[syzbot] WARNING in page_counter_cancel (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 42eb8fdac2fc Merge tag 'gfs2-v5.16-rc2-fixes' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1483f0e9b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=b7264d1cb8ba2795
dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc9e2d...@syzkaller.appspotmail.com

------------[ cut here ]------------
page_counter underflow: -4294964789 nr_pages=4294967295
WARNING: CPU: 2 PID: 3785 at mm/page_counter.c:56 page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56
Modules linked in:
CPU: 2 PID: 3785 Comm: kworker/2:6 Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Workqueue: events mptcp_worker

RIP: 0010:page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56
Code: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 2a 2b b5 ff 4c 89 ea 48 89 ee 48 c7 c7 00 9e b8 89 c6 05 a0 c1 ba 0b 01 e8 95 e4 4b 07 <0f> 0b eb a8 4c 89 e7 e8 25 5a fb ff eb c7 0f 1f 00 41 56 41 55 49
RSP: 0018:ffffc90002d4f918 EFLAGS: 00010082

RAX: 0000000000000000 RBX: ffff88806a494120 RCX: 0000000000000000
RDX: ffff8880688c41c0 RSI: ffffffff815e8f28 RDI: fffff520005a9f15
RBP: ffffffff000009cb R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815e2cfe R11: 0000000000000000 R12: ffff88806a494120
R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2de21000 CR3: 000000005ad59000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
page_counter_uncharge+0x2e/0x60 mm/page_counter.c:160
drain_stock+0xc1/0x180 mm/memcontrol.c:2219
refill_stock+0x139/0x2f0 mm/memcontrol.c:2271
__sk_mem_reduce_allocated+0x24d/0x550 net/core/sock.c:2945
__mptcp_rmem_reclaim net/mptcp/protocol.c:167 [inline]
__mptcp_mem_reclaim_partial+0x124/0x410 net/mptcp/protocol.c:975
mptcp_mem_reclaim_partial net/mptcp/protocol.c:982 [inline]
mptcp_alloc_tx_skb net/mptcp/protocol.c:1212 [inline]
mptcp_sendmsg_frag+0x18c6/0x2190 net/mptcp/protocol.c:1279
__mptcp_push_pending+0x232/0x720 net/mptcp/protocol.c:1545
mptcp_release_cb+0xfe/0x200 net/mptcp/protocol.c:2975
release_sock+0xb4/0x1b0 net/core/sock.c:3306
mptcp_worker+0x51e/0xc10 net/mptcp/protocol.c:2443
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8

dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc9e2d...@syzkaller.appspotmail.com

R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
</TASK>
------------[ cut here ]------------
page_counter underflow: -4294966651 nr_pages=4294967295
WARNING: CPU: 1 PID: 3665 at mm/page_counter.c:56 page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56 mm/page_counter.c:56
Modules linked in:
CPU: 1 PID: 3665 Comm: syz-executor933 Not tainted 5.16.0-rc5-next-20211216-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56 mm/page_counter.c:56
Code: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 ba 77 af ff 4c 89 ea 48 89 ee 48 c7 c7 60 fe b8 89 c6 05 5f b3 b5 0b 01 e8 a6 85 48 07 <0f> 0b eb a8 4c 89 e7 e8 d5 85 fa ff eb c7 0f 1f 00 41 56 41 55 49
RSP: 0018:ffffc90002b1f620 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff88807b6e8120 RCX: 0000000000000000
RDX: ffff88807ad31d40 RSI: ffffffff815f4748 RDI: fffff52000563eb6
RBP: ffffffff00000285 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff815ee4ae R11: 0000000000000000 R12: ffff88807b6e8120

R13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001

FS: 000055555596c300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000000020000080 CR3: 000000007f24a000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

page_counter_uncharge+0x2e/0x60 mm/page_counter.c:159 mm/page_counter.c:159
drain_stock+0xc1/0x170 mm/memcontrol.c:2172 mm/memcontrol.c:2172
refill_stock+0x131/0x1b0 mm/memcontrol.c:2224 mm/memcontrol.c:2224
__sk_mem_reduce_allocated+0x24d/0x550 net/core/sock.c:2951 net/core/sock.c:2951
__mptcp_rmem_reclaim net/mptcp/protocol.c:169 [inline]
__mptcp_rmem_reclaim net/mptcp/protocol.c:169 [inline] net/mptcp/protocol.c:978
__mptcp_mem_reclaim_partial+0x124/0x410 net/mptcp/protocol.c:978 net/mptcp/protocol.c:978
mptcp_mem_reclaim_partial net/mptcp/protocol.c:985 [inline]
mptcp_alloc_tx_skb net/mptcp/protocol.c:1215 [inline]
mptcp_mem_reclaim_partial net/mptcp/protocol.c:985 [inline] net/mptcp/protocol.c:1282
mptcp_alloc_tx_skb net/mptcp/protocol.c:1215 [inline] net/mptcp/protocol.c:1282
mptcp_sendmsg_frag+0x1ada/0x2410 net/mptcp/protocol.c:1282 net/mptcp/protocol.c:1282
__mptcp_push_pending+0x232/0x7a0 net/mptcp/protocol.c:1548 net/mptcp/protocol.c:1548
mptcp_release_cb+0xfe/0x200 net/mptcp/protocol.c:3013 net/mptcp/protocol.c:3013
release_sock+0xb4/0x1b0 net/core/sock.c:3312 net/core/sock.c:3312
sk_stream_wait_memory+0x608/0xed0 net/core/stream.c:145 net/core/stream.c:145
mptcp_sendmsg+0x8df/0x1300 net/mptcp/protocol.c:1745 net/mptcp/protocol.c:1745
inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:641 net/ipv6/af_inet6.c:641
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:724
sock_sendmsg+0xcf/0x120 net/socket.c:724 net/socket.c:724
sock_write_iter+0x289/0x3c0 net/socket.c:1057 net/socket.c:1057
call_write_iter include/linux/fs.h:2079 [inline]
call_write_iter include/linux/fs.h:2079 [inline] fs/read_write.c:503
new_sync_write+0x429/0x660 fs/read_write.c:503 fs/read_write.c:503
vfs_write+0x7cd/0xae0 fs/read_write.c:590 fs/read_write.c:590
ksys_write+0x1ee/0x250 fs/read_write.c:643 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_x64 arch/x86/entry/common.c:50 [inline] arch/x86/entry/common.c:80
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f4cc423cf49
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdeb8585f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4cc423cf49
RDX: 0000000000017f88 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00007ffdeb858620 R08: 0000000000000001 R09: 00007ffdeb858630
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
</TASK>

[syzbot]

syzbot has bisected this issue to:

commit 22849b5ea5952d853547cc5e0651f34a246b2a4f
Author: Leon Romanovsky <leo...@nvidia.com>
Date: Thu Oct 21 14:16:14 2021 +0000

devlink: Remove not-executed trap policer notifications

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16464095b00000
start commit: 158b515f703e tun: avoid double free in tun_free_netdev
git tree: net
final oops: https://syzkaller.appspot.com/x/report.txt?x=15464095b00000
console output: https://syzkaller.appspot.com/x/log.txt?x=11464095b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa556098924b78f0
dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ff127eb00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11bedb6db00000

Reported-by: syzbot+bc9e2d...@syzkaller.appspotmail.com
Fixes: 22849b5ea595 ("devlink: Remove not-executed trap policer notifications")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Andrew Morton]

On Sat, 18 Dec 2021 06:04:22 -0800 syzbot <syzbot+bc9e2d...@syzkaller.appspotmail.com> wrote:

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8
> dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000

Useful to have that, thanks.

I'm suspecting that mptcp is doing something strange. Could I as the
developers to please take a look?

[Michal Hocko]

On Tue 21-12-21 15:57:36, Andrew Morton wrote:
> On Sat, 18 Dec 2021 06:04:22 -0800 syzbot <syzbot+bc9e2d...@syzkaller.appspotmail.com> wrote:
>
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
> > git tree: linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8
> > dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
> > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000
>
> Useful to have that, thanks.
>
> I'm suspecting that mptcp is doing something strange.

Yes.

> Could I as the
> developers to please take a look?
>
>
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+bc9e2d...@syzkaller.appspotmail.com
> >
> > R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
> > </TASK>
> > ------------[ cut here ]------------
> > page_counter underflow: -4294966651 nr_pages=4294967295

__mptcp_mem_reclaim_partial is trying to uncharge (via
__sk_mem_reduce_allocated) negative amount. nr_pages has overflown when
converted from int to unsigned int (-1). I would say that
__mptcp_mem_reclaim_partial has evaluated
reclaimable = mptcp_sk(sk)->rmem_fwd_alloc - sk_unused_reserved_mem(sk)
to 0 and __mptcp_rmem_reclaim(sk, reclaimable - 1) made it -1.
--
Michal Hocko
SUSE Labs

[Mat Martineau]

On Wed, 29 Dec 2021, Michal Hocko wrote:

> On Tue 21-12-21 15:57:36, Andrew Morton wrote:
>> On Sat, 18 Dec 2021 06:04:22 -0800 syzbot <syzbot+bc9e2d...@syzkaller.appspotmail.com> wrote:
>>
>>> syzbot has found a reproducer for the following issue on:
>>>
>>> HEAD commit: fbf252e09678 Add linux-next specific files for 20211216
>>> git tree: linux-next
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1797de99b00000
>>> kernel config: https://syzkaller.appspot.com/x/.config?x=7fcbb9aa19a433c8
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
>>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135d179db00000
>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113edb6db00000
>>
>> Useful to have that, thanks.
>>
>> I'm suspecting that mptcp is doing something strange.
>
> Yes.
>
>> Could I as the
>> developers to please take a look?
>>

Andrew -

Yes, we'll get a fix in to net-next soon - thanks for adding the mptcp &
netdev lists.

>>
>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>> Reported-by: syzbot+bc9e2d...@syzkaller.appspotmail.com
>>>
>>> R13: 00007ffdeb858640 R14: 00007ffdeb858680 R15: 0000000000000004
>>> </TASK>
>>> ------------[ cut here ]------------
>>> page_counter underflow: -4294966651 nr_pages=4294967295
>
> __mptcp_mem_reclaim_partial is trying to uncharge (via
> __sk_mem_reduce_allocated) negative amount. nr_pages has overflown when
> converted from int to unsigned int (-1). I would say that
> __mptcp_mem_reclaim_partial has evaluated
> reclaimable = mptcp_sk(sk)->rmem_fwd_alloc - sk_unused_reserved_mem(sk)
> to 0 and __mptcp_rmem_reclaim(sk, reclaimable - 1) made it -1.

Thanks for the analysis Michal.

--
Mat Martineau
Intel

[Mat Martineau]

On Wed, 29 Dec 2021, Michal Hocko wrote:

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index df5a0cf431c1..7ed86e81181e 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -975,7 +975,9 @@ static void __mptcp_mem_reclaim_partial(struct sock
*sk)

lockdep_assert_held_once(&sk->sk_lock.slock);

- __mptcp_rmem_reclaim(sk, reclaimable - 1);
+ if (reclaimable >= SK_MEM_QUANTUM )
+ __mptcp_rmem_reclaim(sk, reclaimable - 1);
+
sk_mem_reclaim_partial(sk);
}


--
Mat Martineau
Intel

[Mat Martineau]

On Wed, 29 Dec 2021, Michal Hocko wrote:

Trying again with fixed syntax for the bot:

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

---

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file net/mptcp/protocol.c
patch: **** unexpected end of file in patch



Tested on:

commit: ffd32ea6 Revert "net: wwan: iosm: Keep device at D0 fo..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=1216323bb00000

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file net/mptcp/protocol.c
patch: **** unexpected end of file in patch



Tested on:

commit: ffd32ea6 Revert "net: wwan: iosm: Keep device at D0 fo..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=1050454fb00000

[Mat Martineau]

On Wed, 29 Dec 2021, Michal Hocko wrote:

Ok, formatting really fixed this time (I hope), trailing whitespace and
all:

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

---
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c

index df5a0cf431c1..8fa56b9651a2 100644

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file net/mptcp/protocol.c
patch: **** unexpected end of file in patch



Tested on:

commit: b9adba35 Merge git://git.kernel.org/pub/scm/linux/kern..

git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=168e0c07b00000

[Mat Martineau]

On Wed, 29 Dec 2021, Michal Hocko wrote:

Well, given that the inline patch isn't working out, I'll try having
syzbot directly access my git tree:

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/martineau/linux.git syz-test-reclaim


--
Mat Martineau
Intel

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+bc9e2d...@syzkaller.appspotmail.com

Tested on:

commit: 7b501ffb mptcp: Test fix for syzkaller failure
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/martineau/linux.git syz-test-reclaim
kernel config: https://syzkaller.appspot.com/x/.config?x=34274384f56cbb7e

dashboard link: https://syzkaller.appspot.com/bug?extid=bc9e2d2dbcb347dd215a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+bc9e2d...@syzkaller.appspotmail.com

Tested on:

commit: 954500e7 mptcp: Test fix for syzkaller failure
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/martineau/linux.git syz-test-reclaim-upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=32f9fa260d7413b4

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+bc9e2d...@syzkaller.appspotmail.com

Tested on:

commit: c99e62f4 mptcp: Test fix for syzkaller failure