Re: PROBLEM: Probabilistic segfault on AMD hardware with INVLPGB

[Henrik Böving]

On Tue, Jul 7, 2026 at 2:18 PM Matt Fleming <matt@xxxxxxxxxxxxxxxx> wrote:
>
> Hi Rik and Henrik,
>
> I've got a small C reproducer that triggers this within the first round
> on Cloudflare's AMD Turin machines:
>
>   https://gist.github.com/mfleming/ca26ad3f8d65a12d23d62fb176480fc1
>
> Build:
>
>   gcc -O2 -Wall -Wextra -pthread -static -o repro-invlpgb repro-invlpgb.c
>
> Run:
>
>   ./repro-invlpgb --batch --rounds 20 --jobs 32 -d 5 -w 8 -m 2 -s 512 -q
>
> The mutator side holds a pthread rwlock write lock while doing
> munmap() + mmap(MAP_FIXED) on the same VA and filling the range with
> {cookie, slot, generation, offset} markers. Reader threads hold the read
> lock while checking those markers.
>
> The failure mode is usually a CORRUPTION line rather than a direct
> SIGSEGV: a read from one virtual offset returns a valid marker for a
> different offset. That looks consistent with a stale or wrong translation
> after VA reuse.
>
> Thanks,
> Matt

Hi Rik and Matt,

Thanks for the reproducer, Matt! We are able to reliably reproduce the
corruption on 6.15 and can confirm that it does not seem to occur
before 6.15 and also not on 6.15 with INVLPGB disabled.

Sorry for taking a bit longer to respond, we were looking for older AMD
hardware to reproduce the bug. But it seems this is no longer necessary
thanks to Matt.

Best regards
Henrik