Alright, I found out the answer. When PAGE_MAPPING_ANON bit is set, page->mapping points to anon vma of the respective page. It has been documented (https://elixir.bootlin.com/linux/v5.11.22/source/include/linux/page-flags.h#L474). The mapping field points to different data structures based on the flag.