mm: page fault in __do_huge_pmd_anonymous_page

[Dmitry Vyukov]

Hello,

While running syzkaller fuzzer I've got the following crash report.
Unfortunately it's not reproducible.
On commit 1a0a02d1efa066001fd315c1b4df583d939fa2c4 (Jun 30).

BUG: unable to handle kernel paging request at ffff88005f269000
IP: [<ffffffff82ced4ac>] clear_page+0xc/0x10 arch/x86/lib/clear_page_64.S:22
PGD a973067 PUD a976067 PMD 7fc09067 PTE 800000005f269060
Oops: 0002 [#1] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 3 PID: 10563 Comm: syz-executor Not tainted 4.7.0-rc5+ #28
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880069230300 ti: ffff88006c288000 task.ti: ffff88006c288000
RIP: 0010:[<ffffffff82ced4ac>]
 [<ffffffff82ced4ac>] clear_page+0xc/0x10 arch/x86/lib/clear_page_64.S:22
RSP: 0018:ffff88006c28fce8  EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000017c9a40 RCX: 0000000000000200
RDX: 0000000080000000 RSI: 0000000000000f42 RDI: ffff88005f269000
RBP: ffff88006c28fd40 R08: 0000000000029900 R09: 0000000000000000
R10: fffffffffffffffd R11: ffffffffffffffe8 R12: dffffc0000000000
R13: ffff880069230300 R14: 00000000017d0000 R15: ffffed000d2462b7
FS:  0000000002c4c880(0000) GS:ffff88006d500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88005f269000 CR3: 000000006b2b3000 CR4: 00000000000006e0
Stack:
 ffffffff81747f60 0000000000000000 ffff88006c28fd20 ffffffff81483dcd
 ffffea00019ebf40 ffff8800692315b8 ffff8800672c9700 0000000020000000
 1ffff1000d851fb2 ffffea00017c8000 0000000000000000 ffff88006c28fe18
Call Trace:
 [<     inline     >] ? clear_user_page ./arch/x86/include/asm/page.h:27
 [<     inline     >] ? clear_user_highpage include/linux/highmem.h:136
 [<ffffffff81747f60>] ? clear_huge_page+0x110/0x470 mm/memory.c:3907
 [<ffffffff81483dcd>] ? __raw_spin_lock_init+0x2d/0x100
kernel/locking/spinlock_debug.c:24
 [<     inline     >] __do_huge_pmd_anonymous_page mm/huge_memory.c:819
 [<ffffffff817d727b>] do_huge_pmd_anonymous_page+0x53b/0xfe0
mm/huge_memory.c:970
 [<ffffffff814b4be7>] ? debug_lockdep_rcu_enabled+0x77/0x90
kernel/rcu/update.c:261
 [<ffffffff817d6d40>] ? __khugepaged_enter+0x2a0/0x2a0 mm/huge_memory.c:1903
 [<     inline     >] ? rcu_read_unlock include/linux/rcupdate.h:907
 [<     inline     >] ? mem_cgroup_count_vm_event include/linux/memcontrol.h:513
 [<ffffffff81741b94>] ? handle_mm_fault+0x194/0x11a0 mm/memory.c:3506
 [<     inline     >] create_huge_pmd mm/memory.c:3309
 [<     inline     >] __handle_mm_fault mm/memory.c:3433
 [<ffffffff81742994>] handle_mm_fault+0xf94/0x11a0 mm/memory.c:3518
 [<     inline     >] ? arch_static_branch include/linux/vmstat.h:41
 [<     inline     >] ? mem_cgroup_disabled include/linux/memcontrol.h:278
 [<     inline     >] ? mem_cgroup_count_vm_event include/linux/memcontrol.h:494
 [<ffffffff81741a94>] ? handle_mm_fault+0x94/0x11a0 mm/memory.c:3506
 [<ffffffff81290e67>] __do_page_fault+0x457/0xbb0 arch/x86/mm/fault.c:1356
 [<ffffffff8129170f>] trace_do_page_fault+0xdf/0x5b0 arch/x86/mm/fault.c:1449
 [<ffffffff81281c24>] do_async_page_fault+0x14/0xd0 arch/x86/kernel/kvm.c:265
 [<ffffffff86a96fb8>] async_page_fault+0x28/0x30 arch/x86/entry/entry_64.S:923
Code: ff ff e9 fd fe ff ff 4c 89 ff e8 e0 c6 ac fe e9 1a ff ff ff 90
90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 b9 00 02 00 00 31 c0 <f3>
48 ab c3 31 c0 b9 40 00 00 00 66 0f 1f 84 00 00 00 00 00 ff
RIP  [<ffffffff82ced4ac>] clear_page+0xc/0x10 arch/x86/lib/clear_page_64.S:22
 RSP <ffff88006c28fce8>
CR2: ffff88005f269000
---[ end trace 69bd3018b876c97d ]---