From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8BDEFC98311 for ; Thu, 24 Sep 2026 09:27:55 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 776806B0092; Thu, 24 Sep 2026 05:27:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 724BC6B0093; Thu, 24 Sep 2026 05:27:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 63AD96B0095; Thu, 24 Sep 2026 05:27:54 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 3F7806B0092 for ; Thu, 24 Sep 2026 05:27:54 -0400 (EDT) Received: from smtpin10.hostedemail.com (lb01a-stub [10.200.18.249]) by unirelay06.hostedemail.com (Postfix) with ESMTP id CB0BDA5C7D for ; Thu, 24 Sep 2026 09:27:53 +0000 (UTC) X-FDA: 85248128826.10.3C94AF8 Received: from mta0.migadu.com (out-217.mta0.migadu.com [91.218.175.217]) by imf24.hostedemail.com (Postfix) with ESMTP id 6691B180002 for ; Thu, 24 Sep 2026 09:27:51 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=czuAz6+f; spf=pass (imf24.hostedemail.com: domain of lance.yang@linux.dev designates 91.218.175.217 as permitted sender) smtp.mailfrom=lance.yang@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1790242071; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=5f7eDWrEAxsskMCWSghcr3IBmYC/YDZeBkEGQ/WYK2Q=; b=h65MyTJqb1tINQtxszuFtIP539HNPtRZFG0yijuCfzXfJHJUFpHLRq0spveeuFQKFdmsWJ uFxm6LZG9ik2CYtLAUbUYY6HgQcDSw3eEaVaWMGShR0HkrrA+Cab9bPdB7jTOapmMb9Rro lO0990hc4ZXxsUMJcJQ6M//KzL3R7Wc= ARC-Seal: i=1; a=rsa-sha256; d=hostedemail.com; s=arc-20220608; cv=none; t=1790242071; b=LpoiWABE83xXFCgr5r1arS1mitdOQRuyu3c/Z6AfZekBDNbxX6m89WI26Q7PsfOLo6BN52 Is+Ga8hr3xQrO37LyUDEGKC33AVepyj2LDoQpjXEbJ1ukDIJ9L0igQmj7mda99NeUxB8YX +R7MlfXzpKfs1wXgXT3qHdeDlJ9DQNU= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=czuAz6+f; spf=pass (imf24.hostedemail.com: domain of lance.yang@linux.dev designates 91.218.175.217 as permitted sender) smtp.mailfrom=lance.yang@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Envelope-To: linux-mm@kvack.org DKIM-Signature: a=rsa-sha256; bh=yQ1JL3OS1DIhfdfcLe4c8iEZGo0TsjpYksuAFp/3C9s=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790242069; v=1; x=1790846869; b=czuAz6+fWkcvel/Ss9yzDdaaRu5B7Vc6wVDqP8BP4o9hrQr87bNJAeSi8Gj3Xk2Kn6fXep0f 2Yxc5UbBub1YEt4sDfOtHKMS2u7DpyivoZQ8nGpiAmrkzbcACMh3zldoCgerts1IrFflCOPXbmv 6im9RzleA2/1AtVK18GchuTg= X-Envelope-To: linux-mm@kvack.org Received: by smtp.migadu.com with ESMTPS id 17e50b02eda3b91c; Thu, 24 Sep 2026 09:27:49 +0000 X-Mizu-Trace-ID: 17e50b02eda3b91c X-Migadu-Flow: FLOW_OUT Message-ID: Date: Thu, 24 Sep 2026 17:27:38 +0800 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [syzbot] [mm?] [ext4?] WARNING in __folio_set_anon To: "Lorenzo Stoakes (ARM)" , "David Hildenbrand (Arm)" Cc: akpm@linux-foundation.org, harry@kernel.org, jannh@google.com, liam@infradead.org, linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, riel@surriel.com, syzkaller-bugs@googlegroups.com, vbabka@kernel.org, syzbot+c181d3198e98f8aef8b9@syzkaller.appspotmail.com References: <6ab4ae75.80e1c6cc.1e8e5f.000d.GAE@google.com> <20260924065458.49698-1-lance.yang@linux.dev> <0a0a07f8-8ac9-4d75-b4c6-c403865f0be9@kernel.org> <08bbb615-a054-472c-9873-787cc0f7a4d7@kernel.org> Content-Language: en-US From: Lance Yang In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 6691B180002 X-Stat-Signature: bfxq68gwgk7dbdo7z3buwgk3o8nxtbtj X-HE-Tag: 1790242071-274860 X-HE-Meta: U2FsdGVkX18DRa5XHj9tWcZ/EPIlXvEjt+hC7DEyVKYB9zi/3V8kA31t12knrlGcsDDHB6jqmA2rNFj6bYQt6T1V0pExMGMlToMVLwEolG+O+eyBUIshPkjB7+gByFB0H/mHAyDgJCOZX5zWiXfvfJ+JyM09hGrlPVu3AgvArSLzLGHu72zncAq7276RyCX4jtyg5skSAmflilfbAOrGN1pVw61aI3AE3yC59GimgcV221YS5hkrWwppnfHXUi52QHHPK/Hvf3dIaDeXKRFWQ1W5z9JeqkHA1BdPbDAaUBFiUYRZ128dU8uVf51IU0Uaox2gfb/W3eqlIwQ1I7imdbTLXgWghyM6lLuYAXx9QZbBYVvd3y7tXucxBNRj7jtncqu33aI9nhUbdxQv6nbZojeUbdPcSp/euH3EvSCwjPYLiDzy8PCQZjp6fHAR3USts3bLMZxEl0arkKZUvXC3G5hHATAVQcNORj8bfKP0TyYfnVwg/1MnyF02nBHnGagu1dT3wf4w/4KgVrTYVtB4shunoIQNFjGjMDv+xvoKwUJ9TxqTk80O0/uElPzWBZRDLBGOZK6TWBqiCdCYA7xPOBChDPGUSK2jhPTUw/jEz2+QOY0lmJLpZ+nz6rA4NL9QwhE6kUwT9uFDpJj8cjlYeLo5p3CM7AoJIb3NdZx8mgZxuzRUikmaBKuuT0jVZlb/89BpicZzade6jTt2XimiP3rKopP72LHIFO4bxy9dXlAKyV9Y+ZhFRQ5sqR4YfOJi2du2eGgmTd5GV2Fq9TUvFjz+F2HntI70i0s1b2ff1aYae127sFWFrrN4sPN5g5RTQg6nXmxjBusF9kBZ3F02KZUEtC09AOMbrRxEPhk2GcbRVDFoGcDS72sN8vSjCwXD0CLrfsRmPVuv83FT7gsTI1AUGgqXIei+84jRin0m518auHAwXEai0mX1uYNe4azTXtBro6Dte0nloo1t0r2 pJHhPIyP H+IqL3aGOlfV95JiFB3OK4pQeH7Q8Ds4Un/jVOYaZ1lDnFPMA8RrSCuXVUr3bR1tCffj2npvx+C61kGJmyZB2FZT3rH8oe6ujNpE5Xo2dyTMe/BAT1Tpsn1pTzNlBr7jG0cMAHjkX7bRi0JGuB88uwTk8JTIklUhlxqmLkAMMVb6ep/hSQMoPgUCgl5JsYeUXIhI4dUEArBWmqit0elsIcO01j1B4TXSs/5LWlEFUsvuyK/V8MMfq9Xf2IR+ATtIHKsuQwMUJB7SNRdC55lZ5cvk2mrQUKgI3ZnAjQFJtPwkBjsnbq8wmTARUgrzxyCzbR9buCwi4YQDjJASTFZdcj686673JDbEeerwnhT/cFstteedKzOwIJrN5Eyhpm75uNG106mHqXk8AvghFET+yJQupVChsVC0+BrsIsuek+Bd68R/LagJrzP9yV2UOKw5j7pYjc50V0y6/Ww78cpyglp3Afs7fWgZrWXKpPqOxVfIIxp2PMf9QElI07HJPljD1jaYEj3H9KKnjQMDuJVARggiSNfU67Ia6U4p5GaribeqpLXR9g0tfeKMyzZFLXV9vUf6EZ64bmlyb9m5M1Zshl+RKuXI12iF1eolF5yYM0XDrwTJrDHk9TTPzuOsIwdr7nUU8SGwo8+HMcbxLrNeMUCLy9B8jrQEEPmv0i4Tsi2EtKdyFLLMPBnrpxGTGzko5WGGOTTaZW0dew6mH4Q5SF6lPfrsjTz8cV/L5fBeE3YRCqcU= Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2026/9/24 16:52, Lorenzo Stoakes (ARM) wrote: > On Thu, Sep 24, 2026 at 09:50:02AM +0200, David Hildenbrand (Arm) wrote: >> On 9/24/26 09:43, David Hildenbrand (Arm) wrote: >>> On 9/24/26 08:54, Lance Yang wrote: >>>> >>>> On Wed, Sep 23, 2026 at 10:00:37PM -0700, syzbot wrote: >>>>> Hello, >>>>> >>>>> syzbot found the following issue on: >>>>> >>>>> HEAD commit: 38872197cae2 Merge branch 'for-next/fixes' into for-kernelci >>>>> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci >>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=17a44d25580000 >>>>> kernel config: https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c >>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=c181d3198e98f8aef8b9 >>>>> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 >>>>> userspace arch: arm64 >>>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a36515580000 >>>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16dcf4c9580000 >>>> >>>> Looking at the repro, emm ... the repro maps an O_RDONLY /dev/zero fd with >>> >>> Does this trigger upstream or only after Lorenzo's rework (not upstream yet IIRC) > > It'd trigger with my make MAP_PRIVATE-/dev/zero true anon stuff too yes. > >>> >>> 46827ac1ab221 mm/vma: make MAP_PRIVATE-mapped /dev/zero mappings truly anonymous >>> db7438ea23180 mm/vma: only permit MAP_PRIVATE /dev/zero to be mapped anonymous >>> 54e8e096ea86b mm: implement file_is_dev_zero() to uniquely identify /dev/zero >>> fb24843cfd9eb mm: move drivers/char/mem.c to mm/char-mem.c >>> >>> I assume it triggers upstream. Does it also trigger with lorenzo's changes? >>> >>>> MAP_SHARED | PROT_READ. do_mmap() clears VM_SHARED and VM_MAYWRITE, so >>> >>> Clearing VM_MAYWRITE for a private mapping is odd. Can you point me at the code >>> that clears both things? >>> >>> I assume we still have the file pointer, and as the file is read-only we remove >>> VM_MAYWRITE. But why are we removing MAP_SHARED? (where?) >> >> Looking at the code, it's the >> >> if (!(file->f_mode & FMODE_WRITE)) >> vma_flags_clear(&vma_flags, VMA_MAYWRITE_BIT, VMA_SHARED_BIT); >> >> So we end up with VMA_MAYSHARE_BIT but without VMA_MAYWRITE_BIT and without >> VMA_SHARED_BIT. >> >> So it's by definition not a COW mapping. But it's marked anonymous and confuses >> the system :) > > This is definitely a bug. And I added these asserts specifically to find > bugs like this with anon mappings: > > VM_WARN_ON_ONCE(!vma_is_cow_mapping(vma)); <-- fires > if (vma_is_anonymous(vma)) > VM_WARN_ON_ONCE(pgoff != linear_page_index(vma, address)); <-- would have fired > > It's because mmap_zero_prepare() keys off VMA_SHARED_BIT when it should be > keying off the terribly-named VMA_MAYSHARE_BIT. > > (VMA_MAYSHARE_BIT actually tells you if the mapping was mapped shared _in > the first place_ specifically because of this clearing of VMA_SHARED_BIT, > VMA_MAYWRITE_BIT.) Cool! Using VMA_MAYSHARE_BIT instead of VMA_SHARED_BIT in mmap_zero_prepare() should do the trick. > > So it turns out forever a readonly /dev/zero shared mapping has quietly been > converted to yet another variant of a 'special' anonymous mapping that we > weren't even aware of. > > And it's got an incorrect pgoff (but not anon pgoff now) as a result, > similar to the usual MAP_PRIVATE-/dev/zero case. > > So the solution is simple, check for VMA_MAYSHARE_BIT in > mmap_zero_prepare(). The Fixes: will be in the sands of time. > > I'll send a fix out. Thanks, Lorenzo! >> >> -- >> Cheers, >> >> David > > -- > Cheers, Lorenzo