[v6.1] WARNING in lru_gen_look_around (2)
2 views
Skip to first unread message
syzbot
May 26, 2025, 8:28:29 AM5/26/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: da3c5173c55f Linux 6.1.140
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1633bad4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2bfe5a2f04bb30e3
dashboard link: https://syzkaller.appspot.com/bug?extid=68f30a5d113386f5a4e3
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2c3ee4de68a1/disk-da3c5173.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/19742d73f52b/vmlinux-da3c5173.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0ffdd39d32ee/Image-da3c5173.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+68f30a...@syzkaller.appspotmail.com
vhci_hcd: invalid port number 96
vhci_hcd: default hub control req: 0000 vfffc i0060 l0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5358 at mm/vmscan.c:3839 get_pte_pfn mm/vmscan.c:3839 [inline]
WARNING: CPU: 1 PID: 5358 at mm/vmscan.c:3839 lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
Modules linked in:
CPU: 1 PID: 5358 Comm: syz.0.366 Not tainted 6.1.140-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : get_pte_pfn mm/vmscan.c:3839 [inline]
pc : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
lr : get_pte_pfn mm/vmscan.c:3839 [inline]
lr : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
sp : ffff800021d95290
x29: ffff800021d95320 x28: 0000000020040000 x27: 016000013c001fc3
x26: ffff0000db5a8000 x25: ffff0000ccfa6000 x24: 000000000013c001
x23: ffff0000db5a8008 x22: 0100000000000000 x21: 1fffe0001b6b5001
x20: dfff800000000000 x19: 0000000020001000 x18: ffff800011a7bd00
x17: ffff8000181a0000 x16: ffff8000082d076c x15: 0000000000000002
x14: 0000000000000200 x13: 1ffff00002a0e0b1 x12: 0000000000080000
x11: 000000000007ffff x10: ffff800021e69000 x9 : ffff800008728cd8
x8 : 0000000000080000 x7 : ffff800008737f50 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800008728be0
x2 : 0000000000000001 x1 : 0100000000000000 x0 : 0000000000000000
Call trace:
get_pte_pfn mm/vmscan.c:3839 [inline]
lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
folio_referenced_one+0x368/0x9b4 mm/rmap.c:828
rmap_walk_anon+0x348/0x4d4 mm/rmap.c:2451
rmap_walk mm/rmap.c:2527 [inline]
folio_referenced+0x2dc/0x3e8 mm/rmap.c:933
folio_check_references mm/vmscan.c:1463 [inline]
shrink_folio_list+0xb20/0x4448 mm/vmscan.c:1796
evict_folios+0x387c/0x49d0 mm/vmscan.c:5046
lru_gen_shrink_lruvec mm/vmscan.c:5229 [inline]
shrink_lruvec+0x958/0x34e4 mm/vmscan.c:5924
shrink_node_memcgs mm/vmscan.c:6145 [inline]
shrink_node+0x52c/0x20ac mm/vmscan.c:6176
shrink_zones mm/vmscan.c:6417 [inline]
do_try_to_free_pages+0x550/0x144c mm/vmscan.c:6479
try_to_free_mem_cgroup_pages+0x2d8/0xa50 mm/vmscan.c:6794
try_charge_memcg+0x48c/0x1448 mm/memcontrol.c:2686
obj_cgroup_charge_pages mm/memcontrol.c:3101 [inline]
__memcg_kmem_charge_page+0x304/0x54c mm/memcontrol.c:3127
__alloc_pages+0x1fc/0x53c mm/page_alloc.c:5623
alloc_pages+0x434/0x6f8 mm/mempolicy.c:-1
vm_area_alloc_pages mm/vmalloc.c:2994 [inline]
__vmalloc_area_node mm/vmalloc.c:3063 [inline]
__vmalloc_node_range+0x734/0xe48 mm/vmalloc.c:3235
kvmalloc_node+0x168/0x1dc mm/util.c:606
kvmalloc include/linux/slab.h:716 [inline]
kvzalloc include/linux/slab.h:724 [inline]
ip_set_alloc+0x2c/0x3c net/netfilter/ipset/ip_set_core.c:261
hash_netiface_create+0x2c4/0xcb8 net/netfilter/ipset/ip_set_hash_gen.h:1515
ip_set_create+0x48c/0x1024 net/netfilter/ipset/ip_set_core.c:1111
nfnetlink_rcv_msg+0x9d4/0xed8 net/netfilter/nfnetlink.c:302
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2493
nfnetlink_rcv+0x1f8/0x1afc net/netfilter/nfnetlink.c:659
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x600/0x818 net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1859
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
___sys_sendmsg net/socket.c:2573 [inline]
__sys_sendmsg+0x25c/0x320 net/socket.c:2602
__do_sys_sendmsg net/socket.c:2611 [inline]
__se_sys_sendmsg net/socket.c:2609 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 538352
hardirqs last enabled at (538351): [<ffff800011a00854>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (538351): [<ffff800011a00854>] _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
hardirqs last disabled at (538352): [<ffff8000119153e0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (533194): [<ffff8000081a8dc0>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (533194): [<ffff8000081a8dc0>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:606
softirqs last disabled at (533185): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:612
---[ end trace 0000000000000000 ]---
syz.0.366 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000
CPU: 1 PID: 5358 Comm: syz.0.366 Tainted: G W 6.1.140-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
dump_header+0xc0/0x724 mm/oom_kill.c:467
oom_kill_process+0x360/0x674 mm/oom_kill.c:1046
out_of_memory+0xc5c/0xf68 mm/oom_kill.c:1184
mem_cgroup_out_of_memory+0x210/0x2bc mm/memcontrol.c:1711
mem_cgroup_oom mm/memcontrol.c:1941 [inline]
try_charge_memcg+0xac4/0x1448 mm/memcontrol.c:2734
obj_cgroup_charge_pages mm/memcontrol.c:3101 [inline]
__memcg_kmem_charge_page+0x304/0x54c mm/memcontrol.c:3127
__alloc_pages+0x1fc/0x53c mm/page_alloc.c:5623
alloc_pages+0x434/0x6f8 mm/mempolicy.c:-1
vm_area_alloc_pages mm/vmalloc.c:2994 [inline]
__vmalloc_area_node mm/vmalloc.c:3063 [inline]
__vmalloc_node_range+0x734/0xe48 mm/vmalloc.c:3235
kvmalloc_node+0x168/0x1dc mm/util.c:606
kvmalloc include/linux/slab.h:716 [inline]
kvzalloc include/linux/slab.h:724 [inline]
ip_set_alloc+0x2c/0x3c net/netfilter/ipset/ip_set_core.c:261
hash_netiface_create+0x2c4/0xcb8 net/netfilter/ipset/ip_set_hash_gen.h:1515
ip_set_create+0x48c/0x1024 net/netfilter/ipset/ip_set_core.c:1111
nfnetlink_rcv_msg+0x9d4/0xed8 net/netfilter/nfnetlink.c:302
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2493
nfnetlink_rcv+0x1f8/0x1afc net/netfilter/nfnetlink.c:659
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x600/0x818 net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1859
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
___sys_sendmsg net/socket.c:2573 [inline]
__sys_sendmsg+0x25c/0x320 net/socket.c:2602
__do_sys_sendmsg net/socket.c:2611 [inline]
__se_sys_sendmsg net/socket.c:2609 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
memory: usage 307200kB, limit 307200kB, failcnt 153
memory+swap: usage 307384kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307188kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz0:
anon 0
file 12288
kernel 314560512
kernel_stack 65536
pagetables 131072
sec_pagetables 0
percpu 4736
sock 0
vmalloc 0
shmem 0
zswap 0
zswapped 0
file_mapped 12288
file_dirty 12288
file_writeback 0
swapcached 188416
anon_thp 0
file_thp 0
shmem_thp 0
inactive_anon 0
active_anon 0
inactive_file 0
active_file 12288
unevictable 0
slab_reclaimable 248720
slab_unreclaimable 402208
slab 650928
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.366,pid=5357,uid=0
Memory cgroup out of memory: Killed process 5357 (syz.0.366) total-vm:101656kB, anon-rss:940kB, file-rss:22980kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: da3c5173c55f Linux 6.1.140
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1633bad4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2bfe5a2f04bb30e3
dashboard link: https://syzkaller.appspot.com/bug?extid=68f30a5d113386f5a4e3
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2c3ee4de68a1/disk-da3c5173.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/19742d73f52b/vmlinux-da3c5173.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0ffdd39d32ee/Image-da3c5173.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+68f30a...@syzkaller.appspotmail.com
vhci_hcd: invalid port number 96
vhci_hcd: default hub control req: 0000 vfffc i0060 l0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5358 at mm/vmscan.c:3839 get_pte_pfn mm/vmscan.c:3839 [inline]
WARNING: CPU: 1 PID: 5358 at mm/vmscan.c:3839 lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
Modules linked in:
CPU: 1 PID: 5358 Comm: syz.0.366 Not tainted 6.1.140-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : get_pte_pfn mm/vmscan.c:3839 [inline]
pc : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
lr : get_pte_pfn mm/vmscan.c:3839 [inline]
lr : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
sp : ffff800021d95290
x29: ffff800021d95320 x28: 0000000020040000 x27: 016000013c001fc3
x26: ffff0000db5a8000 x25: ffff0000ccfa6000 x24: 000000000013c001
x23: ffff0000db5a8008 x22: 0100000000000000 x21: 1fffe0001b6b5001
x20: dfff800000000000 x19: 0000000020001000 x18: ffff800011a7bd00
x17: ffff8000181a0000 x16: ffff8000082d076c x15: 0000000000000002
x14: 0000000000000200 x13: 1ffff00002a0e0b1 x12: 0000000000080000
x11: 000000000007ffff x10: ffff800021e69000 x9 : ffff800008728cd8
x8 : 0000000000080000 x7 : ffff800008737f50 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800008728be0
x2 : 0000000000000001 x1 : 0100000000000000 x0 : 0000000000000000
Call trace:
get_pte_pfn mm/vmscan.c:3839 [inline]
lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
folio_referenced_one+0x368/0x9b4 mm/rmap.c:828
rmap_walk_anon+0x348/0x4d4 mm/rmap.c:2451
rmap_walk mm/rmap.c:2527 [inline]
folio_referenced+0x2dc/0x3e8 mm/rmap.c:933
folio_check_references mm/vmscan.c:1463 [inline]
shrink_folio_list+0xb20/0x4448 mm/vmscan.c:1796
evict_folios+0x387c/0x49d0 mm/vmscan.c:5046
lru_gen_shrink_lruvec mm/vmscan.c:5229 [inline]
shrink_lruvec+0x958/0x34e4 mm/vmscan.c:5924
shrink_node_memcgs mm/vmscan.c:6145 [inline]
shrink_node+0x52c/0x20ac mm/vmscan.c:6176
shrink_zones mm/vmscan.c:6417 [inline]
do_try_to_free_pages+0x550/0x144c mm/vmscan.c:6479
try_to_free_mem_cgroup_pages+0x2d8/0xa50 mm/vmscan.c:6794
try_charge_memcg+0x48c/0x1448 mm/memcontrol.c:2686
obj_cgroup_charge_pages mm/memcontrol.c:3101 [inline]
__memcg_kmem_charge_page+0x304/0x54c mm/memcontrol.c:3127
__alloc_pages+0x1fc/0x53c mm/page_alloc.c:5623
alloc_pages+0x434/0x6f8 mm/mempolicy.c:-1
vm_area_alloc_pages mm/vmalloc.c:2994 [inline]
__vmalloc_area_node mm/vmalloc.c:3063 [inline]
__vmalloc_node_range+0x734/0xe48 mm/vmalloc.c:3235
kvmalloc_node+0x168/0x1dc mm/util.c:606
kvmalloc include/linux/slab.h:716 [inline]
kvzalloc include/linux/slab.h:724 [inline]
ip_set_alloc+0x2c/0x3c net/netfilter/ipset/ip_set_core.c:261
hash_netiface_create+0x2c4/0xcb8 net/netfilter/ipset/ip_set_hash_gen.h:1515
ip_set_create+0x48c/0x1024 net/netfilter/ipset/ip_set_core.c:1111
nfnetlink_rcv_msg+0x9d4/0xed8 net/netfilter/nfnetlink.c:302
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2493
nfnetlink_rcv+0x1f8/0x1afc net/netfilter/nfnetlink.c:659
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x600/0x818 net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1859
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
___sys_sendmsg net/socket.c:2573 [inline]
__sys_sendmsg+0x25c/0x320 net/socket.c:2602
__do_sys_sendmsg net/socket.c:2611 [inline]
__se_sys_sendmsg net/socket.c:2609 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 538352
hardirqs last enabled at (538351): [<ffff800011a00854>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (538351): [<ffff800011a00854>] _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
hardirqs last disabled at (538352): [<ffff8000119153e0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (533194): [<ffff8000081a8dc0>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (533194): [<ffff8000081a8dc0>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:606
softirqs last disabled at (533185): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:612
---[ end trace 0000000000000000 ]---
syz.0.366 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000
CPU: 1 PID: 5358 Comm: syz.0.366 Tainted: G W 6.1.140-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
dump_header+0xc0/0x724 mm/oom_kill.c:467
oom_kill_process+0x360/0x674 mm/oom_kill.c:1046
out_of_memory+0xc5c/0xf68 mm/oom_kill.c:1184
mem_cgroup_out_of_memory+0x210/0x2bc mm/memcontrol.c:1711
mem_cgroup_oom mm/memcontrol.c:1941 [inline]
try_charge_memcg+0xac4/0x1448 mm/memcontrol.c:2734
obj_cgroup_charge_pages mm/memcontrol.c:3101 [inline]
__memcg_kmem_charge_page+0x304/0x54c mm/memcontrol.c:3127
__alloc_pages+0x1fc/0x53c mm/page_alloc.c:5623
alloc_pages+0x434/0x6f8 mm/mempolicy.c:-1
vm_area_alloc_pages mm/vmalloc.c:2994 [inline]
__vmalloc_area_node mm/vmalloc.c:3063 [inline]
__vmalloc_node_range+0x734/0xe48 mm/vmalloc.c:3235
kvmalloc_node+0x168/0x1dc mm/util.c:606
kvmalloc include/linux/slab.h:716 [inline]
kvzalloc include/linux/slab.h:724 [inline]
ip_set_alloc+0x2c/0x3c net/netfilter/ipset/ip_set_core.c:261
hash_netiface_create+0x2c4/0xcb8 net/netfilter/ipset/ip_set_hash_gen.h:1515
ip_set_create+0x48c/0x1024 net/netfilter/ipset/ip_set_core.c:1111
nfnetlink_rcv_msg+0x9d4/0xed8 net/netfilter/nfnetlink.c:302
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2493
nfnetlink_rcv+0x1f8/0x1afc net/netfilter/nfnetlink.c:659
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x600/0x818 net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1859
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
___sys_sendmsg net/socket.c:2573 [inline]
__sys_sendmsg+0x25c/0x320 net/socket.c:2602
__do_sys_sendmsg net/socket.c:2611 [inline]
__se_sys_sendmsg net/socket.c:2609 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
memory: usage 307200kB, limit 307200kB, failcnt 153
memory+swap: usage 307384kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307188kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz0:
anon 0
file 12288
kernel 314560512
kernel_stack 65536
pagetables 131072
sec_pagetables 0
percpu 4736
sock 0
vmalloc 0
shmem 0
zswap 0
zswapped 0
file_mapped 12288
file_dirty 12288
file_writeback 0
swapcached 188416
anon_thp 0
file_thp 0
shmem_thp 0
inactive_anon 0
active_anon 0
inactive_file 0
active_file 12288
unevictable 0
slab_reclaimable 248720
slab_unreclaimable 402208
slab 650928
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.366,pid=5357,uid=0
Memory cgroup out of memory: Killed process 5357 (syz.0.366) total-vm:101656kB, anon-rss:940kB, file-rss:22980kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
May 26, 2025, 9:34:38 AM5/26/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: da3c5173c55f Linux 6.1.140
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10ff8df4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16571df4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2c3ee4de68a1/disk-da3c5173.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/19742d73f52b/vmlinux-da3c5173.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0ffdd39d32ee/Image-da3c5173.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+68f30a...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4298 at mm/vmscan.c:3839 get_pte_pfn mm/vmscan.c:3839 [inline]
WARNING: CPU: 0 PID: 4298 at mm/vmscan.c:3839 lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
Modules linked in:
CPU: 0 PID: 4298 Comm: syz-executor301 Not tainted 6.1.140-syzkaller #0
x29: ffff800020715320 x28: 0000000020040000 x27: 0160000124801fc3
x26: ffff0000d39cb000 x25: ffff0000d5d00000 x24: 0000000000124801
x23: ffff0000d39cb008 x22: 0100000000000000 x21: 1fffe0001a739601
x20: dfff800000000000 x19: 0000000020001000 x18: 0000000000000000
x17: ffff8000181a0000 x16: ffff8000082d076c x15: 0000000000000000
x14: 0000000000000200 x13: 1ffff00002a0e0b1 x12: 0000000000ff0100
x11: ff00800008728cd8 x10: 0000000000000000 x9 : ffff800008728cd8
x8 : ffff0000de383780 x7 : ffff800008737f50 x6 : 0000000000000000
irq event stamp: 534160
hardirqs last enabled at (534159): [<ffff800011a00854>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (534159): [<ffff800011a00854>] _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
hardirqs last disabled at (534160): [<ffff8000119153e0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (521524): [<ffff8000081a8dc0>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (521524): [<ffff8000081a8dc0>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:606
softirqs last disabled at (521515): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:612
CPU: 0 PID: 4298 Comm: syz-executor301 Tainted: G W 6.1.140-syzkaller #0
memory: usage 307200kB, limit 307200kB, failcnt 68
memory+swap: usage 307224kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307196kB, limit 9007199254740988kB, failcnt 0
file 0
kernel 314568704
kernel_stack 32768
pagetables 36864
sec_pagetables 0
percpu 0
file_dirty 0
file_writeback 0
swapcached 24576
unevictable 0
slab_reclaimable 14120
slab_unreclaimable 31024
slab 45144
Tasks state (memory values in pages):
[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name
[ 4297] 0 4297 4324 14 32768 0 0 syz-executor301
[ 4298] 0 4298 4324 104 49152 6 1000 syz-executor301
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor301,pid=4298,uid=0
Memory cgroup out of memory: Killed process 4298 (syz-executor301) total-vm:17296kB, anon-rss:32kB, file-rss:384kB, shmem-rss:0kB, UID:0 pgtables:48kB oom_score_adj:1000
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: da3c5173c55f Linux 6.1.140
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=2bfe5a2f04bb30e3
dashboard link: https://syzkaller.appspot.com/bug?extid=68f30a5d113386f5a4e3
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11e55170580000
dashboard link: https://syzkaller.appspot.com/bug?extid=68f30a5d113386f5a4e3
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16571df4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2c3ee4de68a1/disk-da3c5173.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/19742d73f52b/vmlinux-da3c5173.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0ffdd39d32ee/Image-da3c5173.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+68f30a...@syzkaller.appspotmail.com
WARNING: CPU: 0 PID: 4298 at mm/vmscan.c:3839 get_pte_pfn mm/vmscan.c:3839 [inline]
WARNING: CPU: 0 PID: 4298 at mm/vmscan.c:3839 lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
Modules linked in:
CPU: 0 PID: 4298 Comm: syz-executor301 Not tainted 6.1.140-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : get_pte_pfn mm/vmscan.c:3839 [inline]
pc : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
lr : get_pte_pfn mm/vmscan.c:3839 [inline]
lr : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
sp : ffff800020715290
pc : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
lr : get_pte_pfn mm/vmscan.c:3839 [inline]
lr : lru_gen_look_around+0xb74/0x1330 mm/vmscan.c:4663
x29: ffff800020715320 x28: 0000000020040000 x27: 0160000124801fc3
x26: ffff0000d39cb000 x25: ffff0000d5d00000 x24: 0000000000124801
x23: ffff0000d39cb008 x22: 0100000000000000 x21: 1fffe0001a739601
x20: dfff800000000000 x19: 0000000020001000 x18: 0000000000000000
x17: ffff8000181a0000 x16: ffff8000082d076c x15: 0000000000000000
x14: 0000000000000200 x13: 1ffff00002a0e0b1 x12: 0000000000ff0100
x11: ff00800008728cd8 x10: 0000000000000000 x9 : ffff800008728cd8
x8 : ffff0000de383780 x7 : ffff800008737f50 x6 : 0000000000000000
hardirqs last enabled at (534159): [<ffff800011a00854>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (534159): [<ffff800011a00854>] _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
hardirqs last disabled at (534160): [<ffff8000119153e0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (521524): [<ffff8000081a8dc0>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (521524): [<ffff8000081a8dc0>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:606
softirqs last disabled at (521515): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:612
---[ end trace 0000000000000000 ]---
syz-executor301 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000
CPU: 0 PID: 4298 Comm: syz-executor301 Tainted: G W 6.1.140-syzkaller #0
memory+swap: usage 307224kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307196kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz0:
anon 4096
file 0
kernel 314568704
kernel_stack 32768
pagetables 36864
sec_pagetables 0
percpu 0
sock 0
vmalloc 0
shmem 0
zswap 0
zswapped 0
file_mapped 0
vmalloc 0
shmem 0
zswap 0
zswapped 0
file_dirty 0
file_writeback 0
swapcached 24576
anon_thp 0
file_thp 0
shmem_thp 0
inactive_anon 0
active_anon 0
inactive_file 0
active_file 0
file_thp 0
shmem_thp 0
inactive_anon 0
active_anon 0
inactive_file 0
unevictable 0
slab_reclaimable 14120
slab_unreclaimable 31024
slab 45144
Tasks state (memory values in pages):
[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name
[ 4297] 0 4297 4324 14 32768 0 0 syz-executor301
[ 4298] 0 4298 4324 104 49152 6 1000 syz-executor301
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor301,pid=4298,uid=0
Memory cgroup out of memory: Killed process 4298 (syz-executor301) total-vm:17296kB, anon-rss:32kB, file-rss:384kB, shmem-rss:0kB, UID:0 pgtables:48kB oom_score_adj:1000
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Sep 21, 2025, 1:04:03 PM9/21/25
to syzkaller...@googlegroups.com
syzbot suspects this issue could be fixed by backporting the following commit:
commit c28ac3c7eb945fee6e20f47d576af68fdff1392a
git tree: upstream
Author: Yu Zhao <yuz...@google.com>
Date: Sat Dec 23 04:56:47 2023 +0000
mm/mglru: skip special VMAs in lru_gen_look_around()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1606d0e2580000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fd5170580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17e09df4580000
Please keep in mind that other backports might be required as well.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit c28ac3c7eb945fee6e20f47d576af68fdff1392a
git tree: upstream
Author: Yu Zhao <yuz...@google.com>
Date: Sat Dec 23 04:56:47 2023 +0000
mm/mglru: skip special VMAs in lru_gen_look_around()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1606d0e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2bfe5a2f04bb30e3
dashboard link: https://syzkaller.appspot.com/bug?extid=68f30a5d113386f5a4e3
userspace arch: arm64
dashboard link: https://syzkaller.appspot.com/bug?extid=68f30a5d113386f5a4e3
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fd5170580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17e09df4580000
Please keep in mind that other backports might be required as well.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages