Re: [BUG next-20260105] khugepaged: kernel BUG at ./include/linux/xarray.h:1441

[Shivank Garg <shivagar@amd.com>]

On 1/6/2026 12:52 AM, Matthew Wilcox wrote:
> On Mon, Jan 05, 2026 at 10:48:00AM -0800, Calvin Owens wrote:
>> [   16.042275][   T58] RIP: 0010:hpage_collapse_scan_file (./include/linux/xarray.h:1441 mm/khugepaged.c:2042 mm/khugepaged.c:2389)
> 
> Perfect.  2389 is the call to collapse_file(), then 2042 is
> xas_lock_irq().  And this is exactly the kind of thing we want to be
> catching; we drop the lock, then reuse the xa_state.  In the meantime,
> the xa_node might have been replaced, and the xa_state now has a pointer
> to a dead node.  It *might* still be safe in this instance; I'll look
> at this carefully for a bit and decide how best to fix it.
> 
> 

Hi,

I'm able to reproduce this issue locally. 
I tested with xas_reset() before taking lock and this fixed the issue.

Thanks,
Shivank

diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 6c8c35d3e0c9..641523111830 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -2039,6 +2039,7 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr,
 			try_to_unmap(folio,
 					TTU_IGNORE_MLOCK | TTU_BATCH_FLUSH);
 
+		xas_reset(&xas);
 		xas_lock_irq(&xas);
 
 		VM_BUG_ON_FOLIO(folio != xa_load(xas.xa, index), folio);