Re: [BUG] WARNING in unlink_anon_vmas()

[David Hildenbrand (Arm)]

On 3/18/26 11:42, Jiakai Xu wrote:
> Hi all,

Hi,

> 
> While fuzzing the KVM subsystem on RISC-V, I stumbled upon a kernel WARNING
> that triggers in unlink_anon_vmas().
> 

Looking at the log, this is against 7.0.0-rc2-00014-gc61ec3e8cc5d

>  WARNING: mm/rmap.c:528 at unlink_anon_vmas+0x562/0x768 mm/rmap.c:528
>  unlink_anon_vmas+0x562/0x768 mm/rmap.c:528
>  free_pgtables+0x2a0/0x860 mm/memory.c:427
>  exit_mmap+0x406/0xd14 mm/mmap.c:1314
>  __mmput+0x114/0x3d4 kernel/fork.c:1174
>  mmput+0x74/0x88 kernel/fork.c:1197
>  exit_mm kernel/exit.c:581 [inline]
>  do_exit+0x7de/0x2adc kernel/exit.c:959
>  do_group_exit+0xd4/0x26c kernel/exit.c:1112
>  __do_sys_exit_group kernel/exit.c:1123 [inline]
>  __se_sys_exit_group kernel/exit.c:1121 [inline]
>  __riscv_sys_exit_group+0x4a/0x54 kernel/exit.c:1121
>  syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112
>  do_trap_ecall_u+0x39e/0x62e arch/riscv/kernel/traps.c:344
>  handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232
> 
> I am not an expert in this area and have not done a deep manual analysis.
> 
> The full crash log, a reproducer, the kernel .config, and the relevant
> source/commit info are available in my GitHub repository:
>     https://github.com/j1akai/temp/tree/main/20260318
> 
> If this turns out to be a real bug and there is anything I can do to help
> with fixing or testing, I am happy to do so. I hope this report is useful
> and sorry for any noise if it has already been addressed.


We trigger a VM_WARN_ON, so that's certainly something to resolve.

Seems to be:

	VM_WARN_ON(anon_vma->num_active_vmas);

Which was added by

commit 2555283eb40df89945557273121e9393ef9b542b
Author: Jann Horn <jannh@xxxxxxxxxx>
Date:   Wed Aug 31 19:06:00 2022 +0200

    mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
    
    anon_vma->degree tracks the combined number of child anon_vmas and VMAs
    that use the anon_vma as their ->anon_vma.



-- 
Cheers,

David