From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E99C0474BF2 for ; Thu, 8 Jan 2026 14:39:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767883177; cv=none; b=q7xuIRYyA5Cx3dRwX52iYONJFa527R0n3Wn0NkaYnwqgDX2ItFQNG81n0Lu7HDoylnlBW0ow7IqBikRr1UEYFpxOYJ5mDwWxlj3rnmzwsxZ8+wQGf7VoC3EYjfJjvQ+oPM0bLSm636s69rnQPzLBeYb3ArsaFg27K4BnHjX9XAI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767883177; c=relaxed/simple; bh=JdygvNUgOaQqfNXG/TbY6JObMUxZmAB03wFoGVjF/ks=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=PZt9NjbIKoT+C/u6oHsEyibdRuIp19INvHDLCksaGnAeEzu3pfNYALCFn0761Ngu4yLY7Xo2dsoyGekxfmjoyNTCLtwk55OagAzWpMjNojj86Wt0KV3qvxdNnS997yEmzf44j8B6Hb3qvP0feVcCWZ+3ZyVAd6KbiCpgbRkSmLM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=nS4FJzk0; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="nS4FJzk0" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=wTL8U1oUZwkghfEX1cr6pYgRbtEkFJeHOx0vM5v97j8=; b=nS4FJzk0nUmfsQVHsnpEYh7IT4 hyypekP3TcURyqSfN/PrkuuM1fq1hwqkY0BT1bYBuZY2FmZTUsNWFX+bRYIEhbW92ZtUEXFpeDE9O j8IcWoxLB+GGr+EQu9xixRIkURn7WYWrE6t9V33pF4dqn2JxFcz59ieYLTRf3GrwY2kQDirSTGxwm T8W3z2S3epsMWgSsYxYh63yBlYKHQxZmdG4pn1IseIPHcDhYCw+C8XiwdTq1ctsPnDZbnDldO77/6 hhPunyLEyiB0qRyYitTINmYd/lyJVW/FvQpiV4FGs3zdCyp0s6Z8ecAtXqhyoOPqFD5Um6xZSTDlj tHhtpCsQ==; Received: from willy by casper.infradead.org with local (Exim 4.98.2 #2 (Red Hat Linux)) id 1vdrAf-0000000F4Dq-0yvk; Thu, 08 Jan 2026 14:39:29 +0000 Date: Thu, 8 Jan 2026 14:39:29 +0000 From: Matthew Wilcox To: syzbot Cc: Liam.Howlett@oracle.com, akpm@linux-foundation.org, david@redhat.com, harry.yoo@oracle.com, jannh@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, lorenzo.stoakes@oracle.com, riel@surriel.com, syzkaller-bugs@googlegroups.com, vbabka@suse.cz Subject: Re: [syzbot] [mm?] INFO: task hung in __rmap_walk_file Message-ID: References: <68e9715a.050a0220.1186a4.000d.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <68e9715a.050a0220.1186a4.000d.GAE@google.com> On Fri, Oct 10, 2025 at 01:49:30PM -0700, syzbot wrote: > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=133e89e2580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f3ba7c580000 #syz test diff --git a/mm/migrate.c b/mm/migrate.c index 5169f9717f60..4688b9e38cd2 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1458,6 +1458,7 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio, int page_was_mapped = 0; struct anon_vma *anon_vma = NULL; struct address_space *mapping = NULL; + enum ttu_flags ttu = 0; if (folio_ref_count(src) == 1) { /* page was freed from under us. So we are done. */ @@ -1498,8 +1499,6 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio, goto put_anon; if (folio_mapped(src)) { - enum ttu_flags ttu = 0; - if (!folio_test_anon(src)) { /* * In shared mappings, try_to_unmap could potentially @@ -1516,16 +1515,17 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio, try_to_migrate(src, ttu); page_was_mapped = 1; - - if (ttu & TTU_RMAP_LOCKED) - i_mmap_unlock_write(mapping); } if (!folio_mapped(src)) rc = move_to_new_folio(dst, src, mode); if (page_was_mapped) - remove_migration_ptes(src, !rc ? dst : src, 0); + remove_migration_ptes(src, !rc ? dst : src, + ttu ? RMP_LOCKED : 0); + + if (ttu & TTU_RMAP_LOCKED) + i_mmap_unlock_write(mapping); unlock_put_anon: folio_unlock(dst);