* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 17:52 [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma syzbot
@ 2025-07-08 22:19 ` Suren Baghdasaryan
2025-07-08 23:15 ` Liam R. Howlett
2025-07-09 10:26 ` Vlastimil Babka
2025-07-09 1:54 ` syzbot
` (5 subsequent siblings)
6 siblings, 2 replies; 18+ messages in thread
From: Suren Baghdasaryan @ 2025-07-08 22:19 UTC (permalink / raw)
To: syzbot
Cc: Liam.Howlett, akpm, linux-kernel, linux-mm, lorenzo.stoakes,
shakeel.butt, syzkaller-bugs, vbabka
On Tue, Jul 8, 2025 at 10:52 AM syzbot
<syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
>
> ================================================
> WARNING: lock held when returning to user space!
> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> ------------------------------------------------
> syz.0.22/6068 is leaving the kernel with locks still held!
> 1 lock held by syz.0.22/6068:
> #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
Hmm. I must be missing an unlock_vma() somewhere but I don't see it
yet. Will try the reproducer.
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 22:19 ` Suren Baghdasaryan
@ 2025-07-08 23:15 ` Liam R. Howlett
2025-07-08 23:51 ` Suren Baghdasaryan
2025-07-09 10:26 ` Vlastimil Babka
1 sibling, 1 reply; 18+ messages in thread
From: Liam R. Howlett @ 2025-07-08 23:15 UTC (permalink / raw)
To: Suren Baghdasaryan
Cc: syzbot, akpm, linux-kernel, linux-mm, lorenzo.stoakes,
shakeel.butt, syzkaller-bugs, vbabka
* Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> On Tue, Jul 8, 2025 at 10:52 AM syzbot
> <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> > git tree: linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> >
> > ================================================
> > WARNING: lock held when returning to user space!
> > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > ------------------------------------------------
> > syz.0.22/6068 is leaving the kernel with locks still held!
> > 1 lock held by syz.0.22/6068:
> > #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
>
> Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> yet. Will try the reproducer.
The last one was against v5 patches, is this v6?
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 23:15 ` Liam R. Howlett
@ 2025-07-08 23:51 ` Suren Baghdasaryan
2025-07-09 0:05 ` Suren Baghdasaryan
0 siblings, 1 reply; 18+ messages in thread
From: Suren Baghdasaryan @ 2025-07-08 23:51 UTC (permalink / raw)
To: Liam R. Howlett, Suren Baghdasaryan, syzbot, akpm, linux-kernel,
linux-mm, lorenzo.stoakes, shakeel.butt, syzkaller-bugs, vbabka
On Tue, Jul 8, 2025 at 4:15 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
>
> * Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> > > git tree: linux-next
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > > compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> > >
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> > >
> > > ================================================
> > > WARNING: lock held when returning to user space!
> > > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > > ------------------------------------------------
> > > syz.0.22/6068 is leaving the kernel with locks still held!
> > > 1 lock held by syz.0.22/6068:
> > > #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> >
> > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > yet. Will try the reproducer.
>
> The last one was against v5 patches, is this v6?
Oh, good point. Let me check that. Thanks!
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 23:51 ` Suren Baghdasaryan
@ 2025-07-09 0:05 ` Suren Baghdasaryan
0 siblings, 0 replies; 18+ messages in thread
From: Suren Baghdasaryan @ 2025-07-09 0:05 UTC (permalink / raw)
To: Liam R. Howlett, Suren Baghdasaryan, syzbot, akpm, linux-kernel,
linux-mm, lorenzo.stoakes, shakeel.butt, syzkaller-bugs, vbabka
On Tue, Jul 8, 2025 at 4:51 PM Suren Baghdasaryan <surenb@google.com> wrote:
>
> On Tue, Jul 8, 2025 at 4:15 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
> >
> > * Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> > > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> > > >
> > > > Hello,
> > > >
> > > > syzbot found the following issue on:
> > > >
> > > > HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> > > > git tree: linux-next
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > > > kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > > > compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> > > >
> > > > Downloadable assets:
> > > > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > > > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > > > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> > > >
> > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> > > >
> > > > ================================================
> > > > WARNING: lock held when returning to user space!
> > > > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > > > ------------------------------------------------
> > > > syz.0.22/6068 is leaving the kernel with locks still held!
> > > > 1 lock held by syz.0.22/6068:
> > > > #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> > >
> > > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > > yet. Will try the reproducer.
> >
> > The last one was against v5 patches, is this v6?
>
> Oh, good point. Let me check that. Thanks!
You are probably right since the latest linux-next does not have my
patchset. So it must have been reported with the previous v5 version
of the patches.
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 22:19 ` Suren Baghdasaryan
2025-07-08 23:15 ` Liam R. Howlett
@ 2025-07-09 10:26 ` Vlastimil Babka
2025-07-09 14:29 ` Suren Baghdasaryan
1 sibling, 1 reply; 18+ messages in thread
From: Vlastimil Babka @ 2025-07-09 10:26 UTC (permalink / raw)
To: Suren Baghdasaryan, syzbot
Cc: Liam.Howlett, akpm, linux-kernel, linux-mm, lorenzo.stoakes,
shakeel.butt, syzkaller-bugs
On 7/9/25 00:19, Suren Baghdasaryan wrote:
> On Tue, Jul 8, 2025 at 10:52 AM syzbot
> <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
>>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
>> git tree: linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
>> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
>> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
>>
>> ================================================
>> WARNING: lock held when returning to user space!
>> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
>> ------------------------------------------------
>> syz.0.22/6068 is leaving the kernel with locks still held!
>> 1 lock held by syz.0.22/6068:
>> #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
>
> Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> yet. Will try the reproducer.
I don't see it either. I don't also see v6 being substantially different.
Hopefully this (and the other report) was some consequence of the kmalloc()
under rcu that v5 had. Maybe it can lead to sleep and when it wake ups it
doesn't restore the rcu lock section?
The unhandled vma_start_read_locked() return value I pointed out could play
a role too (in the other report) but I guess only if syzbot would be able to
saturate the refcount (I doubt?).
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-09 10:26 ` Vlastimil Babka
@ 2025-07-09 14:29 ` Suren Baghdasaryan
0 siblings, 0 replies; 18+ messages in thread
From: Suren Baghdasaryan @ 2025-07-09 14:29 UTC (permalink / raw)
To: Vlastimil Babka
Cc: syzbot, Liam.Howlett, akpm, linux-kernel, linux-mm,
lorenzo.stoakes, shakeel.butt, syzkaller-bugs
On Wed, Jul 9, 2025 at 3:26 AM Vlastimil Babka <vbabka@suse.cz> wrote:
>
> On 7/9/25 00:19, Suren Baghdasaryan wrote:
> > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> >>
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> >> git tree: linux-next
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> >> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> >> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> >>
> >> Downloadable assets:
> >> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> >> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> >> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> >>
> >> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> >>
> >> ================================================
> >> WARNING: lock held when returning to user space!
> >> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> >> ------------------------------------------------
> >> syz.0.22/6068 is leaving the kernel with locks still held!
> >> 1 lock held by syz.0.22/6068:
> >> #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> >
> > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > yet. Will try the reproducer.
>
> I don't see it either. I don't also see v6 being substantially different.
> Hopefully this (and the other report) was some consequence of the kmalloc()
> under rcu that v5 had. Maybe it can lead to sleep and when it wake ups it
> doesn't restore the rcu lock section?
I'm not sure. The report says that vm_lock is being held, so that does
not look like an rcu-related issue. I'll try the reproducer with v6 to
see if something fails.
>
> The unhandled vma_start_read_locked() return value I pointed out could play
> a role too (in the other report) but I guess only if syzbot would be able to
> saturate the refcount (I doubt?).
Yes, I should handle that by falling back to mmap_lock, however I
agree this would be highly unlikely.
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 17:52 [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma syzbot
2025-07-08 22:19 ` Suren Baghdasaryan
@ 2025-07-09 1:54 ` syzbot
2025-07-11 0:32 ` Hillf Danton
` (4 subsequent siblings)
6 siblings, 0 replies; 18+ messages in thread
From: syzbot @ 2025-07-09 1:54 UTC (permalink / raw)
To: Liam.Howlett, akpm, andrii, anna.luese, liam.howlett,
linux-kernel, linux-mm, lorenzo.stoakes, shakeel.butt, surenb,
syzkaller-bugs, vbabka
syzbot has bisected this issue to:
commit 6772c457a86536f3496bf5b3716f34a5ac125783
Author: Suren Baghdasaryan <surenb@google.com>
Date: Tue Jun 24 19:33:59 2025 +0000
fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=158fca8c580000
start commit: 26ffb3d6f02c Add linux-next specific files for 20250704
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=178fca8c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=138fca8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
Fixes: 6772c457a865 ("fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 17:52 [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma syzbot
2025-07-08 22:19 ` Suren Baghdasaryan
2025-07-09 1:54 ` syzbot
@ 2025-07-11 0:32 ` Hillf Danton
2025-07-11 1:25 ` syzbot
2025-07-11 2:25 ` Hillf Danton
` (3 subsequent siblings)
6 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2025-07-11 0:32 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Tue, 08 Jul 2025 10:52:27 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
#syz test
--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -187,6 +187,7 @@ static struct vm_area_struct *get_next_v
}
#else /* CONFIG_PER_VMA_LOCK */
+static void unlock_vma(struct proc_maps_private *priv) {}
static inline bool lock_vma_range(struct seq_file *m,
struct proc_maps_private *priv)
@@ -582,6 +583,7 @@ skip_vma:
if (flags & PROCMAP_QUERY_COVERING_OR_NEXT_VMA)
goto next_vma;
+ unlock_vma(priv);
no_vma:
return ERR_PTR(-ENOENT);
}
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-11 0:32 ` Hillf Danton
@ 2025-07-11 1:25 ` syzbot
0 siblings, 0 replies; 18+ messages in thread
From: syzbot @ 2025-07-11 1:25 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: bad unlock balance in query_matching_vma
=====================================
WARNING: bad unlock balance detected!
6.16.0-rc5-next-20250710-syzkaller-08625-gb551c4e2a98a-dirty #0 Not tainted
-------------------------------------
syz.0.40/6692 is trying to release lock (vm_lock) at:
[<ffffffff825976c4>] get_next_vma fs/proc/task_mmu.c:181 [inline]
[<ffffffff825976c4>] query_vma_find_by_addr fs/proc/task_mmu.c:513 [inline]
[<ffffffff825976c4>] query_matching_vma+0x344/0x600 fs/proc/task_mmu.c:545
but there are no more locks to release!
other info that might help us debug this:
1 lock held by syz.0.40/6692:
#0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: query_vma_find_by_addr fs/proc/task_mmu.c:511 [inline]
#0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: query_matching_vma+0x152/0x600 fs/proc/task_mmu.c:545
stack backtrace:
CPU: 1 UID: 0 PID: 6692 Comm: syz.0.40 Not tainted 6.16.0-rc5-next-20250710-syzkaller-08625-gb551c4e2a98a-dirty #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5301
__lock_release kernel/locking/lockdep.c:5540 [inline]
lock_release+0x269/0x3e0 kernel/locking/lockdep.c:5892
vma_refcount_put include/linux/mmap_lock.h:141 [inline]
vma_end_read include/linux/mmap_lock.h:237 [inline]
unlock_vma+0x70/0x180 fs/proc/task_mmu.c:135
get_next_vma fs/proc/task_mmu.c:181 [inline]
query_vma_find_by_addr fs/proc/task_mmu.c:513 [inline]
query_matching_vma+0x344/0x600 fs/proc/task_mmu.c:545
do_procmap_query fs/proc/task_mmu.c:631 [inline]
procfs_procmap_ioctl+0x3f9/0xd50 fs/proc/task_mmu.c:749
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:598 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2c38b8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2c399b2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2c38db6080 RCX: 00007f2c38b8e929
RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000003
RBP: 00007f2c38c10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f2c38db6080 R15: 00007fff905431d8
</TASK>
------------[ cut here ]------------
WARNING: ./include/linux/mmap_lock.h:292 at vma_assert_attached include/linux/mmap_lock.h:292 [inline], CPU#0: syz.0.40/6692
WARNING: ./include/linux/mmap_lock.h:292 at vma_mark_detached+0x1fa/0x2d0 mm/mmap_lock.c:109, CPU#0: syz.0.40/6692
Modules linked in:
CPU: 0 UID: 0 PID: 6692 Comm: syz.0.40 Not tainted 6.16.0-rc5-next-20250710-syzkaller-08625-gb551c4e2a98a-dirty #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:vma_assert_attached include/linux/mmap_lock.h:292 [inline]
RIP: 0010:vma_mark_detached+0x1fa/0x2d0 mm/mmap_lock.c:109
Code: 48 8b 05 09 f2 9a 10 48 3b 44 24 08 0f 85 d0 00 00 00 48 83 c4 10 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc e8 27 a8 b5 ff 90 <0f> 0b 90 e9 45 ff ff ff e8 19 a8 b5 ff 90 0f 0b 90 e9 92 fe ff ff
RSP: 0018:ffffc90003b6f7c0 EFLAGS: 00010293
RAX: ffffffff820a0e39 RBX: ffff88807904b280 RCX: ffff888033a68000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88807904b303 R09: 1ffff1100f209660
R10: dffffc0000000000 R11: ffffed100f209661 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88807904b300 R15: ffff888049f08c20
FS: 0000000000000000(0000) GS:ffff888125bd0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f93657ae7d0 CR3: 000000000df36000 CR4: 00000000003526f0
Call Trace:
<TASK>
exit_mmap+0x537/0xb50 mm/mmap.c:1307
__mmput+0x118/0x420 kernel/fork.c:1120
exit_mm+0x1da/0x2c0 kernel/exit.c:581
do_exit+0x648/0x2300 kernel/exit.c:947
do_group_exit+0x21c/0x2d0 kernel/exit.c:1100
get_signal+0x1286/0x1340 kernel/signal.c:3034
arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:208 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2c38b8e929
Code: Unable to access opcode bytes at 0x7f2c38b8e8ff.
RSP: 002b:00007f2c399b20e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f2c38db6088 RCX: 00007f2c38b8e929
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2c38db6088
RBP: 00007f2c38db6080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2c38db608c
R13: 0000000000000000 R14: 00007fff905430f0 R15: 00007fff905431d8
</TASK>
Tested on:
commit: b551c4e2 Add linux-next specific files for 20250710
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16fa20f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=90b2e63e925474ab
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=127d3a8c580000
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 17:52 [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma syzbot
` (2 preceding siblings ...)
2025-07-11 0:32 ` Hillf Danton
@ 2025-07-11 2:25 ` Hillf Danton
2025-07-11 2:30 ` syzbot
2025-07-11 3:54 ` Hillf Danton
` (2 subsequent siblings)
6 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2025-07-11 2:25 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Tue, 08 Jul 2025 10:52:27 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
#syz test
--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -586,6 +586,7 @@ no_vma:
return ERR_PTR(-ENOENT);
}
+static DEFINE_MUTEX(query_mutex);
static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
{
struct procmap_query karg;
@@ -630,6 +631,7 @@ static int do_procmap_query(struct proc_
return -ENOMEM;
}
+ mutex_lock(&query_mutex);
err = query_vma_setup(priv);
if (err)
goto fail_vma_setup;
@@ -712,6 +714,7 @@ static int do_procmap_query(struct proc_
/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
query_vma_teardown(priv);
+ mutex_unlock(&query_mutex);
mmput(mm);
if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
@@ -733,6 +736,7 @@ static int do_procmap_query(struct proc_
out:
query_vma_teardown(priv);
fail_vma_setup:
+ mutex_unlock(&query_mutex);
mmput(mm);
kfree(name_buf);
return err;
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 17:52 [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma syzbot
` (3 preceding siblings ...)
2025-07-11 2:25 ` Hillf Danton
@ 2025-07-11 3:54 ` Hillf Danton
2025-07-11 3:56 ` syzbot
2025-07-11 4:03 ` Hillf Danton
2025-07-11 5:09 ` Hillf Danton
6 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2025-07-11 3:54 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Tue, 08 Jul 2025 10:52:27 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
#syz test https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -585,6 +585,7 @@ no_vma:
return ERR_PTR(-ENOENT);
}
+static DEFINE_MUTEX(query_mutex);
static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
{
struct procmap_query karg;
@@ -620,8 +621,10 @@ static int do_procmap_query(struct proc_
if (!mm || !mmget_not_zero(mm))
return -ESRCH;
+ mutex_lock(&query_mutex);
err = query_vma_setup(priv);
if (err) {
+ mutex_unlock(&query_mutex);
mmput(mm);
return err;
}
@@ -712,6 +715,7 @@ static int do_procmap_query(struct proc_
/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
query_vma_teardown(priv);
+ mutex_unlock(&query_mutex);
mmput(mm);
if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
@@ -732,6 +736,7 @@ static int do_procmap_query(struct proc_
out:
query_vma_teardown(priv);
+ mutex_unlock(&query_mutex);
mmput(mm);
kfree(name_buf);
return err;
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 17:52 [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma syzbot
` (4 preceding siblings ...)
2025-07-11 3:54 ` Hillf Danton
@ 2025-07-11 4:03 ` Hillf Danton
2025-07-11 4:28 ` syzbot
2025-07-11 5:09 ` Hillf Danton
6 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2025-07-11 4:03 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Tue, 08 Jul 2025 10:52:27 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
#syz test
--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -585,6 +585,7 @@ no_vma:
return ERR_PTR(-ENOENT);
}
+static DEFINE_MUTEX(query_mutex);
static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
{
struct procmap_query karg;
@@ -620,8 +621,10 @@ static int do_procmap_query(struct proc_
if (!mm || !mmget_not_zero(mm))
return -ESRCH;
+ mutex_lock(&query_mutex);
err = query_vma_setup(priv);
if (err) {
+ mutex_unlock(&query_mutex);
mmput(mm);
return err;
}
@@ -712,6 +715,7 @@ static int do_procmap_query(struct proc_
/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
query_vma_teardown(priv);
+ mutex_unlock(&query_mutex);
mmput(mm);
if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
@@ -732,6 +736,7 @@ static int do_procmap_query(struct proc_
out:
query_vma_teardown(priv);
+ mutex_unlock(&query_mutex);
mmput(mm);
kfree(name_buf);
return err;
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma
2025-07-08 17:52 [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma syzbot
` (5 preceding siblings ...)
2025-07-11 4:03 ` Hillf Danton
@ 2025-07-11 5:09 ` Hillf Danton
2025-07-11 5:44 ` syzbot
6 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2025-07-11 5:09 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Tue, 08 Jul 2025 10:52:27 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 26ffb3d6f02c Add linux-next specific files for 20250704
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
#syz test
^ permalink raw reply [flat|nested] 18+ messages in thread