WARNING in untrack_pfn

Status: upstream: reported C repro on 2019/08/05 09:38
Reported-by: syzbot+5f488e922d047d8f00cc@syzkaller.appspotmail.com
First crash: 2551d, last: 1289d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH v6.1 1/2] x86/mm/pat: clear VM_PAT if copy_p4d_range failed 2 (2) 2026/01/08 13:36
[RFC PATCH 1/1] x86/mm/pat: Clear VM_PAT if copy_p4d_range failed 5 (5) 2023/03/02 03:47
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in untrack_pfn kernel -1 syz, C done error 128 856d 2928d 0/29 auto-obsoleted due to no activity on 2024/07/03 15:42
android-49 WARNING in untrack_pfn -1 syz 35 2430d 2663d 0/3 public: reported syz repro on 2019/04/14 09:28
linux-5.15 WARNING in untrack_pfn origin:lts-only -1 syz, C done 10 41d 1107d 0/3 upstream: reported C repro on 2023/07/19 07:05
android-6-12 WARNING in untrack_pfn origin:downstream -1 syz, C 9 9d17h 406d 0/1 premoderation: reported C repro on 2025/06/19 03:53
linux-4.14 WARNING in untrack_pfn -1 syz, C inconclusive 27 1282d 2543d 0/1 upstream: reported C repro on 2019/08/13 08:40
android-44 WARNING in untrack_pfn -1 syz, C 211 2696d 3069d 0/2 closed as invalid on 2019/03/16 01:21
android-414 WARNING in untrack_pfn -1 syz 1 2776d 2665d 0/1 public: reported syz repro on 2019/04/13 00:01
linux-6.1 WARNING in untrack_pfn (2) origin:lts-only -1 syz, C done 6 241d 1060d 0/3 upstream: reported C repro on 2023/09/04 06:46
linux-6.1 WARNING in untrack_pfn -1 2 1194d 1202d 0/3 auto-obsoleted due to no activity on 2023/08/21 02:48
android-44 WARNING in untrack_pfn (2) -1 syz, C 71 2430d 2667d 0/2 public: reported C repro on 2019/04/11 08:44
▶ ▼ Fix bisection attempts (22)
Created Duration User Patch Repo Result
2021/09/23 00:30 21m bisect fix linux-4.19.y error job log
2021/08/23 20:48 39m bisect fix linux-4.19.y OK (0) job log log
2021/07/24 20:06 41m bisect fix linux-4.19.y OK (0) job log log
2021/06/24 19:26 39m bisect fix linux-4.19.y OK (0) job log log
2021/05/25 17:25 41m bisect fix linux-4.19.y OK (0) job log log
2021/04/25 13:53 40m bisect fix linux-4.19.y OK (0) job log log
2021/03/26 06:11 37m bisect fix linux-4.19.y OK (0) job log log
2021/02/24 05:33 37m bisect fix linux-4.19.y OK (0) job log log
2021/01/24 05:09 23m bisect fix linux-4.19.y OK (0) job log log
2020/12/25 03:45 24m bisect fix linux-4.19.y OK (0) job log log
2020/11/25 03:10 24m bisect fix linux-4.19.y OK (0) job log log
2020/10/26 02:47 23m bisect fix linux-4.19.y OK (0) job log log
2020/09/26 01:48 24m bisect fix linux-4.19.y OK (0) job log log
2020/08/27 00:55 26m bisect fix linux-4.19.y OK (0) job log log
2020/07/09 18:21 24m bisect fix linux-4.19.y OK (0) job log log
2020/06/09 17:50 26m bisect fix linux-4.19.y OK (0) job log log
2020/05/10 17:24 25m bisect fix linux-4.19.y OK (0) job log log
2020/04/10 16:48 25m bisect fix linux-4.19.y OK (0) job log log
2020/03/11 16:19 28m bisect fix linux-4.19.y OK (0) job log log
2020/02/10 15:51 27m bisect fix linux-4.19.y OK (0) job log log
2020/01/11 10:12 26m bisect fix linux-4.19.y OK (0) job log log
2019/12/12 09:46 26m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f342ba4a6b9
RDX: 0000000000000000 RSI: 0000000000000060 RDI: 0000000000000000
RBP: 00007ffc92d76910 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
WARNING: CPU: 1 PID: 8138 at arch/x86/mm/pat.c:1064 untrack_pfn+0x247/0x290 arch/x86/mm/pat.c:1064
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8138 Comm: syz-executor410 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 panic+0x26a/0x50e kernel/panic.c:186
 __warn.cold+0x20/0x5a kernel/panic.c:541
 report_bug+0x262/0x2b0 lib/bug.c:183
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:untrack_pfn+0x247/0x290 arch/x86/mm/pat.c:1064
Code: 84 6c ff ff ff e8 09 55 37 00 4c 89 ee 4c 89 e7 e8 ae da ff ff e8 f9 54 37 00 48 85 db 0f 85 58 ff ff ff eb 82 e8 e9 54 37 00 <0f> 0b e9 76 ff ff ff 48 89 df e8 ca 31 6d 00 e9 98 fe ff ff e8 60
RSP: 0018:ffff88809707f910 EFLAGS: 00010293
RAX: ffff888094d383c0 RBX: ffff8880afc62568 RCX: ffffffff812b2f56
RDX: 0000000000000000 RSI: ffffffff812b3087 RDI: 0000000000000005
RBP: 1ffff11012e0ff22 R08: ffff88809707f878 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: 00000000ffffffea
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880afc625b8
 unmap_single_vma+0x1bc/0x300 mm/memory.c:1558
 unmap_vmas+0xa9/0x180 mm/memory.c:1609
 exit_mmap+0x2b9/0x530 mm/mmap.c:3093
 __mmput kernel/fork.c:1016 [inline]
 mmput+0x14e/0x4a0 kernel/fork.c:1037
 dup_mm kernel/fork.c:1301 [inline]
 copy_mm kernel/fork.c:1341 [inline]
 copy_process.part.0+0x662a/0x8260 kernel/fork.c:1913
 copy_process kernel/fork.c:1710 [inline]
 _do_fork+0x22f/0xf30 kernel/fork.c:2219
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f342ba4a6b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc92d768f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f342ba4a6b9
RDX: 0000000000000000 RSI: 0000000000000060 RDI: 0000000000000000
RBP: 00007ffc92d76910 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/01/17 20:15 linux-4.19.y 3f8a27f9e27b 42660d9e .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 WARNING in untrack_pfn
2022/10/09 07:46 linux-4.19.y 3f8a27f9e27b aea5da89 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 WARNING in untrack_pfn
2022/06/18 16:54 linux-4.19.y 3f8a27f9e27b 8f633d84 .config console log report syz C ci2-linux-4-19 WARNING in untrack_pfn
2019/08/11 00:20 linux-4.19.y 893af1c79e42 acb51638 .config console log report syz C ci2-linux-4-19
2023/01/17 19:46 linux-4.19.y 3f8a27f9e27b 42660d9e .config console log report info [disk image] [vmlinux] ci2-linux-4-19 WARNING in untrack_pfn
2022/09/15 12:56 linux-4.19.y 3f8a27f9e27b dd9a85ff .config console log report info [disk image] [vmlinux] ci2-linux-4-19 WARNING in untrack_pfn
2022/08/13 04:40 linux-4.19.y 3f8a27f9e27b 8dfcaa3d .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2022/07/26 06:02 linux-4.19.y 3f8a27f9e27b 34795c51 .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2022/07/23 11:19 linux-4.19.y 3f8a27f9e27b 22343af4 .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2022/07/20 23:39 linux-4.19.y 3f8a27f9e27b 88cb1383 .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2022/07/19 17:10 linux-4.19.y 3f8a27f9e27b 72a3cc0c .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2022/07/12 22:21 linux-4.19.y 3f8a27f9e27b d91dd8ea .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2022/02/05 18:57 linux-4.19.y 3f8a27f9e27b a7dab638 .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2022/01/15 12:30 linux-4.19.y 3f8a27f9e27b 723cfaf0 .config console log report info ci2-linux-4-19 WARNING in untrack_pfn
2020/07/28 00:49 linux-4.19.y 20b3a3dfdf6c cb93dc6a .config console log report ci2-linux-4-19
2020/07/18 17:33 linux-4.19.y 17a87580a885 9c812472 .config console log report ci2-linux-4-19
2019/10/11 22:37 linux-4.19.y dafd634415a7 426631dd .config console log report ci2-linux-4-19
2019/10/01 22:27 linux-4.19.y 555161ee1b7a b7a87a83 .config console log report ci2-linux-4-19
2019/09/08 13:22 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
2019/09/03 07:51 linux-4.19.y 97ab07e11fbf 14544a56 .config console log report ci2-linux-4-19
2019/08/29 21:03 linux-4.19.y 97ab07e11fbf cd626f3b .config console log report ci2-linux-4-19
2019/08/22 12:13 linux-4.19.y a5aa80588fcd 4ea67ff8 .config console log report ci2-linux-4-19
2019/08/10 20:27 linux-4.19.y 893af1c79e42 acb51638 .config console log report ci2-linux-4-19
2019/08/05 08:37 linux-4.19.y b3060a1a313f 6affd8e8 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.