Re: VM_BUG_ON_VMA in split_huge_pmd_locked: huge PMD doesn't cover full VMA range

[Lorenzo Stoakes]

On Wed, Feb 25, 2026 at 02:50:16PM +0100, David Hildenbrand (Arm) wrote:
> On 2/25/26 14:43, Sasha Levin wrote:
> > Hi,
> >
> > I've been playing around with improvements to syzkaller locally, and hit
> > the
> > following crash on v7.0-rc1:
> >
> >   vma ffff888109f988c0 start 0000555580cc0000 end 0000555580ce2000 mm
> > ffff8881048e1780
> >   prot 8000000000000025 anon_vma ffff88810b20f100 vm_ops 0000000000000000
> >   pgoff 555580cc0 file 0000000000000000 private_data 0000000000000000
> >   refcnt 1
> >   flags: 0x100073(read|write|mayread|maywrite|mayexec|account)
> >   ------------[ cut here ]------------
> >   kernel BUG at mm/huge_memory.c:2999!
> >   Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
> >   CPU: 3 UID: 0 PID: 15162 Comm: syz.7.3120 Tainted: G
> > N  7.0.0-rc1-00001-gc5447a46efed #51 PREEMPT(full)
> >   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-
> > debian-1.17.0-1 04/01/2014
> >   RIP: 0010:split_huge_pmd_locked+0x11a0/0x2f80
> >   RSP: 0018:ffff888053cc7338 EFLAGS: 00010282
> >   RAX: 0000000000000126 RBX: ffff888109f988d0 RCX: 0000000000000000
> >   RDX: 0000000000000126 RSI: 0000000000000000 RDI: ffffed100a798e43
> >   RBP: 0000555580cc0000 R08: ffffffffa3e62775 R09: 0000000000000001
> >   R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000080
> >   R13: 0000000000000000 R14: 0000555580c00000 R15: ffff888109f988c0
> >   FS:  0000000000000000(0000) GS:ffff88816f701000(0000)
> > knlGS:0000000000000000
> >   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >   CR2: 00007fe2ac1907a0 CR3: 0000000021c91000 CR4: 0000000000750ef0
> >   PKRU: 80000000
> >   Call Trace:
> >    <TASK>
> >    __split_huge_pmd+0x201/0x350
> >    unmap_page_range+0xa6a/0x3db0
> >    unmap_single_vma+0x14b/0x230
> >    unmap_vmas+0x28f/0x580
> >    exit_mmap+0x203/0xa80
> >    __mmput+0x11b/0x540
> >    mmput+0x81/0xa0
> >    do_exit+0x7b9/0x2c60
> >    do_group_exit+0xd5/0x2a0
> >    get_signal+0x1fdc/0x2340
> >    arch_do_signal_or_restart+0x93/0x790
> >    exit_to_user_mode_loop+0x84/0x480
> >    do_syscall_64+0x4df/0x700
> >    entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >    </TASK>
> >   Kernel panic - not syncing: Fatal exception
> >
> > The assertion VM_BUG_ON_VMA(vma->vm_start > haddr, vma) fires at
> > mm/huge_memory.c:2999 because a huge PMD exists at PMD-aligned address
> > 0x555580c00000 but the VMA only covers [0x555580cc0000, 0x555580ce2000):
> > a 136KB region starting 816KB past the PMD base.
>
> Do you have a reproducer and would this trigger before v7.0-rc1?
>
> Lorenzo did some changes around anon_vma locking recently, maybe related
> to that.

A quick glance doesn't suggest any changes I made should have had an impact
here.

_Should have_ :)

I think without a reproducer this is going to be hard to pinpoint. Hopefully
syzbot proper should figure one out eventually?

>
> --
> Cheers,
>
> David

Thanks, Lorenzo