WARNING in __mmdrop

Status: fixed on 2020/06/28 13:52
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+e58112d71f77113ddb7b@syzkaller.appspotmail.com
Fix commit: 3d2c7d370475 Revert "vhost: access vq metadata through kernel virtual address"
First crash: 2603d, last: 2554d
Cause bisection: introduced by (bisect log) :
commit 7f466032dc9e5a61217f22ea34b2df932786bbfc
Author: Jason Wang <jasowang@redhat.com>
Date: Fri May 24 08:12:18 2019 +0000

  vhost: access vq metadata through kernel virtual address

Crash: BUG: Bad rss-counter state (log)
Repro: syz .config
  
▶ ▼ Duplicate bugs (2)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: use-after-free Read in finish_task_switch (2) kernel 19 syz done 1 2564d 2564d 0/29 closed as dup on 2019/07/24 07:07
KASAN: use-after-free Write in tlb_finish_mmu kernel 22 syz done 1 2564d 2564d 0/29 closed as dup on 2019/07/24 07:07
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH V5 0/9] Fixes for vhost metadata acceleration 25 (25) 2019/09/01 18:02
[PATCH V4 0/9] Fixes for metadata accelreation 18 (18) 2019/08/10 19:12
[PATCH V3 00/10] Fixes for metadata accelreation 12 (12) 2019/08/07 07:05
[PATCH V2 0/9] Fixes for metadata accelreation 51 (51) 2019/08/07 06:49
WARNING in __mmdrop 86 (88) 2019/07/31 23:00
[PATCH 0/6] Fixes for meta data acceleration 16 (16) 2019/07/25 05:21
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in __mmdrop (2) kernel -1 C 7 163d 166d 29/29 fixed on 2026/05/06 16:40
▶ ▼ Last patch testing requests (19)
Created Duration User Patch Repo Result
2019/07/23 02:26 17m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc OK
2019/07/22 12:26 10m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc error
2019/07/22 10:43 10m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc report log
2019/07/22 09:09 9m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc report log
2019/07/22 09:08 3m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc error
2019/07/22 08:33 17m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc OK
2019/07/22 07:33 16m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc OK
2019/07/22 04:35 10m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc report log
2019/07/22 04:17 10m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc report log
2019/07/22 03:31 18m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc error
2019/07/22 03:03 16m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc OK
2019/07/22 03:03 10m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc report log
2019/07/22 03:02 16m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc OK
2019/07/22 02:43 9m jasowang@redhat.com patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7f466032dc9e5a61217f22ea34b2df932786bbfc report log
2019/07/22 02:27 18m jasowang@redhat.com patch linux-next error
2019/07/21 14:11 18m jasowang@redhat.com patch linux-next error
2019/07/21 14:11 18m jasowang@redhat.com patch linux-next error
2019/07/21 12:14 18m jasowang@redhat.com patch linux-next error
2019/07/21 11:23 18m jasowang@redhat.com upstream error

Sample crash report:
WARNING: CPU: 0 PID: 9142 at kernel/fork.c:677 __mmdrop+0x26a/0x320 /kernel/fork.c:677
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 9142 Comm: syz-executor.0 Not tainted 5.2.0-next-20190718 #41
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack /lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 /lib/dump_stack.c:113
 panic+0x2dc/0x755 /kernel/panic.c:219
 __warn.cold+0x20/0x4c /kernel/panic.c:576
 report_bug+0x263/0x2b0 /lib/bug.c:186
 fixup_bug /arch/x86/kernel/traps.c:179 [inline]
 fixup_bug /arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x11b/0x200 /arch/x86/kernel/traps.c:272
 do_invalid_op+0x37/0x50 /arch/x86/kernel/traps.c:291
 invalid_op+0x14/0x20 /arch/x86/entry/entry_64.S:1008
RIP: 0010:__mmdrop+0x26a/0x320 /kernel/fork.c:677
Code: 5f 5d c3 e8 18 7e 2f 00 4c 89 ef e8 60 d7 2b 00 eb d2 e8 09 7e 2f 00 0f 0b e8 02 7e 2f 00 0f 0b e9 fa fd ff ff e8 f6 7d 2f 00 <0f> 0b e9 2b fe ff ff e8 ea 7d 2f 00 4c 89 e7 e8 a2 f7 67 00 e9 85
RSP: 0018:ffff8880a176fac0 EFLAGS: 00010293
RAX: ffff888098f02600 RBX: ffff888098f02600 RCX: ffffffff81430bab
RDX: 0000000000000000 RSI: ffffffff814306fa RDI: ffff888098f02a30
RBP: ffff8880a176fae8 R08: ffff888098f02600 R09: ffffed10148dd4ec
R10: ffffed10148dd4eb R11: ffff8880a46ea75f R12: ffff8880a46ea700
R13: ffff8880a46ea828 R14: ffff8880a46eac50 R15: 0000000000000000
 mmdrop /./include/linux/sched/mm.h:49 [inline]
 __mmput /kernel/fork.c:1074 [inline]
 mmput+0x3f0/0x4d0 /kernel/fork.c:1085
 exit_mm /kernel/exit.c:547 [inline]
 do_exit+0x84e/0x2ea0 /kernel/exit.c:864
 do_group_exit+0x135/0x360 /kernel/exit.c:981
 get_signal+0x47c/0x2500 /kernel/signal.c:2728
 do_signal+0x87/0x1700 /arch/x86/kernel/signal.c:815
 exit_to_usermode_loop+0x286/0x380 /arch/x86/entry/common.c:159
 prepare_exit_to_usermode /arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath /arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x5a9/0x6a0 /arch/x86/entry/common.c:299
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459819
Code: Bad RIP value.
RSP: 002b:00007f75afccbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000459819
RDX: 00000000200023c0 RSI: 000000004028af11 RDI: 0000000000000003
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f75afccc6d4
R13: 00000000004c4722 R14: 00000000004d87d0 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/19 03:34 linux-next 6d21a41b7b1f 7bb222f7 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/28 14:53 upstream 5168afe6ef59 c85e1c5b .config console log report ci-upstream-kasan-gce-smack-root
2019/07/28 12:51 upstream 5168afe6ef59 c85e1c5b .config console log report ci-upstream-kasan-gce-smack-root
2019/07/22 00:36 upstream c6dd78fcb8ee 1656845f .config console log report ci-upstream-kasan-gce-selinux-root
2019/07/19 19:07 upstream 3bfe1fc46794 1656845f .config console log report ci-upstream-kasan-gce-386
2019/07/18 20:59 upstream 22051d9c4a57 7bb222f7 .config console log report ci-upstream-kasan-gce-386
2019/07/23 10:09 linux-next 6d21a41b7b1f 55e0c077 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/07/20 23:27 linux-next 6d21a41b7b1f 1656845f .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/29 16:55 linux-next 48568d8c7f47 7509bf36 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/27 12:09 linux-next 8087b004bd09 7509bf36 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/26 18:15 linux-next 1dd45f170b7e 7509bf36 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/22 16:49 linux-next dc636f5d78de 34bf9440 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/16 05:50 linux-next f4788d37bc84 442206d7 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/09 23:50 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.