WARNING in split_huge_page_to_list (2)

syzbot syzbot 3 participants 3 messages Aug 23, 2022 – Apr 6, 2023 Memory management

lore

Share & tools

lore

syzbot

author syzbot

2022-08-23 22:08 UTC #0 lore raw

Hello,

syzbot found the following issue on:

HEAD commit:    680fb5b009e8 Merge tag 'arm64-upstream' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=10ef7dc3080000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4557ad2600fc45f4
dashboard link: https://syzkaller.appspot.com/bug?extid=07a218429c8d19b1fb25
compiler:       Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17993aa5080000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16521a3d080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by [email protected]

raw: 05ffc00000010801 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000
page dumped because: VM_WARN_ON_ONCE_PAGE(is_hzp)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3025 at mm/huge_memory.c:2555 split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
Modules linked in:
CPU: 1 PID: 3025 Comm: syz-executor201 Not tainted 5.19.0-rc8-syzkaller-01618-g680fb5b009e8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/20/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
lr : split_huge_page_to_list+0x308/0xe2c mm/huge_memory.c:2555

sp : ffff80001321bba0
x29: ffff80001321bbf0 x28: 0000000000400000 x27: 0000000000000001
x26: ffff80000ceda000 x25: 05ffc00000000000 x24: ffff80000d8c1000
x23: fffffc0003300000 x22: ffff0001ff012d40 x21: fffffc0003304400
x20: 0000000000000000 x19: fffffc0003300000 x18: 00000000000000c0
x17: ffff80000dcfd698 x16: ffff80000db3b658 x15: ffff0000c6708000
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c6708000
x11: ff808000081bf324 x10: 0000000000000000 x9 : 461f0eca467c0e00 x8 : 0000000000000001 x7 : ffff8000081937c0 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000031

Call trace:
 split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
 split_huge_page include/linux/huge_mm.h:206 [inline]
 try_to_split_thp_page mm/memory-failure.c:1488 [inline]
 memory_failure+0x510/0x14cc mm/memory-failure.c:1870
 madvise_inject_error+0x260/0x334 mm/madvise.c:1115
 do_madvise+0x258/0x5ac mm/madvise.c:1398
 __do_sys_madvise mm/madvise.c:1423 [inline]
 __se_sys_madvise mm/madvise.c:1421 [inline]
 __arm64_sys_madvise+0x2c/0x40 mm/madvise.c:1421
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x154 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x14c arch/arm64/kernel/entry-common.c:624
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:642
 el0t_64_sync+0x18c/0x190
irq event stamp: 11566
hardirqs last  enabled at (11565): [<ffff8000081bd590>] __up_console_sem+0xb0/0xfc kernel/printk/printk.c:264
hardirqs last disabled at (11566): [<ffff80000bfa4314>] el1_dbg+0x24/0x5c arch/arm64/kernel/entry-common.c:395
softirqs last  enabled at (11536): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (11527): [<ffff800008101e20>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (11527): [<ffff800008101e20>] invoke_softirq+0x70/0xbc kernel/softirq.c:452
---[ end trace 0000000000000000 ]---

Memory Failure: 0x10c110: thp split failed
Memory failure: 0x10c110: recovery action for unsplit thp: Ignored

---
This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Yang Shi

2022-08-24 01:36 UTC #1 lore raw

Quoted 40 lines · syzbot

Hello,
syzbot found the following issue on:
HEAD commit:    680fb5b009e8 Merge tag 'arm64-upstream' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=10ef7dc3080000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4557ad2600fc45f4
dashboard link: https://syzkaller.appspot.com/bug?extid=07a218429c8d19b1fb25
compiler:       Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17993aa5080000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16521a3d080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by [email protected]
raw: 05ffc00000010801 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000
page dumped because: VM_WARN_ON_ONCE_PAGE(is_hzp)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3025 at mm/huge_memory.c:2555 split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
Modules linked in:
CPU: 1 PID: 3025 Comm: syz-executor201 Not tainted 5.19.0-rc8-syzkaller-01618-g680fb5b009e8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/20/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
lr : split_huge_page_to_list+0x308/0xe2c mm/huge_memory.c:2555
sp : ffff80001321bba0
x29: ffff80001321bbf0 x28: 0000000000400000 x27: 0000000000000001
x26: ffff80000ceda000 x25: 05ffc00000000000 x24: ffff80000d8c1000
x23: fffffc0003300000 x22: ffff0001ff012d40 x21: fffffc0003304400
x20: 0000000000000000 x19: fffffc0003300000 x18: 00000000000000c0
x17: ffff80000dcfd698 x16: ffff80000db3b658 x15: ffff0000c6708000
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c6708000
x11: ff808000081bf324 x10: 0000000000000000 x9 : 461f0eca467c0e00 x8 : 0000000000000001 x7 : ffff8000081937c0 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000031

Quoted 6 lines

Call trace:
 split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
 split_huge_page include/linux/huge_mm.h:206 [inline]
 try_to_split_thp_page mm/memory-failure.c:1488 [inline]
 memory_failure+0x510/0x14cc mm/memory-failure.c:1870
 madvise_inject_error+0x260/0x334 mm/madvise.c:1115

MADV_HWPOISON is called on a huge zero page. The warning was raised for this case intentionally (it was a BUG before), see commit 478d134e9506c7e9bfe2830ed03dd85e97966313 ("mm/huge_memory: do not overkill when splitting huge_zero_page").

Quoted 32 lines

 do_madvise+0x258/0x5ac mm/madvise.c:1398
 __do_sys_madvise mm/madvise.c:1423 [inline]
 __se_sys_madvise mm/madvise.c:1421 [inline]
 __arm64_sys_madvise+0x2c/0x40 mm/madvise.c:1421
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x154 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x14c arch/arm64/kernel/entry-common.c:624
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:642
 el0t_64_sync+0x18c/0x190
irq event stamp: 11566
hardirqs last  enabled at (11565): [<ffff8000081bd590>] __up_console_sem+0xb0/0xfc kernel/printk/printk.c:264
hardirqs last disabled at (11566): [<ffff80000bfa4314>] el1_dbg+0x24/0x5c arch/arm64/kernel/entry-common.c:395
softirqs last  enabled at (11536): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (11527): [<ffff800008101e20>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (11527): [<ffff800008101e20>] invoke_softirq+0x70/0xbc kernel/softirq.c:452
---[ end trace 0000000000000000 ]---

Memory Failure: 0x10c110: thp split failed
Memory failure: 0x10c110: recovery action for unsplit thp: Ignored

---
This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected].

HORIGUCHI NAOYA(堀口直也)

2023-04-06 08:25 UTC #2 lore raw

Quoted 49 lines · Yang Shi

Quoted 40 lines · syzbot
Hello,
syzbot found the following issue on:
HEAD commit:    680fb5b009e8 Merge tag 'arm64-upstream' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=10ef7dc3080000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4557ad2600fc45f4
dashboard link: https://syzkaller.appspot.com/bug?extid=07a218429c8d19b1fb25
compiler:       Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17993aa5080000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16521a3d080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by [email protected]
raw: 05ffc00000010801 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000
page dumped because: VM_WARN_ON_ONCE_PAGE(is_hzp)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3025 at mm/huge_memory.c:2555 split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
Modules linked in:
CPU: 1 PID: 3025 Comm: syz-executor201 Not tainted 5.19.0-rc8-syzkaller-01618-g680fb5b009e8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/20/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
lr : split_huge_page_to_list+0x308/0xe2c mm/huge_memory.c:2555
sp : ffff80001321bba0
x29: ffff80001321bbf0 x28: 0000000000400000 x27: 0000000000000001
x26: ffff80000ceda000 x25: 05ffc00000000000 x24: ffff80000d8c1000
x23: fffffc0003300000 x22: ffff0001ff012d40 x21: fffffc0003304400
x20: 0000000000000000 x19: fffffc0003300000 x18: 00000000000000c0
x17: ffff80000dcfd698 x16: ffff80000db3b658 x15: ffff0000c6708000
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c6708000
x11: ff808000081bf324 x10: 0000000000000000 x9 : 461f0eca467c0e00 x8 : 0000000000000001 x7 : ffff8000081937c0 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000031
Quoted 6 lines
Call trace:
 split_huge_page_to_list+0x310/0xe2c mm/huge_memory.c:2555
 split_huge_page include/linux/huge_mm.h:206 [inline]
 try_to_split_thp_page mm/memory-failure.c:1488 [inline]
 memory_failure+0x510/0x14cc mm/memory-failure.c:1870
 madvise_inject_error+0x260/0x334 mm/madvise.c:1115

Quoted 4 lines

MADV_HWPOISON is called on a huge zero page. The warning was raised for this case intentionally (it was a BUG before), see commit 478d134e9506c7e9bfe2830ed03dd85e97966313 ("mm/huge_memory: do not overkill when splitting huge_zero_page").

Sorry for my delayed response, I just now posted a patch to avoid this warning.
https://lore.kernel.org/linux-mm/[email protected]/T/#u

Thanks,
Naoya Horiguchi