syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1344]
≡ Subsystems
🐞 Fixed [7090]
🐞 Invalid [18714]
⬇ Missing Backports [220]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

WARNING in folio_add_new_anon_rmap

Status: upstream: reported C repro on 2026/03/15 19:09
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+e24a2e34fad0efbac047@syzkaller.appspotmail.com
Fix commit: userfaultfd-introduce-struct-mfill_state-fix
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 65d, last: 62d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
1ffca708-4a67-4b64-96a6-4ffda6f4ed91 assessment-security 💥 WARNING in folio_add_new_anon_rmap 2026/05/15 07:05 2026/05/15 07:05 2026/05/15 07:06 6ccb967e465e832a7bfd7a116ad00d52a0923a5d failed to run ["git" "pull" "origin" "HEAD" "--depth=1" "--allow-unrelated-histories"]: exit status 128 From /app/workdir/repo/linux * branch HEAD -> FETCH_HEAD Updating files: 18% (17503/93440) Updating files: 19% (17754/93440) error: unable to write file arch/arm64/boot/dts/qcom/sm6115.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm6115p-lenovo-j606f.dts error: unable to write file arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts error: unable to write file arch/arm64/boot/dts/qcom/sm6125-xiaomi-ginkgo-common.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm6125-xiaomi-ginkgo.dts error: unable to write file arch/arm64/boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts error: unable to write file arch/arm64/boot/dts/qcom/sm6125-xiaomi-willow.dts error: unable to write file arch/arm64/boot/dts/qcom/sm6125.dtsi error: unable to create file arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts: No space left on device error: unable to create file arch/arm64/boot/dts/qcom/sm6350.dtsi: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts error: unable to write file arch/arm64/boot/dts/qcom/sm6375.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm7125-xiaomi-common.dtsi error: unable to create file arch/arm64/boot/dts/qcom/sm7125-xiaomi-curtana.dts: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm7125-xiaomi-joyeuse.dts error: unable to create file arch/arm64/boot/dts/qcom/sm7125.dtsi: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts error: unable to write file arch/arm64/boot/dts/qcom/sm7225.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm7325-nothing-spacewar.dts error: unable to write file arch/arm64/boot/dts/qcom/sm7325.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm8150-hdk.dts error: unable to create file arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm8150-mtp.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano-bahamut.dts error: unable to create file arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano-griffin.dts: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm8150.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm8250-hdk.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8250-mtp.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8250-samsung-common.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm8250-samsung-r8q.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8250-samsung-x1q.dts error: unable to create file arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi error: unable to create file arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-boe.dts: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-csot.dts error: unable to create file arch/arm64/boot/dts/qcom/sm8250-xiaomi-pipa.dts: No space left on device error: unable to write file arch/arm64/boot/dts/qcom/sm8250.dtsi error: unable to write file arch/arm64/boot/dts/qcom/sm8350-hdk.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8350-mtp.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts error: unable to write file arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi error: unable to write file arch/a
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [mm?] WARNING in folio_add_new_anon_rmap 2 (6) 2026/03/16 11:01
[PATCH] mm/userfaultfd: re-validate vma in mfill_atomic() loop under CONFIG_PER_VMA_LOCK 2 (2) 2026/03/16 10:59
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/03/16 06:20 32m harry.yoo@oracle.com patch linux-next OK log
2026/03/16 05:11 47m kartikey406@gmail.com patch linux-next report log
2026/03/16 02:02 33m kartikey406@gmail.com patch linux-next OK log

Sample crash report:
------------[ cut here ]------------
address < vma->vm_start || address + (nr << 12) > vma->vm_end
WARNING: mm/rmap.c:1682 at folio_add_new_anon_rmap+0x5fe/0x14b0 mm/rmap.c:1681, CPU#1: syz.2.19/6118
Modules linked in:
CPU: 1 UID: 0 PID: 6118 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
RIP: 0010:folio_add_new_anon_rmap+0x5fe/0x14b0 mm/rmap.c:1681
Code: 89 f5 4d 8b 36 4c 89 e7 4c 89 f6 e8 ec aa a9 ff 4d 39 f4 73 1a e8 82 a8 a9 ff 4c 8b 74 24 10 49 bc 00 00 00 00 00 fc ff df 90 <0f> 0b 90 eb 5a 44 89 f8 c1 e0 0c 48 98 49 01 c4 49 83 c5 08 4c 89
RSP: 0018:ffffc900036675a0 EFLAGS: 00010293
RAX: ffffffff821d041e RBX: ffffea0001c0c1c0 RCX: ffff888060bf5b80
RDX: 0000000000000000 RSI: 00002000004ca000 RDI: 00002000004cb000
RBP: 0000000000000000 R08: ffffea0001c0c1c7 R09: 1ffffd4000381838
R10: dffffc0000000000 R11: fffff94000381839 R12: dffffc0000000000
R13: ffff8880784ad788 R14: ffffea0001c0c1c8 R15: 0000000000000001
FS:  00007f9a968ce6c0(0000) GS:ffff88812553e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000002b8000 CR3: 000000007c646000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 mfill_atomic_install_pte+0x578/0x870 mm/userfaultfd.c:390
 __mfill_atomic_pte+0x3c4/0x5f0 mm/userfaultfd.c:523
 mfill_atomic_pte_copy mm/userfaultfd.c:557 [inline]
 mfill_atomic_pte mm/userfaultfd.c:865 [inline]
 mfill_atomic mm/userfaultfd.c:923 [inline]
 mfill_atomic_copy+0x4d9/0x1330 mm/userfaultfd.c:950
 userfaultfd_copy fs/userfaultfd.c:1642 [inline]
 userfaultfd_ioctl+0x2b8a/0x4b00 fs/userfaultfd.c:2059
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9a9599c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9a968ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f9a95c15fa0 RCX: 00007f9a9599c799
RDX: 0000200000000040 RSI: 00000000c028aa03 RDI: 0000000000000003
RBP: 00007f9a95a32c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9a95c16038 R14: 00007f9a95c15fa0 R15: 00007ffd373c5448
 </TASK>

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/12 01:11 linux-next f90aadf1c67c 2d88ab01 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/12 00:35 linux-next f90aadf1c67c 2d88ab01 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/11 23:47 linux-next f90aadf1c67c 2d88ab01 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/11 23:00 linux-next f90aadf1c67c 2d88ab01 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/14 07:06 linux-next b84a0ebe421c ee8d34d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in folio_add_new_anon_rmap
2026/03/14 01:50 linux-next b84a0ebe421c 351cb5cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in folio_add_new_anon_rmap
2026/03/13 01:05 linux-next 5c9e55fecf93 2f7f359d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/13 01:05 linux-next 5c9e55fecf93 2f7f359d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/12 23:22 linux-next 5c9e55fecf93 2f7f359d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in folio_add_new_anon_rmap
2026/03/12 23:22 linux-next 5c9e55fecf93 2f7f359d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in folio_add_new_anon_rmap
2026/03/12 10:52 linux-next f90aadf1c67c 4efadf07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/12 10:52 linux-next f90aadf1c67c 4efadf07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/12 10:52 linux-next f90aadf1c67c 4efadf07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
2026/03/11 18:59 linux-next f90aadf1c67c 2d88ab01 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in folio_add_new_anon_rmap
* Struck through repros no longer work on HEAD.