From: Sasha Levin <sashal@kernel.org>
To: "David Hildenbrand (Arm)" <david@kernel.org>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Lorenzo Stoakes <lorenzo.stoakes@oracle.com>,
Andrew Morton <akpm@linux-foundation.org>,
Hugh Dickins <hughd@google.com>, Zi Yan <ziy@nvidia.com>,
Gavin Guo <gavinguo@igalia.com>
Subject: Re: VM_BUG_ON_VMA in split_huge_pmd_locked: huge PMD doesn't cover full VMA range
Date: Wed, 25 Feb 2026 13:12:28 -0500 [thread overview]
Message-ID: <aZ87jIN0mWfBbcEv@laps> (raw)
In-Reply-To: <24cbde8e-53b1-48bb-b44d-2b4bdc674d55@kernel.org>
On Wed, Feb 25, 2026 at 02:50:16PM +0100, David Hildenbrand (Arm) wrote:
>On 2/25/26 14:43, Sasha Levin wrote:
>> Hi,
>>
>> I've been playing around with improvements to syzkaller locally, and hit
>> the
>> following crash on v7.0-rc1:
>>
>> vma ffff888109f988c0 start 0000555580cc0000 end 0000555580ce2000 mm
>> ffff8881048e1780
>> prot 8000000000000025 anon_vma ffff88810b20f100 vm_ops 0000000000000000
>> pgoff 555580cc0 file 0000000000000000 private_data 0000000000000000
>> refcnt 1
>> flags: 0x100073(read|write|mayread|maywrite|mayexec|account)
>> ------------[ cut here ]------------
>> kernel BUG at mm/huge_memory.c:2999!
>> Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
>> CPU: 3 UID: 0 PID: 15162 Comm: syz.7.3120 Tainted: G
>> N 7.0.0-rc1-00001-gc5447a46efed #51 PREEMPT(full)
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-
>> debian-1.17.0-1 04/01/2014
>> RIP: 0010:split_huge_pmd_locked+0x11a0/0x2f80
>> RSP: 0018:ffff888053cc7338 EFLAGS: 00010282
>> RAX: 0000000000000126 RBX: ffff888109f988d0 RCX: 0000000000000000
>> RDX: 0000000000000126 RSI: 0000000000000000 RDI: ffffed100a798e43
>> RBP: 0000555580cc0000 R08: ffffffffa3e62775 R09: 0000000000000001
>> R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000080
>> R13: 0000000000000000 R14: 0000555580c00000 R15: ffff888109f988c0
>> FS: 0000000000000000(0000) GS:ffff88816f701000(0000)
>> knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00007fe2ac1907a0 CR3: 0000000021c91000 CR4: 0000000000750ef0
>> PKRU: 80000000
>> Call Trace:
>> <TASK>
>> __split_huge_pmd+0x201/0x350
>> unmap_page_range+0xa6a/0x3db0
>> unmap_single_vma+0x14b/0x230
>> unmap_vmas+0x28f/0x580
>> exit_mmap+0x203/0xa80
>> __mmput+0x11b/0x540
>> mmput+0x81/0xa0
>> do_exit+0x7b9/0x2c60
>> do_group_exit+0xd5/0x2a0
>> get_signal+0x1fdc/0x2340
>> arch_do_signal_or_restart+0x93/0x790
>> exit_to_user_mode_loop+0x84/0x480
>> do_syscall_64+0x4df/0x700
>> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>> </TASK>
>> Kernel panic - not syncing: Fatal exception
>>
>> The assertion VM_BUG_ON_VMA(vma->vm_start > haddr, vma) fires at
>> mm/huge_memory.c:2999 because a huge PMD exists at PMD-aligned address
>> 0x555580c00000 but the VMA only covers [0x555580cc0000, 0x555580ce2000):
>> a 136KB region starting 816KB past the PMD base.
>
>Do you have a reproducer and would this trigger before v7.0-rc1?
No reproducer. I saw it exactly once yesterday, syzkaller wasn't able to come
up with a reproducer and pointing the LLM at that task hasn't produced anything
useful either :(
--
Thanks,
Sasha
next prev parent reply other threads:[~2026-02-25 18:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-25 13:43 Sasha Levin
2026-02-25 13:50 ` David Hildenbrand (Arm)
2026-02-25 18:12 ` Sasha Levin [this message]
2026-02-25 20:30 ` David Hildenbrand (Arm)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aZ87jIN0mWfBbcEv@laps \
--to=sashal@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=david@kernel.org \
--cc=gavinguo@igalia.com \
--cc=hughd@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox