From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF994215798 for ; Fri, 10 Jan 2025 16:27:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736526431; cv=none; b=cPdRRGuKHJP1f7jf4SAXOx2rFf3q3lzNfkXTbtvHPV3W87dWF0/bvkNiLWvgCognaKHKcGViva0M3WepC7TXkbAjB7BNS0XBMwkLc3RNKzBXCb+5KeCYBQn201idch7CUCgtMupu85bfxhGUu7JMmwZ9purT+/9UGBeX9g09Kzg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736526431; c=relaxed/simple; bh=ihwiVQHWMtBsZKLp6pZbftycog7iM23bTyL0US9I9O0=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=tJAg0TPR7XpdI4byCeNH+j9g0zvhZBDCK9r57/LVSdxeRFtBJEprLnNXUoS33J+m+00oDHtUmoDyuzf3w1gWwCuEg1hhCv5OYuTbk/3/U7jRefm1jiVDGUfqmOLWzO7u0QcOYNj2ccQpiNYr1stql88Z5haDwsCzDlwatSGhWF8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=mF3WsEd6; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="mF3WsEd6" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=4JZZcyLRx4S+2U42ri9DGjU2GQ4V/PN7cHJ97TJK0j4=; b=mF3WsEd6itGAdf5Sk/cbaBNn6M P3S5pU3vHEpffV6DPwQ1JpTKW3iG/wva0PDHPPI4oSy9M8JBnsI3OJl3ws9zxwkUFCXg+FZ3isb4L A4Iulqk6BsUj6Mo3Vv+89gFhKgphTSqKC6aZ8Hy7s0j13joTc1RyCly3phiJwhmuPEzKhnCWH16+P fCONzvzcbXH3zV3Rg72jK7MBkxug+43Iw2lKG15BYKBO5OummgiWiwEuihCeOINHgqTyn+1rVTCK5 XRcY+T6Oe6ew8Hob4N+YLso0bCL1PIIQsWdj6i1SAT+0AuGYAo5rbXfifq1vn5h0zCO6aBtlHhR3+ e1EYLjqQ==; Received: from willy by casper.infradead.org with local (Exim 4.98 #2 (Red Hat Linux)) id 1tWHqh-0000000E1yT-2Gcp; Fri, 10 Jan 2025 16:27:03 +0000 Date: Fri, 10 Jan 2025 16:27:03 +0000 From: Matthew Wilcox To: David Hildenbrand Cc: syzbot , akpm@linux-foundation.org, hdanton@sina.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com, "Liam R. Howlett" , Lorenzo Stoakes Subject: Re: [syzbot] [mm?] WARNING in __folio_rmap_sanity_checks (2) Message-ID: References: <676fee37.050a0220.2f3838.0497.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Fri, Jan 10, 2025 at 05:19:54PM +0100, David Hildenbrand wrote: > On 10.01.25 17:14, Matthew Wilcox wrote: > > On Fri, Jan 10, 2025 at 04:48:03PM +0100, David Hildenbrand wrote: > > > If I would have to guess, I would assume that we have a refcount issue such > > > that we succeed in splitting a folio while concurrently mapping it. > > > > That would seem hard to accomplish, because both hold the folio lock, > > so it wouldn't be just a refcount bug but also a locking bug. Not sure > > what this is though. > > Yeah, but we also have > > https://lkml.kernel.org/r/6774bf44.050a0220.25abdd.098a.GAE@google.com That one is a UAF on the vma, so it's either a different issue, or the problem is with the VMA refcount/lookup/..., not the folio refcount. cc'ing the relevant maintainers.