From nobody Fri Dec 19 11:50:38 2025 Received: from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 154692F1FCF for ; Mon, 8 Dec 2025 05:14:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765170895; cv=none; b=OhCQqFfe9/KDuVH9VlGtpYb4kyJdSzadKSe0aTE0gChgznxDJtPxPy1PSAm8khdapyWfwXS3vlJvPo9/evGGqkktA8itXQQmWSI3gBmznnReaerQHVEobPog2tOJazaVV4QvWA3E/dfwqqrSPZdJ/0PVKw2gMl/dAP+UoxSChFY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765170895; c=relaxed/simple; bh=62LHso9rBLUjVkiDICeXfO1i9LGL1VFJO0o43CASApo=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=S4sX8YOzqoXDmZDgVGZ7Pmw3/TECYOtbz/DY4D/uqNt30SH2gCZEnBU9ehu9b3UbbgG/AH1lxymwy3FcE5qixLesBPBiiDWFg9KZRudmAmci4p3XWqQszrl0UTf5/7nA5Iu/S2p1wJ2ldlFNFWZ9n5BGpAE+6P3IRXjG3TCbpI8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-6574d366132so3002752eaf.0 for ; Sun, 07 Dec 2025 21:14:51 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765170888; x=1765775688; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zVj/SClaxwX/FKnUV31jI9YoUJ1cNBY39fbxnapLJQg=; b=jL92VUEDDHRsH+aFQDWsySjh8CdjQxuR1ODVTQIxnhsEQ+CMQWvVlHIkhFxkOt3BT5 zvY0T8+CDcmmB4RzVYCU0DV8O4quywxr7xRMGLRQ0tUm1aVq3Z3QcLSbNhdR5VkWlnrD MTl2u4bwvWZtEOy7OGTPvTMvNwdEsNLpUzHubFUvMaHuQyRM9sLawtZaJPi2NxuxEJGx Yh658r9N1BAbGjnBWjm9a218jWkiu8/WPrnhYCrAmWowaIRPK09yLyNrkPSuY6QKjs5g S065v1w1Alb1ZAQDvNO1maLAE3wT0u7zqpzISpjp9IpJeaSsNpZFHgUroLgvhlMrmUZR hYUw== X-Gm-Message-State: AOJu0YxWKCkU66O36sWU0C31ZZNGvejszPIW/hJ0LB5Vy4CQrcZr85zy e3PsUb9zF9oGHNQhxImGlgtGhD0aaYZsTnp6WDnIfkS7NaGA32WjybGTonA/d9NXFE595zg4f5w rV7Noz9/xD+ynj0zc6YKVXGmkCHmoQVy1qxPZqn3XzX3eoYW3Vpou9hKbn4w= X-Google-Smtp-Source: AGHT+IEIM2IQi4Xb3bvkS7LXBwha+bPtRjZp2yfZPB45BYDjkRx8zRvfATOm0Yht++ieT+S5N5aG89IuMfG1R9Y27ATms0M3mpJx Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:168d:b0:659:9a49:8e68 with SMTP id 006d021491bc7-6599a963185mr3299685eaf.56.1765170888422; Sun, 07 Dec 2025 21:14:48 -0800 (PST) Date: Sun, 07 Dec 2025 21:14:48 -0800 In-Reply-To: <693540fe.a70a0220.38f243.004c.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69365ec8.a70a0220.38f243.0086.GAE@google.com> Subject: Forwarded: [PATCH] mm/workingset: fix crash from corrupted shadow entries in lru_gen From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] mm/workingset: fix crash from corrupted shadow entries in = lru_gen Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master Syzbot reported crashes in lru_gen_test_recent() and subsequent NULL pointer dereferences in the page cache code: Oops: general protection fault in lru_gen_test_recent+0xfc/0x370 KASAN: probably user-memory-access in range [0x0000000000004e00-0x0000000= 000004e07] And later: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode RIP: 0010:0x0 Call Trace: filemap_read_folio+0xc8/0x2a0 The root cause is that unpack_shadow() can extract an invalid node ID from a corrupted shadow entry, causing NODE_DATA(nid) to return NULL for pgdat. When this NULL pgdat is passed to mem_cgroup_lruvec(), it leads to crashes when dereferencing memcg->nodeinfo. Even if we detect and return early from lru_gen_test_recent(), the corrupted state propagates through the call chain, eventually causing crashes in the page cache code when trying to use the corrupted folio. Fix this by: 1. Checking if pgdat is NULL in lru_gen_test_recent() and setting *lruvec to NULL to signal the corruption to the caller. 2. Adding a NULL check for lruvec in lru_gen_refault() to catch corrupted shadow entries and skip processing before the corruption can propagate further into the page cache code. Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspot.com Link: https://syzkaller.appspot.com/bug?extid=3De008db2ac01e282550ee Signed-off-by: Deepanshu Kartikey --- --- mm/workingset.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/mm/workingset.c b/mm/workingset.c index e9f05634747a..364434168b4c 100644 --- a/mm/workingset.c +++ b/mm/workingset.c @@ -270,7 +270,15 @@ static bool lru_gen_test_recent(void *shadow, struct l= ruvec **lruvec, struct pglist_data *pgdat; =20 unpack_shadow(shadow, &memcg_id, &pgdat, token, workingset); - + /* + * If pgdat is NULL, the shadow entry contains an invalid node ID. + * Set lruvec to NULL so caller can detect and skip processing. + */ + if (unlikely(!pgdat)) { + *lruvec =3D NULL; + pr_warn("lru_gen_test_recent: Detected corrupted shadow (NULL pgdat), se= tting lruvec=3DNULL\n"); + return false; + } memcg =3D mem_cgroup_from_id(memcg_id); *lruvec =3D mem_cgroup_lruvec(memcg, pgdat); =20 @@ -294,9 +302,11 @@ static void lru_gen_refault(struct folio *folio, void = *shadow) rcu_read_lock(); =20 recent =3D lru_gen_test_recent(shadow, &lruvec, &token, &workingset); - if (lruvec !=3D folio_lruvec(folio)) + if (!lruvec || lruvec !=3D folio_lruvec(folio)) { + if(!lruvec) + pr_warn("lru_gen_refault: Skipping corrupted entry (lruvec=3DNULL)\n"); goto unlock; - + } mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + type, delta); =20 if (!recent) --=20 2.43.0