From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-176.mta1.migadu.com (out-176.mta1.migadu.com [95.215.58.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCD572C3251 for ; Thu, 19 Mar 2026 02:59:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773889157; cv=none; b=enUEoK0V8DnpTyhtSMExk037ETbgWJ48uuEzsm2KbhjHsJE2tRC85ItM39KwJKQTAgCb/4+j6M2zyB+sVLbl4FPvcroIwKlSrUD/ue4dfbIDvHes/EoSSSBY8AewmJiBaD3HWPYtdXYNyt9vOeYcUFnp+rIptjDo5uef681c8PQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773889157; c=relaxed/simple; bh=5vZxdWrAwBgugAUEFi6WFmjovW8LGZ7i0KRDOtHPoFk=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=QSZksO6JCYqxXC4pe812Gy3YZ4TfhJbN+uO/DnqY9ISNRmVdXvHyrV0ra8LIrHdcLMMthnGLxSo+o8Jy/YPj0Q9+7wB1sHe09YenpWseAZAf2AXlJrCyLz4ZKIvVa2QA2YgbJbBihrqCQngYVU6VBxVEj9vmN/EETdqTB6WI1eI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=nD51bTaW; arc=none smtp.client-ip=95.215.58.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="nD51bTaW" Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1773889152; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MWqXdr13sDo2VgZ2GClp58nX4LNm23y/nrWdjg9tW7E=; b=nD51bTaWiThhqClTAYPJeuMAWr4G6nJmXjWQc3sRg6r+wdum0aIwe2R9Dn9Jk06tBHd/o2 dKvIEoiGAyd0BhU6WjxVlQ/LrqcylhXdJ3owTAyHmeR+fl912LsD4L5uKc/61PPBl0wOCy bnqqzbFFmAcCriQoFTKFYkW0kCYVPzA= Date: Thu, 19 Mar 2026 10:58:56 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [syzbot] [mm?] general protection fault in zap_huge_pmd Content-Language: en-US To: "Lorenzo Stoakes (Oracle)" Cc: syzbot , david@kernel.org, ryan.roberts@arm.com, npache@redhat.com, Liam.Howlett@oracle.com, ziy@nvidia.com, linux-mm@kvack.org, akpm@linux-foundation.org, baohua@kernel.org, baolin.wang@linux.alibaba.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, dev.jain@arm.com References: <69babeba.050a0220.1b2d94.0003.GAE@google.com> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Lance Yang In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT On 2026/3/19 01:35, Lorenzo Stoakes (Oracle) wrote: > On Thu, Mar 19, 2026 at 12:53:46AM +0800, Lance Yang wrote: >> Looks like it hits a general protection fault in zap_huge_pmd() while >> dereferencing folio->mapping via folio_test_anon() ... >> >> zap_huge_pmd() fails to handle non-present, non-none PMD entries that >> are not valid PMD softleaf entries, leaving folio as NULL and >> dereferencing it ... >> >> For PMD-sized hugetlb mappings like the reproducer above, >> hugetlb/userfaultfd would make such PMD entries that can be >> non-present and non-none without being valid PMD softleaf entries? > > Yeah, exactly :) interesting how it gets there though. > > Even after I figured out this was fixed wanted to track it down! > > See > https://lore.kernel.org/linux-mm/6b3d7ad7-49e1-407a-903d-3103704160d8@lucifer.local/ > >> >> I'll look into it :) > > As per above, I already did the analysis on this monster, it's fixed already (of > course!). > > I am going to send a patch to make this bit of the code more robust anyway! Cool, thanks!