Re: [BUG] WARNING in unlink_anon_vmas()

[Lorenzo Stoakes (Oracle)]

On Wed, Mar 18, 2026 at 11:57:24AM +0100, David Hildenbrand (Arm) wrote:
> On 3/18/26 11:42, Jiakai Xu wrote:
> > Hi all,
>
> Hi,
>
> >
> > While fuzzing the KVM subsystem on RISC-V, I stumbled upon a kernel WARNING
> > that triggers in unlink_anon_vmas().
> >
>
> Looking at the log, this is against 7.0.0-rc2-00014-gc61ec3e8cc5d
>
> >  WARNING: mm/rmap.c:528 at unlink_anon_vmas+0x562/0x768 mm/rmap.c:528
> >  unlink_anon_vmas+0x562/0x768 mm/rmap.c:528
> >  free_pgtables+0x2a0/0x860 mm/memory.c:427
> >  exit_mmap+0x406/0xd14 mm/mmap.c:1314
> >  __mmput+0x114/0x3d4 kernel/fork.c:1174
> >  mmput+0x74/0x88 kernel/fork.c:1197
> >  exit_mm kernel/exit.c:581 [inline]
> >  do_exit+0x7de/0x2adc kernel/exit.c:959
> >  do_group_exit+0xd4/0x26c kernel/exit.c:1112
> >  __do_sys_exit_group kernel/exit.c:1123 [inline]
> >  __se_sys_exit_group kernel/exit.c:1121 [inline]
> >  __riscv_sys_exit_group+0x4a/0x54 kernel/exit.c:1121
> >  syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112
> >  do_trap_ecall_u+0x39e/0x62e arch/riscv/kernel/traps.c:344
> >  handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232
> >
> > I am not an expert in this area and have not done a deep manual analysis.
> >
> > The full crash log, a reproducer, the kernel .config, and the relevant
> > source/commit info are available in my GitHub repository:
> >     https://github.com/j1akai/temp/tree/main/20260318
> >
> > If this turns out to be a real bug and there is anything I can do to help
> > with fixing or testing, I am happy to do so. I hope this report is useful
> > and sorry for any noise if it has already been addressed.
>
>
> We trigger a VM_WARN_ON, so that's certainly something to resolve.
>
> Seems to be:
>
> 	VM_WARN_ON(anon_vma->num_active_vmas);
>
> Which was added by
>
> commit 2555283eb40df89945557273121e9393ef9b542b
> Author: Jann Horn <jannh@xxxxxxxxxx>
> Date:   Wed Aug 31 19:06:00 2022 +0200
>
>     mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
>
>     anon_vma->degree tracks the combined number of child anon_vmas and VMAs
>     that use the anon_vma as their ->anon_vma.

I suspect my recent series + some error path is a cause here, investigating! :)

>
>
>
> --
> Cheers,
>
> David

Cheers, Lorenzo