From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FC7021FF2A for ; Sun, 25 Jan 2026 12:10:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769343025; cv=none; b=MGgKe3hSxAA0PUIIZGSv+XmcfXo2oaIBI6zNZl16XA0gikDNGD3mDi+rDgRzC0hLb+Iy1M2n4bvQeeDNFd2tYZLKwZIfULioLXi7xJHtEnCtHanWQGnbzrPgXkjlifYQXJYW5FQGJwYPmpMZG1EIwoyMLNLIJQxEdLEDJUOJUkc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769343025; c=relaxed/simple; bh=JgzuaCurOGz65Ih0x7mzTBv014mJ5RYuRPlcJz0uVIY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r17Lq4L8kMf0hhhy6o2d/lQaYIUNb/rEZiTTOtxWyoaLfxtiHXRwXoJIzQp06nofjmBlp7U0Ik4mPUfO5ahu5b7c5hmSuPc2q4Ox9Q4ouK/FsW2fdMot8+Sl0cA6zq8JrSj+x3jjbTcQxjNU31u753GDu76JrjNuYRDk1/goi1M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=Ipdmt3Fx; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="Ipdmt3Fx" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1769343019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pdh1TAQMYWo4B4FTcZIJrahTI6XAf3PsxQELr4l8rg4=; b=Ipdmt3FxTs1DByvHiuNGivi3qJdRmZwgEJNN20DVHX/uBDjlXfvfEptoPpmxt5iHGHQVuh e/yYIHuYgjfb6EkH4aJaE3eeWZlQQ4e/vfN/FYjCQo44s7htzyKoY/YqZWqvXga55bGhPJ fG1SQ94+igE8o8C1307HRXGOmAS/ysY= From: Lance Yang To: willy@infradead.org Cc: syzbot+bf6e6a6ca143afea5ca2@syzkaller.appspotmail.com, Liam.Howlett@oracle.com, akpm@linux-foundation.org, baohua@kernel.org, baolin.wang@linux.alibaba.com, david@kernel.org, dev.jain@arm.com, lance.yang@linux.dev, linux-kernel@vger.kernel.org, linux-mm@kvack.org, lorenzo.stoakes@oracle.com, npache@redhat.com, ryan.roberts@arm.com, syzkaller-bugs@googlegroups.com, ziy@nvidia.com Subject: Re: [syzbot] [mm?] kernel BUG in hpage_collapse_scan_file (2) Date: Sun, 25 Jan 2026 20:10:01 +0800 Message-ID: <20260125121001.32733-1-lance.yang@linux.dev> In-Reply-To: <69757ea0.a00a0220.33ccc7.0017.GAE@google.com> References: <69757ea0.a00a0220.33ccc7.0017.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT Ccing Willy. On Sat, 24 Jan 2026 18:23:28 -0800, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: ca3a02fda4da Add linux-next specific files for 20260123 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=10c42452580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=10f2b64f8f12b9a4 > dashboard link: https://syzkaller.appspot.com/bug?extid=bf6e6a6ca143afea5ca2 > compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17f7cbfa580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=112d405a580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/291ebca63a31/disk-ca3a02fd.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/b2112a214b54/vmlinux-ca3a02fd.xz > kernel image: https://storage.googleapis.com/syzbot-assets/77d1ae437e07/bzImage-ca3a02fd.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+bf6e6a6ca143afea5ca2@syzkaller.appspotmail.com > > node ffff888148816ec0 offset 0 parent ffff888148817700 shift 0 count 64 values 0 array ffff88807be6b0f0 list ffff888148816ed8 ffff888148816ed8 marks 0 0 0 > ------------[ cut here ]------------ > kernel BUG at ./include/linux/xarray.h:1441! > Oops: invalid opcode: 0000 [#1] SMP KASAN PTI > CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 > RIP: 0010:XAS_INVALID include/linux/xarray.h:1441 [inline] Seems like that is: ``` static inline struct xa_state *XAS_INVALID(struct xa_state *xas) { XA_NODE_BUG_ON(xas->xa_node, xas_valid(xas)); return xas; } ``` Which was added by commit 43b00759f21b (not land upstream yet): ``` commit 43b00759f21b10142094d1ae5ff65cbb368953a3 Author: Matthew Wilcox (Oracle) Date: Sun Dec 14 10:53:31 2025 -0500 XArray: Add extra debugging check to xas_lock and friends While tracking down a recent bug, we discovered somewhere that had forgotten to call xas_reset() before calling xas_lock(). Add a debug check to be sure that doesn't happen in future and fix all the places in the test suite which were carelessly doing just this. Suggested-by: Linus Torvalds Signed-off-by: Matthew Wilcox (Oracle) ``` which catches places that forget to reset xas before locking. > RIP: 0010:collapse_file mm/khugepaged.c:2041 [inline] Yeah, maybe it caught a bug in collapse_file() ... When we lock again with xas_lock_irq(), xas->xa_node is still pointing at a node from the earlier xas_load(), so the BUG_ON fires, IIUC. Fix it by calling xas_set() before xas_lock_irq() to reset the state. And one spot in rollback doesn't actually need xas at all, just changed it to xa_lock_irq() directly. ---8<--- commit 2003255c52846ab10cad6c2e57cda4d17dddadbe Author: Lance Yang Date: Sun Jan 25 19:37:56 2026 +0800 HACK diff --git a/mm/khugepaged.c b/mm/khugepaged.c index fba6aea5bea6..3656ae491385 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -2038,6 +2038,7 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, try_to_unmap(folio, TTU_IGNORE_MLOCK | TTU_BATCH_FLUSH); + xas_set(&xas, index); xas_lock_irq(&xas); VM_BUG_ON_FOLIO(folio != xa_load(xas.xa, index), folio); @@ -2140,9 +2141,8 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, int nr_none_check = 0; i_mmap_lock_read(mapping); - xas_lock_irq(&xas); - xas_set(&xas, start); + xas_lock_irq(&xas); for (index = start; index < end; index++) { if (!xas_next(&xas)) { xas_store(&xas, XA_RETRY_ENTRY); @@ -2192,6 +2192,7 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, goto rollback; } } else { + xas_set(&xas, start); xas_lock_irq(&xas); } @@ -2250,9 +2251,9 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, rollback: /* Something went wrong: roll back page cache changes */ if (nr_none) { - xas_lock_irq(&xas); + xa_lock_irq(&mapping->i_pages); mapping->nrpages -= nr_none; - xas_unlock_irq(&xas); + xa_unlock_irq(&mapping->i_pages); shmem_uncharge(mapping->host, nr_none); } --- Tested with the syzbot reproducer[1], no more crashes :) [1] https://syzkaller.appspot.com/x/repro.c?x=112d405a580000 Cheers, Lance [...]