Re: Forwarded: Re: [Internet][syzbot ci] Re: memcg: fix dying memcg pinned by swapped out shmem pages
syzbot ci <[email protected]>
| Newsgroups | dev.linux.lists.syzbot |
|---|---|
| Message-ID | <[email protected]> |
> For archival purposes, forwarding an incoming command email to > [email protected]. > > *** > > Subject: Re: [Internet][syzbot ci] Re: memcg: fix dying memcg pinned by swapped out shmem pages > Author: [email protected] > > #syz test Please attach the patch to act upon. > > > > syzbot ci<[email protected]> 在 2026年8月13日 周四 21:26 写道： > > syzbot ci has tested the following series > > [v1] memcg: fix dying memcg pinned by swapped out shmem pages > https://lore.kernel.org/all/[email protected] > * [PATCH RFC 1/5] memcg: move memcg private ID refcount to objcg > * [PATCH RFC 2/5] memcg: get stable memcg first before getting memcgid reference > * [PATCH RFC 3/5] memcg: remove retry logic in mem_cgroup_private_id_get_online > * [PATCH RFC 4/5] memcg: add a helper to get online memcg from memcgid > * [PATCH RFC 5/5] memcg: filter out reparented memcgs got using memcgid > > and found the following issue: > WARNING: refcount bug in __mem_cgroup_uncharge_swap > > Full report is available here: > https://ci.syzbot.org/series/3a8a2a5f-8b6d-4abf-954e-a1a18ee62748 > > *** > > WARNING: refcount bug in __mem_cgroup_uncharge_swap > > tree: linux-next > URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/next/linux-next > base: 288058d8db5d35623228d84f48d9bea3707d5c85 > arch: amd64 > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > config: https://ci.syzbot.org/builds/35dac6f6-b44a-4ea8-9adf-2cdda5584e45/config > syz repro: https://ci.syzbot.org/findings/6e117c0b-d6e2-44a6-8e35-161cb33f2aff/syz_repro > > ------------[ cut here ]------------ > refcount_t: underflow; use-after-free. > WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: syz.2.19/5863 > Modules linked in: > CPU: 0 UID: 0 PID: 5863 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 > RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 > Code: 64 84 8e 0b 67 48 0f b9 3a eb 4a e8 58 fa f2 fc 48 8d 3d 61 84 8e 0b 67 48 0f b9 3a eb 37 e8 45 fa f2 fc 48 8d 3d 5e 84 8e 0b <67> 48 0f b9 3a eb 24 e8 32 fa f2 fc 48 8d 3d 5b 84 8e 0b 67 48 0f > RSP: 0018:ffffc90003bbf1d0 EFLAGS: 00010293 > RAX: ffffffff84d3ed9b RBX: 0000000000000003 RCX: ffff8881bdf58000 > RDX: 0000000000000000 RSI: ffffffff8f363380 RDI: ffffffff90627200 > RBP: 1ffffffff20ae968 R08: ffff8881bdf58000 R09: 0000000000000005 > R10: 0000000000000004 R11: 0000000000000000 R12: ffff8881026f8000 > R13: ffff88810a914100 R14: ffff88810a914134 R15: 1ffff110204df009 > FS: 00007fe2ee63d6c0(0000) GS:ffff88818d960000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000056066247f0b8 CR3: 000000000e946000 CR4: 00000000000006f0 > Call Trace: > <TASK> > mem_cgroup_take_from_private_id mm/memcontrol.c:4049 [inline] > __mem_cgroup_uncharge_swap+0x204/0x2a0 mm/memcontrol.c:5707 > mem_cgroup_uncharge_swap include/linux/swap.h:520 [inline] > __swap_cluster_free_entries+0x735/0xc50 mm/swapfile.c:1955 > swap_put_entries_cluster+0x3b1/0x4b0 mm/swapfile.c:1629 > swap_put_entries_direct+0x137/0x210 mm/swapfile.c:2139 > zap_nonpresent_ptes mm/memory.c:1838 [inline] > do_zap_pte_range mm/memory.c:1905 [inline] > zap_pte_range mm/memory.c:2003 [inline] > zap_pmd_range mm/memory.c:2089 [inline] > zap_pud_range mm/memory.c:2117 [inline] > zap_p4d_range mm/memory.c:2138 [inline] > __zap_vma_range+0x1d9d/0x4f10 mm/memory.c:2178 > unmap_vmas+0x390/0x550 mm/memory.c:2247 > exit_mmap+0x293/0x9f0 mm/mmap.c:1315 > __mmput+0x118/0x420 kernel/fork.c:1187 > exit_mm+0x221/0x2d0 kernel/exit.c:615 > do_exit+0x6cd/0x2360 kernel/exit.c:997 > do_group_exit+0x22d/0x2f0 kernel/exit.c:1152 > get_signal+0x121b/0x12c0 kernel/signal.c:3046 > arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 > __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] > exit_to_user_mode_loop+0x104/0x730 kernel/entry/common.c:101 > __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] > syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] > syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] > do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > RIP: 0033:0x7fe2ed79e0d9 > Code: Unable to access opcode bytes at 0x7fe2ed79e0af. > RSP: 002b:00007fe2ee63d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca > RAX: fffffffffffffe00 RBX: 00007fe2eda25fa8 RCX: 00007fe2ed79e0d9 > RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe2eda25fa8 > RBP: 00007fe2eda25fa0 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > R13: 00007fe2eda26038 R14: 00007fff0bed41b0 R15: 00007fff0bed4298 > </TASK> > ---------------- > Code disassembly (best guess): > 0: 64 84 8e 0b 67 48 0f test %cl,%fs:0xf48670b(%rsi) > 7: b9 3a eb 4a e8 mov $0xe84aeb3a,%ecx > c: 58 pop %rax > d: fa cli > e: f2 fc repnz cld > 10: 48 8d 3d 61 84 8e 0b lea 0xb8e8461(%rip),%rdi # 0xb8e8478 > 17: 67 48 0f b9 3a ud1 (%edx),%rdi > 1c: eb 37 jmp 0x55 > 1e: e8 45 fa f2 fc call 0xfcf2fa68 > 23: 48 8d 3d 5e 84 8e 0b lea 0xb8e845e(%rip),%rdi # 0xb8e8488 > * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction > 2f: eb 24 jmp 0x55 > 31: e8 32 fa f2 fc call 0xfcf2fa68 > 36: 48 8d 3d 5b 84 8e 0b lea 0xb8e845b(%rip),%rdi # 0xb8e8498 > 3d: 67 addr32 > 3e: 48 rex.W > 3f: 0f .byte 0xf > > > *** > > If these findings have caused you to resend the series or submit a > separate fix, please add the following tag to your commit message: > Tested-by: [email protected] > > --- > This report is generated by a bot. It may contain errors. > syzbot ci engineers can be reached at [email protected]. > > To test a fix for this bug, please reply with `#syz test` > (on a separate line) and attach the patch to the email. > > Notes: > - The patch will be applied on top of the tested series (as an > incremental fix). > - To test a new version of the whole series, please send it directly > to [email protected]. > - Arguments like custom git repos and branches are not supported.