Re: [syzbot] [mm?] WARNING in folio_remove_rmap_ptes

[David Hildenbrand (Red Hat)]

On 12/23/25 06:23, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    9094662f6707 Merge tag 'ata-6.19-rc2' of git://git.kernel...
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1411f77c580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
> dashboard link: https://syzkaller.appspot.com/bug?extid=b165fc2e11771c66d8ba
> compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11998b1a580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=128cdb1a580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-9094662f.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/5bec9d32a91c/vmlinux-9094662f.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/3df82e1a3cec/bzImage-9094662f.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b165fc2e11771c66d8ba@xxxxxxxxxxxxxxxxxxxxxxxxx
>
>   handle_mm_fault+0x3fe/0xad0 mm/memory.c:6580
>   do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
>   handle_page_fault arch/x86/mm/fault.c:1476 [inline]
>   exc_page_fault+0x64/0xc0 arch/x86/mm/fault.c:1532
>   asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
> ------------[ cut here ]------------
> WARNING: ./include/linux/rmap.h:462 at __folio_rmap_sanity_checks include/linux/rmap.h:462 [inline], CPU#1: syz.0.18/6090

IIUC, that's the

if (folio_test_anon(folio) && !folio_test_ksm(folio)) {
	...
	VM_WARN_ON_FOLIO(atomic_read(&anon_vma->refcount) == 0, folio);
}

Seems to indicate that the anon_vma is no longer alive :/

Fortunately we have a reproducer.

CCing Jann who addded that check "recently".

--
Cheers

David