Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote: > On Fri, Aug 04, 2023 at 11:14:45AM +0800, Yikebaer Aizezi wrote: > > Just patched it, then I rerun the reproduce program, and I got this > > output from console: > > > > BUG: Bad page state in process POC pfn:0eb8d > > page:ffffea00003ae340 refcount:0 mapcount:0 mapping:0000000000000000 > > index:0x0 pfn:0xeb8d > > flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) > > page_type: 0xffffffff() > > raw: 00fff00000001000 ffffea00003ae348 ffffea00003ae348 0000000000000000 > > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > > page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set > > page_owner info is not present (never set?) > > Modules linked in: > > CPU: 0 PID: 7959 Comm: POC Not tainted 6.5.0-rc2 #2 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > > Call Trace: > > <TASK> > > __dump_stack lib/dump_stack.c:88 [inline] > > dump_stack_lvl+0xd4/0xf0 lib/dump_stack.c:106 > > bad_page+0x71/0x1a0 mm/page_alloc.c:533 > > free_page_is_bad_report mm/page_alloc.c:974 [inline] > > free_page_is_bad mm/page_alloc.c:984 [inline] > > free_pages_prepare mm/page_alloc.c:1153 [inline] > > free_unref_page_prepare+0x5f3/0xb50 mm/page_alloc.c:2348 > > free_unref_page+0x2f/0x3c0 mm/page_alloc.c:2443 > > __folio_put_small mm/swap.c:106 [inline] > > __folio_put+0xa2/0x110 mm/swap.c:129 > > folio_put include/linux/mm.h:1423 [inline] > > put_page include/linux/mm.h:1492 [inline] > > extract_user_to_sg lib/scatterlist.c:1151 [inline] > > Ohh. I think this is something Dave Howells has a patch for. > > > extract_iter_to_sg lib/scatterlist.c:1349 [inline] > > extract_iter_to_sg+0x11ec/0x1570 lib/scatterlist.c:1339 > > hash_sendmsg+0x487/0xf50 crypto/algif_hash.c:119 > > sock_sendmsg_nosec net/socket.c:725 [inline] > > sock_sendmsg+0xcf/0x170 net/socket.c:748 > > ____sys_sendmsg+0x676/0x860 net/socket.c:2494 > > ___sys_sendmsg+0x109/0x1a0 net/socket.c:2548 > > __sys_sendmsg+0xe4/0x1b0 net/socket.c:2577 > > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > > entry_SYSCALL_64_after_hwframe+0x63/0xcd This might be the fix you're looking for. https://lore.kernel.org/linux-crypto/20571.1690369076@xxxxxxxxxxxxxxxxxxxxxx/ Andrew has it in mm-hotfixes-unstable. David
