From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC8BC282EB for ; Sat, 3 Jan 2026 03:13:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767410003; cv=none; b=me0RSmNmqmz0OA/7YHiEzKF8n9tjgiT3nD7hfDBeQg3fvV5CmRE+hnJ5h7ZNCwihrfApPsp8gPQ6JCE/0gfjRIrhoctsuVdkIL5MXBL+AJLvyjKkJ7fsRV57P5ctX9+6UD+PP5GaTFUEcpUEA9yMkkVsD7mFvXwczc19DlsOWqQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767410003; c=relaxed/simple; bh=CF2hVjICI5/LTXtJlDjeNGwyhQNilJujF+9MJaFlxgY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=gQHR6B0G4Jzm/o6CHtKpxcytatFnZMjUg1GyhXYQFZymu3zbnixOiU9HiX0aje0A77TQ6G+27yu1zppaSenMi38uY9fwZsOVY5TD8xYAceJ75L2uaRAXAB+DMZmy8igIwaQlQgfjFayZ1ld5SRJuwY9fp1DcEI+iwrIl80UvzDk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cVdhS9Hi; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cVdhS9Hi" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-34c2f335681so9465301a91.1 for ; Fri, 02 Jan 2026 19:13:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1767410001; x=1768014801; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6jBjF7CKh1zD+109/pTDjFb6qM5hBbTrCNiXJB7yE0U=; b=cVdhS9HiRjQogg/QWxCITU2yCOI3HlzIucCbB8SjpPlTs9ZDFVeiXAkybvCobd+CXY 0eKfuHkCpZM22QJmSnbKCsxjBoQQH8s9RsvsrKzkhk+9VD++1ug+dh0JxR8LNj1+yIg2 IY++f9kTWhzbltthFP6TEX5CZ47FabWV+/ze4apcnjZYdo8du29rWzaq2pss6rxWLPEs PjNRPMs5CQmDU2R2vJXXOVria+x6CB3cMVsDXuLVqkSc27Aarixh7m/Jh14s7nJjU7EF z2uPNC46KeBU5Nofovn4fEHQMliQDCpZijzl2gUxjhx82hN+lSEKtaihV8UVvTcmLZkh 35Cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767410001; x=1768014801; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=6jBjF7CKh1zD+109/pTDjFb6qM5hBbTrCNiXJB7yE0U=; b=dSTrCUZXsyP9k/Grc7cx2n6rxhq7sHU8p8KxaRhAPBZbnk6NFKpgx22FPxPVzT074K 6oY7CN0ATerbJ0q5uqGb4/784ZBtrwh8JDSk4HT7lsdr6Dsj8IAWm/viglBmhSWnX/tM oU3jaUO5PzI/YTguqoWWO9/aCnRPR10IwRy9K/TQcyY31v/P1yqk1aRh1QiQz3C1waiN tO7xh+SZcPAmdeVWpnbsNogqk1DNS/5CdJFJpcy4TrF+75e/kKBeH846F0TiXMVwYS7D uKyOjXI9yRZtLnB/ySUikwk0o/K+SVbOSzuU1ST4NwstKJbIruehO/i68Gk/XtaXBu2w 2Gig== X-Gm-Message-State: AOJu0Yz5TjE0tBBB5xyCNGOJsSzL5tTldFOP6TRyagRwaTLIOVpY6Ldq U05pAs8Al+X3jHQU4FVs6WHkO4t76Yr4RfSjg1Jl2pfhjJtvZ71TvPj5 X-Gm-Gg: AY/fxX5TCnIfKJROWgYFqOnFzu5eTtHrChWWwTnGy2vqf7+hs+Pu7NE6RNptPO8F0ry qkxNSNR64CmcSx3se1vDC5R9AIwkFUpCkkOuMVo2o0vxd9BrooBPZAsAHI3u5j3gSqVW13eke0a bHJIv52ih977uWMFlEUXuWhXvd7VjZ7/WjydEeZgWgb8IqutWhudwRGNrMdJPxlB7YiKmAi8gVr hQohjRnzDWtW420vD9Up/867MPuDyeqBisRNM7Xjaiv6RBkhGb6WGIRIVoEpXeTcpJFJuW0BIqP M+uM25DL0nHoMrXja6pOoKhrbzON7s+KdVuHAojxIPKu3lIw9xq2aOQhEUu6mfEPW0bOZe6LU8o XrGSYfvKkgrJ9yT9v6Pnor/PGOGiinUhGBpBA39Czxilp3YVSanzX2LJuYzBptLWsTHf9s0GOGZ HaH/5/NB83Iqw4U81JfVZinMGwxl9G27D4ijNTOA== X-Google-Smtp-Source: AGHT+IHmQ+ZGx0MIr8ms0zvWM76yr9rOtafQJHvAG78su7CueyPLxjred7x42jQ20jVRRENetHwMPg== X-Received: by 2002:a17:90b:35ca:b0:340:d1b5:bfda with SMTP id 98e67ed59e1d1-34e9212f302mr33622647a91.3.1767410000740; Fri, 02 Jan 2026 19:13:20 -0800 (PST) Received: from name2965-Precision-7820-Tower.. ([121.185.186.233]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34f476ec33esm420325a91.1.2026.01.02.19.13.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Jan 2026 19:13:20 -0800 (PST) From: Jeongjun Park To: syzbot+b165fc2e11771c66d8ba@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [mm?] WARNING in folio_remove_rmap_ptes Date: Sat, 3 Jan 2026 12:13:17 +0900 Message-Id: <20260103031317.1121113-1-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <694a2745.050a0220.19928e.0017.GAE@google.com> References: <694a2745.050a0220.19928e.0017.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test upstream master --- mm/vma.c | 58 ++++++++++++++++++++++++++++++++++++++++++-------------- mm/vma.h | 3 +++ 2 files changed, 47 insertions(+), 14 deletions(-) diff --git a/mm/vma.c b/mm/vma.c index 6377aa290a27..2268f518a89b 100644 --- a/mm/vma.c +++ b/mm/vma.c @@ -1130,26 +1130,50 @@ int vma_expand(struct vma_merge_struct *vmg) mmap_assert_write_locked(vmg->mm); vma_start_write(target); - if (next && (target != next) && (vmg->end == next->vm_end)) { + if (next && vmg->end == next->vm_end) { + struct vm_area_struct *copied_from = vmg->copied_from; int ret; - sticky_flags |= next->vm_flags & VM_STICKY; - remove_next = true; - /* This should already have been checked by this point. */ - VM_WARN_ON_VMG(!can_merge_remove_vma(next), vmg); - vma_start_write(next); - /* - * In this case we don't report OOM, so vmg->give_up_on_mm is - * safe. - */ - ret = dup_anon_vma(target, next, &anon_dup); - if (ret) - return ret; + if (target != next) { + sticky_flags |= next->vm_flags & VM_STICKY; + remove_next = true; + /* This should already have been checked by this point. */ + VM_WARN_ON_VMG(!can_merge_remove_vma(next), vmg); + vma_start_write(next); + /* + * In this case we don't report OOM, so vmg->give_up_on_mm is + * safe. + */ + ret = dup_anon_vma(target, next, &anon_dup); + if (ret) + return ret; + } else if (copied_from) { + vma_start_write(next); + + /* + * We are copying from a VMA (i.e. mremap()'ing) to + * next, and thus must ensure that either anon_vma's are + * already compatible (in which case this call is a nop) + * or all anon_vma state is propagated to next + */ + ret = dup_anon_vma(next, copied_from, &anon_dup); + if (ret) + return ret; + } else { + /* In no other case may the anon_vma differ. */ + VM_WARN_ON_VMG(target->anon_vma != next->anon_vma, vmg); + } } /* Not merging but overwriting any part of next is not handled. */ VM_WARN_ON_VMG(next && !remove_next && next != target && vmg->end > next->vm_start, vmg); + /* + * We should only see a copy with next as the target on a new merge + * which sets the end to the next of next. + */ + VM_WARN_ON_VMG(target == next && vmg->copied_from && + vmg->end != next->vm_end, vmg); /* Only handles expanding */ VM_WARN_ON_VMG(target->vm_start < vmg->start || target->vm_end > vmg->end, vmg); @@ -1807,6 +1831,13 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, VMA_ITERATOR(vmi, mm, addr); VMG_VMA_STATE(vmg, &vmi, NULL, vma, addr, addr + len); + /* + * VMG_VMA_STATE() installs vma in middle, but this is a new VMA, inform + * merging logic correctly. + */ + vmg.copied_from = vma; + vmg.middle = NULL; + /* * If anonymous vma has not yet been faulted, update new pgoff * to match new location, to increase its chance of merging. @@ -1828,7 +1859,6 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, if (new_vma && new_vma->vm_start < addr + len) return NULL; /* should never get here */ - vmg.middle = NULL; /* New VMA range. */ vmg.pgoff = pgoff; vmg.next = vma_iter_next_rewind(&vmi, NULL); new_vma = vma_merge_new_range(&vmg); diff --git a/mm/vma.h b/mm/vma.h index e4c7bd79de5f..50f0bdb0eb79 100644 --- a/mm/vma.h +++ b/mm/vma.h @@ -106,6 +106,9 @@ struct vma_merge_struct { struct anon_vma_name *anon_name; enum vma_merge_state state; + /* If we are copying a VMA, which VMA are we copying from? */ + struct vm_area_struct *copied_from; + /* Flags which callers can use to modify merge behaviour: */ /* --