From: syzbot <syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [kvm?] WARNING in kvm_gmem_fault_user_mapping
Date: Sun, 08 Feb 2026 18:34:07 -0800 [thread overview]
Message-ID: <6989479f.050a0220.3b3015.0066.GAE@google.com> (raw)
In-Reply-To: <20260209015545.20766-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in __unmap_hugepage_range
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 0 UID: 0 PID: 6527 Comm: syz.4.21 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:hstate_inode include/linux/hugetlb.h:540 [inline]
RIP: 0010:hstate_file include/linux/hugetlb.h:756 [inline]
RIP: 0010:hstate_vma include/linux/hugetlb.h:772 [inline]
RIP: 0010:__unmap_hugepage_range+0x113/0x15f0 mm/hugetlb.c:5177
Code: 48 c1 ea 03 80 3c 02 00 0f 85 dd 12 00 00 48 8b 9b 38 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cb 12 00 00 48 8b 43 50 48 89 44 24 10 48 05 a8
RSP: 0018:ffffc90003e9f700 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000200000800000
RDX: 000000000000000a RSI: ffffffff826be487 RDI: 0000000000000050
RBP: ffff88804f9ff000 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000400000 R11: 0000000000000000 R12: 0000000000000003
R13: ffff88804f9ff000 R14: 0000200000000000 R15: 0000200000800000
FS: 0000000000000000(0000) GS:ffff8881245d9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f37b2b31000 CR3: 000000006529d000 CR4: 00000000003526f0
Call Trace:
<TASK>
unmap_single_vma+0x1ef/0x240 mm/memory.c:2058
unmap_vmas+0x218/0x470 mm/memory.c:2104
exit_mmap+0x181/0xae0 mm/mmap.c:1277
__mmput+0x12a/0x410 kernel/fork.c:1173
mmput+0x67/0x80 kernel/fork.c:1196
exit_mm kernel/exit.c:581 [inline]
do_exit+0x78a/0x2a30 kernel/exit.c:959
do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x86/0x4b0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4fe/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1b38f9aeb9
Code: Unable to access opcode bytes at 0x7f1b38f9ae8f.
RSP: 002b:00007f1b39d820e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f1b39215fa8 RCX: 00007f1b38f9aeb9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1b39215fac
RBP: 00007f1b39215fa0 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1b39216038 R14: 00007ffe5bb4b350 R15: 00007ffe5bb4b438
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hstate_inode include/linux/hugetlb.h:540 [inline]
RIP: 0010:hstate_file include/linux/hugetlb.h:756 [inline]
RIP: 0010:hstate_vma include/linux/hugetlb.h:772 [inline]
RIP: 0010:__unmap_hugepage_range+0x113/0x15f0 mm/hugetlb.c:5177
Code: 48 c1 ea 03 80 3c 02 00 0f 85 dd 12 00 00 48 8b 9b 38 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cb 12 00 00 48 8b 43 50 48 89 44 24 10 48 05 a8
RSP: 0018:ffffc90003e9f700 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000200000800000
RDX: 000000000000000a RSI: ffffffff826be487 RDI: 0000000000000050
RBP: ffff88804f9ff000 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000400000 R11: 0000000000000000 R12: 0000000000000003
R13: ffff88804f9ff000 R14: 0000200000000000 R15: 0000200000800000
FS: 0000000000000000(0000) GS:ffff8881246d9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6a9d71f286 CR3: 0000000060f0e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 48 c1 ea 03 shr $0x3,%rdx
4: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
8: 0f 85 dd 12 00 00 jne 0x12eb
e: 48 8b 9b 38 06 00 00 mov 0x638(%rbx),%rbx
15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1c: fc ff df
1f: 48 8d 7b 50 lea 0x50(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 cb 12 00 00 jne 0x12ff
34: 48 8b 43 50 mov 0x50(%rbx),%rax
38: 48 89 44 24 10 mov %rax,0x10(%rsp)
3d: 48 rex.W
3e: 05 .byte 0x5
3f: a8 .byte 0xa8
Tested on:
commit: 05f7e89a Linux 6.19
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=125217fa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1fac0919970b671
dashboard link: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=171d865a580000
next parent reply other threads:[~2026-02-09 2:34 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260209015545.20766-1-kartikey406@gmail.com>
2026-02-09 2:34 ` syzbot [this message]
[not found] <20260213154336.434008-1-kartikey406@gmail.com>
2026-02-13 16:10 ` syzbot
[not found] <20260209131144.33939-1-kartikey406@gmail.com>
2026-02-09 13:38 ` syzbot
[not found] <20260209020250.21590-1-kartikey406@gmail.com>
2026-02-09 3:04 ` syzbot
2026-02-04 17:01 [PATCH] KVM: guest_memfd: Disable VMA merging with VM_DONTEXPAND Ackerley Tng
2026-02-04 18:21 ` [syzbot] [kvm?] WARNING in kvm_gmem_fault_user_mapping syzbot
-- strict thread matches above, loose matches on Subject: below --
2026-02-03 22:50 [PATCH 1/2] KVM: guest_memfd: Always use order 0 when allocating for guest_memfd Ackerley Tng
2026-02-03 22:00 ` [syzbot] [kvm?] WARNING in kvm_gmem_fault_user_mapping syzbot
[not found] <20260202151142.99116-1-kartikey406@gmail.com>
2026-02-02 16:39 ` syzbot
[not found] <20260202083439.95644-1-kartikey406@gmail.com>
2026-02-02 10:52 ` syzbot
[not found] <20260201110809.91962-1-kartikey406@gmail.com>
2026-02-01 11:39 ` syzbot
[not found] <20260201074823.90148-1-kartikey406@gmail.com>
2026-02-01 10:33 ` syzbot
[not found] <20260201054807.88100-1-kartikey406@gmail.com>
2026-02-01 6:25 ` syzbot
[not found] <20260201045720.85957-1-kartikey406@gmail.com>
2026-02-01 5:40 ` syzbot
2026-01-30 20:15 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6989479f.050a0220.3b3015.0066.GAE@google.com \
--to=syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome