Hi On 5/17/2024 3:15 PM, Pengfei Xu wrote: > Hi Yuntao, > > Greeting! > > On 2024-04-14 at 19:28:16 -0700, syzbot wrote: >> Hello, >> >> syzbot found the following issue on: >> >> HEAD commit: 7efd0a74039f Merge tag 'ata-6.9-rc4' of git://git.kernel.o.. >> git tree: upstream >> console output: https://syzkaller.appspot.com/x/log.txt?x=1358aeed180000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=285be8dd6baeb438 >> dashboard link: https://syzkaller.appspot.com/bug?extid=a7f061d2d16154538c58 >> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 >> >> Unfortunately, I don't have any reproducer for this issue yet. >> > I used syzkaller and could reproduce the similar issue "WARNING in > get_page_from_freelist" in v6.9 mainline kernel. The warning report is different with the dead-lock syzbot report. The warning is "WARN_ON_ONCE((gfp_flags & __GFP_NOFAIL) && (order > 1))" in rmqueue() and it is caused by "kzalloc(sizeof(struct xfs_mount), GFP_KERNEL | __GFP_NOFAIL)" in xfs_init_fs_context(). > > Bisected and found first bad commit: > " > 816d334afa85 kexec: modify the meaning of the end parameter in kimage_is_destination_range() > " > Revert above commit on top of v6.9 kernel this issue was gone. > > All detailed info: https://github.com/xupengfe/syzkaller_logs/tree/main/240517_085953_get_page_from_freelist > mount_*.gz are in above link. > Syzkaller reproduced code: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/rep.c > Syzkaller syscall repro steps: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/repro.prog > Syzkaller report: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/repro.report I think it is a false positive, because without KASAN enabled, the size of xfs_mount is about 2496 bytes and it is impossible to trigger the WARN_ON_ONCE(). However with KASAN enabled, the size of xfs_mount will be greater than 4096, so the warning will be triggered accordingly when the 8KB-slab needs to refill its slabs.
