WARNING: lock held when returning to user space in lock_next

WARNING: lock held when returning to user space in lock_next_vma

Status: upstream: reported C repro on 2025/07/08 17:52
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+80011ad33eec39e6ce42@syzkaller.appspotmail.com
First crash: 2d12h, last: 2d12h

Cause bisection: introduced by (bisect log) :
commit 6772c457a86536f3496bf5b3716f34a5ac125783
Author: Suren Baghdasaryan <surenb@google.com>
Date: Tue Jun 24 19:33:59 2025 +0000

fs/proc/task_mmu:: execute PROCMAP_QUERY ioctl under per-vma locks

Crash: BUG: unable to handle kernel paging request in lock_next_vma (log)
Repro: C syz .config

▶ ▼ Discussions (1)

Title	Replies (including bot)	Last reply
[syzbot] [mm?] WARNING: lock held when returning to user space in lock_next_vma	6 (8)	2025/07/09 14:29

Sample crash report:

================================================
WARNING: lock held when returning to user space!
6.16.0-rc4-next-20250704-syzkaller #0 Not tainted
------------------------------------------------
syz.0.22/6068 is leaving the kernel with locks still held!
1 lock held by syz.0.22/6068:
 #0: ffff8880792a3588 (vm_lock){++++}-{0:0}, at: lock_next_vma+0x146/0xdc0 mm/mmap_lock.c:220

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/07/08 08:48	linux-next	26ffb3d6f02c	4f67c4ae	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	WARNING: lock held when returning to user space in lock_next_vma

* ~~Struck through~~ repros no longer work on HEAD.