linux-kernel - Re: [syzbot] [mm?] WARNING in follow_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3a565e1a-6a40-4bd1-a6e0-7f64b745d00f@arm.com>
Date: Wed, 6 Aug 2025 16:53:38 +0530
From: Dev Jain <dev.jain@....com>
To: syzbot+57bcc752f0df8bb1365c@...kaller.appspotmail.com
Cc: akpm@...ux-foundation.org, david@...hat.com, jgg@...pe.ca,
 jhubbard@...dia.com, linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 peterx@...hat.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] WARNING in follow_page_pte


On 06/08/25 4:49 pm, Dev Jain wrote:
> #syz test
>
> In commit_anon_folio_batch(), we iterate over all pages pointed to by the
> PTE batch. Therefore we need to know the first page of the batch;
> currently we derive that via folio_page(folio, 0), but, that takes us
> to the first (head) page of the folio instead - our PTE batch may lie
> in the middle of the folio, leading to incorrectness.
>
> Bite the bullet and throw away the micro-optimization of reusing the
> folio in favour of code simplicity. Derive the page and the folio in
> change_pte_range, and pass the page too to commit_anon_folio_batch to
> fix the aforementioned issue.
>
> Also, instead of directly adding to the stuct page *page pointer, use
> the nth_page() macro for safety.
>
> Fixes: cac1db8c3aad ("mm: optimize mprotect() by PTE batching")
> Signed-off-by: Dev Jain <dev.jain@....com>
> ---
>   mm/mprotect.c | 25 +++++++++++--------------
>   1 file changed, 11 insertions(+), 14 deletions(-)
>

Oops, this patch is based off mm-hotfixes-unstable, but I guess syzbot
will need it rebased on Torvalds' master?