Forwarded: [PATCH] mm/workingset: fix NULL pointer dereference in lru_gen_test_recent()

syzbot
2025-12-08T02:31:42Z

Subject: [PATCH] mm/workingset: fix NULL pointer dereference in lru_gen_test_recent()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Syzbot reported a general protection fault in lru_gen_test_recent() when
accessing memcg->nodeinfo with a NULL memcg pointer:

Oops: general protection fault in lru_gen_test_recent+0xfc/0x370
KASAN: probably user-memory-access in range [0x0000000000004e00-0x0000000000004e07]
RIP: 0010:lru_gen_test_recent+0xfc/0x370

The crash occurs when unpack_shadow() extracts parameters from a shadow
entry. There are two cases where NULL pointers can be returned:

1. pgdat can be NULL when NODE_DATA(nid) returns NULL for an invalid or
offlined NUMA node ID stored in the shadow entry.

2. memcg can be NULL when mem_cgroup_from_id() fails to find the memory
cgroup (e.g., if it was destroyed).

The existing code directly passes these potentially NULL pointers to
mem_cgroup_lruvec(), which dereferences memcg->nodeinfo without checking,
leading to the crash.

Fix this by:
- Checking if pgdat is NULL and returning early if so, as we cannot
determine page recency without a valid node.
- Checking if memcg is NULL and falling back to pgdat->__lruvec (the
root memcg's lruvec) instead of calling mem_cgroup_lruvec() which
would dereference NULL.

Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspot.com
Link: https://syzkaller.appspot.com/bug?extid=e008db2ac01e282550ee
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
mm/workingset.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/mm/workingset.c b/mm/workingset.c
index e9f05634747a..335c2d34ac94 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -270,10 +270,18 @@ static bool lru_gen_test_recent(void *shadow, struct lruvec **lruvec,
struct pglist_data *pgdat;

unpack_shadow(shadow, &memcg_id, &pgdat, token, workingset);
-
+ if(unlikely(!pgdat))
+ return false;
memcg = mem_cgroup_from_id(memcg_id);
- *lruvec = mem_cgroup_lruvec(memcg, pgdat);
-
+ if (unlikely(!memcg)) {
+ pr_warn("DEBUG: memcg is NULL (memcg_id=%d), pgdat=%p, returning false\n",memcg_id, pgdat);
+ pr_warn("DEBUG: shadow=%p token=%lx workingset=%d\n",shadow, *token, *workingset);
+ memcg = root_mem_cgroup;
+ *lruvec = &pgdat->__lruvec;
+ } else {
+ *lruvec = mem_cgroup_lruvec(memcg, pgdat);
+ }
+ pr_warn("DEBUG: memcg=%p, lruvec=%p, continuing normally\n", memcg, *lruvec);
max_seq = READ_ONCE((*lruvec)->lrugen.max_seq);
max_seq &= EVICTION_MASK >> LRU_REFS_WIDTH;

--
2.43.0