Re: [Linux Kernel Bug] WARNING in remove_vm_area

Jiaming Zhang <[email protected]> Fri, 12 Sep 2025 00:27:23 +0800

Newsgroups	org.kernel.vger.linux-bcachefs,org.kernel.vger.linux-kernel
Message-ID	<CANypQFYGt3c1eoeytCzw3RKLw+cbtDDPJy8UM=aj8HQMC8MWmA@mail.gmail.com>

Hello,

Apologies for the oversight in my previous email. I neglected to
include the formatted report.

Please find the formatted report (formatted by syz-symbolize) attached
to this email. This should be easier to read and analyze.

Sorry for any inconvenience.

Jiaming Zhang <[email protected]> 于2025年9月11日周四 21:59写道：
>
> Dear Linux kernel developers and maintainers:
>
> We are writing to report a kernel WARNING in remove_vm_area,
> discovered with our modified version of syzkaller.
>
> This issue was initially found in kernel v6.17-rc5 (commit
> 76eeb9b8de9880ca38696b2fb56ac45ac0a25c6c). Unfortunately, we do not
> have a stable C or Syz program to reproduce this warning. We are
> actively analyzing the root cause and working to create a reliable
> reproducer, which we will share as soon as it is available.
>
> Attached are the kernel console output and the .config file for your
> analysis. Please let us know if any further information would be
> helpful.
>
> Best regards,
> Jiaming Zhang

report.log (application/octet-stream, 2.8 KB)

Trying to vfree() bad address (ffffe8ffac67339a)
WARNING: CPU: 0 PID: 46280 at mm/vmalloc.c:3282 remove_vm_area+0x2f3/0x300 mm/vmalloc.c:3281
Modules linked in:
CPU: 0 UID: 0 PID: 46280 Comm: syz.5.3823 Not tainted 6.17.0-rc5 #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:remove_vm_area+0x2f3/0x300 mm/vmalloc.c:3281
Code: 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 04 08 70 09 cc e8 ae f8 ac ff 90 48 c7 c7 a0 78 96 8b 48 89 de e8 3e 1b 70 ff 90 <0f> 0b 90 90 eb ca 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003627ad8 EFLAGS: 00010246
RAX: 40afba36e42f4800 RBX: ffffe8ffac67339a RCX: 0000000000080000
RDX: ffffc9001f887000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffe8ffac67339a R08: ffff88802b824253 R09: 1ffff1100570484a
R10: dffffc0000000000 R11: ffffed100570484b R12: 1ffffd1ff58ce670
R13: 1ffffd1ff58ce672 R14: ffffe8ffac67339a R15: ffffe8ffac673330
FS:  00007f2eaf802640(0000) GS:ffff888098e1f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3448ff CR3: 000000004adc8000 CR4: 0000000000752ef0
PKRU: 80000000
Call Trace:
 <TASK>
 vfree+0x63/0x400 mm/vmalloc.c:3414
 rcu_pending_exit+0x6b8/0x7b0 fs/bcachefs/rcu_pending.c:630
 bch2_fs_btree_key_cache_exit+0x900/0xa30 fs/bcachefs/btree_key_cache.c:809
 __bch2_fs_free fs/bcachefs/super.c:616 [inline]
 bch2_fs_release+0x2a3/0x830 fs/bcachefs/super.c:667
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x228/0x480 lib/kobject.c:737
 deactivate_locked_super+0xbc/0x130 fs/super.c:474
 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1375
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x2b3/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2eae9bd44e
Code: 48 c7 c0 ff ff ff ff eb aa e8 2e 23 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2eaf801da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffec RBX: 000000000000fe88 RCX: 00007f2eae9bd44e
RDX: 000000002000fec0 RSI: 000000002000ff00 RDI: 00007f2eaf801e00
RBP: 00007f2eaf801e40 R08: 00007f2eaf801e40 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000002000fec0
R13: 000000002000ff00 R14: 00007f2eaf801e00 R15: 000000002000ff40
 </TASK>