Re: [syzbot] [mm?] WARNING in folio_remove_rmap_ptes

[Hillf Danton <hdanton@sina.com>]

On Tue, 23 Dec 2025 09:24:05 +0100 "David Hildenbrand (Red Hat)" wrote:
> On 12/23/25 06:23, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    9094662f6707 Merge tag 'ata-6.19-rc2' of git://git.kernel...
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1411f77c580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
> > dashboard link: https://syzkaller.appspot.com/bug?extid=b165fc2e11771c66d8ba
> > compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11998b1a580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=128cdb1a580000
> > 
> > Downloadable assets:
> > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-9094662f.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/5bec9d32a91c/vmlinux-9094662f.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/3df82e1a3cec/bzImage-9094662f.xz
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+b165fc2e11771c66d8ba@syzkaller.appspotmail.com
> > 
> >   handle_mm_fault+0x3fe/0xad0 mm/memory.c:6580
> >   do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
> >   handle_page_fault arch/x86/mm/fault.c:1476 [inline]
> >   exc_page_fault+0x64/0xc0 arch/x86/mm/fault.c:1532
> >   asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
> > ------------[ cut here ]------------
> > WARNING: ./include/linux/rmap.h:462 at __folio_rmap_sanity_checks include/linux/rmap.h:462 [inline], CPU#1: syz.0.18/6090
> 
> IIUC, that's the
> 
> if (folio_test_anon(folio) && !folio_test_ksm(folio)) {
> 	...
> 	VM_WARN_ON_FOLIO(atomic_read(&anon_vma->refcount) == 0, folio);
> }
> 
> Seems to indicate that the anon_vma is no longer alive :/
> 
> Fortunately we have a reproducer.
> 
> CCing Jann who addded that check "recently".
>
That check looks incorrect given the atomic_inc_not_zero in folio_get_anon_vma().