[syzbot] [trace?] WARNING in tracing_buffers_mmap_close (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7dff99b35460 Remove WARN_ALL_UNSEEDED_RANDOM kernel config..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14bc2006580000
kernel config: https://syzkaller.appspot.com/x/.config?x=af6ed0125ed44356
dashboard link: https://syzkaller.appspot.com/bug?extid=3b5dd2030fe08afdf65d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11bc4202580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107f155a580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/45c7b6686727/disk-7dff99b3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/36fcc9cd6296/vmlinux-7dff99b3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/fe952fd2745b/bzImage-7dff99b3.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3b5dd2...@syzkaller.appspotmail.com

------------[ cut here ]------------
ring_buffer_unmap(iter->array_buffer->buffer, iter->cpu_file)
WARNING: kernel/trace/trace.c:8221 at tracing_buffers_mmap_close kernel/trace/trace.c:8221 [inline], CPU#0: syz.0.17/5983
WARNING: kernel/trace/trace.c:8221 at tracing_buffers_mmap_close+0xea/0x140 kernel/trace/trace.c:8216, CPU#0: syz.0.17/5983
Modules linked in:
CPU: 0 UID: 0 PID: 5983 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:tracing_buffers_mmap_close kernel/trace/trace.c:8221 [inline]
RIP: 0010:tracing_buffers_mmap_close+0xea/0x140 kernel/trace/trace.c:8216
Code: 08 e8 3a 74 ff ff 31 ff 89 c3 89 c6 e8 2f 50 fb ff 85 db 75 0f e8 76 55 fb ff 48 83 c4 08 5b e9 cc 45 83 09 e8 67 55 fb ff 90 <0f> 0b 90 e8 5e 55 fb ff 48 83 c4 08 5b c3 cc cc cc cc e8 df bd 66
RSP: 0018:ffffc90003ff7ab8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000ffffffed RCX: ffffffff820ca5c1
RDX: ffff88802a299e40 RSI: ffffffff820ca5d9 RDI: ffff88802a299e40
RBP: ffffffff820ca4f0 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000ffffffed R11: 0000000000000000 R12: ffff88807fc6ecc8
R13: 0000000000000001 R14: 0000000000000005 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff888124351000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc3f6e17dac CR3: 000000000e598000 CR4: 00000000003526f0
Call Trace:
<TASK>
vma_close mm/internal.h:190 [inline]
remove_vma+0x88/0x160 mm/vma.c:466
tear_down_vmas+0x2a5/0x600 mm/mmap.c:1264
exit_mmap+0x469/0xa30 mm/mmap.c:1322
__mmput+0x12a/0x410 kernel/fork.c:1174
mmput+0x67/0x80 kernel/fork.c:1197
exit_mm kernel/exit.c:581 [inline]
do_exit+0x78a/0x2aa0 kernel/exit.c:959
do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
__do_sys_exit_group kernel/exit.c:1123 [inline]
__se_sys_exit_group kernel/exit.c:1121 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc3f6b9c629
Code: Unable to access opcode bytes at 0x7fc3f6b9c5ff.
RSP: 002b:00007ffc852ef4c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3f6b9c629
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fc3f6de53e0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc3f6de53e0 R14: 0000000000000003 R15: 00007ffc852ef580
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Qing Wang]

#syz test

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 23de3719f495..c74ba9c8c98e 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8251,12 +8251,14 @@ static int tracing_buffers_mmap(struct file *filp, struct vm_area_struct *vma)
return ret;

ret = ring_buffer_map(iter->array_buffer->buffer, iter->cpu_file, vma);
- if (ret)
+ if (ret) {
put_snapshot_map(iter->tr);
+ return ret;
+ }

vma->vm_ops = &tracing_buffers_vmops;

- return ret;
+ return 0;
}

static const struct file_operations tracing_buffers_fops = {

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in tracing_buffers_mmap_close

------------[ cut here ]------------
ring_buffer_unmap(iter->array_buffer->buffer, iter->cpu_file)

WARNING: kernel/trace/trace.c:8221 at tracing_buffers_mmap_close kernel/trace/trace.c:8221 [inline], CPU#0: syz.0.17/6401
WARNING: kernel/trace/trace.c:8221 at tracing_buffers_mmap_close+0xea/0x140 kernel/trace/trace.c:8216, CPU#0: syz.0.17/6401
Modules linked in:
CPU: 0 UID: 0 PID: 6401 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:tracing_buffers_mmap_close kernel/trace/trace.c:8221 [inline]
RIP: 0010:tracing_buffers_mmap_close+0xea/0x140 kernel/trace/trace.c:8216

Code: 08 e8 1a 74 ff ff 31 ff 89 c3 89 c6 e8 0f 50 fb ff 85 db 75 0f e8 56 55 fb ff 48 83 c4 08 5b c3 cc cc cc cc e8 47 55 fb ff 90 <0f> 0b 90 e8 3e 55 fb ff 48 83 c4 08 5b e9 54 55 83 09 e8 ff bd 66
RSP: 0018:ffffc90002f27ab8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000ffffffed RCX: ffffffff820ca621
RDX: ffff88801efcdac0 RSI: ffffffff820ca639 RDI: ffff88801efcdac0
RBP: ffffffff820ca550 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000ffffffed R11: 0000000000000000 R12: ffff888078da3048

R13: 0000000000000001 R14: 0000000000000005 R15: 0000000000000001

FS: 0000000000000000(0000) GS:ffff88812434f000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f4d99a17dac CR3: 000000000e598000 CR4: 00000000003526f0

Call Trace:
<TASK>
vma_close mm/internal.h:190 [inline]
remove_vma+0x88/0x160 mm/vma.c:466
tear_down_vmas+0x2a5/0x600 mm/mmap.c:1264
exit_mmap+0x469/0xa30 mm/mmap.c:1322
__mmput+0x12a/0x410 kernel/fork.c:1174
mmput+0x67/0x80 kernel/fork.c:1197
exit_mm kernel/exit.c:581 [inline]
do_exit+0x78a/0x2aa0 kernel/exit.c:959
do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
__do_sys_exit_group kernel/exit.c:1123 [inline]
__se_sys_exit_group kernel/exit.c:1121 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f4d9979c629
Code: Unable to access opcode bytes at 0x7f4d9979c5ff.
RSP: 002b:00007ffea34a0a28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4d9979c629

RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000

RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f4d999e53e0

R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f4d999e53e0 R14: 0000000000000003 R15: 00007ffea34a0ae0
</TASK>


Tested on:

commit: f4d0ec0a Merge tag 'erofs-for-7.0-rc2-fixes' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12efb55a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=af6ed0125ed44356
dashboard link: https://syzkaller.appspot.com/bug?extid=3b5dd2030fe08afdf65d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=1484c24a580000

[Qing Wang]

#syz test

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c

index 23de3719f495..72b39295a8b0 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8213,6 +8213,14 @@ static inline int get_snapshot_map(struct trace_array *tr) { return 0; }
static inline void put_snapshot_map(struct trace_array *tr) { }
#endif

+static void tracing_buffers_mmap_open(struct vm_area_struct *vma)
+{
+ struct ftrace_buffer_info *info = vma->vm_file->private_data;
+ struct trace_iterator *iter = &info->iter;
+
+ WARN_ON(ring_buffer_map(iter->array_buffer->buffer, iter->cpu_file, vma));
+}
+
static void tracing_buffers_mmap_close(struct vm_area_struct *vma)
{
struct ftrace_buffer_info *info = vma->vm_file->private_data;
@@ -8232,6 +8240,7 @@ static int tracing_buffers_may_split(struct vm_area_struct *vma, unsigned long a
}

static const struct vm_operations_struct tracing_buffers_vmops = {
+ .open = tracing_buffers_mmap_open,
.close = tracing_buffers_mmap_close,
.may_split = tracing_buffers_may_split,
};

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

BUG: Bad rss-counter state

BUG: Bad rss-counter state mm:ffff888022363100 type:MM_FILEPAGES val:4 Comm:syz.0.17 Pid:6501

Tested on:

commit: f4d0ec0a Merge tag 'erofs-for-7.0-rc2-fixes' of git://..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=158ac202580000

kernel config: https://syzkaller.appspot.com/x/.config?x=af6ed0125ed44356
dashboard link: https://syzkaller.appspot.com/bug?extid=3b5dd2030fe08afdf65d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=10fe1b94580000

[Qing Wang]

#syz test

diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 876358cfe1b1..07f5127c8255 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -248,6 +248,7 @@ int trace_rb_cpu_prepare(unsigned int cpu, struct hlist_node *node);

int ring_buffer_map(struct trace_buffer *buffer, int cpu,
struct vm_area_struct *vma);
+void ring_buffer_map_user_mapped_inc(struct trace_buffer *buffer, int cpu);
int ring_buffer_unmap(struct trace_buffer *buffer, int cpu);
int ring_buffer_map_get_reader(struct trace_buffer *buffer, int cpu);
#endif /* _LINUX_RING_BUFFER_H */
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index f16f053ef77d..59516b89e612 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7310,6 +7310,30 @@ int ring_buffer_map(struct trace_buffer *buffer, int cpu,
return err;
}

+/**
+ * ring_buffer_map_user_mapped_inc - Increment user_mapped counter for VMA duplication
+ * @buffer: The ring buffer
+ * @cpu: The CPU of the ring buffer to increment
+ *
+ * This is called when a VMA is duplicated (e.g., on fork()) to increment
+ * the user_mapped counter without remapping pages.
+ */
+void ring_buffer_map_user_mapped_inc(struct trace_buffer *buffer, int cpu)
+{
+ struct ring_buffer_per_cpu *cpu_buffer;
+
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
+ guard(mutex)(&cpu_buffer->mapping_lock);
+
+ if (cpu_buffer->user_mapped)
+ __rb_inc_dec_mapped(cpu_buffer, true);
+}
+EXPORT_SYMBOL_GPL(ring_buffer_map_user_mapped_inc);
+
int ring_buffer_unmap(struct trace_buffer *buffer, int cpu)
{
struct ring_buffer_per_cpu *cpu_buffer;
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 23de3719f495..b2ab95ed8d41 100644

--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8213,6 +8213,14 @@ static inline int get_snapshot_map(struct trace_array *tr) { return 0; }
static inline void put_snapshot_map(struct trace_array *tr) { }
#endif

+static void tracing_buffers_mmap_open(struct vm_area_struct *vma)
+{
+ struct ftrace_buffer_info *info = vma->vm_file->private_data;
+ struct trace_iterator *iter = &info->iter;
+

+ ring_buffer_map_user_mapped_inc(iter->array_buffer->buffer, iter->cpu_file);

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+3b5dd2...@syzkaller.appspotmail.com
Tested-by: syzbot+3b5dd2...@syzkaller.appspotmail.com

Tested on:

commit: f4d0ec0a Merge tag 'erofs-for-7.0-rc2-fixes' of git://..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=1222bde6580000

kernel config: https://syzkaller.appspot.com/x/.config?x=af6ed0125ed44356
dashboard link: https://syzkaller.appspot.com/bug?extid=3b5dd2030fe08afdf65d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=145d4d5a580000

Note: testing is done by a robot and is best-effort only.