From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-179.mta0.migadu.com (out-179.mta0.migadu.com [91.218.175.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC6211850A4 for ; Mon, 26 Jan 2026 01:54:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769392467; cv=none; b=Nzr5lQXntyQ7DAAjs3R/RvOIwt+vapsTOyuHvj2n59G0TYtQZRcbIxUR9+ZA4ot36weAOfxLElB5tfXeYxDR8szUZukeFtdE4ioSvMISBGDWT5ST4+4NphKW8JOE8bFGqhPB83iLOCuI69me9NmazKeCVrEGjrujxNRdDNDKkdc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769392467; c=relaxed/simple; bh=gGiJupebzCna5WvkgzU4BYSZSz+qZGnaA0paXbO1JVo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=i9j2JXkCIS9yEFQpXFW+bRVkffhrLRmGU1Kfdce49ceFsl+3KOBK8qvaHY+2SKQ30DnqEPKx1mt/J4vR//oVhEMI+7ZcHGReGw11MFFdz4QT9OpncwTmfNOpdr4pr829Gr88LcFgEnYqFEseRbC+6p1T2RIbrJJHo/qfGM2vuqQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=lNTomWoT; arc=none smtp.client-ip=91.218.175.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="lNTomWoT" Message-ID: <35fb4fc8-8ca7-4ca1-9528-630ed4d1e782@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1769392463; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nyu57uSYb5lGmRQqv2IuaFGLa8ntALrsc6QD6O349Fw=; b=lNTomWoT2Ne//HsqXqvGPIBNj+Z5zT2ZjR8uJZR20bL+g77EPlFf828kyzEJ21+x3LmEG8 P2lRdPazbVJFpigPaPzuvGn4juFyU5zSv9ub4ESdtm6aCilDzhTBdTCyzF6TtB+fQDowq8 Uemnq5i0BxAaDfu1FDMEgBeffATSTd8= Date: Mon, 26 Jan 2026 09:54:17 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [syzbot] [mm?] kernel BUG in hpage_collapse_scan_file (2) To: "David Hildenbrand (Red Hat)" , willy@infradead.org Cc: syzbot+bf6e6a6ca143afea5ca2@syzkaller.appspotmail.com, Liam.Howlett@oracle.com, akpm@linux-foundation.org, baohua@kernel.org, baolin.wang@linux.alibaba.com, dev.jain@arm.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, lorenzo.stoakes@oracle.com, npache@redhat.com, ryan.roberts@arm.com, syzkaller-bugs@googlegroups.com, ziy@nvidia.com References: <69757ea0.a00a0220.33ccc7.0017.GAE@google.com> <20260125121001.32733-1-lance.yang@linux.dev> <7bce9231-714c-424a-a4e3-dd42734fb767@kernel.org> Content-Language: en-US X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Lance Yang In-Reply-To: <7bce9231-714c-424a-a4e3-dd42734fb767@kernel.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT On 2026/1/26 02:13, David Hildenbrand (Red Hat) wrote: > On 1/25/26 13:10, Lance Yang wrote: >> Ccing Willy. >> >> On Sat, 24 Jan 2026 18:23:28 -0800, syzbot wrote: >>> Hello, >>> >>> syzbot found the following issue on: >>> >>> HEAD commit:    ca3a02fda4da Add linux-next specific files for 20260123 >>> git tree:       linux-next >>> console output: https://syzkaller.appspot.com/x/log.txt?x=10c42452580000 >>> kernel config:  https://syzkaller.appspot.com/x/.config? >>> x=10f2b64f8f12b9a4 >>> dashboard link: https://syzkaller.appspot.com/bug? >>> extid=bf6e6a6ca143afea5ca2 >>> compiler:       Debian clang version 21.1.8 (+ >>> +20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD >>> 21.1.8 >>> syz repro:      https://syzkaller.appspot.com/x/repro.syz? >>> x=17f7cbfa580000 >>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=112d405a580000 >>> >>> Downloadable assets: >>> disk image: https://storage.googleapis.com/syzbot- >>> assets/291ebca63a31/disk-ca3a02fd.raw.xz >>> vmlinux: https://storage.googleapis.com/syzbot-assets/b2112a214b54/ >>> vmlinux-ca3a02fd.xz >>> kernel image: https://storage.googleapis.com/syzbot- >>> assets/77d1ae437e07/bzImage-ca3a02fd.xz >>> >>> IMPORTANT: if you fix the issue, please add the following tag to the >>> commit: >>> Reported-by: syzbot+bf6e6a6ca143afea5ca2@syzkaller.appspotmail.com >>> >>> node ffff888148816ec0 offset 0 parent ffff888148817700 shift 0 count >>> 64 values 0 array ffff88807be6b0f0 list ffff888148816ed8 >>> ffff888148816ed8 marks 0 0 0 >>> ------------[ cut here ]------------ >>> kernel BUG at ./include/linux/xarray.h:1441! >>> Oops: invalid opcode: 0000 [#1] SMP KASAN PTI >>> CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 >>> PREEMPT(full) >>> Hardware name: Google Google Compute Engine/Google Compute Engine, >>> BIOS Google 01/13/2026 >>> RIP: 0010:XAS_INVALID include/linux/xarray.h:1441 [inline] >> >> Seems like that is: >> >> ``` >> static inline struct xa_state *XAS_INVALID(struct xa_state *xas) >> { >>     XA_NODE_BUG_ON(xas->xa_node, xas_valid(xas)); >>     return xas; >> } >> ``` > > I think there was recently already a discussion about this. > > See > > https://lore.kernel.org/linux-mm/aVvz3tYdu49TGkjI@mozart.vkv.me/ > > > And where Willy said that likely it needs more thought: > > https://lore.kernel.org/linux-mm/aVwm3MQ_ZDa_kU8c@casper.infradead.org/ Ah, I see. Thanks for the pointer!