From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f80.google.com (mail-oo1-f80.google.com [209.85.161.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 633C626AF4 for ; Thu, 5 Feb 2026 22:40:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.80 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770331235; cv=none; b=GDx0RSVj1llkEDtA+SCyfErGl20G+I5hzLT4jYX01WxU5PYpFlbYpCPd2C21vbkOQ5zWdi3zIpl8HQamjHHNowgkQCewkUjlfBYFvcHpyGISPeRCcfUMIOzcNjT2nNbZVO97MGiUSoagO0b9vJFgw4TVBGr4F3YbPjSv9tbDlW4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770331235; c=relaxed/simple; bh=DkX+gj5HwZQ01C8iKnf2scl6QeRgJPOi2zY66UPki2c=; h=MIME-Version:Date:Message-ID:Subject:From:To:Content-Type; b=cyf5OitiryAbkFVQ/WfUJXn+uEc2UBvRpXLWk6B/aGAbB7uAHyPBSaHVWZCTU8I0bCBtXnpw4SP/SM8toAsuTQX26G2HlbljGW1+4hMlFZC0doVqAv8JoBwwISea2yQjMt1h6rbqqDA5nMxIXI9rQAOclA4XFdl/wA+pJAPCSIs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.80 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f80.google.com with SMTP id 006d021491bc7-66b560fcc42so6745950eaf.0 for ; Thu, 05 Feb 2026 14:40:35 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770331234; x=1770936034; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=DuWAEd+N9k1V2CmdDlaOa4SrWIxcBY/M7PymrB9H2NI=; b=U5WYjMTy8FTv588ZSN1pFyYppSywz5qlJRlN3o0vnz+R7R8aFm0l3pYSqVPs8cE4S/ R540BoFeRmjU8Aiw7I7/ijhX9T2YbqB020jT7+5a0b9iBXRsbs48ERG0c8sjImzchIpV Qxg1d0zPJ+y3OV2Ag9o8KyN4TAVNFzyGIT2Rji2vhvPnke1iVErplTaDUMJpgbub0T3e mf1O9mcpSEasAznGcl6KV6+OkIHxgsURUZpaeZ2f/Getqg4XbPpVa0/O6RiCBfavyj2O tLtZcWyJngQv9BILhc47q8J+KCSrYt3mmjq7B2hMShZ5h1ljzjLbrh4z5R7Wai3AUt53 hxYw== X-Forwarded-Encrypted: i=1; AJvYcCVWKuN0cz2/Fkr4eh6nRMH810aYZkLkQctv/D50kojqAm3FKRrJG42QXEdOUf1aGRsrhvzltAfd+1M4waY=@vger.kernel.org X-Gm-Message-State: AOJu0Yxj1VEKEkr52t5rE3XOK9l1dZ/VBSBa5ZidkCTA1x9yzsn3+4uZ FT/axHy73fC0cfJuFivPH54g1S4DRXCuPQo7sedrPEwa6cL7Bd4j57R40UwVQDPTvQ/1ZRCuNyu nbxPZVWx9iF3sT+YLGXcNo1fwEx6xASoius9OS7RQspirA5noyN1S0oBa7Sc= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:611:b0:662:fe0b:d763 with SMTP id 006d021491bc7-66d334b3eaemr231461eaf.37.1770331234288; Thu, 05 Feb 2026 14:40:34 -0800 (PST) Date: Thu, 05 Feb 2026 14:40:34 -0800 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69851c62.a00a0220.37c87e.002e.GAE@google.com> Subject: [syzbot] [mm?] kernel BUG in page_table_check_set (2) From: syzbot To: akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, pasha.tatashin@soleen.com, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot found the following issue on: HEAD commit: 099ba40b1bd9 riscv: lib: optimize strlen loop efficiency git tree: git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next console output: https://syzkaller.appspot.com/x/log.txt?x=158c8b22580000 kernel config: https://syzkaller.appspot.com/x/.config?x=781a4eb07921464d dashboard link: https://syzkaller.appspot.com/bug?extid=227179d5a8a87e9df90d compiler: riscv64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 userspace arch: riscv64 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/a741b348759c/non_bootable_disk-099ba40b.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/38fcde8ce410/vmlinux-099ba40b.xz kernel image: https://storage.googleapis.com/syzbot-assets/9246b4696c47/Image-099ba40b.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+227179d5a8a87e9df90d@syzkaller.appspotmail.com ------------[ cut here ]------------ kernel BUG at [] mm/page_table_check.c:118! Kernel BUG [#1] Modules linked in: CPU: 0 UID: 0 PID: 7886 Comm: syz.4.1009 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: riscv-virtio,qemu (DT) epc : page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118 ra : page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118 epc : ffffffff80bfcb7c ra : ffffffff80bfcb7c sp : ffff8f8000cb6860 gp : ffffffff89f9df20 tp : ffffaf801c80b500 t0 : 0000000000000000 t1 : fffff5ef026b8409 t2 : ffffffff9136c6e8 s0 : ffff8f8000cb68e0 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000 a2 : 0000000000080000 a3 : ffffffff80bfcb7c a4 : ffff8f800b83a948 a5 : 000000000007f948 a6 : 0000000000000003 a7 : ffffaf80135c204b s2 : 00000000000b5a00 s3 : 0000000000000000 s4 : ffffaf80135c2000 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000 s8 : 0000000000007fff s9 : ffffffff88825fa0 s10: 0000000000000000 s11: ffffffff8a0b5d80 t3 : 0000000000000001 t4 : fffff5ef026b8409 t5 : fffff5ef026b840a t6 : 0000000000000002 ssp : 0000000000000000 status: 0000000200000120 badaddr: ffffffff80bfcb7c cause: 0000000000000003 [] page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118 [] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:212 [] page_table_check_ptes_set include/linux/page_table_check.h:76 [inline] [] set_ptes arch/riscv/include/asm/pgtable.h:640 [inline] [] remove_migration_pte+0x1136/0x2494 mm/migrate.c:436 [] rmap_walk_anon+0x30e/0x690 mm/rmap.c:2861 [] rmap_walk_locked+0xa6/0xcc mm/rmap.c:2977 [] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:470 [] remap_page mm/huge_memory.c:3434 [inline] [] __folio_split+0xeb4/0x16f8 mm/huge_memory.c:4069 [] __split_huge_page_to_list_to_order+0x7e/0x140 mm/huge_memory.c:4200 [] split_huge_page_to_list_to_order include/linux/huge_mm.h:385 [inline] [] split_folio_to_list+0x22/0x30 mm/huge_memory.c:4264 [] madvise_cold_or_pageout_pte_range+0x1862/0x2400 mm/madvise.c:412 [] walk_pmd_range mm/pagewalk.c:130 [inline] [] walk_pud_range mm/pagewalk.c:224 [inline] [] walk_p4d_range mm/pagewalk.c:262 [inline] [] walk_pgd_range+0xcc6/0x1f84 mm/pagewalk.c:303 [] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:410 [] walk_page_range_vma_unsafe+0x212/0x868 mm/pagewalk.c:714 [] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:724 [] madvise_cold_page_range mm/madvise.c:586 [inline] [] madvise_cold+0x1a4/0x5f4 mm/madvise.c:606 [] madvise_vma_behavior+0x1188/0x251c mm/madvise.c:1364 [] madvise_walk_vmas+0x23a/0x970 mm/madvise.c:1721 [] madvise_do_behavior+0x1ea/0x5c0 mm/madvise.c:1937 [] do_madvise+0x18a/0x22c mm/madvise.c:2030 [] __do_sys_madvise mm/madvise.c:2039 [inline] [] __se_sys_madvise mm/madvise.c:2037 [inline] [] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2037 [] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x3d2/0x58c arch/riscv/kernel/traps.c:344 [] handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232 Code: 7097 ff90 80e7 4580 81e3 e004 8097 ff90 80e7 9380 (9002) 8097 ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: ff907097 auipc ra,0xff907 4: 458080e7 jalr 1112(ra) # 0xff907458 8: e00481e3 beqz s1,0xfffffffffffffe0a c: ff908097 auipc ra,0xff908 10: 938080e7 jalr -1736(ra) # 0xff907944 * 14: 9002 ebreak <-- trapping instruction 16: 9780 .short 0x8097 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup