Re: [PATCH] mm/workingset: fix crash from corrupted shadow entries in lru_gen

["David Hildenbrand (Red Hat)" <david@kernel.org>]

On 12/8/25 07:00, Deepanshu Kartikey wrote:
> Syzbot reported crashes in lru_gen_test_recent() and subsequent NULL
> pointer dereferences in the page cache code:
> 
>    Oops: general protection fault in lru_gen_test_recent+0xfc/0x370
>    KASAN: probably user-memory-access in range [0x0000000000004e00-0x0000000000004e07]
> 
> And later:
> 
>    BUG: kernel NULL pointer dereference, address: 0000000000000000
>    #PF: supervisor instruction fetch in kernel mode
>    RIP: 0010:0x0
>    Call Trace:
>     filemap_read_folio+0xc8/0x2a0
> 
> Investigation revealed that unpack_shadow() can extract an invalid node ID
> from shadow entries, causing NODE_DATA(nid) to return NULL for pgdat. In
> the reported case, the shadow value was 0x0000000000000041, which is
> suspiciously small and indicates corruption.
> 
> When this NULL pgdat is passed to mem_cgroup_lruvec(), it leads to crashes
> when dereferencing memcg->nodeinfo. The corrupted state also propagates
> through the call chain causing subsequent crashes in page cache code.
> 
> The root cause of shadow entry corruption is unclear and may indicate a
> deeper issue in xarray management, page cache eviction/refault race
> conditions, or memory corruption. However, regardless of the source, the
> code should handle corrupted entries defensively.

We should identify+fix the root cause.

[...]
> -
> +	/*
> +	 * If pgdat is NULL, the shadow entry contains an invalid node ID.
> +	 * Set lruvec to NULL so caller can detect and skip processing.
> +	 */
> +	if (unlikely(!pgdat)) {
> +		*lruvec = NULL;
> +		return false;
> +	}

That's just hacking around the root cause, no? Because IIUC, that's not 
something we would ever expect to happen unless BUG.

Unless I am missing something this patch is trying to cure the symptoms, 
but not the root cause.

Now, if it would be valid (and we would not have a corruption), then 
handling it like you propose would be the right thing.

-- 
Cheers

David