Re: [syzbot] [mm?] kernel BUG in page_table_check_set

[Pasha Tatashin]

On Sat, Aug 23, 2025 at 1:16 AM Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> On Thu, 21 Aug 2025 21:16:32 -0700 syzbot <syzbot+49a796ed2c9709652f1e@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    8f5ae30d69d7 Linux 6.17-rc1
> > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> > console output: https://syzkaller.appspot.com/x/log.txt?x=15f926f0580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=8c5ac3d8b8abfcb
> > dashboard link: https://syzkaller.appspot.com/bug?extid=49a796ed2c9709652f1e
> > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > userspace arch: arm64
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15faa7a2580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=144143bc580000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/18a2e4bd0c4a/disk-8f5ae30d.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/3b5395881b25/vmlinux-8f5ae30d.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/e875f4e3b7ff/Image-8f5ae30d.gz.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+49a796ed2c9709652f1e@xxxxxxxxxxxxxxxxxxxxxxxxx
> >
> > ------------[ cut here ]------------
> > kernel BUG at mm/page_table_check.c:118!
>
> Thanks.
>
> Presumably due to the series "Support page table check on PowerPC".
> Andrew, could you please take a look?
>
> The series has been in mm.git for a week so I guess the impact of this
> is small.  I won't drop it at this time, but prompt attention would be
> appreciated.

page_table_check_set()
     BUG_ON(atomic_inc_return(&ptc->anon_map_count) > 1 && rw);

This code triggers a BUG_ON if we attempt to set a new PTE in a user
page table with RW permission for an anonymous page that is already
mapped elsewhere. Anonymous pages can only be shared with RO
permissions for COW; otherwise, it can't be shared.

Pasha