Re: [syzbot] [mm?] [ext4?] WARNING in __folio_set_anon

[David Hildenbrand (Arm)]

On 9/24/26 08:54, Lance Yang wrote:
> 
> On Wed, Sep 23, 2026 at 10:00:37PM -0700, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    38872197cae2 Merge branch 'for-next/fixes' into for-kernelci
>> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
>> console output: https://syzkaller.appspot.com/x/log.txt?x=17a44d25580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
>> dashboard link: https://syzkaller.appspot.com/bug?extid=c181d3198e98f8aef8b9
>> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
>> userspace arch: arm64
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16a36515580000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16dcf4c9580000
> 
> Looking at the repro, emm ... the repro maps an O_RDONLY /dev/zero fd with

Does this trigger upstream or only after Lorenzo's rework (not upstream yet IIRC)

46827ac1ab221 mm/vma: make MAP_PRIVATE-mapped /dev/zero mappings truly anonymous
db7438ea23180 mm/vma: only permit MAP_PRIVATE /dev/zero to be mapped anonymous
54e8e096ea86b mm: implement file_is_dev_zero() to uniquely identify /dev/zero
fb24843cfd9eb mm: move drivers/char/mem.c to mm/char-mem.c

I assume it triggers upstream. Does it also trigger with lorenzo's changes?

> MAP_SHARED | PROT_READ. do_mmap() clears VM_SHARED and VM_MAYWRITE, so

Clearing VM_MAYWRITE for a private mapping is odd. Can you point me at the code
that clears both things?

I assume we still have the file pointer, and as the file is read-only we remove
VM_MAYWRITE. But why are we removing MAP_SHARED? (where?)

> mmap_zero_prepare() marks the VMA anonymous. MADV_COLLAPSE then allocates
> a new folio and adds an anon rmap, hitting the warning in
> linear_anon_page_index().
> 
> Can an anonymous VMA without VM_MAYWRITE legitimately have an anon rmap?

It's not a COW mapping (by definition) so we don't expect anonymous folios in there.

-- 
Cheers,

David