From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA0152701B8 for ; Wed, 25 Feb 2026 18:12:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772043150; cv=none; b=d1ciB1x50+4F1/TAiCwiqX06tsbSROG71N0QgzxArsRoZfQnBYr5cGtQUWkaEpNvMNuYAJVTasJNusKhuCATlT6tyfp7CePZaLUIhRlDr4wgV4vYvK7uz+Ju6tD/tdPGWathQnfDyyktonylHVixUU64fy1xTs6/FE1Cz69LwDA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772043150; c=relaxed/simple; bh=49QvQ4TbddAGvgoT5UB+apP76VxdQZq65SDCKT6nENw=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=UoMSqEEqRGD3h/7lT/8zECIC7xsVU2eKEUC8KsH6YXnAluPgYaCw7Q0BvK9T43QhHk3LROYKPtLkgamwzzmLcYPrsjsDBzRrT0MwnErnGFUbJ42w5SS/n7h4oC05BGw2+BijKjkerP4FotZ3ktxHv7p3tK/Wxbhw+JCuk0HC5EI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mCVhFnWb; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mCVhFnWb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D280C116D0; Wed, 25 Feb 2026 18:12:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772043150; bh=49QvQ4TbddAGvgoT5UB+apP76VxdQZq65SDCKT6nENw=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=mCVhFnWbSg9j91soLEar5wX/m2n/Q1lo0wOe/qgSz5Z6WsDlWrXd1H2TZCly9lcGb vPxbpIgmTzaB/o624PMvf/J0g2b9KPHlMZIZTdXA4Oxzx2y6PYbbcdmYX7O7MPVR0t KwO9rNKtOCebHu0GpSa6U1Xs76eZjV9jerksdkrp5qm7niBX3tOWu2tym8T1diabDi IDSYjLlOpwfo5Hz4G5qlbgu+7VEMu57elKgfjLBkY1hN1nwmHrh7WizLG6hl5XnY/i kLk7mKPI/zozmsvb6c15wkWL9SOgYOYfhAblCZQGLNgiIfANEiQbzQQzBQOhbof/AJ glOGwReXiBKMg== Date: Wed, 25 Feb 2026 13:12:28 -0500 From: Sasha Levin To: "David Hildenbrand (Arm)" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Lorenzo Stoakes , Andrew Morton , Hugh Dickins , Zi Yan , Gavin Guo Subject: Re: VM_BUG_ON_VMA in split_huge_pmd_locked: huge PMD doesn't cover full VMA range Message-ID: References: <24cbde8e-53b1-48bb-b44d-2b4bdc674d55@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <24cbde8e-53b1-48bb-b44d-2b4bdc674d55@kernel.org> On Wed, Feb 25, 2026 at 02:50:16PM +0100, David Hildenbrand (Arm) wrote: >On 2/25/26 14:43, Sasha Levin wrote: >> Hi, >> >> I've been playing around with improvements to syzkaller locally, and hit >> the >> following crash on v7.0-rc1: >> >>   vma ffff888109f988c0 start 0000555580cc0000 end 0000555580ce2000 mm >> ffff8881048e1780 >>   prot 8000000000000025 anon_vma ffff88810b20f100 vm_ops 0000000000000000 >>   pgoff 555580cc0 file 0000000000000000 private_data 0000000000000000 >>   refcnt 1 >>   flags: 0x100073(read|write|mayread|maywrite|mayexec|account) >>   ------------[ cut here ]------------ >>   kernel BUG at mm/huge_memory.c:2999! >>   Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI >>   CPU: 3 UID: 0 PID: 15162 Comm: syz.7.3120 Tainted: G                 >> N  7.0.0-rc1-00001-gc5447a46efed #51 PREEMPT(full) >>   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0- >> debian-1.17.0-1 04/01/2014 >>   RIP: 0010:split_huge_pmd_locked+0x11a0/0x2f80 >>   RSP: 0018:ffff888053cc7338 EFLAGS: 00010282 >>   RAX: 0000000000000126 RBX: ffff888109f988d0 RCX: 0000000000000000 >>   RDX: 0000000000000126 RSI: 0000000000000000 RDI: ffffed100a798e43 >>   RBP: 0000555580cc0000 R08: ffffffffa3e62775 R09: 0000000000000001 >>   R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000080 >>   R13: 0000000000000000 R14: 0000555580c00000 R15: ffff888109f988c0 >>   FS:  0000000000000000(0000) GS:ffff88816f701000(0000) >> knlGS:0000000000000000 >>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>   CR2: 00007fe2ac1907a0 CR3: 0000000021c91000 CR4: 0000000000750ef0 >>   PKRU: 80000000 >>   Call Trace: >>    >>    __split_huge_pmd+0x201/0x350 >>    unmap_page_range+0xa6a/0x3db0 >>    unmap_single_vma+0x14b/0x230 >>    unmap_vmas+0x28f/0x580 >>    exit_mmap+0x203/0xa80 >>    __mmput+0x11b/0x540 >>    mmput+0x81/0xa0 >>    do_exit+0x7b9/0x2c60 >>    do_group_exit+0xd5/0x2a0 >>    get_signal+0x1fdc/0x2340 >>    arch_do_signal_or_restart+0x93/0x790 >>    exit_to_user_mode_loop+0x84/0x480 >>    do_syscall_64+0x4df/0x700 >>    entry_SYSCALL_64_after_hwframe+0x77/0x7f >>    >>   Kernel panic - not syncing: Fatal exception >> >> The assertion VM_BUG_ON_VMA(vma->vm_start > haddr, vma) fires at >> mm/huge_memory.c:2999 because a huge PMD exists at PMD-aligned address >> 0x555580c00000 but the VMA only covers [0x555580cc0000, 0x555580ce2000): >> a 136KB region starting 816KB past the PMD base. > >Do you have a reproducer and would this trigger before v7.0-rc1? No reproducer. I saw it exactly once yesterday, syzkaller wasn't able to come up with a reproducer and pointing the LLM at that task hasn't produced anything useful either :( -- Thanks, Sasha