From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
To: Zhao Gongyi <zhaogongyi@bytedance.com>
Cc: David Hildenbrand <david@kernel.org>, Xu Xin <xu.xin@linux.dev>,
Chengming Zhou <chengming.zhou@linux.dev>,
Andrew Morton <akpm@linux-foundation.org>,
Rik van Riel <riel@redhat.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mm/ksm: avoid unsafe anon rmap dereference in KSM merge
Date: Fri, 6 Nov 2026 10:06:31 +0000 [thread overview]
Message-ID: <au2mm0Y9PdumuzgE@gremlin> (raw)
In-Reply-To: <75926835-508f-48d3-a5d9-176cea61546d@bytedance.com>
On Fri, Nov 06, 2026 at 10:43:45AM +0800, Zhao Gongyi wrote:
> I tested Lorenzo's posted patch on Linux 7.3.0-syz-13001714+
> with CONFIG_KSM=y, CONFIG_KASAN=y and CONFIG_SLUB_RCU_DEBUG=y.
>
> An earlier unpatched run of the fixed-pool KSM/mremap reproducer hit a
> KASAN slab-use-after-free in page_address_in_vma() after about 342 seconds.
> With the patch applied, the workload ran for 12 minutes (1027 KSM full
> scans) without KASAN, BUG or panic. The fork/COW smoke test passed.
>
> ksm_functional_tests reported 8 passes, 1 failure and 1 skip. The
> "ptrace write failed" failure is a known test-environment issue; dmesg
> showed no kernel error.
>
> Tested-by: Zhao Gongyi <zhaogongyi@bytedance.com>
Thanks!
--
Cheers, Lorenzo
next prev parent reply other threads:[~2026-11-06 10:06 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-02 12:32 Lorenzo Stoakes (ARM)
2026-11-02 12:49 ` David Hildenbrand (Arm)
2026-11-02 12:55 ` Lorenzo Stoakes (ARM)
2026-11-02 13:39 ` David Hildenbrand (Arm)
2026-11-05 9:40 ` David Hildenbrand
2026-11-06 2:43 ` Zhao Gongyi
2026-11-06 10:06 ` Lorenzo Stoakes (ARM) [this message]
2026-11-06 12:40 ` David Hildenbrand (Arm)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=au2mm0Y9PdumuzgE@gremlin \
--to=ljs@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=chengming.zhou@linux.dev \
--cc=david@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=riel@redhat.com \
--cc=xu.xin@linux.dev \
--cc=zhaogongyi@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®