redhat.com, wanpengli@tencent.com,
	will@kernel.org, x86@kernel.org
Subject: Re: [syzbot] kernel BUG in find_lock_entries
Date: Mon, 9 Aug 2021 23:50:29 +0100	[thread overview]
Message-ID: <YRGxNaVc1cGsyd0Y@casper.infradead.org> (raw)
In-Reply-To: <0000000000009cfcda05c926b34b@google.com>

On Mon, Aug 09, 2021 at 02:02:22PM -0700, syzbot wrote:
> The issue was bisected to:
> 
> commit 997acaf6b4b59c6a9c259740312a69ea549cc684
> Author: Mark Rutland <mark.rutland@arm.com>
> Date:   Mon Jan 11 15:37:07 2021 +0000
> 
>     lockdep: report broken irq restoration

That's just a bogus bisection.  The correct bad commit is 5c211ba29deb.

> kernel BUG at mm/filemap.c:2041!
> invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> CPU: 1 PID: 24786 Comm: syz-executor626 Not tainted 5.14.0-rc4-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:find_lock_entries+0x10d5/0x1110 mm/filemap.c:2041

This patch should fix it.  It's not just removing the warning; this
warning duplicates the warning a few lines down (after taking the
lock).  It's not safe to make this assertion without holding the page
lock as the page can move between the page cache and the swap cache.

#syz test

diff --git a/mm/filemap.c b/mm/filemap.c
index d1458ecf2f51..34de0b14aaa9 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2038,7 +2038,6 @@ unsigned find_lock_entries(struct address_space *mapping, pgoff_t start,
 		if (!xa_is_value(page)) {
 			if (page->index < start)
 				goto put;
-			VM_BUG_ON_PAGE(page->index != xas.xa_index, page);
 			if (page->index + thp_nr_pages(page) - 1 > end)
 				goto put;
 			if (!trylock_page(page))


  reply	other threads:[~2021-08-09 22:53 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-09 21:02 [syzbot] kernel BUG in find_lock_entries syzbot
2021-08-09 22:50 ` Matthew Wilcox [this message]
2021-08-09 22:51   ` syzbot
2021-08-09 22:54   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YRGxNaVc1cGsyd0Y@casper.infradead.org \
    --to=willy@infradead.org \
    --cc=akpm@linux-foundation.org \
    --cc=bp@alien8.de \
    --cc=frederic@kernel.org \
    --cc=hpa@zytor.com \
    --cc=jmattson@google.com \
    --cc=joro@8bytes.org \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mark.rutland@arm.com \
    --cc=masahiroy@kernel.org \
    --cc=mingo@redhat.com \
    --cc=npiggin@gmail.com \
    --cc=pbonzini@redhat.com \
    --cc=peterz@infradead.org \
    --cc=rafael.j.wysocki@intel.com \
    --cc=rostedt@goodmis.org \
    --cc=seanjc@google.com \
    --cc=sedat.dilek@gmail.com \
    --cc=syzbot+c87be4f669d920c76330@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tglx@linutronix.de \
    --cc=vitor@massaru.org \
    --cc=vkuznets@redhat.com \
    --cc=wanpengli@tencent.com \
    --cc=will@kernel.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).