Re: [syzbot] kernel BUG in __page_mapcount

[Matthew Wilcox]

On Tue, Dec 21, 2021 at 10:24:27AM -0800, Yang Shi wrote:
> It seems the THP is split during smaps walk. The reproducer does call
> MADV_FREE on partial THP which may split the huge page.
> 
> The below fix (untested) should be able to fix it.

Did you read the rest of the thread on this?  If the page is being
migrated, we should still account it ... also, you've changed the
refcount, so this:

        if (page_count(page) == 1) {
                smaps_page_accumulate(mss, page, size, size << PSS_SHIFT, dirty,
                        locked, true);
                return;
        }

will never trigger.