[syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com

================================================
WARNING: lock held when returning to user space!
6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
------------------------------------------------
syz.0.22/6068 is leaving the kernel with locks still held!
1 lock held by syz.0.22/6068:
 #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Tue, Jul 8, 2025 at 10:52 AM syzbot
<syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
>
> ================================================
> WARNING: lock held when returning to user space!
> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> ------------------------------------------------
> syz.0.22/6068 is leaving the kernel with locks still held!
> 1 lock held by syz.0.22/6068:
>  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220

Hmm. I must be missing an unlock_vma() somewhere but I don't see it
yet. Will try the reproducer.

>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Liam R. Howlett]

* Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> On Tue, Jul 8, 2025 at 10:52 AM syzbot
> <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> > git tree:       linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> >
> > ================================================
> > WARNING: lock held when returning to user space!
> > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > ------------------------------------------------
> > syz.0.22/6068 is leaving the kernel with locks still held!
> > 1 lock held by syz.0.22/6068:
> >  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> 
> Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> yet. Will try the reproducer.

The last one was against v5 patches, is this v6?

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Tue, Jul 8, 2025 at 4:15 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
>
> * Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> > > git tree:       linux-next
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> > >
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> > >
> > > ================================================
> > > WARNING: lock held when returning to user space!
> > > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > > ------------------------------------------------
> > > syz.0.22/6068 is leaving the kernel with locks still held!
> > > 1 lock held by syz.0.22/6068:
> > >  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> >
> > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > yet. Will try the reproducer.
>
> The last one was against v5 patches, is this v6?

Oh, good point. Let me check that. Thanks!

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Tue, Jul 8, 2025 at 4:51 PM Suren Baghdasaryan <surenb@google.com> wrote:
>
> On Tue, Jul 8, 2025 at 4:15 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
> >
> > * Suren Baghdasaryan <surenb@google.com> [250708 18:19]:
> > > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> > > >
> > > > Hello,
> > > >
> > > > syzbot found the following issue on:
> > > >
> > > > HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> > > > git tree:       linux-next
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> > > > compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> > > >
> > > > Downloadable assets:
> > > > disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> > > > vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> > > > kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> > > >
> > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> > > >
> > > > ================================================
> > > > WARNING: lock held when returning to user space!
> > > > 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> > > > ------------------------------------------------
> > > > syz.0.22/6068 is leaving the kernel with locks still held!
> > > > 1 lock held by syz.0.22/6068:
> > > >  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> > >
> > > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > > yet. Will try the reproducer.
> >
> > The last one was against v5 patches, is this v6?
>
> Oh, good point. Let me check that. Thanks!

You are probably right since the latest linux-next does not have my
patchset. So it must have been reported with the previous v5 version
of the patches.

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

syzbot has bisected this issue to:

commit 6772c457a86536f3496bf5b3716f34a5ac125783
Author: Suren Baghdasaryan <surenb@google.com>
Date:   Tue Jun 24 19:33:59 2025 +0000

    fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=158fca8c580000
start commit:   26ffb3d6f02c Add linux-next specific files for 20250704
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=178fca8c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=138fca8c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
Fixes: 6772c457a865 ("fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Vlastimil Babka]

On 7/9/25 00:19, Suren Baghdasaryan wrote:
> On Tue, Jul 8, 2025 at 10:52 AM syzbot
> <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
>>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
>> git tree:       linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
>> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
>> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
>>
>> ================================================
>> WARNING: lock held when returning to user space!
>> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
>> ------------------------------------------------
>> syz.0.22/6068 is leaving the kernel with locks still held!
>> 1 lock held by syz.0.22/6068:
>>  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> 
> Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> yet. Will try the reproducer.

I don't see it either. I don't also see v6 being substantially different.
Hopefully this (and the other report) was some consequence of the kmalloc()
under rcu that v5 had. Maybe it can lead to sleep and when it wake ups it
doesn't restore the rcu lock section?

The unhandled vma_start_read_locked() return value I pointed out could play
a role too (in the other report) but I guess only if syzbot would be able to
saturate the refcount (I doubt?).

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Suren Baghdasaryan]

On Wed, Jul 9, 2025 at 3:26 AM Vlastimil Babka <vbabka@suse.cz> wrote:
>
> On 7/9/25 00:19, Suren Baghdasaryan wrote:
> > On Tue, Jul 8, 2025 at 10:52 AM syzbot
> > <syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com> wrote:
> >>
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> >> git tree:       linux-next
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> >> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> >> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> >> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000
> >>
> >> Downloadable assets:
> >> disk image: https://storage.googleapis.com/syzbot-assets/fd5569903143/disk-26ffb3d6.raw.xz
> >> vmlinux: https://storage.googleapis.com/syzbot-assets/1b0c9505c543/vmlinux-26ffb3d6.xz
> >> kernel image: https://storage.googleapis.com/syzbot-assets/9d864c72bed1/bzImage-26ffb3d6.xz
> >>
> >> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >> Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
> >>
> >> ================================================
> >> WARNING: lock held when returning to user space!
> >> 6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
> >> ------------------------------------------------
> >> syz.0.22/6068 is leaving the kernel with locks still held!
> >> 1 lock held by syz.0.22/6068:
> >>  #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
> >
> > Hmm. I must be missing an unlock_vma() somewhere but I don't see it
> > yet. Will try the reproducer.
>
> I don't see it either. I don't also see v6 being substantially different.
> Hopefully this (and the other report) was some consequence of the kmalloc()
> under rcu that v5 had. Maybe it can lead to sleep and when it wake ups it
> doesn't restore the rcu lock section?

I'm not sure. The report says that vm_lock is being held, so that does
not look like an rcu-related issue. I'll try the reproducer with v6 to
see if something fails.

>
> The unhandled vma_start_read_locked() return value I pointed out could play
> a role too (in the other report) but I guess only if syzbot would be able to
> saturate the refcount (I doubt?).

Yes, I should handle that by falling back to mmap_lock, however I
agree this would be highly unlikely.

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Hillf Danton]

> Date: Tue, 08 Jul 2025 10:52:27 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

#syz test

--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -187,6 +187,7 @@ static struct vm_area_struct *get_next_v
 }
 
 #else /* CONFIG_PER_VMA_LOCK */
+static void unlock_vma(struct proc_maps_private *priv) {}
 
 static inline bool lock_vma_range(struct seq_file *m,
 				  struct proc_maps_private *priv)
@@ -582,6 +583,7 @@ skip_vma:
 	if (flags & PROCMAP_QUERY_COVERING_OR_NEXT_VMA)
 		goto next_vma;
 
+	unlock_vma(priv);
 no_vma:
 	return ERR_PTR(-ENOENT);
 }
--

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: bad unlock balance in query_matching_vma

=====================================
WARNING: bad unlock balance detected!
6.16.0-rc5-next-20250710-syzkaller-08625-gb551c4e2a98a-dirty #0 Not tainted
-------------------------------------
syz.0.40/6692 is trying to release lock (vm_lock) at:
[<ffffffff825976c4>] get_next_vma fs/proc/task_mmu.c:181 [inline]
[<ffffffff825976c4>] query_vma_find_by_addr fs/proc/task_mmu.c:513 [inline]
[<ffffffff825976c4>] query_matching_vma+0x344/0x600 fs/proc/task_mmu.c:545
but there are no more locks to release!

other info that might help us debug this:
1 lock held by syz.0.40/6692:
 #0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: query_vma_find_by_addr fs/proc/task_mmu.c:511 [inline]
 #0: ffffffff8e13c4e0 (rcu_read_lock){....}-{1:3}, at: query_matching_vma+0x152/0x600 fs/proc/task_mmu.c:545

stack backtrace:
CPU: 1 UID: 0 PID: 6692 Comm: syz.0.40 Not tainted 6.16.0-rc5-next-20250710-syzkaller-08625-gb551c4e2a98a-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5301
 __lock_release kernel/locking/lockdep.c:5540 [inline]
 lock_release+0x269/0x3e0 kernel/locking/lockdep.c:5892
 vma_refcount_put include/linux/mmap_lock.h:141 [inline]
 vma_end_read include/linux/mmap_lock.h:237 [inline]
 unlock_vma+0x70/0x180 fs/proc/task_mmu.c:135
 get_next_vma fs/proc/task_mmu.c:181 [inline]
 query_vma_find_by_addr fs/proc/task_mmu.c:513 [inline]
 query_matching_vma+0x344/0x600 fs/proc/task_mmu.c:545
 do_procmap_query fs/proc/task_mmu.c:631 [inline]
 procfs_procmap_ioctl+0x3f9/0xd50 fs/proc/task_mmu.c:749
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2c38b8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2c399b2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2c38db6080 RCX: 00007f2c38b8e929
RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000003
RBP: 00007f2c38c10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f2c38db6080 R15: 00007fff905431d8
 </TASK>
------------[ cut here ]------------
WARNING: ./include/linux/mmap_lock.h:292 at vma_assert_attached include/linux/mmap_lock.h:292 [inline], CPU#0: syz.0.40/6692
WARNING: ./include/linux/mmap_lock.h:292 at vma_mark_detached+0x1fa/0x2d0 mm/mmap_lock.c:109, CPU#0: syz.0.40/6692
Modules linked in:
CPU: 0 UID: 0 PID: 6692 Comm: syz.0.40 Not tainted 6.16.0-rc5-next-20250710-syzkaller-08625-gb551c4e2a98a-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:vma_assert_attached include/linux/mmap_lock.h:292 [inline]
RIP: 0010:vma_mark_detached+0x1fa/0x2d0 mm/mmap_lock.c:109
Code: 48 8b 05 09 f2 9a 10 48 3b 44 24 08 0f 85 d0 00 00 00 48 83 c4 10 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc e8 27 a8 b5 ff 90 <0f> 0b 90 e9 45 ff ff ff e8 19 a8 b5 ff 90 0f 0b 90 e9 92 fe ff ff
RSP: 0018:ffffc90003b6f7c0 EFLAGS: 00010293
RAX: ffffffff820a0e39 RBX: ffff88807904b280 RCX: ffff888033a68000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88807904b303 R09: 1ffff1100f209660
R10: dffffc0000000000 R11: ffffed100f209661 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88807904b300 R15: ffff888049f08c20
FS:  0000000000000000(0000) GS:ffff888125bd0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f93657ae7d0 CR3: 000000000df36000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 exit_mmap+0x537/0xb50 mm/mmap.c:1307
 __mmput+0x118/0x420 kernel/fork.c:1120
 exit_mm+0x1da/0x2c0 kernel/exit.c:581
 do_exit+0x648/0x2300 kernel/exit.c:947
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1100
 get_signal+0x1286/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:40
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:208 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2c38b8e929
Code: Unable to access opcode bytes at 0x7f2c38b8e8ff.
RSP: 002b:00007f2c399b20e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f2c38db6088 RCX: 00007f2c38b8e929
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2c38db6088
RBP: 00007f2c38db6080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2c38db608c
R13: 0000000000000000 R14: 00007fff905430f0 R15: 00007fff905431d8
 </TASK>


Tested on:

commit:         b551c4e2 Add linux-next specific files for 20250710
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16fa20f0580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=90b2e63e925474ab
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch:          https://syzkaller.appspot.com/x/patch.diff?x=127d3a8c580000

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Hillf Danton]

> Date: Tue, 08 Jul 2025 10:52:27 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

#syz test

--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -586,6 +586,7 @@ no_vma:
 	return ERR_PTR(-ENOENT);
 }
 
+static DEFINE_MUTEX(query_mutex);
 static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
 {
 	struct procmap_query karg;
@@ -630,6 +631,7 @@ static int do_procmap_query(struct proc_
 		return -ENOMEM;
 	}
 
+	mutex_lock(&query_mutex);
 	err = query_vma_setup(priv);
 	if (err)
 		goto fail_vma_setup;
@@ -712,6 +714,7 @@ static int do_procmap_query(struct proc_
 
 	/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
 	query_vma_teardown(priv);
+	mutex_unlock(&query_mutex);
 	mmput(mm);
 
 	if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
@@ -733,6 +736,7 @@ static int do_procmap_query(struct proc_
 out:
 	query_vma_teardown(priv);
 fail_vma_setup:
+	mutex_unlock(&query_mutex);
 	mmput(mm);
 	kfree(name_buf);
 	return err;
--

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file fs/proc/task_mmu.c
Hunk #1 succeeded at 585 (offset -1 lines).
Hunk #2 succeeded at 621 with fuzz 2 (offset -10 lines).
Hunk #4 FAILED at 736.
1 out of 4 hunks FAILED



Tested on:

commit:         b551c4e2 Add linux-next specific files for 20250710
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=130120f0580000

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Hillf Danton]

> Date: Tue, 08 Jul 2025 10:52:27 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

#syz test https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  master

--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -585,6 +585,7 @@ no_vma:
 	return ERR_PTR(-ENOENT);
 }
 
+static DEFINE_MUTEX(query_mutex);
 static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
 {
 	struct procmap_query karg;
@@ -620,8 +621,10 @@ static int do_procmap_query(struct proc_
 	if (!mm || !mmget_not_zero(mm))
 		return -ESRCH;
 
+	mutex_lock(&query_mutex);
 	err = query_vma_setup(priv);
 	if (err) {
+		mutex_unlock(&query_mutex);
 		mmput(mm);
 		return err;
 	}
@@ -712,6 +715,7 @@ static int do_procmap_query(struct proc_
 
 	/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
 	query_vma_teardown(priv);
+	mutex_unlock(&query_mutex);
 	mmput(mm);
 
 	if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
@@ -732,6 +736,7 @@ static int do_procmap_query(struct proc_
 
 out:
 	query_vma_teardown(priv);
+	mutex_unlock(&query_mutex);
 	mmput(mm);
 	kfree(name_buf);
 	return err;
--

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to checkout kernel repo https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master: failed to run ["git" "fetch" "--force" "c7d0fbf060793662bad7a58c248d99da187d8f14" "master"]: exit status 128
fatal: repository 'https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/' not found



Tested on:

commit:         [unknown 
git tree:       https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16b0ba8c580000

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Hillf Danton]

> Date: Tue, 08 Jul 2025 10:52:27 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

#syz test

--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -585,6 +585,7 @@ no_vma:
 	return ERR_PTR(-ENOENT);
 }
 
+static DEFINE_MUTEX(query_mutex);
 static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
 {
 	struct procmap_query karg;
@@ -620,8 +621,10 @@ static int do_procmap_query(struct proc_
 	if (!mm || !mmget_not_zero(mm))
 		return -ESRCH;
 
+	mutex_lock(&query_mutex);
 	err = query_vma_setup(priv);
 	if (err) {
+		mutex_unlock(&query_mutex);
 		mmput(mm);
 		return err;
 	}
@@ -712,6 +715,7 @@ static int do_procmap_query(struct proc_
 
 	/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
 	query_vma_teardown(priv);
+	mutex_unlock(&query_mutex);
 	mmput(mm);
 
 	if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
@@ -732,6 +736,7 @@ static int do_procmap_query(struct proc_
 
 out:
 	query_vma_teardown(priv);
+	mutex_unlock(&query_mutex);
 	mmput(mm);
 	kfree(name_buf);
 	return err;
--

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
Tested-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com

Tested on:

commit:         b551c4e2 Add linux-next specific files for 20250710
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1498ba8c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=90b2e63e925474ab
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16ef868c580000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[Hillf Danton]

> Date: Tue, 08 Jul 2025 10:52:27 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    26ffb3d6f02c Add linux-next specific files for 20250704
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1719df70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1e4f88512ae53408
> dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1124abd4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1099df70580000

#syz test

Re: [syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: lock held when returning to user space in lock_next_vma

================================================
WARNING: lock held when returning to user space!
6.16.0-rc5-next-20250710-syzkaller #0 Not tainted
------------------------------------------------
syz.0.21/6653 is leaving the kernel with locks still held!
2 locks held by syz.0.21/6653:
 #0: ffff8880722e3808 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220
 #1: ffff8880722e3308 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220


Tested on:

commit:         b551c4e2 Add linux-next specific files for 20250710
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15948d82580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=90b2e63e925474ab
dashboard link: https://syzkaller.appspot.com/bug?extid=80011ad33eec39e6ce42
compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

Note: no patches were applied.