Hello,
syzbot found the following issue on:
HEAD commit: 42eb8fdac2fc Merge tag 'gfs2-v5.16-rc2-fixes' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1483f0e9b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=b7264d1cb8ba2795
dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
------------[ cut here ]------------
page_counter underflow: -4294964789 nr_pages=4294967295
WARNING: CPU: 2 PID: 3785 at mm/page_counter.c:56 page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56
Modules linked in:
CPU: 2 PID: 3785 Comm: kworker/2:6 Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Workqueue: events mptcp_worker
RIP: 0010:page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56
Code: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 2a 2b b5 ff 4c 89 ea 48 89 ee 48 c7 c7 00 9e b8 89 c6 05 a0 c1 ba 0b 01 e8 95 e4 4b 07 <0f> 0b eb a8 4c 89 e7 e8 25 5a fb ff eb c7 0f 1f 00 41 56 41 55 49
RSP: 0018:ffffc90002d4f918 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff88806a494120 RCX: 0000000000000000
RDX: ffff8880688c41c0 RSI: ffffffff815e8f28 RDI: fffff520005a9f15
RBP: ffffffff000009cb R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815e2cfe R11: 0000000000000000 R12: ffff88806a494120
R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2de21000 CR3: 000000005ad59000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
page_counter_uncharge+0x2e/0x60 mm/page_counter.c:160
drain_stock+0xc1/0x180 mm/memcontrol.c:2219
refill_stock+0x139/0x2f0 mm/memcontrol.c:2271
__sk_mem_reduce_allocated+0x24d/0x550 net/core/sock.c:2945
__mptcp_rmem_reclaim net/mptcp/protocol.c:167 [inline]
__mptcp_mem_reclaim_partial+0x124/0x410 net/mptcp/protocol.c:975
mptcp_mem_reclaim_partial net/mptcp/protocol.c:982 [inline]
mptcp_alloc_tx_skb net/mptcp/protocol.c:1212 [inline]
mptcp_sendmsg_frag+0x18c6/0x2190 net/mptcp/protocol.c:1279
__mptcp_push_pending+0x232/0x720 net/mptcp/protocol.c:1545
mptcp_release_cb+0xfe/0x200 net/mptcp/protocol.c:2975
release_sock+0xb4/0x1b0 net/core/sock.c:3306
mptcp_worker+0x51e/0xc10 net/mptcp/protocol.c:2443
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot has found a reproducer for the following issue on:
HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8
dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
</TASK>
------------[ cut here ]------------
page_counter underflow: -4294966651 nr_pages=4294967295
WARNING: CPU: 1 PID: 3665 at mm/page_counter.c:56 page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56 mm/page_counter.c:56
Modules linked in:
CPU: 1 PID: 3665 Comm: syz-executor933 Not tainted 5.16.0-rc5-next-20211216-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56 mm/page_counter.c:56
Code: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 ba 77 af ff 4c 89 ea 48 89 ee 48 c7 c7 60 fe b8 89 c6 05 5f b3 b5 0b 01 e8 a6 85 48 07 <0f> 0b eb a8 4c 89 e7 e8 d5 85 fa ff eb c7 0f 1f 00 41 56 41 55 49
RSP: 0018:ffffc90002b1f620 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff88807b6e8120 RCX: 0000000000000000
RDX: ffff88807ad31d40 RSI: ffffffff815f4748 RDI: fffff52000563eb6
RBP: ffffffff00000285 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff815ee4ae R11: 0000000000000000 R12: ffff88807b6e8120
R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001
FS: 000055555596c300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 000000007f24a000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
page_counter_uncharge+0x2e/0x60 mm/page_counter.c:159 mm/page_counter.c:159
drain_stock+0xc1/0x170 mm/memcontrol.c:2172 mm/memcontrol.c:2172
refill_stock+0x131/0x1b0 mm/memcontrol.c:2224 mm/memcontrol.c:2224
__sk_mem_reduce_allocated+0x24d/0x550 net/core/sock.c:2951 net/core/sock.c:2951
__mptcp_rmem_reclaim net/mptcp/protocol.c:169 [inline]
__mptcp_rmem_reclaim net/mptcp/protocol.c:169 [inline] net/mptcp/protocol.c:978
__mptcp_mem_reclaim_partial+0x124/0x410 net/mptcp/protocol.c:978 net/mptcp/protocol.c:978
mptcp_mem_reclaim_partial net/mptcp/protocol.c:985 [inline]
mptcp_alloc_tx_skb net/mptcp/protocol.c:1215 [inline]
mptcp_mem_reclaim_partial net/mptcp/protocol.c:985 [inline] net/mptcp/protocol.c:1282
mptcp_alloc_tx_skb net/mptcp/protocol.c:1215 [inline] net/mptcp/protocol.c:1282
mptcp_sendmsg_frag+0x1ada/0x2410 net/mptcp/protocol.c:1282 net/mptcp/protocol.c:1282
__mptcp_push_pending+0x232/0x7a0 net/mptcp/protocol.c:1548 net/mptcp/protocol.c:1548
mptcp_release_cb+0xfe/0x200 net/mptcp/protocol.c:3013 net/mptcp/protocol.c:3013
release_sock+0xb4/0x1b0 net/core/sock.c:3312 net/core/sock.c:3312
sk_stream_wait_memory+0x608/0xed0 net/core/stream.c:145 net/core/stream.c:145
mptcp_sendmsg+0x8df/0x1300 net/mptcp/protocol.c:1745 net/mptcp/protocol.c:1745
inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:641 net/ipv6/af_inet6.c:641
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:724
sock_sendmsg+0xcf/0x120 net/socket.c:724 net/socket.c:724
sock_write_iter+0x289/0x3c0 net/socket.c:1057 net/socket.c:1057
call_write_iter include/linux/fs.h:2079 [inline]
call_write_iter include/linux/fs.h:2079 [inline] fs/read_write.c:503
new_sync_write+0x429/0x660 fs/read_write.c:503 fs/read_write.c:503
vfs_write+0x7cd/0xae0 fs/read_write.c:590 fs/read_write.c:590
ksys_write+0x1ee/0x250 fs/read_write.c:643 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_x64 arch/x86/entry/common.c:50 [inline] arch/x86/entry/common.c:80
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f4cc423cf49
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdeb8585f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4cc423cf49
RDX: 0000000000017f88 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00007ffdeb858620 R08: 0000000000000001 R09: 00007ffdeb858630
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
</TASK>
syzbot has bisected this issue to:
commit 22849b5ea5952d853547cc5e0651f34a246b2a4f
Author: Leon Romanovsky <[email protected]>
Date: Thu Oct 21 14:16:14 2021 +0000
devlink: Remove not-executed trap policer notifications
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16464095b00000
start commit: 158b515f703e tun: avoid double free in tun_free_netdev
git tree: net
final oops: https://syzkaller.appspot.com/x/report.txt?x=15464095b00000
console output: https://syzkaller.appspot.com/x/log.txt?x=11464095b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa556098924b78f0
dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ff127eb00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11bedb6db00000
Reported-by: [email protected]
Fixes: 22849b5ea595 ("devlink: Remove not-executed trap policer notifications")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
On Sat, 18 Dec 2021 06:04:22 -0800 syzbot <[email protected]> wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8
> dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000
Useful to have that, thanks.
I'm suspecting that mptcp is doing something strange. Could I as the
developers to please take a look?
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
> </TASK>
> ------------[ cut here ]------------
> page_counter underflow: -4294966651 nr_pages=4294967295
> WARNING: CPU: 1 PID: 3665 at mm/page_counter.c:56 page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56 mm/page_counter.c:56
> Modules linked in:
> CPU: 1 PID: 3665 Comm: syz-executor933 Not tainted 5.16.0-rc5-next-20211216-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56 mm/page_counter.c:56
> Code: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 ba 77 af ff 4c 89 ea 48 89 ee 48 c7 c7 60 fe b8 89 c6 05 5f b3 b5 0b 01 e8 a6 85 48 07 <0f> 0b eb a8 4c 89 e7 e8 d5 85 fa ff eb c7 0f 1f 00 41 56 41 55 49
> RSP: 0018:ffffc90002b1f620 EFLAGS: 00010086
> RAX: 0000000000000000 RBX: ffff88807b6e8120 RCX: 0000000000000000
> RDX: ffff88807ad31d40 RSI: ffffffff815f4748 RDI: fffff52000563eb6
> RBP: ffffffff00000285 R08: 0000000000000000 R09: 0000000000000001
> R10: ffffffff815ee4ae R11: 0000000000000000 R12: ffff88807b6e8120
> R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001
> FS: 000055555596c300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000020000080 CR3: 000000007f24a000 CR4: 00000000003506e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> page_counter_uncharge+0x2e/0x60 mm/page_counter.c:159 mm/page_counter.c:159
> drain_stock+0xc1/0x170 mm/memcontrol.c:2172 mm/memcontrol.c:2172
> refill_stock+0x131/0x1b0 mm/memcontrol.c:2224 mm/memcontrol.c:2224
> __sk_mem_reduce_allocated+0x24d/0x550 net/core/sock.c:2951 net/core/sock.c:2951
> __mptcp_rmem_reclaim net/mptcp/protocol.c:169 [inline]
> __mptcp_rmem_reclaim net/mptcp/protocol.c:169 [inline] net/mptcp/protocol.c:978
> __mptcp_mem_reclaim_partial+0x124/0x410 net/mptcp/protocol.c:978 net/mptcp/protocol.c:978
> mptcp_mem_reclaim_partial net/mptcp/protocol.c:985 [inline]
> mptcp_alloc_tx_skb net/mptcp/protocol.c:1215 [inline]
> mptcp_mem_reclaim_partial net/mptcp/protocol.c:985 [inline] net/mptcp/protocol.c:1282
> mptcp_alloc_tx_skb net/mptcp/protocol.c:1215 [inline] net/mptcp/protocol.c:1282
> mptcp_sendmsg_frag+0x1ada/0x2410 net/mptcp/protocol.c:1282 net/mptcp/protocol.c:1282
> __mptcp_push_pending+0x232/0x7a0 net/mptcp/protocol.c:1548 net/mptcp/protocol.c:1548
> mptcp_release_cb+0xfe/0x200 net/mptcp/protocol.c:3013 net/mptcp/protocol.c:3013
> release_sock+0xb4/0x1b0 net/core/sock.c:3312 net/core/sock.c:3312
> sk_stream_wait_memory+0x608/0xed0 net/core/stream.c:145 net/core/stream.c:145
> mptcp_sendmsg+0x8df/0x1300 net/mptcp/protocol.c:1745 net/mptcp/protocol.c:1745
> inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:641 net/ipv6/af_inet6.c:641
> sock_sendmsg_nosec net/socket.c:704 [inline]
> sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:724
> sock_sendmsg+0xcf/0x120 net/socket.c:724 net/socket.c:724
> sock_write_iter+0x289/0x3c0 net/socket.c:1057 net/socket.c:1057
> call_write_iter include/linux/fs.h:2079 [inline]
> call_write_iter include/linux/fs.h:2079 [inline] fs/read_write.c:503
> new_sync_write+0x429/0x660 fs/read_write.c:503 fs/read_write.c:503
> vfs_write+0x7cd/0xae0 fs/read_write.c:590 fs/read_write.c:590
> ksys_write+0x1ee/0x250 fs/read_write.c:643 fs/read_write.c:643
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_x64 arch/x86/entry/common.c:50 [inline] arch/x86/entry/common.c:80
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f4cc423cf49
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffdeb8585f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4cc423cf49
> RDX: 0000000000017f88 RSI: 0000000020000000 RDI: 0000000000000003
> RBP: 00007ffdeb858620 R08: 0000000000000001 R09: 00007ffdeb858630
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
> R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
> </TASK>
On Tue 21-12-21 15:57:36, Andrew Morton wrote:
> On Sat, 18 Dec 2021 06:04:22 -0800 syzbot <[email protected]> wrote:
>
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
> > git tree: linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8
> > dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
> > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000
>
> Useful to have that, thanks.
>
> I'm suspecting that mptcp is doing something strange.
Yes.
> Could I as the
> developers to please take a look?
>
>
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: [email protected]
> >
> > R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
> > </TASK>
> > ------------[ cut here ]------------
> > page_counter underflow: -4294966651 nr_pages=4294967295
__mptcp_mem_reclaim_partial is trying to uncharge (via
__sk_mem_reduce_allocated) negative amount. nr_pages has overflown when
converted from int to unsigned int (-1). I would say that
__mptcp_mem_reclaim_partial has evaluated
reclaimable = mptcp_sk(sk)->rmem_fwd_alloc - sk_unused_reserved_mem(sk)
to 0 and __mptcp_rmem_reclaim(sk, reclaimable - 1) made it -1.
--
Michal Hocko
SUSE Labs
On Wed, 29 Dec 2021, Michal Hocko wrote:
> On Tue 21-12-21 15:57:36, Andrew Morton wrote:
>> On Sat, 18 Dec 2021 06:04:22 -0800 syzbot <[email protected]> wrote:
>>
>>> syzbot has found a reproducer for the following issue on:
>>>
>>> HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
>>> git tree: linux-next
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
>>> kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
>>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000
>>
>> Useful to have that, thanks.
>>
>> I'm suspecting that mptcp is doing something strange.
>
> Yes.
>
>> Could I as the
>> developers to please take a look?
>>
Andrew -
Yes, we'll get a fix in to net-next soon - thanks for adding the mptcp &
netdev lists.
>>
>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>> Reported-by: [email protected]
>>>
>>> R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
>>> </TASK>
>>> ------------[ cut here ]------------
>>> page_counter underflow: -4294966651 nr_pages=4294967295
>
> __mptcp_mem_reclaim_partial is trying to uncharge (via
> __sk_mem_reduce_allocated) negative amount. nr_pages has overflown when
> converted from int to unsigned int (-1). I would say that
> __mptcp_mem_reclaim_partial has evaluated
> reclaimable = mptcp_sk(sk)->rmem_fwd_alloc - sk_unused_reserved_mem(sk)
> to 0 and __mptcp_rmem_reclaim(sk, reclaimable - 1) made it -1.
Thanks for the analysis Michal.
--
Mat Martineau
Intel