linux-kernel - Re: [REGRESSION][BISECTED] Crash with Bad page state for FUSE/Flatpak related applications since v6.13

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f8b08ef9-5bba-490c-9d99-9ab955e68732@suse.cz>
Date: Fri, 7 Feb 2025 11:55:58 +0100
From: Vlastimil Babka <vbabka@...e.cz>
To: Miklos Szeredi <miklos@...redi.hu>
Cc: Matthew Wilcox <willy@...radead.org>,
 Christian Heusel <christian@...sel.eu>, Josef Bacik <josef@...icpanda.com>,
 Miklos Szeredi <mszeredi@...hat.com>, regressions@...ts.linux.dev,
 linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
 Joanne Koong <joannelkoong@...il.com>, linux-mm <linux-mm@...ck.org>
Subject: Re: [REGRESSION][BISECTED] Crash with Bad page state for FUSE/Flatpak
 related applications since v6.13

On 2/7/25 11:43, Miklos Szeredi wrote:
> On Fri, 7 Feb 2025 at 11:25, Vlastimil Babka <vbabka@...e.cz> wrote:
> 
>> Could be a use-after free of the page, which sets PG_lru again. The list
>> corruptions in __rmqueue_pcplist also suggest some page manipulation after
>> free. The -1 refcount suggests somebody was using the page while it was
>> freed due to refcount dropping to 0 and then did a put_page()?
> 
> Can you suggest any debug options that could help pinpoint the offender?

CONFIG_DEBUG_VM enables a check in put_page_testzero() that would catch the
underflow (modulo a tiny race window where it wouldn't). Worth trying.

> Thanks,
> Miklos