From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f71.google.com (mail-oo1-f71.google.com [209.85.161.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 548FA2D46CE for ; Tue, 9 Dec 2025 05:35:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.71 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765258559; cv=none; b=d5dslUn9kid2TiXHvU6m+mSrAbtc7ySE5H7gD6dIJ4+gyCbeHGTkFlEgmeh+vPpca+2+5AAt9R5oCDvAo6AtmE72IPHlPcmZnXzPTcPiD8sAECZC9Pskwy4DM6XrDSP9HIrWPvz2Y+wJnoBMRL8BzzThmExv83BItTD0ZAb3pcw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765258559; c=relaxed/simple; bh=XRJ4hdJPl7nixLisqj5slpg56SDV0/Cailwe4TJfVCI=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=ER2aNvWbfQmBCFuEbk2bPYqOl5m0bNiarAX5IqaRfzZPq6a0fnFA2PwnfV8VXZgaFaLFos+4+aNaVKvMRzHVECCe/RS961znbBbsPyjT0IG8Ltdql33N/fj1Q3EAMeGGGiosm7f/mWao7b/9ocmBrUL6eekScOvfq2Ci7N9QOhU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f71.google.com with SMTP id 006d021491bc7-657486eb435so6430725eaf.1 for ; Mon, 08 Dec 2025 21:35:57 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765258556; x=1765863356; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=nH/YaIuJ1oB9S/Go3zjzANMIc1E5T6n7ZAKl0OGtzQo=; b=cfeeqMV9oIf54Vh1Sriwbs09mtKZLfa4yAbs5DWVbO6KsqlQWjRZRsC4stXCxzThso WLpP3dwaVfpXzgk8L9NCaO9G+tNfiJf6Q/7GySGMsIiWUze7tNBvAkAOFqV6cZ9Vmpau C5yepaBWOrkiax3DBaLMgGBxQdrO9PEt+dV1aN3B3juRmIe6HWRFk1sNoiQmfkkixfsa A7JprskTHuPTcd2snOEWh63ufdLJZUa/V5eVD1I7rMgI4TW44gLsgXFGlTIHi7iqeJVY VJTHZeaGygaxhAUHZYlDVIbzqXYNpo7IUpdxFJcyiulzBMmpGjLIfasou7YyMpgzHTTs JvFQ== X-Gm-Message-State: AOJu0YxeXaPfz3l68Un3OqR9QEzwQnliLYBa54iQYJO3YS1Gy22RIJDb R19DcbvekJOnFLJJHxTgjpGlETk7X3Z+FbOk2j4y53yoQa5NEtcc0ZuTVGsLmncX1ccUR+wzXqu uD3fEUdCy0bHaBAwmGITj8K5ly4jXJKzoXRgPfCWsv5huMJkWW0VzBLVM+jg= X-Google-Smtp-Source: AGHT+IEk3ojfa7HaKEt/pdf3G1cv8pu86yKNqPcEQU9kfj8oZL7w6WDhtZVDtdFxPqPfFfc86I3pytm7J6BObaxkVHgLhpvif9tO Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a4a:e84c:0:b0:659:9a49:8f05 with SMTP id 006d021491bc7-6599a8d5c2cmr3371048eaf.22.1765258556411; Mon, 08 Dec 2025 21:35:56 -0800 (PST) Date: Mon, 08 Dec 2025 21:35:56 -0800 In-Reply-To: <693540fe.a70a0220.38f243.004c.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6937b53c.a70a0220.38f243.00bf.GAE@google.com> Subject: Forwarded: [PATCH] mm/workingset: add debug instrumentation for MGLRU shadow corruption From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] mm/workingset: add debug instrumentation for MGLRU shadow corruption Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master Add comprehensive debug logging to track down NULL pointer dereference in lru_gen_test_recent() when unpacking shadow entries with value 0x41. The crash occurs when: 1. A shadow entry with value 0x41 is created during page eviction 2. The page later refaults and tries to unpack this shadow 3. unpack_shadow() extracts an invalid node ID from 0x41 4. NODE_DATA() returns NULL for the invalid node 5. Crash when trying to dereference NULL pgdat This debug patch instruments the complete shadow entry lifecycle: 1. pack_shadow() - Log shadow creation and detect 0x41 creation 2. lru_gen_eviction() - Log MGLRU eviction path with min_seq/token 3. unpack_shadow() - Log shadow unpacking and detect 0x41 unpacking 4. lru_gen_test_recent() - Log entry and detect NULL pgdat 5. workingset_refault() - Log refault entry point 6. lru_gen_refault() - Log MGLRU refault handler Each function dumps stack trace when 0x41 shadow is detected to capture the full call chain. The goal is to identify why pack_shadow() creates 0x41, which likely indicates MGLRU generation counters (min_seq) are zero when they shouldn't be. Link: https://syzkaller.appspot.com/bug?extid=e008db2ac01e282550ee Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey --- mm/workingset.c | 64 +++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 57 insertions(+), 7 deletions(-) diff --git a/mm/workingset.c b/mm/workingset.c index 0ec205a1ae92..d64490cd987d 100644 --- a/mm/workingset.c +++ b/mm/workingset.c @@ -199,28 +199,49 @@ static unsigned int bucket_order __read_mostly; static void *pack_shadow(int memcgid, pg_data_t *pgdat, unsigned long eviction, bool workingset) { + pr_err("PACK_SHADOW: CREATING SHADOW\n"); + pr_err(" memcgid=%d node_id=%d eviction=0x%lx workingset=%d\n", + memcgid, pgdat->node_id, eviction, workingset); eviction &= EVICTION_MASK; eviction = (eviction << MEM_CGROUP_ID_SHIFT) | memcgid; eviction = (eviction << NODES_SHIFT) | pgdat->node_id; eviction = (eviction << WORKINGSET_SHIFT) | workingset; - - return xa_mk_value(eviction); + void *shadow = xa_mk_value(eviction); + pr_err(" Final packed shadow=0x%lx (raw eviction=0x%lx)\n", + (unsigned long)shadow, eviction); + if ((unsigned long)shadow == 0x41) { + pr_err("*** BUG: CREATED SHADOW 0x41! ***\n"); + dump_stack(); + } + return shadow; } static void unpack_shadow(void *shadow, int *memcgidp, pg_data_t **pgdat, unsigned long *evictionp, bool *workingsetp) { + pr_err("UNPACK_SHADOW: READING SHADOW\n"); + pr_err(" shadow=0x%lx\n", (unsigned long)shadow); unsigned long entry = xa_to_value(shadow); int memcgid, nid; bool workingset; - + // CRITICAL: Detect if we're reading the bad 0x41 shadow! + if ((unsigned long)shadow == 0x41) { + pr_err("*** BUG: UNPACKING CORRUPTED SHADOW 0x41! ***\n"); + dump_stack(); + } workingset = entry & ((1UL << WORKINGSET_SHIFT) - 1); entry >>= WORKINGSET_SHIFT; nid = entry & ((1UL << NODES_SHIFT) - 1); entry >>= NODES_SHIFT; memcgid = entry & ((1UL << MEM_CGROUP_ID_SHIFT) - 1); entry >>= MEM_CGROUP_ID_SHIFT; - + pr_err(" Unpacked: memcgid=%d nid=%d eviction=0x%lx workingset=%d\n", + memcgid, nid, entry, workingset); + pr_err(" NODE_DATA(%d)=%px\n", nid, NODE_DATA(nid)); + if (nid >= MAX_NUMNODES || !NODE_DATA(nid)) { + pr_err("*** BUG: INVALID NODE ID %d! ***\n", nid); + dump_stack(); + } *memcgidp = memcgid; *pgdat = NODE_DATA(nid); *evictionp = entry; @@ -231,6 +252,8 @@ static void unpack_shadow(void *shadow, int *memcgidp, pg_data_t **pgdat, static void *lru_gen_eviction(struct folio *folio) { + pr_err("LRU_GEN_EVICTION: ENTERED\n"); + pr_err(" folio=%px node=%d\n", folio, folio_nid(folio)); int hist; unsigned long token; unsigned long min_seq; @@ -250,11 +273,15 @@ static void *lru_gen_eviction(struct folio *folio) lrugen = &lruvec->lrugen; min_seq = READ_ONCE(lrugen->min_seq[type]); token = (min_seq << LRU_REFS_WIDTH) | max(refs - 1, 0); - + pr_err("LRU_GEN_EVICTION: min_seq=0x%lx refs=%d tier=%d\n", + min_seq, refs, tier); + pr_err(" token=0x%lx (will be eviction parameter)\n", token); hist = lru_hist_from_seq(min_seq); atomic_long_add(delta, &lrugen->evicted[hist][type][tier]); - - return pack_shadow(mem_cgroup_id(memcg), pgdat, token, workingset); + void *shadow = pack_shadow(mem_cgroup_id(memcg), pgdat, token, workingset); + pr_err("LRU_GEN_EVICTION: Returning shadow=0x%lx\n", (unsigned long)shadow); + return shadow; + //return pack_shadow(mem_cgroup_id(memcg), pgdat, token, workingset); } /* @@ -289,6 +316,13 @@ static bool lru_gen_test_recent(void *shadow, struct lruvec **lruvec, static void lru_gen_refault(struct folio *folio, void *shadow) { + pr_err("LRU_GEN_REFAULT: ENTERED\n"); + pr_err(" folio=%px shadow=0x%lx\n", folio, (unsigned long)shadow); + + if ((unsigned long)shadow == 0x41) { + pr_err("*** BUG: LRU_GEN_REFAULT received corrupted shadow 0x41! ***\n"); + //dump_stack(); + } bool recent; int hist, tier, refs; bool workingset; @@ -299,8 +333,11 @@ static void lru_gen_refault(struct folio *folio, void *shadow) int delta = folio_nr_pages(folio); rcu_read_lock(); + pr_err("LRU_GEN_REFAULT: Calling lru_gen_test_recent\n"); recent = lru_gen_test_recent(shadow, &lruvec, &token, &workingset); + pr_err("LRU_GEN_REFAULT: lru_gen_test_recent returned %d\n", recent); + pr_err(" lruvec=%px token=0x%lx workingset=%d\n", lruvec, token, workingset); if (!lruvec || lruvec != folio_lruvec(folio)) goto unlock; mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + type, delta); @@ -539,6 +576,12 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset, */ void workingset_refault(struct folio *folio, void *shadow) { + pr_err("WORKINGSET_REFAULT: ENTERED\n"); + pr_err(" folio=%px shadow=0x%lx\n", folio, (unsigned long)shadow); + if ((unsigned long)shadow == 0x41) { + pr_err("*** BUG: WORKINGSET_REFAULT received corrupted shadow 0x41! ***\n"); + dump_stack(); + } bool file = folio_is_file_lru(folio); struct pglist_data *pgdat; struct mem_cgroup *memcg; @@ -549,9 +592,13 @@ void workingset_refault(struct folio *folio, void *shadow) VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio); if (lru_gen_enabled()) { + pr_err("WORKINGSET_REFAULT: LRU_GEN enabled, calling lru_gen_refault\n"); lru_gen_refault(folio, shadow); + pr_err("WORKINGSET_REFAULT: lru_gen_refault returned\n"); + return; } + pr_err("WORKINGSET_REFAULT: Using regular (non-LRU_GEN) path\n"); /* * The activation decision for this folio is made at the level @@ -568,6 +615,7 @@ void workingset_refault(struct folio *folio, void *shadow) lruvec = mem_cgroup_lruvec(memcg, pgdat); mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + file, nr); + pr_err("WORKINGSET_REFAULT: Calling workingset_test_recent\n"); if (!workingset_test_recent(shadow, file, &workingset, true)) return; @@ -578,6 +626,7 @@ void workingset_refault(struct folio *folio, void *shadow) /* Folio was active prior to eviction */ if (workingset) { + pr_err("WORKINGSET_REFAULT: Folio was workingset, restoring\n"); folio_set_workingset(folio); /* * XXX: Move to folio_add_lru() when it supports new vs @@ -586,6 +635,7 @@ void workingset_refault(struct folio *folio, void *shadow) lru_note_cost_refault(folio); mod_lruvec_state(lruvec, WORKINGSET_RESTORE_BASE + file, nr); } + pr_err("WORKINGSET_REFAULT: EXITING\n"); } /** -- 2.43.0