Re: [syzbot] [mm?] WARNING in follow_page_pte

[David Hildenbrand <david@redhat.com>]

On 06.08.25 09:55, David Hildenbrand wrote:
> On 06.08.25 09:32, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    7e161a991ea7 Merge tag 'i2c-for-6.17-rc1-part2' of git://g..
>> git tree:       upstream
>> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16d385bc580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=75e522434dc68cb9
>> dashboard link: https://syzkaller.appspot.com/bug?extid=57bcc752f0df8bb1365c
>> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13fa96a2580000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1083c434580000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/85ce789ac77a/disk-7e161a99.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/4d1fd8fed61a/vmlinux-7e161a99.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/9bd5f709ed6f/bzImage-7e161a99.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+57bcc752f0df8bb1365c@syzkaller.appspotmail.com
>>
>>    do_initcall_level+0x104/0x190 init/main.c:1331
>>    do_initcalls+0x59/0xa0 init/main.c:1347
>>    kernel_init_freeable+0x334/0x4b0 init/main.c:1579
>>    kernel_init+0x1d/0x1d0 init/main.c:1469
>>    ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
>>    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>> ------------[ cut here ]------------
>> WARNING: CPU: 0 PID: 5866 at mm/gup.c:869 follow_page_pte+0xe3c/0x13e0 mm/gup.c:868
> 
> That's the
> 
> 	VM_WARN_ON_ONCE_PAGE((flags & FOLL_PIN) && PageAnon(page) &&
> 			     !PageAnonExclusive(page), page);
> 
> [   89.134725][ T5866] page: refcount:507 mapcount:1 mapping:0000000000000000 index:0x200000009 pfn:0x70809
> [   89.144633][ T5866] head: order:9 mapcount:505 entire_mapcount:0 nr_pages_mapped:505 pincount:2
> [   89.153655][ T5866] memcg:ffff88801b6f8000
> [   89.157938][ T5866] anon flags: 0xfff6000002007c(referenced|uptodate|dirty|lru|head|swapbacked|node=0|zone=1|lastcpupid=0x7ff)
> [   89.170337][ T5866] raw: 00fff00000000000 ffffea0001c20001 dead000000000122 dead000000000400
> [   89.179013][ T5866] raw: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
> [   89.188218][ T5866] head: 00fff6000002007c ffffea0001c52088 ffffea0001cc9988 ffff88807c250551
> [   89.196996][ T5866] head: 0000000200000000 0000000000000000 000001fbffffffff ffff88801b6f8000
> [   89.205866][ T5866] head: 00fff00000010a09 ffffea0001c20001 000001f9000001f8 00000002ffffffff
> [   89.214719][ T5866] head: ffffffff000001f8 0000000000000015 0000000000000000 0000000000000200
> 
> So it's a pte-mapped THP, whereby the folio is pinned two times.
> 
> The warning indicates that we likely have !exclusive anon page that is mapped writable
> into the page table.
> 
> xdp_umem_pin_pages calls pin_user_pages(FOLL_WRITE | FOLL_LONGTERM).
> 
> Let me dig, the reproducer seems to involve fork, io_uring, mprotect and setsockopt.

Just tried on 6.16 and wasn't able to quickly reproduce.

I suspect that this is due to

commit cac1db8c3aad97d6ffb56ced8868d6cbbbd2bfbe
Author: Dev Jain <dev.jain@arm.com>
Date:   Fri Jul 18 14:32:43 2025 +0530

     mm: optimize mprotect() by PTE batching

whereby the

   syscall(__NR_mprotect, /*addr=*/0x200000000000ul, /*len=*/0x800000ul,
           /*prot=PROT_WRITE|PROT_EXEC*/ 6ul);

End sup upgrading write permissions and we somehow end up ignoring the 
missing PAE bit.

-- 
Cheers,

David / dhildenb