[syzbot] linux-next boot error: general protection fault in _compound_head

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 6b31ffe9c8b9 Add linux-next specific files for 20230113
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=152656ea480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=65231569237fd5c39d34
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce9e6ba7733a/disk-6b31ffe9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1e7d869b72b8/vmlinux-6b31ffe9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6a2e565791bb/bzImage-6b31ffe9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+652315...@syzkaller.appspotmail.com

zswap: loaded using pool lzo/zbud
debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
Key type .fscrypt registered
Key type fscrypt-provisioning registered
kAFS: Red Hat AFS client v0.1 registering.
Btrfs loaded, crc32c=crc32c-intel, assert=on, ref-verify=on, zoned=yes, fsverity=yes
Key type big_key registered
Key type encrypted registered
AppArmor: AppArmor sha1 policy hashing enabled
ima: No TPM chip found, activating TPM-bypass!
Loading compiled-in module X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: eb9e833d5ab7051cb5090e71343bc6c45ed6a48c'
ima: Allocated hash algorithm: sha256
ima: No architecture policies found
evm: Initialising EVM extended attributes:
evm: security.selinux (disabled)
evm: security.SMACK64 (disabled)
evm: security.SMACK64EXEC (disabled)
evm: security.SMACK64TRANSMUTE (disabled)
evm: security.SMACK64MMAP (disabled)
evm: security.apparmor
evm: security.ima
evm: security.capability
evm: HMAC attrs: 0x1
PM: Magic number: 7:396:565
usb usb29-port6: hash matches
printk: console [netcon0] enabled
netconsole: network logging started
gtp: GTP module loaded (pdp ctx size 104 bytes)
rdma_rxe: loaded
cfg80211: Loading compiled-in X.509 certificates for regulatory database
cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
ALSA device list:
#0: Dummy 1
#1: Loopback 1
#2: Virtual MIDI Card 1
md: Waiting for all devices to be available before autodetect
md: If you don't use raid, use raid=noautodetect
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
EXT4-fs (sda1): mounted filesystem 9ce8f422-5403-4bd0-ab21-1df2c0fc2934 with ordered data mode. Quota mode: none.
VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
devtmpfs: mounted
Freeing unused kernel image (initmem) memory: 2928K
Write protecting the kernel read-only data: 184320k
Freeing unused kernel image (rodata/data gap) memory: 1256K
x86/mm: Checked W+X mappings: passed, no W+X pages found.
Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
Run /sbin/init as init process
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 1 Comm: init Not tainted 6.2.0-rc3-next-20230113-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:_compound_head+0x21/0x150 include/linux/page-flags.h:251
Code: e8 34 6a 14 00 eb ee 66 90 41 54 55 53 48 89 fb e8 44 a2 c6 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 fd 00 00 00 48 8b 6b 08 31 ff 49 89 ec 41 83 e4
RSP: 0000:ffffc90000067bb0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff81bb265c RDI: 0000000000000008
RBP: ffff88801be3bd20 R08: 0000000000000000 R09: ffff88801c278303
R10: ffffed100384f060 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc90000067da8 R14: ffffc90000067d80 R15: 0000000000000000
FS: 00007f92c0dc0800(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f92c0e4c300 CR3: 000000001bf3c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
wp_page_copy mm/memory.c:3047 [inline]
do_wp_page+0x749/0x3880 mm/memory.c:3425
handle_pte_fault mm/memory.c:4937 [inline]
__handle_mm_fault+0x2183/0x3eb0 mm/memory.c:5061
handle_mm_fault+0x1b6/0x850 mm/memory.c:5207
do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1407
handle_page_fault arch/x86/mm/fault.c:1498 [inline]
exc_page_fault+0x98/0x170 arch/x86/mm/fault.c:1554
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7f92c0e2df98
Code: 0b 8b 3d 6f d3 01 00 e9 9e ff ff ff c3 55 53 48 8d 1d 9c e3 01 00 52 48 8b 3d 74 e3 01 00 48 8d ab 00 01 00 00 e8 08 f1 ff ff <48> c7 05 5d e3 01 00 00 00 00 00 48 8b 3b 48 83 c3 08 e8 f1 f0 ff
RSP: 002b:00007ffd667702e0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 00007f92c0e4c320 RCX: 000055ba317c6480
RDX: 0000000000000007 RSI: 000055ba317c6480 RDI: 0000000000000000
RBP: 00007f92c0e4c420 R08: 0000000000000000 R09: 000055ba317c64d0
R10: 0000000000000011 R11: 000000000000000c R12: 0000000000000000
R13: 00007ffd6677036c R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:_compound_head+0x21/0x150 include/linux/page-flags.h:251
Code: e8 34 6a 14 00 eb ee 66 90 41 54 55 53 48 89 fb e8 44 a2 c6 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 fd 00 00 00 48 8b 6b 08 31 ff 49 89 ec 41 83 e4
RSP: 0000:ffffc90000067bb0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff81bb265c RDI: 0000000000000008
RBP: ffff88801be3bd20 R08: 0000000000000000 R09: ffff88801c278303
R10: ffffed100384f060 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc90000067da8 R14: ffffc90000067d80 R15: 0000000000000000
FS: 00007f92c0dc0800(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f92c0e4c300 CR3: 000000001bf3c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: e8 34 6a 14 00 callq 0x146a39
5: eb ee jmp 0xfffffff5
7: 66 90 xchg %ax,%ax
9: 41 54 push %r12
b: 55 push %rbp
c: 53 push %rbx
d: 48 89 fb mov %rdi,%rbx
10: e8 44 a2 c6 ff callq 0xffc6a259
15: 48 8d 7b 08 lea 0x8(%rbx),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 fd 00 00 00 jne 0x131
34: 48 8b 6b 08 mov 0x8(%rbx),%rbp
38: 31 ff xor %edi,%edi
3a: 49 89 ec mov %rbp,%r12
3d: 41 rex.B
3e: 83 .byte 0x83
3f: e4 .byte 0xe4


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Matthew Wilcox]

This is Kefeng's patch:

mm: memory: convert wp_page_copy() to use folios

+++ b/mm/memory.c
@@ -3044,7 +3044,9 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf)
struct vm_area_struct *vma = vmf->vma;
struct mm_struct *mm = vma->vm_mm;
struct page *old_page = vmf->page;
+ struct folio *old_folio = page_folio(old_page);
struct page *new_page = NULL;
+ struct folio *new_folio = NULL;
pte_t entry;
int page_copied = 0;
struct mmu_notifier_range range;

If old_page was NULL, calling page_folio() on it generates a NULL
pointer dereference. Suggest dropping this patch; I don't think it was
tested before being posted.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.