linux-kernel - Re: [PATCH] mm/workingset: fix crash from corrupted shadow entries in lru

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bc25b607-f99d-4878-abb7-cff5de13fc2c@kernel.org>
Date: Mon, 8 Dec 2025 12:24:45 +0100
From: "David Hildenbrand (Red Hat)" <david@...nel.org>
To: Deepanshu Kartikey <kartikey406@...il.com>, akpm@...ux-foundation.org,
 axelrasmussen@...gle.com, yuanchu@...gle.com, weixugc@...gle.com,
 hannes@...xchg.org, mhocko@...nel.org, zhengqi.arch@...edance.com,
 shakeel.butt@...ux.dev, lorenzo.stoakes@...cle.com
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org,
 syzbot+e008db2ac01e282550ee@...kaller.appspot.com,
 Yu Zhao <yuzhao@...gle.com>
Subject: Re: [PATCH] mm/workingset: fix crash from corrupted shadow entries in
 lru_gen

On 12/8/25 07:00, Deepanshu Kartikey wrote:
> Syzbot reported crashes in lru_gen_test_recent() and subsequent NULL
> pointer dereferences in the page cache code:
> 
>    Oops: general protection fault in lru_gen_test_recent+0xfc/0x370
>    KASAN: probably user-memory-access in range [0x0000000000004e00-0x0000000000004e07]
> 
> And later:
> 
>    BUG: kernel NULL pointer dereference, address: 0000000000000000
>    #PF: supervisor instruction fetch in kernel mode
>    RIP: 0010:0x0
>    Call Trace:
>     filemap_read_folio+0xc8/0x2a0
> 
> Investigation revealed that unpack_shadow() can extract an invalid node ID
> from shadow entries, causing NODE_DATA(nid) to return NULL for pgdat. In
> the reported case, the shadow value was 0x0000000000000041, which is
> suspiciously small and indicates corruption.
> 
> When this NULL pgdat is passed to mem_cgroup_lruvec(), it leads to crashes
> when dereferencing memcg->nodeinfo. The corrupted state also propagates
> through the call chain causing subsequent crashes in page cache code.
> 
> The root cause of shadow entry corruption is unclear and may indicate a
> deeper issue in xarray management, page cache eviction/refault race
> conditions, or memory corruption. However, regardless of the source, the
> code should handle corrupted entries defensively.

We should identify+fix the root cause.

[...]
> -
> +	/*
> +	 * If pgdat is NULL, the shadow entry contains an invalid node ID.
> +	 * Set lruvec to NULL so caller can detect and skip processing.
> +	 */
> +	if (unlikely(!pgdat)) {
> +		*lruvec = NULL;
> +		return false;
> +	}

That's just hacking around the root cause, no? Because IIUC, that's not 
something we would ever expect to happen unless BUG.

Unless I am missing something this patch is trying to cure the symptoms, 
but not the root cause.

Now, if it would be valid (and we would not have a corruption), then 
handling it like you propose would be the right thing.

-- 
Cheers

David