WARNING: lock held when returning to user space in lock_next

WARNING: lock held when returning to user space in lock_next_vma

Status: upstream: reported C repro on 2025/07/08 17:52
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
First crash: 5d09h, last: 9h50m

Cause bisection: introduced by (bisect log) :
commit 6772c457a86536f3496bf5b3716f34a5ac125783
Author: Suren Baghdasaryan <surenb@google.com>
Date: Tue Jun 24 19:33:59 2025 +0000

fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks

Crash: BUG: unable to handle kernel paging request in lock_next_vma (log)
Repro: C syz .config

▶ ▼ Discussions (1)

Title	Replies (including bot)	Last reply
[syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma	11 (18)	2025/07/11 05:44

▶ ▼ Last patch testing requests (5)


Created	Duration	User	Patch	Repo	Result
2025/07/11 05:09	16m	hdanton@sina.com		linux-next	report log
2025/07/11 04:03	24m	hdanton@sina.com	patch	linux-next	OK log
2025/07/11 03:54	0m	hdanton@sina.com	patch	https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master	error
2025/07/11 02:26	0m	hdanton@sina.com	patch	linux-next	error
2025/07/11 00:32	19m	hdanton@sina.com	patch	linux-next	report log

Sample crash report:

================================================
WARNING: lock held when returning to user space!
6.16.0-rc5-next-20250711-syzkaller #0 Not tainted
------------------------------------------------
syz.0.23/6088 is leaving the kernel with locks still held!
1 lock held by syz.0.23/6088:
 #0: ffff888076b956c8 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/07/13 08:45	linux-next	a62b7a37e6fc	3cda49cf	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	WARNING: lock held when returning to user space in lock_next_vma
2025/07/08 08:48	linux-next	26ffb3d6f02c	4f67c4ae	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	WARNING: lock held when returning to user space in lock_next_vma

* ~~Struck through~~ repros no longer work on HEAD.