WARNING in untrack_pfn

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 815e34f8 Merge 4.14.90 into android-4.14
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=135cdcab400000
kernel config: https://syzkaller.appspot.com/x/.config?x=608dc5a2664d6079
dashboard link: https://syzkaller.appspot.com/bug?extid=c9ed87b5e704273da74d
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b90057400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c9ed87...@syzkaller.appspotmail.com

ip (3239) used greatest stack depth: 23744 bytes left
audit: type=1400 audit(1545523373.967:10): avc: denied { map } for
pid=4474 comm="syz-executor0" path="/selinux/status" dev="selinuxfs" ino=19
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1
------------[ cut here ]------------
WARNING: CPU: 1 PID: 10290 at arch/x86/mm/pat.c:1020
untrack_pfn+0x200/0x250 arch/x86/mm/pat.c:1020
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 10290 Comm: syz-executor4 Not tainted 4.14.90+ #29
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x11b lib/dump_stack.c:53
panic+0x1bf/0x3a4 kernel/panic.c:181
__warn.cold.7+0x2f/0x35 kernel/panic.c:542
report_bug+0x1f7/0x26c lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
do_error_trap+0x1ba/0x2c0 arch/x86/kernel/traps.c:295
invalid_op+0x18/0x40 arch/x86/entry/entry_64.S:944
RIP: 0010:untrack_pfn+0x200/0x250 arch/x86/mm/pat.c:1020
RSP: 0018:ffff8881d43877f8 EFLAGS: 00010297
RAX: ffff8881d669de00 RBX: 1ffff1103a870eff RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff98bd8560
RBP: ffff8881d6bef0f8 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8881d669e630 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
unmap_single_vma+0x13b/0x170 mm/memory.c:1539
unmap_vmas+0x7c/0xd0 mm/memory.c:1590
exit_mmap+0x1f9/0x420 mm/mmap.c:3068
__mmput kernel/fork.c:929 [inline]
mmput+0xc8/0x350 kernel/fork.c:950
exit_mm kernel/exit.c:544 [inline]
do_exit+0x843/0x28c0 kernel/exit.c:852
do_group_exit+0x100/0x2e0 kernel/exit.c:968
get_signal+0x4e5/0x1470 kernel/signal.c:2348
do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457669
RSP: 002b:00007fb5c158fcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 000000000072bfa8 RCX: 0000000000457669
RDX: 00000000004c35b7 RSI: 0000000000000081 RDI: 000000000072bfac
RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bfac
R13: 00007ffd609685ef R14: 00007fb5c15909c0 R15: 000000000072bfac
Kernel Offset: 0x14200000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: a2f9236e Merge 4.9.147 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=17c5bdb7400000
kernel config: https://syzkaller.appspot.com/x/.config?x=cd889df9a2ecd6
dashboard link: https://syzkaller.appspot.com/bug?extid=0830ee7a7f64fa7f2a45

compiler: gcc (GCC) 8.0.1 20180413 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=146420c3400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+0830ee...@syzkaller.appspotmail.com

audit: type=1400 audit(1545521427.348:5): avc: denied { associate } for
pid=2111 comm="syz-executor4" name="syz4"
scontext=unconfined_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6988 at arch/x86/mm/pat.c:1019 untrack_pfn+0x242/0x290
arch/x86/mm/pat.c:1019

Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 6988 Comm: syz-executor2 Not tainted 4.9.147+ #86
ffff8801d27ef660 ffffffff81b43be9 ffffffff82a39060 00000000ffffffff
ffffffff82a34400 0000000000000001 0000000000000009 ffff8801d27ef720
ffffffff813f7745 0000000041b58ab3 ffffffff82e2ac3b ffffffff813f7586
Call Trace:
[<ffffffff81b43be9>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81b43be9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff813f7745>] panic+0x1bf/0x39f kernel/panic.c:179
[<ffffffff813f7982>] __warn.cold.8+0x2f/0x2f kernel/panic.c:542
[<ffffffff810dc0bc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
[<ffffffff810bea52>] untrack_pfn+0x242/0x290 arch/x86/mm/pat.c:1019
[<ffffffff8149a791>] unmap_single_vma+0x141/0x170 mm/memory.c:1315
[<ffffffff8149ae71>] unmap_vmas+0x81/0xd0 mm/memory.c:1366
[<ffffffff814b0f4c>] exit_mmap+0x1cc/0x3a0 mm/mmap.c:3021
[<ffffffff810d26ed>] __mmput kernel/fork.c:884 [inline]
[<ffffffff810d26ed>] mmput+0xcd/0x360 kernel/fork.c:906
[<ffffffff810e6c19>] exit_mm kernel/exit.c:514 [inline]
[<ffffffff810e6c19>] do_exit+0x6c9/0x2a50 kernel/exit.c:820
[<ffffffff810ed431>] do_group_exit+0x111/0x300 kernel/exit.c:937
[<ffffffff8110ebe1>] get_signal+0x4e1/0x1460 kernel/signal.c:2321
[<ffffffff81052b35>] do_signal+0x95/0x1b00 arch/x86/kernel/signal.c:807
[<ffffffff81003e2e>] exit_to_usermode_loop+0x10e/0x150
arch/x86/entry/common.c:158
[<ffffffff81005932>] prepare_exit_to_usermode arch/x86/entry/common.c:194
[inline]
[<ffffffff81005932>] syscall_return_slowpath arch/x86/entry/common.c:263
[inline]
[<ffffffff81005932>] do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290
[<ffffffff8281a4d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Kernel Offset: disabled