Re: [syzbot] [kernel?] WARNING in exit_mm

[Hillf Danton <hdanton@sina.com>]

> Date: Tue, 17 Mar 2026 13:39:24 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    b84a0ebe421c Add linux-next specific files for 20260313
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=15fb1602580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e7280ad1f68b2dce
> dashboard link: https://syzkaller.appspot.com/bug?extid=295a8715dd1bfadef8bf
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=177918ba580000

#syz test

--- x/kernel/locking/rwsem.c
+++ y/kernel/locking/rwsem.c
@@ -365,12 +365,11 @@ enum rwsem_wake_type {
 #define MAX_READERS_WAKEUP	0x100
 
 static inline
-bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter)
+void __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter)
 	__must_hold(&sem->wait_lock)
 {
 	if (list_empty(&waiter->list)) {
 		sem->first_waiter = NULL;
-		return true;
 	}
 
 	if (sem->first_waiter == waiter) {
@@ -378,8 +377,6 @@ bool __rwsem_del_waiter(struct rw_semaph
 						     struct rwsem_waiter, list);
 	}
 	list_del(&waiter->list);
-
-	return false;
 }
 
 /*
@@ -394,7 +391,8 @@ static inline bool
 rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter)
 {
 	lockdep_assert_held(&sem->wait_lock);
-	if (__rwsem_del_waiter(sem, waiter))
+	__rwsem_del_waiter(sem, waiter);
+	if (rwsem_is_contended(sem))
 		return true;
 	atomic_long_andnot(RWSEM_FLAG_HANDOFF | RWSEM_FLAG_WAITERS, &sem->count);
 	return false;
--