From: "David Hildenbrand (Red Hat)" <david@kernel.org>
To: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>,
Jeongjun Park <aha310510@gmail.com>
Cc: Harry Yoo <harry.yoo@oracle.com>,
Liam.Howlett@oracle.com, akpm@linux-foundation.org,
jannh@google.com, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, riel@surriel.com,
syzbot+b165fc2e11771c66d8ba@syzkaller.appspotmail.com,
syzkaller-bugs@googlegroups.com, vbabka@suse.cz
Subject: Re: [syzbot] [mm?] WARNING in folio_remove_rmap_ptes
Date: Thu, 1 Jan 2026 18:06:23 +0100 [thread overview]
Message-ID: <dd304877-1010-462d-bdf8-9d824250a05c@kernel.org> (raw)
In-Reply-To: <794095b5-e9ee-4fff-8e3a-1e6b98e670a2@lucifer.local>
On 1/1/26 17:32, Lorenzo Stoakes wrote:
> On Thu, Jan 01, 2026 at 11:30:52PM +0900, Jeongjun Park wrote:
>>
>> Based on my testing, I found that the WARNING starts from commit
>> d23cb648e365 ("mm/mremap: permit mremap() move of multiple VMAs"),
>> which is right after commit 2cf442d74216 ("mm/mremap: clean up mlock
>> populate behavior") in Lorenzo's mremap-related patch series.
>
> OK let me take a look.
Trying to make sense of the reproducer and how bpf comes into play ... I
assume BPF is only used to install a uprobe.
We seem to create a file0 and register a uprobe on it.
We then mmap() that file with PROT_NONE. We should end up in
uprobe_mmap() and trigger a COW fault -> allocate an anon_vma.
So likely the bpf magic is only there to allocate an anon_vma for a
PROT_NONE region.
But it's all a bit confusing ... :)
--
Cheers
David
next prev parent reply other threads:[~2026-01-01 17:06 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-23 5:23 [syzbot] [mm?] WARNING in folio_remove_rmap_ptes syzbot
2025-12-23 8:24 ` David Hildenbrand (Red Hat)
2025-12-24 2:48 ` Hillf Danton
2025-12-23 9:42 ` Hillf Danton
2025-12-23 10:10 ` syzbot
2025-12-24 5:35 ` Harry Yoo
2025-12-30 22:02 ` David Hildenbrand (Red Hat)
2025-12-31 6:59 ` Harry Yoo
2026-01-01 13:09 ` Jeongjun Park
2026-01-01 13:45 ` Harry Yoo
2026-01-01 14:30 ` Jeongjun Park
2026-01-01 16:32 ` Lorenzo Stoakes
2026-01-01 17:06 ` David Hildenbrand (Red Hat) [this message]
2026-01-01 21:28 ` Lorenzo Stoakes
2026-01-02 8:14 ` Harry Yoo
2026-01-02 11:31 ` Lorenzo Stoakes
2026-01-02 15:49 ` Lorenzo Stoakes
2026-01-02 16:30 ` Lorenzo Stoakes
2026-01-02 17:46 ` Lorenzo Stoakes
2026-01-01 16:54 ` Lorenzo Stoakes
2026-01-01 8:33 ` Jeongjun Park
2026-01-01 8:53 ` syzbot
2026-01-01 17:43 ` Lorenzo Stoakes
2026-01-03 3:13 ` Jeongjun Park
2026-01-03 3:35 ` syzbot
2026-01-06 14:39 ` Jeongjun Park
2026-01-06 15:00 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dd304877-1010-462d-bdf8-9d824250a05c@kernel.org \
--to=david@kernel.org \
--cc=Liam.Howlett@oracle.com \
--cc=aha310510@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=harry.yoo@oracle.com \
--cc=jannh@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=riel@surriel.com \
--cc=syzbot+b165fc2e11771c66d8ba@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.