[v6.1] kernel BUG in vmf_insert_pfn_prot

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7eaef76fbc46 Linux 6.1.20
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10db2bc2c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=29ad3fe3c7b61175
dashboard link: https://syzkaller.appspot.com/bug?extid=a4d5a11e163f2d728bd0
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/34f95428f5fb/disk-7eaef76f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1bdd9b2c390d/vmlinux-7eaef76f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/419140981cfa/Image-7eaef76f.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a4d5a1...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at mm/memory.c:2220!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 15123 Comm: syz-executor.3 Not tainted 6.1.20-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : vmf_insert_pfn_prot+0x2bc/0x2d0 mm/memory.c:2220
lr : vmf_insert_pfn_prot+0x2bc/0x2d0 mm/memory.c:2220
sp : ffff80002c877310
x29: ffff80002c877310 x28: ffff80002c8775c0 x27: ffff0000cbad8000
x26: 0000000010000400 x25: 0000000004040471 x24: dfff800000000000
x23: 0000000000000420 x22: 0000000000108d1c x21: ffff0000d6471438
x20: 0000000020000000 x19: 0060000000000fc3 x18: ffff80002c876ec0
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000002 x13: 0000000010000400 x12: 0000000000040000
x11: 0000000000001070 x10: ffff800023c09000 x9 : ffff80000885ada4
x8 : 0000000000001071 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : 0060000000000fc3
x2 : 0000000000108d1c x1 : 0000000000000420 x0 : 0000000000000420
Call trace:
vmf_insert_pfn_prot+0x2bc/0x2d0 mm/memory.c:2220
vmf_insert_pfn+0x54/0x68 mm/memory.c:2259
drm_gem_shmem_fault+0x1ac/0x21c drivers/gpu/drm/drm_gem_shmem_helper.c:562
__do_fault+0x11c/0x3d8 mm/memory.c:4198
do_read_fault mm/memory.c:4549 [inline]
do_fault mm/memory.c:4678 [inline]
handle_pte_fault mm/memory.c:4950 [inline]
__handle_mm_fault mm/memory.c:5092 [inline]
handle_mm_fault+0x1f20/0x3d18 mm/memory.c:5213
__do_page_fault arch/arm64/mm/fault.c:512 [inline]
do_page_fault+0x634/0xac4 arch/arm64/mm/fault.c:612
do_translation_fault+0x94/0xc8 arch/arm64/mm/fault.c:695
do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:831
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:367
el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:427
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576
__arch_copy_from_user+0xb8/0x230 arch/arm64/lib/copy_template.S:110
do_fb_ioctl+0x33c/0xdf0 drivers/video/fbdev/core/fbmem.c:1168
fb_ioctl+0xec/0x134 drivers/video/fbdev/core/fbmem.c:1202
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: d4210000 97f2a387 d4210000 97f2a385 (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 7eaef76fbc46 Linux 6.1.20
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=11395416c80000

kernel config: https://syzkaller.appspot.com/x/.config?x=29ad3fe3c7b61175
dashboard link: https://syzkaller.appspot.com/bug?extid=a4d5a11e163f2d728bd0
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=161b0486c80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1209c881c80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/34f95428f5fb/disk-7eaef76f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1bdd9b2c390d/vmlinux-7eaef76f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/419140981cfa/Image-7eaef76f.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a4d5a1...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at mm/memory.c:2220!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 4388 Comm: syz-executor436 Not tainted 6.1.20-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : vmf_insert_pfn_prot+0x2bc/0x2d0 mm/memory.c:2220
lr : vmf_insert_pfn_prot+0x2bc/0x2d0 mm/memory.c:2220

sp : ffff80001df47310
x29: ffff80001df47310 x28: ffff80001df475c0 x27: ffff0000cbe08000

x26: 0000000010000400 x25: 0000000004040471 x24: dfff800000000000

x23: 0000000000000420 x22: 000000000010a962 x21: ffff0000d937b360
x20: 0000000020000000 x19: 0060000000000fc3 x18: ffff80001df46ec0

x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000

x14: 0000000000000000 x13: 0000000010000400 x12: ffff0000cd55b680
x11: ff8080000885ada4 x10: 0000000000000000 x9 : ffff80000885ada4
x8 : ffff0000cd55b680 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80001890c3b0 x4 : 0000000000000002 x3 : 0060000000000fc3
x2 : 000000000010a962 x1 : 0000000000000420 x0 : 0000000000000420