On Wed, 08 Feb 2023 17:49:49 -0800 syzbot <syzbot+d632e24db18585d7b3c6@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 38d2b86a665b Add linux-next specific files for 20230208 > git tree: linux-next > console+strace: https://syzkaller.appspot.com/x/log.txt?x=15f5e3a7480000 > kernel config: https://syzkaller.appspot.com/x/.config?x=3691b32dd4410e01 > dashboard link: https://syzkaller.appspot.com/bug?extid=d632e24db18585d7b3c6 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1454ddf3480000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14a8431f480000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/0a9d60e90514/disk-38d2b86a.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/71311be5f1a1/vmlinux-38d2b86a.xz > kernel image: https://storage.googleapis.com/syzbot-assets/a242870cc8eb/bzImage-38d2b86a.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+d632e24db18585d7b3c6@xxxxxxxxxxxxxxxxxxxxxxxxx > > memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5080 'syz-executor561' > BUG: unable to handle page fault for address: ffffffffffffffed > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD c570067 P4D c570067 PUD c572067 PMD 0 > Oops: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 5080 Comm: syz-executor561 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 > RIP: 0010:PageTail include/linux/page-flags.h:290 [inline] > RIP: 0010:folio_flags.constprop.0+0x2c/0x150 include/linux/page-flags.h:317 > Code: 49 89 fc 55 53 e8 84 4e b7 ff 49 8d 7c 24 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f8 00 00 00 <49> 8b 5c 24 08 31 ff 83 e3 01 48 89 de e8 c2 4a b7 ff 48 85 db 0f > RSP: 0018:ffffc90003cbfc08 EFLAGS: 00010246 > RAX: dffffc0000000000 RBX: ffffffffffffffe5 RCX: 0000000000000000 > RDX: 1ffffffffffffffd RSI: ffffffff81cd1f5c RDI: ffffffffffffffed > RBP: ffffffffffffffe5 R08: 0000000000000005 R09: 0000000000000000 > R10: 00000000ffffffe5 R11: 0000000000000000 R12: ffffffffffffffe5 > R13: 000feffffff00000 R14: 0000000000000046 R15: 000feffffff00000 > FS: 0000555556e84300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: ffffffffffffffed CR3: 000000002bb37000 CR4: 00000000003506e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > <TASK> > folio_test_head include/linux/page-flags.h:781 [inline] > folio_test_large include/linux/page-flags.h:802 [inline] > PageHeadHuge+0x18/0xc0 mm/hugetlb.c:2060 > folio_test_hugetlb include/linux/page-flags.h:830 [inline] > folio_file_page include/linux/pagemap.h:702 [inline] > shmem_read_mapping_page_gfp+0x34/0x100 mm/shmem.c:4366 > shmem_read_mapping_page include/linux/shmem_fs.h:124 [inline] > udmabuf_create+0x93b/0x1440 drivers/dma-buf/udmabuf.c:286 > udmabuf_ioctl_create drivers/dma-buf/udmabuf.c:346 [inline] > udmabuf_ioctl+0x156/0x2c0 drivers/dma-buf/udmabuf.c:377 Thanks, I expect Matthew just fixed this. From: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Subject: shmem-add-shmem_read_folio-and-shmem_read_folio_gfp-fix Date: Wed Feb 8 07:54:45 PM PST 2023 fix shmem_read_mapping_page_gfp(), per Matthew Link: https://lkml.kernel.org/r/Y+QdJTuzxeBYejw2@xxxxxxxxxxxxxxxxxxxx Cc: Charan Teja Kalla <quic_charante@xxxxxxxxxxx> Cc: David Rientjes <rientjes@xxxxxxxxxx> Cc: Hugh Dickins <hughd@xxxxxxxxxx> Cc: Mark Hemment <markhemm@xxxxxxxxxxxxxx> Cc: "Matthew Wilcox (Oracle)" <willy@xxxxxxxxxxxxx> Cc: Michal Hocko <mhocko@xxxxxxxx> Cc: Pavankumar Kondeti <quic_pkondeti@xxxxxxxxxxx> Cc: Shakeel Butt <shakeelb@xxxxxxxxxx> Cc: Suren Baghdasaryan <surenb@xxxxxxxxxx> Cc: Vlastimil Babka <vbabka@xxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- --- a/mm/shmem.c~shmem-add-shmem_read_folio-and-shmem_read_folio_gfp-fix +++ a/mm/shmem.c @@ -4354,8 +4354,12 @@ struct page *shmem_read_mapping_page_gfp pgoff_t index, gfp_t gfp) { struct folio *folio = shmem_read_folio_gfp(mapping, index, gfp); - struct page *page = folio_file_page(folio, index); + struct page *page; + if (IS_ERR(folio)) + return &folio->page; + + page = folio_file_page(folio, index); if (PageHWPoison(page)) { folio_put(folio); return ERR_PTR(-EIO); _
