linux-kernel - Re: WARNING in memory_failure() at include/linux/huge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <61BBEF63-20D6-4671-B7F7-F015D49B2080@nvidia.com>
Date: Wed, 04 Feb 2026 16:08:50 -0500
From: Zi Yan <ziy@...dia.com>
To: "David Hildenbrand (arm)" <david@...nel.org>,
 是参差 <shicenci@...il.com>
Cc: linux-mm@...ck.org, linmiaohe@...wei.com, akpm@...ux-foundation.org,
 linux-kernel@...r.kernel.org, Matthew Wilcox <willy@...radead.org>
Subject: Re: WARNING in memory_failure() at include/linux/huge_mm.h:635
 triggered

On 4 Feb 2026, at 14:18, David Hildenbrand (arm) wrote:

> On 2/4/26 18:41, Zi Yan wrote:
>> On 4 Feb 2026, at 12:34, Zi Yan wrote:
>>
>>> On 4 Feb 2026, at 12:23, Zi Yan wrote:
>>>
>>>>
>>>>
>>>>  From the C repro above, syzbot opened a dev "/dev/sg#" and did mmap on it.
>>>> Is it a device driver issue?
>>>
>>> OK, it is CONFIG_CHR_DEV_SG. And the driver allocates a compound page at[1].
>>> Since we initialize folio fields in prep_compound_page(), it becomes a folio
>>> when it is inserted into a VMA.
>>
>> More details:
>> later at sg_vma_fault(), the driver just handles a page fault by supplying
>> a subpage from a pre-allocated compound page[3]. We then get a large folio
>> without !CONFIG_TRANSPARENT_HUGEPAGE.
>
> We can identify such non-folio (but compound) things by looking at PG_large_rmappable IIRC.

OK, back to the issue. The patch below should fix the issue?

Hi 是参差,

Can you test it?

>From fa4a900e027a0c7365a9f786840943990d5da971 Mon Sep 17 00:00:00 2001
From: Zi Yan <ziy@...dia.com>
Date: Wed, 4 Feb 2026 16:04:19 -0500
Subject: [PATCH] mm/memory_failure: reject unsupported non-folio compound page

Signed-off-by: Zi Yan <ziy@...dia.com>
---
 mm/memory-failure.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 825c706ac576..4ed903de9a0e 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -2440,9 +2440,12 @@ int memory_failure(unsigned long pfn, int flags)

 	folio = page_folio(p);

-	/* filter pages that are protected from hwpoison test by users */
+	/*
+	 * filter pages that are protected from hwpoison test by users
+	 * or unsupported non folio compound pages
+	 */
 	folio_lock(folio);
-	if (hwpoison_filter(p)) {
+	if (hwpoison_filter(p) || !folio_test_large_rmappable(folio)) {
 		ClearPageHWPoison(p);
 		folio_unlock(folio);
 		folio_put(folio);
-- 
2.51.0



Best Regards,
Yan, Zi