From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-il1-f208.google.com (mail-il1-f208.google.com [209.85.166.208]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4EA03184 for ; Sun, 19 Jan 2025 17:06:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.166.208 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737306384; cv=none; b=ohSQ+dianI+xFHMn4ZAGC4M2xs5z4mpO+hzyFcTZVe0fem3wuGejufzAuD1jwRl1DnbBB38W4FVwByxqOg6LWnFUVkbIVIQd8bOmDJjxYJptgInr2oZOzBpjlk171Gdejn6dKMPCEu6WawYxCkv4cmkQ4S8pb69+1uNIkiuaxFo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737306384; c=relaxed/simple; bh=zyisFXiakS5vtbtyMBKrXu5UhKfsbWbWCouB1WyujPE=; h=MIME-Version:Date:Message-ID:Subject:From:To:Content-Type; b=hR1l8zQDpnRdC615wUa033500Ecgwpc/yw4fXq+wq/HjKIvUiMz2hVv/h6fVegct7+Gy4p+TEzL52vLcVe9OHYSnYF9R+ALjgB0Pf0LCS/2vs4Rc3LI9QHm93x3AJsdKN9/8flHJLbNr2RY8mN4eOP/jzesahDzxFrAQ/21V8l0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.166.208 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-il1-f208.google.com with SMTP id e9e14a558f8ab-3ce795254afso63477005ab.1 for ; Sun, 19 Jan 2025 09:06:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737306381; x=1737911181; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=0NdWpf1zdCd8CeDA/dBjO8++mWB22c2qjxmwBpxR6UE=; b=OH/8ghyhhnWBHCEVHJmiagwffskGtDjoWi7R3llD3/ORAmWsEy5YLm0fqp0PQAewjB o7dbQlb6nepTTxB+5aLRu6+EvD/mVGE387RIkg/JH00B6MBfM8sJ9xsD49+S4ixUKHkM PN0gnC7j/2ihIaoV5Y7GRv1pBFydP2kaQ0h99LJmYfW8R/4daJWgpZ3P5MLRFuzgravm GVIdnHIxmKEAoZGNHMe6kGXSKMZZUL9bbw8NmPSg8gbMUPqT3H5PNHMI0SEj0W8/te1u W80cb0yFfpMG6uPKCUjkFNqekOZqmfTRFrRHDZgSjhwUPvk1Wbrz6rHK7upmrO5YSuFg puCg== X-Forwarded-Encrypted: i=1; AJvYcCW3rL4UVOTCSghy/wVtVjuW/xyCC47D5P4pw5V75Z3rTdg48/cw1h4ltxpvl4TG6cKRZqGloniqIvc2z4w=@vger.kernel.org X-Gm-Message-State: AOJu0Yx9X/w+8UJz+EBDuAwM00a/PvAfBf04lCAwo7KZTcqXCeUJjvTP NHEABY+ATz5J53jRgcX4pVu18Yz/iw+ERaSfQzxCEk4LlpyReSNREhRwNKOSyFZsJvz35ACjP6c JB6sYMiA6O5GQoCBU8m56hxbhMLmTPBGLbHr2J2ROMDyQ83WQBpQBhd4= X-Google-Smtp-Source: AGHT+IF9846ooDfNIArJSsgYA8hC2d+a5jjs/iSB5ry3E33lIpdOma70cXGol3478gHmOWhq+qpNIt/uVASPMCRM4QcF1QvlypiE Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6e02:12cd:b0:3ce:7ac0:64d0 with SMTP id e9e14a558f8ab-3cf743c4a65mr79062775ab.2.1737306381395; Sun, 19 Jan 2025 09:06:21 -0800 (PST) Date: Sun, 19 Jan 2025 09:06:21 -0800 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <678d310d.050a0220.303755.0059.GAE@google.com> Subject: [syzbot] [mm?] WARNING: locking bug in run_posix_cpu_timers From: syzbot To: akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot found the following issue on: HEAD commit: 619f0b6fad52 Merge tag 'seccomp-v6.13-rc8' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14b649df980000 kernel config: https://syzkaller.appspot.com/x/.config?x=d1cb4a1f148c0861 dashboard link: https://syzkaller.appspot.com/bug?extid=a39472aa740094f6347f compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/a127456cb6e4/disk-619f0b6f.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/d571b0066089/vmlinux-619f0b6f.xz kernel image: https://storage.googleapis.com/syzbot-assets/7871c0902366/bzImage-619f0b6f.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+a39472aa740094f6347f@syzkaller.appspotmail.com [ BUG: Invalid wait context ] ----------------------------- ffffffff8e3a43f8 (stack_list_lock){-.-.}-{3:3}, at: add_stack_record_to_list mm/page_owner.c:182 [inline] ffffffff8e3a43f8 (stack_list_lock){-.-.}-{3:3}, at: inc_stack_record_count mm/page_owner.c:214 [inline] ffffffff8e3a43f8 (stack_list_lock){-.-.}-{3:3}, at: __set_page_owner+0x3ea/0x560 mm/page_owner.c:329 other info that might help us debug this: context-{2:2} #0: ffff8880325bb2a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:144 [inline] #0: ffff8880325bb2a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x10c/0xb20 mm/mmap.c:1656 #2: ffff88802a519918 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffff88802a519918 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0xf1/0x300 mm/pgtable-generic.c:402 #3: ffffffff8e1bb840 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #3: ffffffff8e1bb840 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:941 [inline] #3: ffffffff8e1bb840 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid include/linux/mmzone.h:2048 [inline] #3: ffffffff8e1bb840 (rcu_read_lock_sched){....}-{1:2}, at: page_table_check_clear mm/page_table_check.c:70 [inline] #3: ffffffff8e1bb840 (rcu_read_lock_sched){....}-{1:2}, at: __page_table_check_pte_clear+0x1ba/0x580 mm/page_table_check.c:169 CPU: 0 UID: 0 PID: 7575 Comm: syz.0.628 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:544 __run_posix_cpu_timers kernel/time/posix-cpu-timers.c:1223 [inline] run_posix_cpu_timers+0x69f/0x7d0 kernel/time/posix-cpu-timers.c:1422 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x5fb/0xae0 kernel/time/hrtimer.c:1803 hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1865 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline] __sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5814 Code: b8 ff ff ff ff 65 0f c1 05 40 b0 8b 7e 83 f8 01 0f 85 d0 01 00 00 9c 58 f6 c4 02 0f 85 e5 01 00 00 48 85 ed 0f 85 b6 01 00 00 <48> b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 00 00 00 48 c7 RSP: 0018:ffffc90010a87710 EFLAGS: 00000206 RAX: 0000000000000046 RBX: 1ffff92002150ee3 RCX: 00000000a9f140cb RDX: 0000000000000001 RSI: ffffffff8b6cdce0 RDI: ffffffff8bd1ef20 RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2dca798 R10: ffffffff96e53cc7 R11: 0000000000000003 R12: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock_sched include/linux/rcupdate.h:941 [inline] pfn_valid include/linux/mmzone.h:2048 [inline] page_table_check_clear mm/page_table_check.c:70 [inline] __page_table_check_pte_clear+0x1c0/0x580 mm/page_table_check.c:169 page_table_check_pte_clear include/linux/page_table_check.h:49 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1337 [inline] get_and_clear_full_ptes include/linux/pgtable.h:705 [inline] zap_present_folio_ptes mm/memory.c:1502 [inline] zap_present_ptes mm/memory.c:1585 [inline] zap_pte_range mm/memory.c:1627 [inline] zap_pmd_range mm/memory.c:1753 [inline] zap_pud_range mm/memory.c:1782 [inline] zap_p4d_range mm/memory.c:1803 [inline] unmap_page_range+0x22f6/0x3d10 mm/memory.c:1824 unmap_single_vma+0x194/0x2b0 mm/memory.c:1870 exit_mmap+0x1c6/0xb20 mm/mmap.c:1672 __mmput+0x12a/0x4c0 kernel/fork.c:1348 exit_mm kernel/exit.c:570 [inline] do_exit+0x9ba/0x2d70 kernel/exit.c:925 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1096 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 RIP: 0033:0x7fd902b85d29 ---------------- Code disassembly (best guess): 0: b8 ff ff ff ff mov $0xffffffff,%eax 5: 65 0f c1 05 40 b0 8b xadd %eax,%gs:0x7e8bb040(%rip) # 0x7e8bb04d c: 7e d: 83 f8 01 cmp $0x1,%eax 10: 0f 85 d0 01 00 00 jne 0x1e6 16: 9c pushf 17: 58 pop %rax 18: f6 c4 02 test $0x2,%ah 1b: 0f 85 e5 01 00 00 jne 0x206 21: 48 85 ed test %rbp,%rbp 24: 0f 85 b6 01 00 00 jne 0x1e0 * 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction 31: fc ff df 34: 48 01 c3 add %rax,%rbx 37: 48 c7 03 00 00 00 00 movq $0x0,(%rbx) 3e: 48 rex.W 3f: c7 .byte 0xc7 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup