From: Kairui Song <ryncsn@gmail.com>
To: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Dmitry Vyukov <dvyukov@google.com>,
syzbot <syzbot+e12bd9ca48157add237a@syzkaller.appspotmail.com>,
akpm@linux-foundation.org, cgroups@vger.kernel.org,
hannes@cmpxchg.org, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, mhocko@kernel.org, muchun.song@linux.dev,
roman.gushchin@linux.dev, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [cgroups?] [mm?] KASAN: wild-memory-access Read in lookup_swap_cgroup_id (2)
Date: Sat, 14 Feb 2026 00:04:41 +0800 [thread overview]
Message-ID: <CAMgjq7DVNMSez70O-3v1ANuCcSzgwaXckusVcLyT6T=UD-WNOw@mail.gmail.com> (raw)
In-Reply-To: <aYYkvaqYGLXD3_P-@linux.dev>
On Sat, Feb 7, 2026 at 1:30 AM Shakeel Butt <shakeel.butt@linux.dev> wrote:
>
> +Kairui
Thanks for Cc. I just noticed it while cleaning my mailbox.
> On Fri, Feb 06, 2026 at 08:31:19AM +0100, Dmitry Vyukov wrote:
> > On Fri, 6 Feb 2026 at 08:24, syzbot
> > <syzbot+e12bd9ca48157add237a@syzkaller.appspotmail.com> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit: 18f7fcd5e69a Linux 6.19-rc8
> > > git tree: upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1428fc5a580000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=f1fac0919970b671
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=e12bd9ca48157add237a
> > > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> > >
> > > Unfortunately, I don't have any reproducer for this issue yet.
> > >
> > This happened before:
> > https://lore.kernel.org/all/67d04360.050a0220.1939a6.000e.GAE@google.com/T/
> > and now 2 more times.
> > All reports look similar: exit_mm -> zap_p4d_range
> > And all access addresses look the same: top 13 bits are zeros, then
> > some garbage (0007fffffffffffc).
> > I am pretty sure it's telling us something, some kind of tricky race,
> > rather than a previous corruption. Swp entry is somehow invalid?
>
> Thanks for the report. It would be good to have a reproducer. I will dig
> deeper later but good to have eyes from Kairui who has recent changes
> in the area.
I've just checked the syzbot's console log for the two times it
catched the error:
https://syzkaller.appspot.com/text?tag=CrashLog&x=1428fc5a580000
https://syzkaller.appspot.com/text?tag=CrashLog&x=16c2c694580000
(from https://syzkaller.appspot.com/bug?extid=e12bd9ca48157add237a)
In the first log, before the panic, console is full with:
get_swap_device: Bad swap file entry 4003ffffffffffff
Which indicates there is at least one, maybe a lot of invalid swap
entries of the same value in the page table. Unfortunately that's all
it can tell, maybe something corrupted the page table?
prev parent reply other threads:[~2026-02-13 16:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-06 7:24 syzbot
2026-02-06 7:31 ` Dmitry Vyukov
2026-02-06 17:30 ` Shakeel Butt
2026-02-13 16:04 ` Kairui Song [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAMgjq7DVNMSez70O-3v1ANuCcSzgwaXckusVcLyT6T=UD-WNOw@mail.gmail.com' \
--to=ryncsn@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=cgroups@vger.kernel.org \
--cc=dvyukov@google.com \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@kernel.org \
--cc=muchun.song@linux.dev \
--cc=roman.gushchin@linux.dev \
--cc=shakeel.butt@linux.dev \
--cc=syzbot+e12bd9ca48157add237a@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox