Re: [PATCH v4] mm: use per_vma lock for MADV_DONTNEED

[David Hildenbrand <david@redhat.com>]

On 04.08.25 02:58, Lai, Yi wrote:
> Hi Barry Song,
> 
> Greetings!
> 
> I used Syzkaller and found that there is general protection fault in __pte_offset_map_lock in linux-next next-20250801.
> 
> After bisection and the first bad commit is:
> "
> a6fde7add78d mm: use per_vma lock for MADV_DONTNEED
> "
> 
> All detailed into can be found at:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250803_193026___pte_offset_map_lock
> Syzkaller repro code:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250803_193026___pte_offset_map_lock/repro.c
> Syzkaller repro syscall steps:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250803_193026___pte_offset_map_lock/repro.prog
> Syzkaller report:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250803_193026___pte_offset_map_lock/repro.report
> Kconfig(make olddefconfig):
> https://github.com/laifryiee/syzkaller_logs/tree/main/250803_193026___pte_offset_map_lock/kconfig_origin
> Bisect info:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250803_193026___pte_offset_map_lock/bisect_info.log
> bzImage:
> https://github.com/laifryiee/syzkaller_logs/raw/refs/heads/main/250803_193026___pte_offset_map_lock/bzImage_next-20250801
> Issue dmesg:
> https://github.com/laifryiee/syzkaller_logs/blob/main/250803_193026___pte_offset_map_lock/next-20250801_dmesg.log

Skimming over the reproducer, we seem to have racing MADV_DONTNEED and 
MADV_COLLAPSE on the same anon area, but the problem only shows up once 
we tear down that MM.

If I would have to guess, I'd assume it's related to PT_RECLAIM 
reclaiming empty page tables during MADV_DONTNEED -- but the kconfig 
does not indicate that CONFIG_PT_RECLAIM was set.

-- 
Cheers,

David / dhildenb