linux-kernel - Re: [syzbot] [mm?] kernel BUG in page_table_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+CK2bBrv_Cvhce5N_RoNjaSL5380he3ZRaDeTC79hhjYxSmRQ@mail.gmail.com>
Date: Sat, 23 Aug 2025 01:45:07 +0000
From: Pasha Tatashin <pasha.tatashin@...een.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: syzbot <syzbot+49a796ed2c9709652f1e@...kaller.appspotmail.com>, 
	linux-kernel@...r.kernel.org, linux-mm@...ck.org, 
	syzkaller-bugs@...glegroups.com, Andrew Donnellan <ajd@...ux.ibm.com>
Subject: Re: [syzbot] [mm?] kernel BUG in page_table_check_set

On Sat, Aug 23, 2025 at 1:16 AM Andrew Morton <akpm@...ux-foundation.org> wrote:
>
> On Thu, 21 Aug 2025 21:16:32 -0700 syzbot <syzbot+49a796ed2c9709652f1e@...kaller.appspotmail.com> wrote:
>
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    8f5ae30d69d7 Linux 6.17-rc1
> > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> > console output: https://syzkaller.appspot.com/x/log.txt?x=15f926f0580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=8c5ac3d8b8abfcb
> > dashboard link: https://syzkaller.appspot.com/bug?extid=49a796ed2c9709652f1e
> > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > userspace arch: arm64
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15faa7a2580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=144143bc580000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/18a2e4bd0c4a/disk-8f5ae30d.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/3b5395881b25/vmlinux-8f5ae30d.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/e875f4e3b7ff/Image-8f5ae30d.gz.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+49a796ed2c9709652f1e@...kaller.appspotmail.com
> >
> > ------------[ cut here ]------------
> > kernel BUG at mm/page_table_check.c:118!
>
> Thanks.
>
> Presumably due to the series "Support page table check on PowerPC".
> Andrew, could you please take a look?
>
> The series has been in mm.git for a week so I guess the impact of this
> is small.  I won't drop it at this time, but prompt attention would be
> appreciated.

page_table_check_set()
     BUG_ON(atomic_inc_return(&ptc->anon_map_count) > 1 && rw);

This code triggers a BUG_ON if we attempt to set a new PTE in a user
page table with RW permission for an anonymous page that is already
mapped elsewhere. Anonymous pages can only be shared with RO
permissions for COW; otherwise, it can't be shared.

Pasha