From nobody Sun Feb 8 22:30:26 2026 Received: from szxga07-in.huawei.com (szxga07-in.huawei.com [45.249.212.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A07737160 for ; Thu, 9 Jan 2025 07:05:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.35 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736406363; cv=none; b=YzhISetYEhj/eF/omDkjeZAmIzzkJv1iz9rSTbFzPKmUjvxWRIPwWP4cQrqIJJzsL/UE6K94BhkTbOYw5QDRIPZIEw55AMEA/8UaKPBhiAzaoHrsk+kXA2kYLlcjP/eRZmtiFdpUZ32xs+vPzgCoplKQO534H+Vh7iEc/svS9eQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736406363; c=relaxed/simple; bh=jlv8SluJI7NocnSknN6boYcOXeD5ufecxM4PbxGn+Sc=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=LF+tohQk60nxHRg+grmmeyptCsUvDuNtxpfgRW7kw0oeSO/gV1+wvcx0xdbZdVhv3cUaBaKfpoCh7BbQFMgnuffdemrYxFkq69VqFp0I/biC6NbFaHQ9xRbeaF+BZj2yaVo+uo7j8GaoDKISy+QEqvS5/iT2v3mXAjsRuxtCPH0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.35 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.214]) by szxga07-in.huawei.com (SkyGuard) with ESMTP id 4YTG253x0Bz1V4WM; Thu, 9 Jan 2025 15:02:37 +0800 (CST) Received: from kwepemg200013.china.huawei.com (unknown [7.202.181.64]) by mail.maildlp.com (Postfix) with ESMTPS id 990D91A016C; Thu, 9 Jan 2025 15:05:40 +0800 (CST) Received: from huawei.com (10.175.113.32) by kwepemg200013.china.huawei.com (7.202.181.64) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 9 Jan 2025 15:05:39 +0800 From: Liu Shixin To: Andrew Morton , Chengming Zhou , Matthew Wilcox , Kefeng Wang , Nanyong Sun , Muchun Song , Qi Zheng , Johannes Weiner , Yang Shi CC: , , Liu Shixin Subject: [PATCH] mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma Date: Thu, 9 Jan 2025 15:00:59 +0800 Message-ID: <20250109070059.369257-1-liushixin2@huawei.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemg200013.china.huawei.com (7.202.181.64) Content-Type: text/plain; charset="utf-8" syzkaller reported such a BUG_ON(): ------------[ cut here ]------------ kernel BUG at mm/khugepaged.c:1835! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP ... CPU: 6 UID: 0 PID: 8009 Comm: syz.15.106 Kdump: loaded Tainted: G W= 6.13.0-rc6 #22 Tainted: [W]=3DWARN Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=3D--) pc : collapse_file+0xa44/0x1400 lr : collapse_file+0x88/0x1400 sp : ffff80008afe3a60 ... Call trace: collapse_file+0xa44/0x1400 (P) hpage_collapse_scan_file+0x278/0x400 madvise_collapse+0x1bc/0x678 madvise_vma_behavior+0x32c/0x448 madvise_walk_vmas.constprop.0+0xbc/0x140 do_madvise.part.0+0xdc/0x2c8 __arm64_sys_madvise+0x68/0x88 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 This indicates that the pgoff is unaligned. After analysis, I confirm the vma is mapped to /dev/zero. Such a vma certainly has vm_file, but it is set to anonymous by mmap_zero(). So even if it's mmapped by 2m-unaligned, it can pass the check in thp_vma_allowable_order() as it is an anonymous-mmap, but then be collapsed as a file-mmap. It seems the problem has existed for a long time, but actually, since we have khugepaged_max_ptes_none check before, we will skip collapse it as it is /dev/zero and so has no present page. But commit d8ea7cc8547c limit the check for only khugepaged, so the BUG_ON() can be triggered by madvise_collapse(). Add vma_is_anonymous() check to make such vma be processed by hpage_collapse_scan_pmd(). Fixes: d8ea7cc8547c ("mm/khugepaged: add flag to predicate khugepaged-only = behavior") Signed-off-by: Liu Shixin --- mm/khugepaged.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 653dbb1ff05c..eb9d240e42e8 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -2422,7 +2422,8 @@ static unsigned int khugepaged_scan_mm_slot(unsigned = int pages, int *result, VM_BUG_ON(khugepaged_scan.address < hstart || khugepaged_scan.address + HPAGE_PMD_SIZE > hend); - if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { + if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file && + !vma_is_anonymous(vma)) { struct file *file =3D get_file(vma->vm_file); pgoff_t pgoff =3D linear_page_index(vma, khugepaged_scan.address); @@ -2768,7 +2769,8 @@ int madvise_collapse(struct vm_area_struct *vma, stru= ct vm_area_struct **prev, mmap_assert_locked(mm); memset(cc->node_load, 0, sizeof(cc->node_load)); nodes_clear(cc->alloc_nmask); - if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { + if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file && + !vma_is_anonymous(vma)) { struct file *file =3D get_file(vma->vm_file); pgoff_t pgoff =3D linear_page_index(vma, addr); =20 --=20 2.34.1