Re: [syzbot] [mm?] [ext4?] WARNING in __folio_set_anon

["David Hildenbrand (Arm)" <david@kernel.org>]

On 9/24/26 09:43, David Hildenbrand (Arm) wrote:
> On 9/24/26 08:54, Lance Yang wrote:
>>
>> On Wed, Sep 23, 2026 at 10:00:37PM -0700, syzbot wrote:
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit:    38872197cae2 Merge branch 'for-next/fixes' into for-kernelci
>>> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=17a44d25580000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=c181d3198e98f8aef8b9
>>> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
>>> userspace arch: arm64
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16a36515580000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16dcf4c9580000
>>
>> Looking at the repro, emm ... the repro maps an O_RDONLY /dev/zero fd with
> 
> Does this trigger upstream or only after Lorenzo's rework (not upstream yet IIRC)
> 
> 46827ac1ab221 mm/vma: make MAP_PRIVATE-mapped /dev/zero mappings truly anonymous
> db7438ea23180 mm/vma: only permit MAP_PRIVATE /dev/zero to be mapped anonymous
> 54e8e096ea86b mm: implement file_is_dev_zero() to uniquely identify /dev/zero
> fb24843cfd9eb mm: move drivers/char/mem.c to mm/char-mem.c
> 
> I assume it triggers upstream. Does it also trigger with lorenzo's changes?
> 
>> MAP_SHARED | PROT_READ. do_mmap() clears VM_SHARED and VM_MAYWRITE, so
> 
> Clearing VM_MAYWRITE for a private mapping is odd. Can you point me at the code
> that clears both things?
> 
> I assume we still have the file pointer, and as the file is read-only we remove
> VM_MAYWRITE. But why are we removing MAP_SHARED? (where?)

Looking at the code, it's the

	if (!(file->f_mode & FMODE_WRITE))
		vma_flags_clear(&vma_flags, VMA_MAYWRITE_BIT, VMA_SHARED_BIT);

So we end up with VMA_MAYSHARE_BIT but without VMA_MAYWRITE_BIT and without
VMA_SHARED_BIT.

So it's by definition not a COW mapping. But it's marked anonymous and confuses
the system :)

-- 
Cheers,

David