Re: [syzbot] [cgroups?] [mm?] KASAN: wild-memory-access Read in lookup_swap_cgroup_id (2)

[Kairui Song]

On Sat, Feb 7, 2026 at 1:30 AM Shakeel Butt <shakeel.butt@xxxxxxxxx> wrote:
>
> +Kairui

Thanks for Cc. I just noticed it while cleaning my mailbox.

> On Fri, Feb 06, 2026 at 08:31:19AM +0100, Dmitry Vyukov wrote:
> > On Fri, 6 Feb 2026 at 08:24, syzbot
> > <syzbot+e12bd9ca48157add237a@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit:    18f7fcd5e69a Linux 6.19-rc8
> > > git tree:       upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1428fc5a580000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=f1fac0919970b671
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=e12bd9ca48157add237a
> > > compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> > >
> > > Unfortunately, I don't have any reproducer for this issue yet.
> > >
> > This happened before:
> > https://lore.kernel.org/all/67d04360.050a0220.1939a6.000e.GAE@xxxxxxxxxx/T/
> > and now 2 more times.
> > All reports look similar: exit_mm -> zap_p4d_range
> > And all access addresses look the same: top 13 bits are zeros, then
> > some garbage (0007fffffffffffc).
> > I am pretty sure it's telling us something, some kind of tricky race,
> > rather than a previous corruption. Swp entry is somehow invalid?
>
> Thanks for the report. It would be good to have a reproducer. I will dig
> deeper later but good to have eyes from Kairui who has recent changes
> in the area.

I've just checked the syzbot's console log for the two times it
catched the error:
https://syzkaller.appspot.com/text?tag=CrashLog&x=1428fc5a580000
https://syzkaller.appspot.com/text?tag=CrashLog&x=16c2c694580000

(from https://syzkaller.appspot.com/bug?extid=e12bd9ca48157add237a)

In the first log, before the panic, console is full with:
get_swap_device: Bad swap file entry 4003ffffffffffff

Which indicates there is at least one, maybe a lot of invalid swap
entries of the same value in the page table. Unfortunately that's all
it can tell, maybe something corrupted the page table?