general protection fault in follow_pfnmap

Based on kernel commit 075dbe9f6e3c:

Root Cause Analysis

The reported kernel crash is a general protection fault triggered by a NULL pointer dereference within the lockdep assertion helper pfnmap_lockdep_assert() in mm/memory.c.

1. Functions, Structs, and Fields Involved

File: mm/memory.c
Function: pfnmap_lockdep_assert() (invoked at the beginning of follow_pfnmap_start())
Structs & Fields:
- struct vm_area_struct: vma->vm_file
- struct file: vma->vm_file->f_mapping (offset 0x58)

2. Trigger Mechanism and Lifecycle Invariant Violation

VMA Setup and Mapping Creation: During an mmap() syscall on a character device (in this reproducer, /dev/bus/usb/...), mmap_region() (mm/mmap.c) invokes call_mmap(file, vma). The driver's ->mmap handler (such as usbdev_mmap() in drivers/usb/core/devio.c) sets up page table entries using remap_pfn_range(), marking the VMA with VM_PFNMAP and tracking PAT cache attributes (VM_PAT).
Error Recovery Path in mmap_region(): After call_mmap() returns successfully, mmap_region() validates additional constraints. Because user space enabled PR_SET_MDWE (Memory Denial of Write Execute) via prctl and mapped the memory with PROT_READ | PROT_WRITE | PROT_EXEC, map_deny_write_exec(vma, vma->vm_flags) returns true. Execution jumps to close_and_free_vma / unmap_and_free_vma in mm/mmap.c:
```
unmap_and_free_vma:
    fput(vma->vm_file);
    vma->vm_file = NULL;

    vma_iter_set(&vmi, vma->vm_end);
    /* Undo any partial mapping done by a device driver. */
    unmap_region(&vmi.mas, vma, vmg.prev, vmg.next);
```
Crucially, vma->vm_file is set to NULL before calling unmap_region(). This is an established error cleanup convention in mm/mmap.c (also explicitly documented for hugetlb in unmap_single_vma()).
PAT Untracking and Follow PFN: unmap_region() calls unmap_vmas() -> unmap_single_vma(). Since VM_PFNMAP is set on the VMA, unmap_single_vma() calls untrack_pfn(vma, 0, 0, mm_wr_locked). In arch/x86/mm/pat/memtype.c:
- untrack_pfn() calls get_pat_info(vma, &paddr, NULL).
- get_pat_info() calls follow_phys(vma, &prot, paddr).
- follow_phys() calls follow_pfnmap_start(&args) with args.vma = vma.

The NULL Pointer Dereference: follow_pfnmap_start() immediately executes:

static inline void pfnmap_lockdep_assert(struct vm_area_struct *vma)
{
#ifdef CONFIG_LOCKDEP
    struct address_space *mapping = vma->vm_file->f_mapping;

    if (mapping)
        lockdep_assert(lockdep_is_held(&vma->vm_file->f_mapping->i_mmap_rwsem) ||
                       lockdep_is_held(&vma->vm_mm->mmap_lock));
    else
        lockdep_assert(lockdep_is_held(&vma->vm_mm->mmap_lock));
#endif
}

pfnmap_lockdep_assert() attempts to read vma->vm_file->f_mapping without checking whether vma->vm_file is NULL. With vma->vm_file == NULL, it evaluates offset 0x58 (f_mapping) from address 0x0000000000000000, causing KASAN to detect an access to shadow address 0xdffffc000000000b and crashing with a general protection fault.

The function intended to handle VMAs without a file mapping (as evidenced by the if (mapping) ... else ... fallback asserting lockdep_is_held(&vma->vm_mm->mmap_lock)), but failed to perform a NULL check on vma->vm_file before fetching f_mapping (i.e., vma->vm_file ? vma->vm_file->f_mapping : NULL).

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
1b429b8c	assessment-security	DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	general protection fault in follow_pfnmap_start	2026/11/05 19:23	2026/11/05 19:23	2026/11/05 20:31	5cecaf1f
d2e7009d	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/10/05 18:03	2026/10/05 18:03	2026/10/05 18:27	1995e6c7
ce4bd529	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/09/04 13:09	2026/09/04 13:09	2026/09/04 13:22	801f0966
b32841f7	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/08/05 00:08	2026/08/05 00:08	2026/08/05 00:08	d4abbeac
26b80b23	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/07/05 10:12	2026/07/05 10:12	2026/07/05 10:28	93f57954
aae490a0	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/06/18 09:54	2026/06/18 09:54	2026/06/18 10:13	b62b3ded
f8e4480f	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/06/09 17:20	2026/06/09 17:20	2026/06/09 17:43	c36c07f6
edea896f	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/06/02 14:12	2026/06/02 14:12	2026/06/02 14:39	62fe1528
101230ec	assessment-security		💥	general protection fault in follow_pfnmap_start	2026/05/25 03:08	2026/05/25 03:08	2026/05/25 03:36	c69befb3

assessment-security

DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

general protection fault in follow_pfnmap_start

2026/11/05 19:23

2026/11/05 20:31

5cecaf1f

d2e7009d

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/10/05 18:03

2026/10/05 18:27

1995e6c7

ce4bd529

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/09/04 13:09

2026/09/04 13:22

801f0966

b32841f7

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/08/05 00:08

d4abbeac

26b80b23

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/07/05 10:12

2026/07/05 10:28

93f57954

aae490a0

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/06/18 09:54

2026/06/18 10:13

b62b3ded

f8e4480f

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/06/09 17:20

2026/06/09 17:43

c36c07f6

edea896f

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/06/02 14:12

2026/06/02 14:39

62fe1528

101230ec

assessment-security

💥

general protection fault in follow_pfnmap_start

2026/05/25 03:08

2026/05/25 03:36

c69befb3

Title	Replies (including bot)	Last reply
[PATCH v3] Fixes: null pointer dereference in pfnmap_lockdep_assert	6 (6)	2024/10/08 19:27
[PATCH v4] Fixes: null pointer dereference in pfnmap_lockdep_assert	2 (2)	2024/10/07 13:25
[PATCH v2] Fixes: null pointer dereference in pfnmap_lockdep_assert	3 (3)	2024/10/04 13:27
[PATCH] Fixes: null pointer dereference in pfnmap_lockdep_assert	6 (6)	2024/10/04 12:29
[syzbot] [kernel?] general protection fault in follow_pfnmap_start	0 (1)	2024/10/01 09:37

Title

Replies (including bot)

Last reply

[PATCH v3] Fixes: null pointer dereference in pfnmap_lockdep_assert

6 (6)

2024/10/08 19:27

[PATCH v4] Fixes: null pointer dereference in pfnmap_lockdep_assert

2 (2)

2024/10/07 13:25

[PATCH v2] Fixes: null pointer dereference in pfnmap_lockdep_assert

3 (3)

2024/10/04 13:27

[PATCH] Fixes: null pointer dereference in pfnmap_lockdep_assert

6 (6)

2024/10/04 12:29

[syzbot] [kernel?] general protection fault in follow_pfnmap_start

0 (1)

2024/10/01 09:37

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] CPU: 0 UID: 0 PID: 5102 Comm: syz-executor119 Not tainted 6.11.0-syzkaller-11558-g075dbe9f6e3c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:pfnmap_lockdep_assert mm/memory.c:6349 [inline] RIP: 0010:follow_pfnmap_start+0x1a7/0xfd0 mm/memory.c:6402 Code: 8d 9f 80 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 57 0c 1a 00 48 8b 1b 48 83 c3 58 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 3a 0c 1a 00 4c 8b 23 48 c7 c0 7c RSP: 0018:ffffc9000179f100 EFLAGS: 00010202 RAX: 000000000000000b RBX: 0000000000000058 RCX: ffff88801aa0c880 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000179f1e0 RBP: ffffc9000179f290 R08: ffffc9000179f311 R09: 0000000000000000 R10: ffffc9000179f2f0 R11: fffff520002f3e63 R12: dffffc0000000000 R13: 1ffff110023c0202 R14: ffffc9000179f2e0 R15: ffff888011e01000 FS: 0000555593c58380(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ad1af10f0 CR3: 000000001270e000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> follow_phys arch/x86/mm/pat/memtype.c:956 [inline] get_pat_info+0x182/0x3f0 arch/x86/mm/pat/memtype.c:988 untrack_pfn+0x327/0x640 arch/x86/mm/pat/memtype.c:1101 unmap_single_vma+0x1f6/0x2b0 mm/memory.c:1834 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1900 unmap_region+0x214/0x380 mm/vma.c:354 mmap_region+0x22f9/0x2990 mm/mmap.c:1573 do_mmap+0x8f0/0x1000 mm/mmap.c:496 vm_mmap_pgoff+0x1dd/0x3d0 mm/util.c:588 ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:542 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9ad1a7a879 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd49b2ee58 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9ad1a7a879 RDX: 0000000000000007 RSI: 0000000000005000 RDI: 0000000020371000 RBP: 00007f9ad1aed5f0 R08: 0000000000000003 R09: 0000000000000000 R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001 R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:pfnmap_lockdep_assert mm/memory.c:6349 [inline] RIP: 0010:follow_pfnmap_start+0x1a7/0xfd0 mm/memory.c:6402 Code: 8d 9f 80 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 57 0c 1a 00 48 8b 1b 48 83 c3 58 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 3a 0c 1a 00 4c 8b 23 48 c7 c0 7c RSP: 0018:ffffc9000179f100 EFLAGS: 00010202 RAX: 000000000000000b RBX: 0000000000000058 RCX: ffff88801aa0c880 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000179f1e0 RBP: ffffc9000179f290 R08: ffffc9000179f311 R09: 0000000000000000 R10: ffffc9000179f2f0 R11: fffff520002f3e63 R12: dffffc0000000000 R13: 1ffff110023c0202 R14: ffffc9000179f2e0 R15: ffff888011e01000 FS: 0000555593c58380(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555593c58ca8 CR3: 000000001270e000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 8d 9f 80 00 00 00 lea 0x80(%rdi),%ebx 6: 48 89 d8 mov %rbx,%rax 9: 48 c1 e8 03 shr $0x3,%rax d: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) 12: 74 08 je 0x1c 14: 48 89 df mov %rbx,%rdi 17: e8 57 0c 1a 00 call 0x1a0c73 1c: 48 8b 1b mov (%rbx),%rbx 1f: 48 83 c3 58 add $0x58,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 3a 0c 1a 00 call 0x1a0c73 39: 4c 8b 23 mov (%rbx),%r12 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: c0 .byte 0xc0 3f: 7c .byte 0x7c

Crashes (38):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2024/09/27 10:31	upstream	075dbe9f6e3c	9314348a	.config	console log	report	syz / log	C		[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	general protection fault in follow_pfnmap_start
2024/09/27 09:59	upstream	075dbe9f6e3c	9314348a	.config	console log	report	syz / log	C		[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	general protection fault in follow_pfnmap_start
2024/10/15 17:58	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-root	general protection fault in follow_pfnmap_start
2024/10/15 17:58	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-root	general protection fault in follow_pfnmap_start
2024/10/15 16:11	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	general protection fault in follow_pfnmap_start
2024/10/15 16:11	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	general protection fault in follow_pfnmap_start
2024/10/15 15:59	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in follow_pfnmap_start
2024/10/15 12:41	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	general protection fault in follow_pfnmap_start
2024/10/15 12:41	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	general protection fault in follow_pfnmap_start
2024/10/15 12:41	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	general protection fault in follow_pfnmap_start
2024/10/09 06:26	upstream	5b7c893ed5ed	402f1df0	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in follow_pfnmap_start
2024/10/09 06:26	upstream	5b7c893ed5ed	402f1df0	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in follow_pfnmap_start
2024/10/03 09:00	upstream	f23aa4c0761a	a4c7fd36	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in follow_pfnmap_start
2024/10/03 09:00	upstream	f23aa4c0761a	a4c7fd36	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in follow_pfnmap_start
2024/10/03 02:58	upstream	f23aa4c0761a	a4c7fd36	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	general protection fault in follow_pfnmap_start
2024/10/03 02:58	upstream	f23aa4c0761a	a4c7fd36	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	general protection fault in follow_pfnmap_start
2024/10/02 11:39	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-badwrites-root	general protection fault in follow_pfnmap_start
2024/10/02 11:39	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-badwrites-root	general protection fault in follow_pfnmap_start
2024/10/02 03:32	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-root	general protection fault in follow_pfnmap_start
2024/10/02 03:32	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-root	general protection fault in follow_pfnmap_start
2024/10/02 02:17	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in follow_pfnmap_start
2024/10/02 02:17	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in follow_pfnmap_start
2024/10/01 20:57	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	general protection fault in follow_pfnmap_start
2024/10/01 20:57	upstream	e32cde8d2bd7	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	general protection fault in follow_pfnmap_start
2024/10/15 13:38	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-386	general protection fault in follow_pfnmap_start
2024/10/15 13:38	upstream	eca631b8fe80	14943bb8	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-386	general protection fault in follow_pfnmap_start
2024/10/03 04:22	upstream	f23aa4c0761a	a4c7fd36	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-386	general protection fault in follow_pfnmap_start
2024/09/27 09:26	upstream	075dbe9f6e3c	9314348a	.config	console log	report				[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	general protection fault in follow_pfnmap_start
2024/10/15 19:39	upstream	eca631b8fe80	eddfb4c9	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	general protection fault in follow_pfnmap_start
2024/10/10 16:32	upstream	d3d1556696c1	a156c552	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	general protection fault in follow_pfnmap_start
2024/10/09 20:42	upstream	75b607fab38d	56fb2cb7	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	general protection fault in follow_pfnmap_start
2024/10/03 10:36	upstream	f23aa4c0761a	a4c7fd36	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	general protection fault in follow_pfnmap_start
2024/10/03 10:36	upstream	f23aa4c0761a	a4c7fd36	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	general protection fault in follow_pfnmap_start
2024/09/28 08:15	upstream	e477dba5442c	440b26ec	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	general protection fault in follow_pfnmap_start
2024/10/03 19:54	linux-next	c02d24a5af66	d7906eff	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	general protection fault in follow_pfnmap_start
2024/10/03 19:54	linux-next	c02d24a5af66	d7906eff	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	general protection fault in follow_pfnmap_start
2024/10/01 22:21	linux-next	77df9e4bb222	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	general protection fault in follow_pfnmap_start
2024/10/01 22:21	linux-next	77df9e4bb222	ea2b66a6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	general protection fault in follow_pfnmap_start

Crashes (38):

Assets (help?)

2024/09/27 10:31

upstream