Re: [syzbot] [mm?] WARNING in follow_page_pte

[David Hildenbrand <david@redhat.com>]

On 06.08.25 09:32, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    7e161a991ea7 Merge tag 'i2c-for-6.17-rc1-part2' of git://g..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16d385bc580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=75e522434dc68cb9
> dashboard link: https://syzkaller.appspot.com/bug?extid=57bcc752f0df8bb1365c
> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13fa96a2580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1083c434580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/85ce789ac77a/disk-7e161a99.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/4d1fd8fed61a/vmlinux-7e161a99.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/9bd5f709ed6f/bzImage-7e161a99.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+57bcc752f0df8bb1365c@syzkaller.appspotmail.com
> 
>   do_initcall_level+0x104/0x190 init/main.c:1331
>   do_initcalls+0x59/0xa0 init/main.c:1347
>   kernel_init_freeable+0x334/0x4b0 init/main.c:1579
>   kernel_init+0x1d/0x1d0 init/main.c:1469
>   ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 5866 at mm/gup.c:869 follow_page_pte+0xe3c/0x13e0 mm/gup.c:868

That's the

	VM_WARN_ON_ONCE_PAGE((flags & FOLL_PIN) && PageAnon(page) &&
			     !PageAnonExclusive(page), page);

[   89.134725][ T5866] page: refcount:507 mapcount:1 mapping:0000000000000000 index:0x200000009 pfn:0x70809
[   89.144633][ T5866] head: order:9 mapcount:505 entire_mapcount:0 nr_pages_mapped:505 pincount:2
[   89.153655][ T5866] memcg:ffff88801b6f8000
[   89.157938][ T5866] anon flags: 0xfff6000002007c(referenced|uptodate|dirty|lru|head|swapbacked|node=0|zone=1|lastcpupid=0x7ff)
[   89.170337][ T5866] raw: 00fff00000000000 ffffea0001c20001 dead000000000122 dead000000000400
[   89.179013][ T5866] raw: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[   89.188218][ T5866] head: 00fff6000002007c ffffea0001c52088 ffffea0001cc9988 ffff88807c250551
[   89.196996][ T5866] head: 0000000200000000 0000000000000000 000001fbffffffff ffff88801b6f8000
[   89.205866][ T5866] head: 00fff00000010a09 ffffea0001c20001 000001f9000001f8 00000002ffffffff
[   89.214719][ T5866] head: ffffffff000001f8 0000000000000015 0000000000000000 0000000000000200

So it's a pte-mapped THP, whereby the folio is pinned two times.

The warning indicates that we likely have !exclusive anon page that is mapped writable
into the page table.

xdp_umem_pin_pages calls pin_user_pages(FOLL_WRITE | FOLL_LONGTERM).

Let me dig, the reproducer seems to involve fork, io_uring, mprotect and setsockopt.

-- 
Cheers,

David / dhildenb