Re: [syzbot] [mm?] possible deadlock in mfill_get_vma

Hillf Danton
2026-03-16T01:19:38Z

> Date: Sun, 15 Mar 2026 11:37:28 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: b84a0ebe421c Add linux-next specific files for 20260313
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=131ab8da580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e7280ad1f68b2dce
> dashboard link: https://syzkaller.appspot.com/bug?extid=c473aa669b5e8a6f48d2
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=126c98ba580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1644a2d6580000

#syz test

--- x/mm/userfaultfd.c
+++ y/mm/userfaultfd.c
@@ -217,6 +217,7 @@ static int mfill_get_vma(struct mfill_st
dst_vma = uffd_mfill_lock(ctx->mm, state->dst_start, state->len);
if (IS_ERR(dst_vma))
return PTR_ERR(dst_vma);
+ state->vma = dst_vma;

/*
* If memory mappings are changing because of non-cooperative
--