linux-kernel - Re: [syzbot] [mm?] kernel BUG in hpage_collapse_scan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <35fb4fc8-8ca7-4ca1-9528-630ed4d1e782@linux.dev>
Date: Mon, 26 Jan 2026 09:54:17 +0800
From: Lance Yang <lance.yang@...ux.dev>
To: "David Hildenbrand (Red Hat)" <david@...nel.org>, willy@...radead.org
Cc: syzbot+bf6e6a6ca143afea5ca2@...kaller.appspotmail.com,
 Liam.Howlett@...cle.com, akpm@...ux-foundation.org, baohua@...nel.org,
 baolin.wang@...ux.alibaba.com, dev.jain@....com,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 lorenzo.stoakes@...cle.com, npache@...hat.com, ryan.roberts@....com,
 syzkaller-bugs@...glegroups.com, ziy@...dia.com
Subject: Re: [syzbot] [mm?] kernel BUG in hpage_collapse_scan_file (2)



On 2026/1/26 02:13, David Hildenbrand (Red Hat) wrote:
> On 1/25/26 13:10, Lance Yang wrote:
>> Ccing Willy.
>>
>> On Sat, 24 Jan 2026 18:23:28 -0800, syzbot wrote:
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit:    ca3a02fda4da Add linux-next specific files for 20260123
>>> git tree:       linux-next
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=10c42452580000
>>> kernel config:  https://syzkaller.appspot.com/x/.config? 
>>> x=10f2b64f8f12b9a4
>>> dashboard link: https://syzkaller.appspot.com/bug? 
>>> extid=bf6e6a6ca143afea5ca2
>>> compiler:       Debian clang version 21.1.8 (+ 
>>> +20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 
>>> 21.1.8
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz? 
>>> x=17f7cbfa580000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=112d405a580000
>>>
>>> Downloadable assets:
>>> disk image: https://storage.googleapis.com/syzbot- 
>>> assets/291ebca63a31/disk-ca3a02fd.raw.xz
>>> vmlinux: https://storage.googleapis.com/syzbot-assets/b2112a214b54/ 
>>> vmlinux-ca3a02fd.xz
>>> kernel image: https://storage.googleapis.com/syzbot- 
>>> assets/77d1ae437e07/bzImage-ca3a02fd.xz
>>>
>>> IMPORTANT: if you fix the issue, please add the following tag to the 
>>> commit:
>>> Reported-by: syzbot+bf6e6a6ca143afea5ca2@...kaller.appspotmail.com
>>>
>>> node ffff888148816ec0 offset 0 parent ffff888148817700 shift 0 count 
>>> 64 values 0 array ffff88807be6b0f0 list ffff888148816ed8 
>>> ffff888148816ed8 marks 0 0 0
>>> ------------[ cut here ]------------
>>> kernel BUG at ./include/linux/xarray.h:1441!
>>> Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
>>> CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 
>>> PREEMPT(full)
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, 
>>> BIOS Google 01/13/2026
>>> RIP: 0010:XAS_INVALID include/linux/xarray.h:1441 [inline]
>>
>> Seems like that is:
>>
>> ```
>> static inline struct xa_state *XAS_INVALID(struct xa_state *xas)
>> {
>>     XA_NODE_BUG_ON(xas->xa_node, xas_valid(xas));
>>     return xas;
>> }
>> ```
> 
> I think there was recently already a discussion about this.
> 
> See
> 
> https://lore.kernel.org/linux-mm/aVvz3tYdu49TGkjI@mozart.vkv.me/
> 
> 
> And where Willy said that likely it needs more thought:
> 
> https://lore.kernel.org/linux-mm/aVwm3MQ_ZDa_kU8c@casper.infradead.org/

Ah, I see. Thanks for the pointer!