From nobody Fri Dec 19 11:48:28 2025 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0573A179A3 for ; Mon, 8 Dec 2025 06:00:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765173658; cv=none; b=HrGTpIloNCq2v53wUVuD5DRJTCRlq43lAP/36O7u0GPs0vzTNHYUox4nXYhg2/2J48gUQZUH8+TkM/F3+exvJdWX7E9onPIWOhTSQr+VZuDTmlInDZKGzBLw8SdIoFmEfygPqzJW99LSyWb95iG2berXYLqcTrpuEK4EXxWQEFE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765173658; c=relaxed/simple; bh=cVi6J9y9e7pDiTPYxS29T8g5SlOmncV4zSscrOUx1QQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qsvah/gpJbaR/1CU5aabrTzTAZqjTk55WfAc+44COeJOBzgLwyZysbwEsWPfflEvlgzn7H5SFrqWCJn6Mg9Apvvyz0TZUrmPCSjUKQoIcsYkLkp6hDsE2rQPxfd6f81Vc6kNsbgcqZ4DlEtKngiSrf4NtY5cA1MHVGf27W1M+VY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UljLCjrM; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UljLCjrM" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-298287a26c3so54469905ad.0 for ; Sun, 07 Dec 2025 22:00:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765173656; x=1765778456; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=g7J/YDQQZ73q/SxVb4kAtd4MfgYR+nLwZii4e9V0PbI=; b=UljLCjrM3g442dKPXoJKrUxO6l9tjRH4FkTs+HARmarxNPG4BfwjA23tQHKywxh2uv PTXRFkNGd7Q+afCeFH/2ATeuFw5Q4TR/TLUML0EIhYwWPFYX130CxczHIy+6dnLVyyDL cPZB7UntDWPRvOUsE8p++1rp4B896RrdC+oFwdFgfNp4gJRh4C8AJ+FpLeQFUWzB76tz SrYMT96vieB1HOwZp+h2fPcOddi+JQbmJAdH+rQDFypeJTzQcG7zQRV0AXfwrFOg+J/y S7GKfAfANXD413MKMNsB4mvQOWdOd77y4qCQOU88Jfihcsv0Q7mJyjx+dWSFsP2i4516 9ToQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765173656; x=1765778456; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=g7J/YDQQZ73q/SxVb4kAtd4MfgYR+nLwZii4e9V0PbI=; b=RFjEELtmXZdN0UwvtwSYNOgAodvotVHCCow7L96voqCZRpLY3WB+vXVguBHN9K10cD +92m9bRId71MtfVA5GTFywo8dtFyGgG/+4ZetI3y9/xaC+VyBpeDkbiTSBm9Q0GaiMYg dqPeNTKW6PwTfBc3zYuiQ2XI/Wwp1q4NWP4OFqW4CpNXDZzCSZOuFgBg9VVJunq3nhm9 Ovo+EKw6iGmwQ/MEYv4ZDLBLJOFmbm47mJYIemOS7k4TbkaRg2cNCaVFZIn+YxEzmW+U tpsZBRrb0zMFo4zTiwlznEhToLtqzsqu4DrcywL1FYeIOFJA775bbhe2xKFuG2FWdvkW rcPQ== X-Forwarded-Encrypted: i=1; AJvYcCWdULBBvHxVlq1v4petn8u1VNdSnxa/FL4+8afJ28tYrhDyk+p5EzEJJVogW6FO/PqoqOQDriVuJnlQm+4=@vger.kernel.org X-Gm-Message-State: AOJu0Ywm8RSxQlZ2SVShZmttnLF/jMLH62c6P2pw7hJFaH/LUdogVbt5 qcFd8n+xnkYFS/9ShsrgvZiQpq66Mh1lZO43fTcSGFuMMtM1glqVYp/G X-Gm-Gg: ASbGncsAzT94vAIghYdV78PooWYbB5527IFWOMINqcSt8DnTzOsjumi+TCbKp/o2lON ZKD1xIccrJjXo9p5q0QGToqs+wnsIHwor5ujgkmLzCpFZHTkRaxXzC8H5GcyTFOEqATy2YB+2rp Ft22DUoKW4MAo+z5LlLxGCbbbLXYfIbw3oFU5JvpuWTsUYRBOb8ayH4qOXt1Q1hNa8oAyZ2a3X3 KhdJzh397BMHPbIpcuzccTlv/DEq+nceUVNXM+dpTb5Lnk9iikq5qjyhTppFz9h6tX6ZnfGQ8pc D+CxZimoCUL2hr+l0lei/DiSp5/nUrJL0PfugLhEneeEUio0kp5HMrd9z0sRVQBg3uDZuK/DevL udLo6zthW4oxKbURlzrGoy9QhRybq+aHWIrU/EHmoVS8YUkWi7Fql9NieeJMASvW/kS7eKWPCS/ FQvS8QWGMNA6I89ZafUIifbSyMy9E3msZc3Wd765YKJBbPwQPrIfdkzr1PdR3ncQ3Gmek= X-Google-Smtp-Source: AGHT+IHXIrsIQkPW0r8bo+8VPEAaIOW9AaDvu1kQ2wNp/zv3km50T88Zq0l5Qov4Ovlwt8mRRYGeIw== X-Received: by 2002:a17:902:e5c2:b0:295:6122:5c42 with SMTP id d9443c01a7336-29df5792c2bmr59443985ad.24.1765173655633; Sun, 07 Dec 2025 22:00:55 -0800 (PST) Received: from deepanshu-kernel-hacker.. ([2405:201:682f:389d:764b:de35:13a7:56dd]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-29dae4cfcfasm110235295ad.41.2025.12.07.22.00.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 07 Dec 2025 22:00:55 -0800 (PST) From: Deepanshu Kartikey To: akpm@linux-foundation.org, axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com, hannes@cmpxchg.org, david@kernel.org, mhocko@kernel.org, zhengqi.arch@bytedance.com, shakeel.butt@linux.dev, lorenzo.stoakes@oracle.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+e008db2ac01e282550ee@syzkaller.appspot.com, Yu Zhao Subject: [PATCH] mm/workingset: fix crash from corrupted shadow entries in lru_gen Date: Mon, 8 Dec 2025 11:30:45 +0530 Message-ID: <20251208060046.2933866-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Syzbot reported crashes in lru_gen_test_recent() and subsequent NULL pointer dereferences in the page cache code: Oops: general protection fault in lru_gen_test_recent+0xfc/0x370 KASAN: probably user-memory-access in range [0x0000000000004e00-0x0000000= 000004e07] And later: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode RIP: 0010:0x0 Call Trace: filemap_read_folio+0xc8/0x2a0 Investigation revealed that unpack_shadow() can extract an invalid node ID from shadow entries, causing NODE_DATA(nid) to return NULL for pgdat. In the reported case, the shadow value was 0x0000000000000041, which is suspiciously small and indicates corruption. When this NULL pgdat is passed to mem_cgroup_lruvec(), it leads to crashes when dereferencing memcg->nodeinfo. The corrupted state also propagates through the call chain causing subsequent crashes in page cache code. The root cause of shadow entry corruption is unclear and may indicate a deeper issue in xarray management, page cache eviction/refault race conditions, or memory corruption. However, regardless of the source, the code should handle corrupted entries defensively. Fix this by: 1. Checking if pgdat is NULL in lru_gen_test_recent() after unpacking the shadow entry, and setting *lruvec to NULL to signal corruption. 2. Adding a NULL check for lruvec in lru_gen_refault() to catch and skip processing of corrupted entries before the corruption propagates further. This prevents the immediate crash while the root cause of shadow corruption can be investigated separately. Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspot.com Closes: https://syzkaller.appspot.com/bug?extid=3De008db2ac01e282550ee Fixes: b1a71694fb00c ("mm/mglru: rework refault detection") Cc: Yu Zhao Signed-off-by: Deepanshu Kartikey --- mm/workingset.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/mm/workingset.c b/mm/workingset.c index e9f05634747a..0ec205a1ae92 100644 --- a/mm/workingset.c +++ b/mm/workingset.c @@ -270,7 +270,14 @@ static bool lru_gen_test_recent(void *shadow, struct l= ruvec **lruvec, struct pglist_data *pgdat; =20 unpack_shadow(shadow, &memcg_id, &pgdat, token, workingset); - + /* + * If pgdat is NULL, the shadow entry contains an invalid node ID. + * Set lruvec to NULL so caller can detect and skip processing. + */ + if (unlikely(!pgdat)) { + *lruvec =3D NULL; + return false; + } memcg =3D mem_cgroup_from_id(memcg_id); *lruvec =3D mem_cgroup_lruvec(memcg, pgdat); =20 @@ -294,9 +301,8 @@ static void lru_gen_refault(struct folio *folio, void *= shadow) rcu_read_lock(); =20 recent =3D lru_gen_test_recent(shadow, &lruvec, &token, &workingset); - if (lruvec !=3D folio_lruvec(folio)) + if (!lruvec || lruvec !=3D folio_lruvec(folio)) goto unlock; - mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + type, delta); =20 if (!recent) --=20 2.43.0