syzbot


kernel BUG in hpage_collapse_scan_file

Status: upstream: reported C repro on 2025/07/29 18:54
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+d3672301e4208b8ac935@syzkaller.appspotmail.com
First crash: 22d, last: 18d
Bug presence (2)
Date Name Commit Repro Result
2025/08/02 linux-6.1.y (ToT) 3594f306da12 C [report] kernel BUG in hpage_collapse_scan_file
2025/08/02 upstream (ToT) a6923c06a3b2 C Didn't crash
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in hpage_collapse_scan_file mm -1 C unreliable 3 856d 894d 22/29 fixed on 2023/06/08 14:41

Sample crash report:
------------[ cut here ]------------
kernel BUG at mm/khugepaged.c:1785!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4471 Comm: syz.0.16 Not tainted 6.1.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : collapse_file mm/khugepaged.c:1785 [inline]
pc : hpage_collapse_scan_file+0x3200/0x422c mm/khugepaged.c:2248
lr : collapse_file mm/khugepaged.c:1785 [inline]
lr : hpage_collapse_scan_file+0x3200/0x422c mm/khugepaged.c:2248
sp : ffff800020ce74a0
x29: ffff800020ce7700 x28: ffff0000c4bb1ca8 x27: ffff800020ce75e0
x26: ffff800020ce7600 x25: dfff800000000000 x24: 00000000000343e2
x23: ffff800020ce7560 x22: ffff0000d13ace38 x21: ffff0000d0d0c200
x20: 0000000000000001 x19: 00000000000001e2 x18: ffff800011aabce0
x17: ffff8000181e7000 x16: ffff8000082d0ec4 x15: 0000000000000000
x14: 0000000000000003 x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff00800008917b80 x10: 0000000000000000 x9 : ffff800008917b80
x8 : ffff0000d2698000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000010
x2 : 0000000000000008 x1 : 00000000000001e2 x0 : 0000000000000000
Call trace:
 collapse_file mm/khugepaged.c:1785 [inline]
 hpage_collapse_scan_file+0x3200/0x422c mm/khugepaged.c:2248
 madvise_collapse+0x580/0xc10 mm/khugepaged.c:2703
 madvise_vma_behavior mm/madvise.c:1085 [inline]
 madvise_walk_vmas mm/madvise.c:1259 [inline]
 do_madvise+0x8f8/0x2920 mm/madvise.c:1438
 __do_sys_madvise mm/madvise.c:1451 [inline]
 __se_sys_madvise mm/madvise.c:1449 [inline]
 __arm64_sys_madvise+0xa4/0xc0 mm/madvise.c:1449
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1a03e0 97fa5974 d4210000 97ee27f3 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/29 19:42 linux-6.1.y 3594f306da12 c4a95487 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in hpage_collapse_scan_file
2025/07/29 19:19 linux-6.1.y 3594f306da12 c4a95487 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in hpage_collapse_scan_file
2025/08/03 02:09 linux-6.1.y 3594f306da12 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan kernel BUG in hpage_collapse_scan_file
2025/08/03 02:09 linux-6.1.y 3594f306da12 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan kernel BUG in hpage_collapse_scan_file
2025/07/29 18:55 linux-6.1.y 3594f306da12 c4a95487 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in hpage_collapse_scan_file
2025/07/29 18:53 linux-6.1.y 3594f306da12 c4a95487 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in hpage_collapse_scan_file
* Struck through repros no longer work on HEAD.