linux-kernel - Re: [syzbot] [mm?] kernel BUG in try_to_unmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fda7a3e3-1711-4f1b-a0bb-6a4369aa80ab@redhat.com>
Date: Thu, 5 Jun 2025 08:27:42 +0200
From: David Hildenbrand <david@...hat.com>
To: syzbot <syzbot+3b220254df55d8ca8a61@...kaller.appspotmail.com>,
 Liam.Howlett@...cle.com, akpm@...ux-foundation.org, harry.yoo@...cle.com,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 lorenzo.stoakes@...cle.com, riel@...riel.com,
 syzkaller-bugs@...glegroups.com, vbabka@...e.cz, Jens Axboe
 <axboe@...nel.dk>, Catalin Marinas <catalin.marinas@....com>
Subject: Re: [syzbot] [mm?] kernel BUG in try_to_unmap_one (2)

On 05.06.25 08:11, David Hildenbrand wrote:
> On 05.06.25 07:38, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    d7fa1af5b33e Merge branch 'for-next/core' into for-kernelci
> 
> Hmmm, another very odd page-table mapping related problem on that tree
> found on arm64 only:

In this particular reproducer we seem to be having MADV_HUGEPAGE and 
io_uring_setup() be racing with MADV_HWPOISON, MADV_PAGEOUT and 
io_uring_register(IORING_REGISTER_BUFFERS).

I assume the issue is related to MADV_HWPOISON, MADV_PAGEOUT and 
io_uring_register racing, only. I suspect MADV_HWPOISON is trying to 
split a THP, while MADV_PAGEOUT tries paging it out.

IORING_REGISTER_BUFFERS ends up in 
io_sqe_buffers_register->io_sqe_buffer_register where we GUP-fast and 
try coalescing buffers.

And something about THPs is not particularly happy :)

-- 
Cheers,

David / dhildenb