Re: [PATCH v2] mm: fix vma_start_write_killable() signal handling

[Matthew Wilcox <willy@infradead.org>]

On Wed, Nov 26, 2025 at 07:53:13PM +0100, Vlastimil Babka wrote:
> On 11/26/25 7:43 PM, Suren Baghdasaryan wrote:
> > On Wed, Nov 26, 2025 at 6:28 PM Matthew Wilcox <willy@infradead.org> wrote:
> >>
> >> On Wed, Nov 26, 2025 at 06:06:53PM +0000, Lorenzo Stoakes wrote:
> >>> On Wed, Nov 26, 2025 at 05:44:58PM +0000, Matthew Wilcox (Oracle) wrote:
> >>>> If we get a signal, we need to restore the vm_refcnt.  We don't think
> >>>> that the refcount can actually be decremented to zero here as it
> >>>> requires the VMA to be detached, and the vma_mark_detached() uses
> >>>> TASK_UNINTERRUPTIBLE.  However, that's a bit subtle, so handle it
> >>>> as if the refcount was zero at the start of this function.
> >>>>
> >>>> Reported-by: syzbot+5b19bad23ac7f44bf8b8@syzkaller.appspotmail.com
> 
> Closes: https://lore.kernel.org/all/69252076.a70a0220.d98e3.009b.GAE@google.com/
> 
> Unfortunately the reported-by code doesn't work as message id

Hm, that seems like a bug in syzbot.  The mail it sends doesn't use
the word "Closes:" anywhere; it just asks for Reported-by: and Fixes:
If that's not enough, then it should also ask for Closes.

> >>> Really think we should WARN_ON_ONCE() as Vlasta suggested.
> 
> Thanks Lorenzo!
> 
> Can we at least add a "WARN_ON_ONCE(!detaching);" before "err = 0;".

That makes sense; it mirrors the similar calls in the callers of
__vma_exit_locked().