From nobody Fri Dec 19 08:08:53 2025 Received: from mail-ot1-f70.google.com (mail-ot1-f70.google.com [209.85.210.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A11830F543 for ; Tue, 9 Dec 2025 05:44:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.70 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765259099; cv=none; b=StyIk3nwPg0TbuLLN+iN+FseSJwUgoYcXMpk8y03XtCHzRMJJHlos6hUQ+O3rWxeFZAlJZN/4mTut/+51r6iPu/pscgU4gV+kB92H3PtF68pSGGwozmAdIkaEyF+st0zOzOTn33mjUdbmSUCZRozJC7Jya/lUH7mHbjnbORTk9s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765259099; c=relaxed/simple; bh=cgXUdUuYcBRyq+tFdUYKpcbJ11/XO80xdOBXfWpqOcI=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=JfKLC4EBHtnvzlt3xPcK7DVfKqrntm4hsAQaA790Jfb8s2uvF0E8wOxXZaZE+hfMzpi7u8+gln4lBYnpI9kiD8RkbrHQ+2emcHc2o5jHipHxlDjsMqjjcEPcdBIPqYj88ikzCAqhe+NrYrpaT+GgRqlErWHnuGdv9T+Hfx7RqXM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-7c705ffd76fso5389765a34.3 for ; Mon, 08 Dec 2025 21:44:55 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765259094; x=1765863894; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=qROBdzbpm0JaerenrNLmubCmhrdlunEROkUk3CcwTnU=; b=O/t1EC53tqSxShrqJWsUc2kgfYQTLJ1dC4fhrptCEfZ7+HWHKANWUPfHu+87i2Z3fm vhVFzkqUpzylOJ5SlHwPYKwq9j6Y7FRdKjy/G1B1J3m7/WQKgxyVwh9puhhW3XXc9Q92 HY0Q9u9fn9A6w/MsISBeif1BsZFkWUtWD0qnh8SZD6DBEDDEXIiZIGHOZqGthvAsY2mL Y0a9P6mo6ACzeeQhOotS1QuMbiQceQJtls+TwpKuaoquuHCb1I7vHtueqqaJi8K1La1a c/8rHZutku2N1wuENBhTIlC3T02GAwTvFDuLut0zR8VdEj86lGamKyfPZdiQ8NACznYI 2uqQ== X-Gm-Message-State: AOJu0Yz+dIQiG9yUgJP65pZdbupxi1iiuPqbuFWdKdmspEZV94tOJP25 cc/uPbAw2TqT9L4af7DjBodzQwNGYfCi/PVBXlXiJdXDnH1TWwhpAlcaRww3ZkfsM5ySjyHKweC pEysW6ON2bfuqwLceQ82y1fZTnR9VLDMw3e+GSYgMjiz+V2dXM6rHLT5InJ0= X-Google-Smtp-Source: AGHT+IHYyKuT+mT0DM8vNgzhaVp9pHpdcevdArmRKOTPNOA3JW9Xl69EzfvJ1lVkyeskZXIc9E75/7d3tmzycPiegjvIDqJVJXsx Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:607:b0:659:9a49:8dd9 with SMTP id 006d021491bc7-6599a8e96fbmr3680499eaf.27.1765259094570; Mon, 08 Dec 2025 21:44:54 -0800 (PST) Date: Mon, 08 Dec 2025 21:44:54 -0800 In-Reply-To: <693540fe.a70a0220.38f243.004c.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6937b756.a70a0220.38f243.00c2.GAE@google.com> Subject: Forwarded: [PATCH] mm/workingset: debug MGLRU shadow corruption leading to NULL deref From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] mm/workingset: debug MGLRU shadow corruption leading to NU= LL deref Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master Add debug logging to trace shadow entry 0x41 that causes NULL pointer dereference in lru_gen_test_recent(). Instruments: - pack_shadow(): Detect when 0x41 is created - lru_gen_eviction(): Show min_seq and token values - unpack_shadow(): Detect when 0x41 is unpacked - lru_gen_test_recent(): Detect NULL pgdat - workingset_refault/lru_gen_refault(): Trace refault path This will identify if MGLRU generation counters are uninitialized (min_seq=3D0), causing corrupted shadow entries. Link: https://syzkaller.appspot.com/bug?extid=3De008db2ac01e282550ee Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey --- mm/workingset.c | 69 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 57 insertions(+), 12 deletions(-) diff --git a/mm/workingset.c b/mm/workingset.c index e9f05634747a..cebcf5e63f3b 100644 --- a/mm/workingset.c +++ b/mm/workingset.c @@ -199,28 +199,49 @@ static unsigned int bucket_order __read_mostly; static void *pack_shadow(int memcgid, pg_data_t *pgdat, unsigned long evic= tion, bool workingset) { + pr_err("PACK_SHADOW: CREATING SHADOW\n"); + pr_err(" memcgid=3D%d node_id=3D%d eviction=3D0x%lx workingset=3D%d\n", + memcgid, pgdat->node_id, eviction, workingset); eviction &=3D EVICTION_MASK; eviction =3D (eviction << MEM_CGROUP_ID_SHIFT) | memcgid; eviction =3D (eviction << NODES_SHIFT) | pgdat->node_id; eviction =3D (eviction << WORKINGSET_SHIFT) | workingset; - - return xa_mk_value(eviction); + void *shadow =3D xa_mk_value(eviction); + pr_err(" Final packed shadow=3D0x%lx (raw eviction=3D0x%lx)\n", + (unsigned long)shadow, eviction); + if ((unsigned long)shadow =3D=3D 0x41) { + pr_err("*** BUG: CREATED SHADOW 0x41! ***\n"); + dump_stack(); + } + return shadow; } =20 static void unpack_shadow(void *shadow, int *memcgidp, pg_data_t **pgdat, unsigned long *evictionp, bool *workingsetp) { + pr_err("UNPACK_SHADOW: READING SHADOW\n"); + pr_err(" shadow=3D0x%lx\n", (unsigned long)shadow); unsigned long entry =3D xa_to_value(shadow); int memcgid, nid; bool workingset; - + // CRITICAL: Detect if we're reading the bad 0x41 shadow! + if ((unsigned long)shadow =3D=3D 0x41) { + pr_err("*** BUG: UNPACKING CORRUPTED SHADOW 0x41! ***\n"); + dump_stack(); + } workingset =3D entry & ((1UL << WORKINGSET_SHIFT) - 1); entry >>=3D WORKINGSET_SHIFT; nid =3D entry & ((1UL << NODES_SHIFT) - 1); entry >>=3D NODES_SHIFT; memcgid =3D entry & ((1UL << MEM_CGROUP_ID_SHIFT) - 1); entry >>=3D MEM_CGROUP_ID_SHIFT; - + pr_err(" Unpacked: memcgid=3D%d nid=3D%d eviction=3D0x%lx workingset=3D%= d\n", + memcgid, nid, entry, workingset); + pr_err(" NODE_DATA(%d)=3D%px\n", nid, NODE_DATA(nid)); + if (nid >=3D MAX_NUMNODES || !NODE_DATA(nid)) { + pr_err("*** BUG: INVALID NODE ID %d! ***\n", nid); + dump_stack(); + } *memcgidp =3D memcgid; *pgdat =3D NODE_DATA(nid); *evictionp =3D entry; @@ -231,6 +252,8 @@ static void unpack_shadow(void *shadow, int *memcgidp, = pg_data_t **pgdat, =20 static void *lru_gen_eviction(struct folio *folio) { + pr_err("LRU_GEN_EVICTION: ENTERED\n"); + pr_err(" folio=3D%px node=3D%d\n", folio, folio_nid(folio)); int hist; unsigned long token; unsigned long min_seq; @@ -250,11 +273,15 @@ static void *lru_gen_eviction(struct folio *folio) lrugen =3D &lruvec->lrugen; min_seq =3D READ_ONCE(lrugen->min_seq[type]); token =3D (min_seq << LRU_REFS_WIDTH) | max(refs - 1, 0); - + pr_err("LRU_GEN_EVICTION: min_seq=3D0x%lx refs=3D%d tier=3D%d\n", + min_seq, refs, tier); + pr_err(" token=3D0x%lx (will be eviction parameter)\n", token); hist =3D lru_hist_from_seq(min_seq); atomic_long_add(delta, &lrugen->evicted[hist][type][tier]); - - return pack_shadow(mem_cgroup_id(memcg), pgdat, token, workingset); + void *shadow =3D pack_shadow(mem_cgroup_id(memcg), pgdat, token, workings= et); + pr_err("LRU_GEN_EVICTION: Returning shadow=3D0x%lx\n", (unsigned long)sha= dow); + return shadow; + //return pack_shadow(mem_cgroup_id(memcg), pgdat, token, workingset); } =20 /* @@ -270,7 +297,14 @@ static bool lru_gen_test_recent(void *shadow, struct l= ruvec **lruvec, struct pglist_data *pgdat; =20 unpack_shadow(shadow, &memcg_id, &pgdat, token, workingset); - + /* + * If pgdat is NULL, the shadow entry contains an invalid node ID. + * Set lruvec to NULL so caller can detect and skip processing. + */ + if (unlikely(!pgdat)) { + *lruvec =3D NULL; + return false; + } memcg =3D mem_cgroup_from_id(memcg_id); *lruvec =3D mem_cgroup_lruvec(memcg, pgdat); =20 @@ -280,7 +314,7 @@ static bool lru_gen_test_recent(void *shadow, struct lr= uvec **lruvec, return abs_diff(max_seq, *token >> LRU_REFS_WIDTH) < MAX_NR_GENS; } =20 -static void lru_gen_refault(struct folio *folio, void *shadow) +static void lru_gen_refault(struct folio *folio, void *shadow)=20 { bool recent; int hist, tier, refs; @@ -292,11 +326,9 @@ static void lru_gen_refault(struct folio *folio, void = *shadow) int delta =3D folio_nr_pages(folio); =20 rcu_read_lock(); - recent =3D lru_gen_test_recent(shadow, &lruvec, &token, &workingset); - if (lruvec !=3D folio_lruvec(folio)) + if (!lruvec || lruvec !=3D folio_lruvec(folio)) goto unlock; - mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + type, delta); =20 if (!recent) @@ -533,6 +565,12 @@ bool workingset_test_recent(void *shadow, bool file, b= ool *workingset, */ void workingset_refault(struct folio *folio, void *shadow) { + pr_err("WORKINGSET_REFAULT: ENTERED\n"); + pr_err(" folio=3D%px shadow=3D0x%lx\n", folio, (unsigned long)sha= dow); + if ((unsigned long)shadow =3D=3D 0x41) { + pr_err("*** BUG: WORKINGSET_REFAULT received corrupted sha= dow 0x41! ***\n"); + dump_stack(); + } bool file =3D folio_is_file_lru(folio); struct pglist_data *pgdat; struct mem_cgroup *memcg; @@ -543,9 +581,13 @@ void workingset_refault(struct folio *folio, void *sha= dow) VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio); =20 if (lru_gen_enabled()) { + pr_err("WORKINGSET_REFAULT: LRU_GEN enabled, calling lru_gen_refault\n"); lru_gen_refault(folio, shadow); + pr_err("WORKINGSET_REFAULT: lru_gen_refault returned\n"); + return; } + pr_err("WORKINGSET_REFAULT: Using regular (non-LRU_GEN) path\n"); =20 /* * The activation decision for this folio is made at the level @@ -562,6 +604,7 @@ void workingset_refault(struct folio *folio, void *shad= ow) lruvec =3D mem_cgroup_lruvec(memcg, pgdat); =20 mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + file, nr); + pr_err("WORKINGSET_REFAULT: Calling workingset_test_recent\n"); =20 if (!workingset_test_recent(shadow, file, &workingset, true)) return; @@ -572,6 +615,7 @@ void workingset_refault(struct folio *folio, void *shad= ow) =20 /* Folio was active prior to eviction */ if (workingset) { + pr_err("WORKINGSET_REFAULT: Folio was workingset, restoring\n"); folio_set_workingset(folio); /* * XXX: Move to folio_add_lru() when it supports new vs @@ -580,6 +624,7 @@ void workingset_refault(struct folio *folio, void *shad= ow) lru_note_cost_refault(folio); mod_lruvec_state(lruvec, WORKINGSET_RESTORE_BASE + file, nr); } + pr_err("WORKINGSET_REFAULT: EXITING\n"); } =20 /** --=20 2.43.0