syzbot


WARNING: locking bug in __set_page_owner (2)

Status: upstream: reported on 2025/10/09 16:45
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+8259e1d0e3ae8ed0c490@syzkaller.appspotmail.com
Fix commit: mm: don't spin in add_stack_record when gfp flags don't allow
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 13d, last: 6d20h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] WARNING: locking bug in __set_page_owner (2) 6 (7) 2025/10/13 08:10
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: locking bug in __set_page_owner mm 4 C error inconclusive 179425 260d 352d 29/29 fixed on 2025/07/05 00:36

Sample crash report:
=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
swapper/0/0 is trying to lock:
ffffffff8e5bb298 (stack_list_lock){-.-.}-{3:3}, at: add_stack_record_to_list mm/page_owner.c:182 [inline]
ffffffff8e5bb298 (stack_list_lock){-.-.}-{3:3}, at: inc_stack_record_count mm/page_owner.c:214 [inline]
ffffffff8e5bb298 (stack_list_lock){-.-.}-{3:3}, at: __set_page_owner+0x3c9/0x550 mm/page_owner.c:333
other info that might help us debug this:
context-{5:5}
3 locks held by swapper/0/0:
 #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:646 [inline]
 #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:631
 #1: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #1: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #1: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2074 [inline]
 #1: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x1bc/0x590 kernel/trace/bpf_trace.c:2116
 #2: ffff8880b8432a20 (stream_local_lock){....}-{3:3}, at: local_trylock_acquire include/linux/local_lock_internal.h:48 [inline]
 #2: ffff8880b8432a20 (stream_local_lock){....}-{3:3}, at: bpf_stream_page_local_lock kernel/bpf/stream.c:46 [inline]
 #2: ffff8880b8432a20 (stream_local_lock){....}-{3:3}, at: bpf_stream_elem_alloc kernel/bpf/stream.c:175 [inline]
 #2: ffff8880b8432a20 (stream_local_lock){....}-{3:3}, at: __bpf_stream_push_str+0x29e/0xba0 kernel/bpf/stream.c:190
stack backtrace:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
 check_wait_context kernel/locking/lockdep.c:4902 [inline]
 __lock_acquire+0xa12/0x1c90 kernel/locking/lockdep.c:5187
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
 add_stack_record_to_list mm/page_owner.c:182 [inline]
 inc_stack_record_count mm/page_owner.c:214 [inline]
 __set_page_owner+0x3c9/0x550 mm/page_owner.c:333
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1850
 prep_new_page mm/page_alloc.c:1858 [inline]
 get_page_from_freelist+0x10a3/0x3a30 mm/page_alloc.c:3884
 alloc_frozen_pages_nolock_noprof+0x16d/0x1d0 mm/page_alloc.c:7595
 alloc_pages_nolock_noprof+0xb/0x1b0 mm/page_alloc.c:7628
 bpf_stream_page_replace+0x17/0x170 kernel/bpf/stream.c:86
 bpf_stream_page_reserve_elem kernel/bpf/stream.c:142 [inline]
 bpf_stream_elem_alloc kernel/bpf/stream.c:177 [inline]
 __bpf_stream_push_str+0x885/0xba0 kernel/bpf/stream.c:190
 bpf_stream_stage_printk+0x15a/0x1d0 kernel/bpf/stream.c:448
 bpf_prog_report_may_goto_violation+0xb2/0x160 kernel/bpf/core.c:3181
 bpf_check_timed_may_goto+0x91/0xe0 kernel/bpf/core.c:3199
 arch_bpf_timed_may_goto+0x21/0x40 arch/x86/net/bpf_timed_may_goto.S:40
 bpf_prog_6fd842a53d323cc5+0x53/0x5f
 bpf_dispatcher_nop_func include/linux/bpf.h:1350 [inline]
 __bpf_prog_run include/linux/filter.h:721 [inline]
 bpf_prog_run include/linux/filter.h:728 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run2+0x239/0x590 kernel/trace/bpf_trace.c:2116
 __bpf_trace_tlb_flush+0xd1/0x110 include/trace/events/tlb.h:38
 __do_trace_tlb_flush include/trace/events/tlb.h:38 [inline]
 trace_tlb_flush+0xe4/0x160 include/trace/events/tlb.h:38
 switch_mm_irqs_off+0x2b1/0x7f0 arch/x86/mm/tlb.c:932
 context_switch kernel/sched/core.c:5309 [inline]
 __schedule+0xf70/0x5de0 kernel/sched/core.c:6929
 schedule_idle+0x5c/0x90 kernel/sched/core.c:7052
 do_idle+0x2b3/0x500 kernel/sched/idle.c:358
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:428
 rest_init+0x16b/0x2b0 init/main.c:757
 start_kernel+0x3f6/0x4e0 init/main.c:1111
 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0x130/0x190 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x148
 </TASK>

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/15 13:02 upstream 9b332cece987 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: locking bug in __set_page_owner
2025/10/15 10:23 net 7f0fddd817ba b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in __set_page_owner
2025/10/09 04:57 net 2c95a756e0cf 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in __set_page_owner
2025/10/10 19:25 net-next 18a7e218cfcd ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: locking bug in __set_page_owner
* Struck through repros no longer work on HEAD.