Subject: [syzbot] [net?] WARNING in print_tainted (2)

From: syzbot <[email-masked]>
Date: Mon, 12 Jun 2023 15:42:10 -0700

Hello,

syzbot found the following issue on:

HEAD commit:    022ce8862dff Merge tag 'i2c-for-6.4-rc6' of git://git.kern..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11cd352d280000
kernel config:  https://syzkaller.appspot.com/x/.config?x=869b244dcd5d983c
dashboard link: https://syzkaller.appspot.com/bug?extid=732b84af10976114e761
compiler:       arm-linux-gnueabi-gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/c35b5b2731d2/non_bootable_disk-022ce886.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/81969b6d173b/vmlinux-022ce886.xz
kernel image: https://storage.googleapis.com/syzbot-assets/95a50e8c0f0b/zImage-022ce886.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email-masked]

------------[ cut here ]------------
WARNING: CPU: 0 PID: 12513 at mm/mmap.c:965 vma_merge+0x170/0x818 mm/mmap.c:965
Modules linked in:
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 0 PID: 12513 Comm: syz-executor.1 Not tainted 6.4.0-rc5-syzkaller #0
Hardware name: ARM-Versatile Express
Backtrace: 
[<817da338>] (dump_backtrace) from [<817da42c>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:256)
 r7:00000000 r6:826229c4 r5:60000093 r4:81f9d90c
[<817da414>] (show_stack) from [<817f6f14>] (__dump_stack lib/dump_stack.c:88 [inline])
[<817da414>] (show_stack) from [<817f6f14>] (dump_stack_lvl+0x48/0x54 lib/dump_stack.c:106)
[<817f6ecc>] (dump_stack_lvl) from [<817f6f38>] (dump_stack+0x18/0x1c lib/dump_stack.c:113)
 r5:00000000 r4:82850d14
[<817f6f20>] (dump_stack) from [<817daf24>] (panic+0x120/0x370 kernel/panic.c:340)
[<817dae04>] (panic) from [<80241fd0>] (print_tainted+0x0/0xa0 kernel/panic.c:236)
 r3:8260c488 r2:00000001 r1:81f86a00 r0:81f8e410
 r7:80465728
[<80241f4c>] (check_panic_on_warn) from [<802421c4>] (__warn+0x7c/0x180 kernel/panic.c:673)
[<80242148>] (__warn) from [<802423a0>] (warn_slowpath_fmt+0xd8/0x1d8 kernel/panic.c:697)
 r8:00000009 r7:000003c5 r6:81fb2798 r5:8260c960 r4:824adf7c
[<802422cc>] (warn_slowpath_fmt) from [<80465728>] (vma_merge+0x170/0x818 mm/mmap.c:965)
 r10:00000000 r9:00000000 r8:847a4f00 r7:200e2000 r6:85c93630 r5:00000000
 r4:85c939f8
[<804655b8>] (vma_merge) from [<80531bf8>] (userfaultfd_register fs/userfaultfd.c:1485 [inline])
[<804655b8>] (vma_merge) from [<80531bf8>] (userfaultfd_ioctl+0x1268/0x1534 fs/userfaultfd.c:2050)
 r10:20ce2000 r9:85c93630 r8:200e2000 r7:85c939f8 r6:00100277 r5:85f98000
 r4:ec8a1eb8
[<80530990>] (userfaultfd_ioctl) from [<804e54dc>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<80530990>] (userfaultfd_ioctl) from [<804e54dc>] (do_vfs_ioctl fs/ioctl.c:830 [inline])
[<80530990>] (userfaultfd_ioctl) from [<804e54dc>] (__do_sys_ioctl fs/ioctl.c:868 [inline])
[<80530990>] (userfaultfd_ioctl) from [<804e54dc>] (sys_ioctl+0x110/0xa74 fs/ioctl.c:856)
 r10:8530e870 r9:00000003 r8:85ca1f00 r7:20000100 r6:85ca1f01 r5:00000000
 r4:c020aa00
[<804e53cc>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66)
Exception stack(0xec8a1fa8 to 0xec8a1ff0)
1fa0:                   00000000 00000000 00000003 c020aa00 20000100 00000000
1fc0: 00000000 00000000 0014c2b8 00000036 7ea0c3c2 76b056d0 7ea0c534 76b0520c
1fe0: 76b05020 76b05010 00017004 0004dfb0
 r10:00000036 r9:84963ac0 r8:80200288 r7:00000036 r6:0014c2b8 r5:00000000
 r4:00000000
Rebooting in 86400 seconds..

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email-masked].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup