linux-kernel - Re: [syzbot] [mm?] WARNING in try_to_migrate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250810060545.4177-1-hdanton@sina.com>
Date: Sun, 10 Aug 2025 14:04:43 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+63859a31071a369082b1@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] WARNING in try_to_migrate_one (3)

> Date: Sat, 09 Aug 2025 13:36:38 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    0227b49b5027 Merge tag 'gpio-updates-for-v6.17-rc1-part2' ..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1422d434580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=2ae1da3a7f4a6ba4
> dashboard link: https://syzkaller.appspot.com/bug?extid=63859a31071a369082b1
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=117c72f0580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17ab7ea2580000

#syz test

--- x/mm/rmap.c
+++ y/mm/rmap.c
@@ -2283,6 +2283,7 @@ static bool try_to_migrate_one(struct fo
 	struct mm_struct *mm = vma->vm_mm;
 	DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, address, 0);
 	bool anon_exclusive, writable, ret = true;
+	int check_excl = 1;
 	pte_t pteval;
 	struct page *subpage;
 	struct mmu_notifier_range range;
@@ -2422,6 +2423,7 @@ static bool try_to_migrate_one(struct fo
 			if (pte_dirty(pteval))
 				folio_mark_dirty(folio);
 			writable = pte_write(pteval);
+			check_excl = 0;
 		} else if (likely(pte_present(pteval))) {
 			flush_cache_page(vma, address, pfn);
 			/* Nuke the page table entry. */
@@ -2446,10 +2448,17 @@ static bool try_to_migrate_one(struct fo
 		} else {
 			pte_clear(mm, address, pvmw.pte);
 			writable = is_writable_device_private_entry(pte_to_swp_entry(pteval));
+			check_excl = 0;
 		}
 
-		VM_WARN_ON_FOLIO(writable && folio_test_anon(folio) &&
-				!anon_exclusive, folio);
+		if (check_excl) {
+			pfn = pte_pfn(pteval);
+			subpage = folio_page(folio, pfn - folio_pfn(folio));
+			anon_exclusive = folio_test_anon(folio) &&
+					PageAnonExclusive(subpage);
+			VM_WARN_ON_FOLIO(writable && folio_test_anon(folio) &&
+					!anon_exclusive, folio);
+		}
 
 		/* Update high watermark before we lower rss */
 		update_hiwater_rss(mm);
--