Re: BUG: Bad page map (3)

[YaÄmur Oymak]

Hello,
I see that syzbot found the following crash.
syzbot <syzbot+0b10582e8ee2a6253de7@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> BUG: Bad page map in process syz-executor3  pte:ffffffff8901f947
> pmd:18d73f067
> addr:000000006b20cb06 vm_flags:180400fb anon_vma:          (null)
> mapping:000000007878cb6c index:b7
> file:kcov fault:          (null) mmap:kcov_mmap readpage:          (null)
> CPU: 0 PID: 19022 Comm: syz-executor3 Not tainted 4.19.0-rc2+ #4
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
>   __dump_stack lib/dump_stack.c:77 [inline]
>   dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
>   print_bad_pte.cold.111+0x1e6/0x24b mm/memory.c:773
>   _vm_normal_page+0x248/0x3c0 mm/memory.c:859
>   zap_pte_range mm/memory.c:1311 [inline]
>   zap_pmd_range mm/memory.c:1440 [inline]
>   zap_pud_range mm/memory.c:1469 [inline]
>   zap_p4d_range mm/memory.c:1490 [inline]
>   unmap_page_range+0x9a5/0x2000 mm/memory.c:1511
>   unmap_single_vma+0x19b/0x310 mm/memory.c:1556
>   unmap_vmas+0x125/0x200 mm/memory.c:1586
>   exit_mmap+0x2be/0x590 mm/mmap.c:3093
>   __mmput kernel/fork.c:1001 [inline]
>   mmput+0x247/0x610 kernel/fork.c:1022
>   exit_mm kernel/exit.c:545 [inline]
>   do_exit+0xe6f/0x2610 kernel/exit.c:854
>   do_group_exit+0x177/0x440 kernel/exit.c:970
>   get_signal+0x8b0/0x1980 kernel/signal.c:2513
>   do_signal+0x9c/0x21e0 arch/x86/kernel/signal.c:816
>   exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
>   prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
>   syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
>   do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
>   entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x457099
> Code: Bad RIP value.
> RSP: 002b:00007f9decd04cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: fffffffffffffe00 RBX: 00000000009300a8 RCX: 0000000000457099
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000009300a8
> RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00000000009300ac
> R13: 00007ffe4545d67f R14: 00007f9decd059c0 R15: 0000000000000000

I'm running the 4.18.8 kernel on Fedora (uname -r is
4.18.8-200.fc28.x86_64). Suddenly, my computer freezed completely.
After a reboot, I've found the following in the logs:
swap_info_get: Bad swap offset entry 1ffffffffffff
BUG: Bad page map in process gdbus  pte:400000000000000 pmd:a9ed2067
addr:00000000bd2fe465 vm_flags:08000070 anon_vma:          (null) map>
file:libgvfsdbus.so fault:ext4_filemap_fault mmap:ext4_file_mmap read>
CPU: 2 PID: 21057 Comm: gdbus Tainted: G    B      OE     4.18.8-200.>
Hardware name: ASUS All Series/Z97-K, BIOS 2305 10/09/2014
Call Trace:
 dump_stack+0x5c/0x80
 print_bad_pte.cold.102+0x9a/0xc4
 ? __swap_info_get.cold.49+0x2f/0x4b
 unmap_page_range+0x85d/0xba0
 unmap_vmas+0x7a/0xb0
 exit_mmap+0xaa/0x190
 mmput+0x5f/0x130
 do_exit+0x280/0xae0
 do_group_exit+0x3a/0xa0
 get_signal+0x276/0x590
 do_signal+0x36/0x610
 exit_to_usermode_loop+0x71/0xd0
 do_syscall_64+0x14d/0x160
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f02c71f93e9
Code: Bad RIP value.
RSP: 002b:00007f02bf7fdce0 EFLAGS: 00000293 ORIG_RAX: 0000000000000007
RAX: fffffffffffffdfc RBX: 00007f02c001f950 RCX: 00007f02c71f93e9
RDX: 00000000ffffffff RSI: 0000000000000001 RDI: 00007f02c001f950
RBP: 0000000000000001 R08: 0000000000000000 R09: 00007f02c001d898
R10: 00007f02c0005280 R11: 0000000000000293 R12: 00000000ffffffff
R13: 00007f02c7b85520 R14: 00000000ffffffff R15: 0000000000000002
BUG: Bad rss-counter state mm:000000003b7d4ec4 idx:2 val:-1

The bug reported by syzbot is very recent and the stack trace looks
like the one I encountered, so I decided to post here.
Unfortunately, I'm running a distribution kernel and my kernel is
tainted (WireGuard module). I will try to reproduce it with a vanilla
kernel and without any out-of-tree modules, if having a human
reproducer would be of any help.

Thanks,
Yagmur Oymak