[syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com

================================================
WARNING: lock held when returning to user space!
6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
------------------------------------------------
syz.0.22/6068 is leaving the kernel with locks still held!
1 lock held by syz.0.22/6068:
 #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Tue, Jul 8, 2025 at 10:52 AM syzbot
<syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
>
> ================================================
> WARNING: lock held when returning to user space!
> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> ------------------------------------------------
> syz.0.22/6068 is leaving the kernel with locks still held!
> 1 lock held by syz.0.22/6068:
>  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220

Hmm. I must be missing an unlock_vma() somewhere but I don't see it
yet. Will try the reproducer.

>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Liam R. Howlett]

* Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> On Tue, Jul 8, 2025 at 10:52 AM syzbot
> <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> > git tree:       linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> >
> > ================================================
> > WARNING: lock held when returning to user space!
> > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > ------------------------------------------------
> > syz.0.22/6068 is leaving the kernel with locks still held!
> > 1 lock held by syz.0.22/6068:
> >  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> 
> Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> yet. Will try the reproducer.

The last one was against v5 patches, is this v6?

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Tue, Jul 8, 2025 at 4:15 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
>
> * Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> > > git tree:       linux-next
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> > >
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> > >
> > > ================================================
> > > WARNING: lock held when returning to user space!
> > > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > > ------------------------------------------------
> > > syz.0.22/6068 is leaving the kernel with locks still held!
> > > 1 lock held by syz.0.22/6068:
> > >  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> >
> > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > yet. Will try the reproducer.
>
> The last one was against v5 patches, is this v6?

Oh, good point. Let me check that. Thanks!

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Tue, Jul 8, 2025 at 4:51 PM Suren Baghdasaryan <surenb@google.com> wrote:
>
> On Tue, Jul 8, 2025 at 4:15 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
> >
> > * Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> > > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> > > >
> > > > Hello,
> > > >
> > > > syzbot found the following issue on:
> > > >
> > > > HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> > > > git tree:       linux-next
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > > > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> > > >
> > > > Downloadable assets:
> > > > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > > > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > > > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> > > >
> > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> > > >
> > > > ================================================
> > > > WARNING: lock held when returning to user space!
> > > > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > > > ------------------------------------------------
> > > > syz.0.22/6068 is leaving the kernel with locks still held!
> > > > 1 lock held by syz.0.22/6068:
> > > >  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> > >
> > > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > > yet. Will try the reproducer.
> >
> > The last one was against v5 patches, is this v6?
>
> Oh, good point. Let me check that. Thanks!

You are probably right since the latest linux-next does not have my
patchset. So it must have been reported with the previous v5 version
of the patches.

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Vlastimil Babka]

On 7/9/25 00:19, Suren Baghdasaryan wrote:
> On Tue, Jul 8, 2025 at 10:52 AM syzbot
> <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
>>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
>> git tree:       linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
>> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
>> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
>>
>> ================================================
>> WARNING: lock held when returning to user space!
>> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
>> ------------------------------------------------
>> syz.0.22/6068 is leaving the kernel with locks still held!
>> 1 lock held by syz.0.22/6068:
>>  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> 
> Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> yet. Will try the reproducer.

I don't see it either. I don't also see v6 being substantially different.
Hopefully this (and the other report) was some consequence of the kmalloc()
under rcu that v5 had. Maybe it can lead to sleep and when it wake ups it
doesn't restore the rcu lock section?

The unhandled vma_start_read_locked() return value I pointed out could play
a role too (in the other report) but I guess only if syzbot would be able to
saturate the refcount (I doubt?).

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Wed, Jul 9, 2025 at 3:26 AM Vlastimil Babka <vbabka@suse.cz> wrote:
>
> On 7/9/25 00:19, Suren Baghdasaryan wrote:
> > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> >>
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> >> git tree:       linux-next
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> >> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> >> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> >> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> >>
> >> Downloadable assets:
> >> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> >> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> >> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> >>
> >> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> >>
> >> ================================================
> >> WARNING: lock held when returning to user space!
> >> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> >> ------------------------------------------------
> >> syz.0.22/6068 is leaving the kernel with locks still held!
> >> 1 lock held by syz.0.22/6068:
> >>  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> >
> > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > yet. Will try the reproducer.
>
> I don't see it either. I don't also see v6 being substantially different.
> Hopefully this (and the other report) was some consequence of the kmalloc()
> under rcu that v5 had. Maybe it can lead to sleep and when it wake ups it
> doesn't restore the rcu lock section?

I'm not sure. The report says that vm_lock is being held, so that does
not look like an rcu-related issue. I'll try the reproducer with v6 to
see if something fails.

>
> The unhandled vma_start_read_locked() return value I pointed out could play
> a role too (in the other report) but I guess only if syzbot would be able to
> saturate the refcount (I doubt?).

Yes, I should handle that by falling back to mmap_lock, however I
agree this would be highly unlikely.

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

syzbot has bisected this issue to:

commit 6772c457a86536f3496bf5b3716f34a5ac125783
Author: Suren Baghdasaryan <surenb@google.com>
Date:   Tue Jun 24 19:33:59 2025 +0000

    fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=158fca8c580000
start commit:   26ffb3d6f02c Add linux-next specific files for 20250704
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=178fca8c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=138fca8c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
Fixes: 6772c457a865 ("fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection