From nobody Thu Sep 11 13:01:07 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F328C04FE2 for ; Thu, 3 Aug 2023 17:27:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234744AbjHCR1F (ORCPT ); Thu, 3 Aug 2023 13:27:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42360 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234670AbjHCR1A (ORCPT ); Thu, 3 Aug 2023 13:27:00 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B18DF3581 for ; Thu, 3 Aug 2023 10:26:58 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id 3f1490d57ef6-d4091be02b1so1264903276.1 for ; Thu, 03 Aug 2023 10:26:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691083618; x=1691688418; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=71RLrK6Mb0aadLJnf8lNJkVJrOaKPnZ5THHnlI7+5Ec=; b=z+dQhQo+Kt6Eb1Ib+dHdcc5V/AMlevUGc3YlsFbmFxB8Ja4tQL0sH583LPCWHFEKjr LCJT0zSGk242YQimvb9fWrReMP3dYgoxBDMB5aSvFbBas9Qi+mtKIyhJ5sOA6H93jSPA R+X5vWxIjdvpEuwSIeyZt4s4fP03JBTeA8GITi/vGy+0azOReq95xpDC5gosxo4P7L+f qORD71ozdIKCy1hZFUlq7/ogEyre/zziudpgQzDONH/lXc9z3s8VuH3xg5QPQ8rKfCS5 Q5g6DHxNksBOYdDKBZ5rLMB641Cm5MK9gkaR7CAnuxbqNZ64rc/TRUA/dgOJMrYH2nl6 /KbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691083618; x=1691688418; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=71RLrK6Mb0aadLJnf8lNJkVJrOaKPnZ5THHnlI7+5Ec=; b=cFtkdoLn+Z8JC2WoqYhRtzjvInIYSh0zI6Xl67smxUUlun5/5kZ/UYHszHFsDINwCp lMcdqnAob+5Vn0bo5PENxC5i3YRst0Y+0yDtOk/DMgfD4zcUKDc8TvI4oHzZ2GuX+2vm o+jDiaZMm/N0f32s9FcLekmOQcMCTyNkVvWl1mNEOifTdptMo5Vboi7qC53XmOjAo/Il WiE4BW1+7KfB7O3HvDjuMDNfunKy4b8DbX/P5LLxjD9FNXvqxZ/jlnm3k4bmcUZ+AWC6 s7/OWqXkmexDzSGxwYciBoyN0Qcj9uKi1As1Sjlst/Jwis7RumTW5doObMracyYBgvtH 1GQQ== X-Gm-Message-State: ABy/qLYY2CFIxtn/vj+zxdA7+moJSl0FtEJ7GV33OchLwWNjtpT5QnbH Gyerprhh7qO/2cEvHLlueJ7ZkfUFO68= X-Google-Smtp-Source: APBJJlHG20H85H4lsY8faC8hU9eTd9+dNHHyvDgi8rmCO+g2myKSnUTG+z8MfGkV4XoNO+8b/dUqf5AuJJw= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3dec:ef9e:7bf4:7a6]) (user=surenb job=sendgmr) by 2002:a05:6902:11cb:b0:d16:7ccc:b406 with SMTP id n11-20020a05690211cb00b00d167cccb406mr243662ybu.5.1691083617987; Thu, 03 Aug 2023 10:26:57 -0700 (PDT) Date: Thu, 3 Aug 2023 10:26:46 -0700 In-Reply-To: <20230803172652.2849981-1-surenb@google.com> Mime-Version: 1.0 References: <20230803172652.2849981-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230803172652.2849981-2-surenb@google.com> Subject: [PATCH v3 1/6] mm: enable page walking API to lock vmas during the walk From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Suren Baghdasaryan , Linus Torvalds Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" walk_page_range() and friends often operate under write-locked mmap_lock. With introduction of vma locks, the vmas have to be locked as well during such walks to prevent concurrent page faults in these areas. Add an additional member to mm_walk_ops to indicate locking requirements for the walk. Cc: stable@vger.kernel.org # 6.4.x Suggested-by: Linus Torvalds Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan --- arch/powerpc/mm/book3s64/subpage_prot.c | 1 + arch/riscv/mm/pageattr.c | 1 + arch/s390/mm/gmap.c | 5 ++++ fs/proc/task_mmu.c | 5 ++++ include/linux/pagewalk.h | 11 ++++++++ mm/damon/vaddr.c | 2 ++ mm/hmm.c | 1 + mm/ksm.c | 25 ++++++++++------- mm/madvise.c | 3 +++ mm/memcontrol.c | 2 ++ mm/memory-failure.c | 1 + mm/mempolicy.c | 22 +++++++++------ mm/migrate_device.c | 1 + mm/mincore.c | 1 + mm/mlock.c | 1 + mm/mprotect.c | 1 + mm/pagewalk.c | 36 ++++++++++++++++++++++--- mm/vmscan.c | 1 + 18 files changed, 100 insertions(+), 20 deletions(-) diff --git a/arch/powerpc/mm/book3s64/subpage_prot.c b/arch/powerpc/mm/book= 3s64/subpage_prot.c index 0dc85556dec5..ec98e526167e 100644 --- a/arch/powerpc/mm/book3s64/subpage_prot.c +++ b/arch/powerpc/mm/book3s64/subpage_prot.c @@ -145,6 +145,7 @@ static int subpage_walk_pmd_entry(pmd_t *pmd, unsigned = long addr, =20 static const struct mm_walk_ops subpage_walk_ops =3D { .pmd_entry =3D subpage_walk_pmd_entry, + .walk_lock =3D PGWALK_WRLOCK_VERIFY, }; =20 static void subpage_mark_vma_nohuge(struct mm_struct *mm, unsigned long ad= dr, diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c index ea3d61de065b..161d0b34c2cb 100644 --- a/arch/riscv/mm/pageattr.c +++ b/arch/riscv/mm/pageattr.c @@ -102,6 +102,7 @@ static const struct mm_walk_ops pageattr_ops =3D { .pmd_entry =3D pageattr_pmd_entry, .pte_entry =3D pageattr_pte_entry, .pte_hole =3D pageattr_pte_hole, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mas= k, diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 9c8af31be970..906a7bfc2a78 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -2514,6 +2514,7 @@ static int thp_split_walk_pmd_entry(pmd_t *pmd, unsig= ned long addr, =20 static const struct mm_walk_ops thp_split_walk_ops =3D { .pmd_entry =3D thp_split_walk_pmd_entry, + .walk_lock =3D PGWALK_WRLOCK_VERIFY, }; =20 static inline void thp_split_mm(struct mm_struct *mm) @@ -2565,6 +2566,7 @@ static int __zap_zero_pages(pmd_t *pmd, unsigned long= start, =20 static const struct mm_walk_ops zap_zero_walk_ops =3D { .pmd_entry =3D __zap_zero_pages, + .walk_lock =3D PGWALK_WRLOCK, }; =20 /* @@ -2655,6 +2657,7 @@ static const struct mm_walk_ops enable_skey_walk_ops = =3D { .hugetlb_entry =3D __s390_enable_skey_hugetlb, .pte_entry =3D __s390_enable_skey_pte, .pmd_entry =3D __s390_enable_skey_pmd, + .walk_lock =3D PGWALK_WRLOCK, }; =20 int s390_enable_skey(void) @@ -2692,6 +2695,7 @@ static int __s390_reset_cmma(pte_t *pte, unsigned lon= g addr, =20 static const struct mm_walk_ops reset_cmma_walk_ops =3D { .pte_entry =3D __s390_reset_cmma, + .walk_lock =3D PGWALK_WRLOCK, }; =20 void s390_reset_cmma(struct mm_struct *mm) @@ -2728,6 +2732,7 @@ static int s390_gather_pages(pte_t *ptep, unsigned lo= ng addr, =20 static const struct mm_walk_ops gather_pages_ops =3D { .pte_entry =3D s390_gather_pages, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 507cd4e59d07..ef6ee330e3be 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -758,12 +758,14 @@ static int smaps_hugetlb_range(pte_t *pte, unsigned l= ong hmask, static const struct mm_walk_ops smaps_walk_ops =3D { .pmd_entry =3D smaps_pte_range, .hugetlb_entry =3D smaps_hugetlb_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static const struct mm_walk_ops smaps_shmem_walk_ops =3D { .pmd_entry =3D smaps_pte_range, .hugetlb_entry =3D smaps_hugetlb_range, .pte_hole =3D smaps_pte_hole, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* @@ -1245,6 +1247,7 @@ static int clear_refs_test_walk(unsigned long start, = unsigned long end, static const struct mm_walk_ops clear_refs_walk_ops =3D { .pmd_entry =3D clear_refs_pte_range, .test_walk =3D clear_refs_test_walk, + .walk_lock =3D PGWALK_WRLOCK, }; =20 static ssize_t clear_refs_write(struct file *file, const char __user *buf, @@ -1622,6 +1625,7 @@ static const struct mm_walk_ops pagemap_ops =3D { .pmd_entry =3D pagemap_pmd_range, .pte_hole =3D pagemap_pte_hole, .hugetlb_entry =3D pagemap_hugetlb_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* @@ -1935,6 +1939,7 @@ static int gather_hugetlb_stats(pte_t *pte, unsigned = long hmask, static const struct mm_walk_ops show_numa_ops =3D { .hugetlb_entry =3D gather_hugetlb_stats, .pmd_entry =3D gather_pte_stats, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/include/linux/pagewalk.h b/include/linux/pagewalk.h index 27a6df448ee5..27cd1e59ccf7 100644 --- a/include/linux/pagewalk.h +++ b/include/linux/pagewalk.h @@ -6,6 +6,16 @@ =20 struct mm_walk; =20 +/* Locking requirement during a page walk. */ +enum page_walk_lock { + /* mmap_lock should be locked for read to stabilize the vma tree */ + PGWALK_RDLOCK =3D 0, + /* vma will be write-locked during the walk */ + PGWALK_WRLOCK =3D 1, + /* vma is expected to be already write-locked during the walk */ + PGWALK_WRLOCK_VERIFY =3D 2, +}; + /** * struct mm_walk_ops - callbacks for walk_page_range * @pgd_entry: if set, called for each non-empty PGD (top-level) entry @@ -66,6 +76,7 @@ struct mm_walk_ops { int (*pre_vma)(unsigned long start, unsigned long end, struct mm_walk *walk); void (*post_vma)(struct mm_walk *walk); + enum page_walk_lock walk_lock; }; =20 /* diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c index 2fcc9731528a..e0e59d420fca 100644 --- a/mm/damon/vaddr.c +++ b/mm/damon/vaddr.c @@ -386,6 +386,7 @@ static int damon_mkold_hugetlb_entry(pte_t *pte, unsign= ed long hmask, static const struct mm_walk_ops damon_mkold_ops =3D { .pmd_entry =3D damon_mkold_pmd_entry, .hugetlb_entry =3D damon_mkold_hugetlb_entry, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void damon_va_mkold(struct mm_struct *mm, unsigned long addr) @@ -525,6 +526,7 @@ static int damon_young_hugetlb_entry(pte_t *pte, unsign= ed long hmask, static const struct mm_walk_ops damon_young_ops =3D { .pmd_entry =3D damon_young_pmd_entry, .hugetlb_entry =3D damon_young_hugetlb_entry, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static bool damon_va_young(struct mm_struct *mm, unsigned long addr, diff --git a/mm/hmm.c b/mm/hmm.c index 855e25e59d8f..277ddcab4947 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -562,6 +562,7 @@ static const struct mm_walk_ops hmm_walk_ops =3D { .pte_hole =3D hmm_vma_walk_hole, .hugetlb_entry =3D hmm_vma_walk_hugetlb_entry, .test_walk =3D hmm_vma_walk_test, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /** diff --git a/mm/ksm.c b/mm/ksm.c index ba266359da55..00c21fb4d94e 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -455,6 +455,12 @@ static int break_ksm_pmd_entry(pmd_t *pmd, unsigned lo= ng addr, unsigned long nex =20 static const struct mm_walk_ops break_ksm_ops =3D { .pmd_entry =3D break_ksm_pmd_entry, + .walk_lock =3D PGWALK_RDLOCK, +}; + +static const struct mm_walk_ops break_ksm_lock_vma_ops =3D { + .pmd_entry =3D break_ksm_pmd_entry, + .walk_lock =3D PGWALK_WRLOCK, }; =20 /* @@ -470,16 +476,17 @@ static const struct mm_walk_ops break_ksm_ops =3D { * of the process that owns 'vma'. We also do not want to enforce * protection keys here anyway. */ -static int break_ksm(struct vm_area_struct *vma, unsigned long addr) +static int break_ksm(struct vm_area_struct *vma, unsigned long addr, bool = lock_vma) { vm_fault_t ret =3D 0; + const struct mm_walk_ops *ops =3D lock_vma ? + &break_ksm_lock_vma_ops : &break_ksm_ops; =20 do { int ksm_page; =20 cond_resched(); - ksm_page =3D walk_page_range_vma(vma, addr, addr + 1, - &break_ksm_ops, NULL); + ksm_page =3D walk_page_range_vma(vma, addr, addr + 1, ops, NULL); if (WARN_ON_ONCE(ksm_page < 0)) return ksm_page; if (!ksm_page) @@ -565,7 +572,7 @@ static void break_cow(struct ksm_rmap_item *rmap_item) mmap_read_lock(mm); vma =3D find_mergeable_vma(mm, addr); if (vma) - break_ksm(vma, addr); + break_ksm(vma, addr, false); mmap_read_unlock(mm); } =20 @@ -871,7 +878,7 @@ static void remove_trailing_rmap_items(struct ksm_rmap_= item **rmap_list) * in cmp_and_merge_page on one of the rmap_items we would be removing. */ static int unmerge_ksm_pages(struct vm_area_struct *vma, - unsigned long start, unsigned long end) + unsigned long start, unsigned long end, bool lock_vma) { unsigned long addr; int err =3D 0; @@ -882,7 +889,7 @@ static int unmerge_ksm_pages(struct vm_area_struct *vma, if (signal_pending(current)) err =3D -ERESTARTSYS; else - err =3D break_ksm(vma, addr); + err =3D break_ksm(vma, addr, lock_vma); } return err; } @@ -1029,7 +1036,7 @@ static int unmerge_and_remove_all_rmap_items(void) if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma) continue; err =3D unmerge_ksm_pages(vma, - vma->vm_start, vma->vm_end); + vma->vm_start, vma->vm_end, false); if (err) goto error; } @@ -2530,7 +2537,7 @@ static int __ksm_del_vma(struct vm_area_struct *vma) return 0; =20 if (vma->anon_vma) { - err =3D unmerge_ksm_pages(vma, vma->vm_start, vma->vm_end); + err =3D unmerge_ksm_pages(vma, vma->vm_start, vma->vm_end, true); if (err) return err; } @@ -2668,7 +2675,7 @@ int ksm_madvise(struct vm_area_struct *vma, unsigned = long start, return 0; /* just ignore the advice */ =20 if (vma->anon_vma) { - err =3D unmerge_ksm_pages(vma, start, end); + err =3D unmerge_ksm_pages(vma, start, end, true); if (err) return err; } diff --git a/mm/madvise.c b/mm/madvise.c index 886f06066622..bfe0e06427bd 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -233,6 +233,7 @@ static int swapin_walk_pmd_entry(pmd_t *pmd, unsigned l= ong start, =20 static const struct mm_walk_ops swapin_walk_ops =3D { .pmd_entry =3D swapin_walk_pmd_entry, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void shmem_swapin_range(struct vm_area_struct *vma, @@ -534,6 +535,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, =20 static const struct mm_walk_ops cold_walk_ops =3D { .pmd_entry =3D madvise_cold_or_pageout_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void madvise_cold_page_range(struct mmu_gather *tlb, @@ -757,6 +759,7 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned = long addr, =20 static const struct mm_walk_ops madvise_free_walk_ops =3D { .pmd_entry =3D madvise_free_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static int madvise_free_single_vma(struct vm_area_struct *vma, diff --git a/mm/memcontrol.c b/mm/memcontrol.c index e8ca4bdcb03c..315fd5f45e3c 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6024,6 +6024,7 @@ static int mem_cgroup_count_precharge_pte_range(pmd_t= *pmd, =20 static const struct mm_walk_ops precharge_walk_ops =3D { .pmd_entry =3D mem_cgroup_count_precharge_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm) @@ -6303,6 +6304,7 @@ static int mem_cgroup_move_charge_pte_range(pmd_t *pm= d, =20 static const struct mm_walk_ops charge_walk_ops =3D { .pmd_entry =3D mem_cgroup_move_charge_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void mem_cgroup_move_charge(void) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index ece5d481b5ff..6bfb762facab 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -831,6 +831,7 @@ static int hwpoison_hugetlb_range(pte_t *ptep, unsigned= long hmask, static const struct mm_walk_ops hwp_walk_ops =3D { .pmd_entry =3D hwpoison_pte_range, .hugetlb_entry =3D hwpoison_hugetlb_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/mm/mempolicy.c b/mm/mempolicy.c index c53f8beeb507..ec2eaceffd74 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -718,6 +718,14 @@ static const struct mm_walk_ops queue_pages_walk_ops = =3D { .hugetlb_entry =3D queue_folios_hugetlb, .pmd_entry =3D queue_folios_pte_range, .test_walk =3D queue_pages_test_walk, + .walk_lock =3D PGWALK_RDLOCK, +}; + +static const struct mm_walk_ops queue_pages_lock_vma_walk_ops =3D { + .hugetlb_entry =3D queue_folios_hugetlb, + .pmd_entry =3D queue_folios_pte_range, + .test_walk =3D queue_pages_test_walk, + .walk_lock =3D PGWALK_WRLOCK, }; =20 /* @@ -738,7 +746,7 @@ static const struct mm_walk_ops queue_pages_walk_ops = =3D { static int queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long= end, nodemask_t *nodes, unsigned long flags, - struct list_head *pagelist) + struct list_head *pagelist, bool lock_vma) { int err; struct queue_pages qp =3D { @@ -749,8 +757,10 @@ queue_pages_range(struct mm_struct *mm, unsigned long = start, unsigned long end, .end =3D end, .first =3D NULL, }; + const struct mm_walk_ops *ops =3D lock_vma ? + &queue_pages_lock_vma_walk_ops : &queue_pages_walk_ops; =20 - err =3D walk_page_range(mm, start, end, &queue_pages_walk_ops, &qp); + err =3D walk_page_range(mm, start, end, ops, &qp); =20 if (!qp.first) /* whole range in hole */ @@ -1078,7 +1088,7 @@ static int migrate_to_node(struct mm_struct *mm, int = source, int dest, vma =3D find_vma(mm, 0); VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))); queue_pages_range(mm, vma->vm_start, mm->task_size, &nmask, - flags | MPOL_MF_DISCONTIG_OK, &pagelist); + flags | MPOL_MF_DISCONTIG_OK, &pagelist, false); =20 if (!list_empty(&pagelist)) { err =3D migrate_pages(&pagelist, alloc_migration_target, NULL, @@ -1321,12 +1331,8 @@ static long do_mbind(unsigned long start, unsigned l= ong len, * Lock the VMAs before scanning for pages to migrate, to ensure we don't * miss a concurrently inserted page. */ - vma_iter_init(&vmi, mm, start); - for_each_vma_range(vmi, vma, end) - vma_start_write(vma); - ret =3D queue_pages_range(mm, start, end, nmask, - flags | MPOL_MF_INVERT, &pagelist); + flags | MPOL_MF_INVERT, &pagelist, true); =20 if (ret < 0) { err =3D ret; diff --git a/mm/migrate_device.c b/mm/migrate_device.c index 8365158460ed..d5f492356e3e 100644 --- a/mm/migrate_device.c +++ b/mm/migrate_device.c @@ -279,6 +279,7 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp, static const struct mm_walk_ops migrate_vma_walk_ops =3D { .pmd_entry =3D migrate_vma_collect_pmd, .pte_hole =3D migrate_vma_collect_hole, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/mm/mincore.c b/mm/mincore.c index b7f7a516b26c..dad3622cc963 100644 --- a/mm/mincore.c +++ b/mm/mincore.c @@ -176,6 +176,7 @@ static const struct mm_walk_ops mincore_walk_ops =3D { .pmd_entry =3D mincore_pte_range, .pte_hole =3D mincore_unmapped_range, .hugetlb_entry =3D mincore_hugetlb, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/mm/mlock.c b/mm/mlock.c index 0a0c996c5c21..479e09d0994c 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -371,6 +371,7 @@ static void mlock_vma_pages_range(struct vm_area_struct= *vma, { static const struct mm_walk_ops mlock_walk_ops =3D { .pmd_entry =3D mlock_pte_range, + .walk_lock =3D PGWALK_WRLOCK_VERIFY, }; =20 /* diff --git a/mm/mprotect.c b/mm/mprotect.c index 6f658d483704..3aef1340533a 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -568,6 +568,7 @@ static const struct mm_walk_ops prot_none_walk_ops =3D { .pte_entry =3D prot_none_pte_entry, .hugetlb_entry =3D prot_none_hugetlb_entry, .test_walk =3D prot_none_test, + .walk_lock =3D PGWALK_WRLOCK, }; =20 int diff --git a/mm/pagewalk.c b/mm/pagewalk.c index 2022333805d3..9b2d23fbf4d3 100644 --- a/mm/pagewalk.c +++ b/mm/pagewalk.c @@ -400,6 +400,33 @@ static int __walk_page_range(unsigned long start, unsi= gned long end, return err; } =20 +static inline void process_mm_walk_lock(struct mm_struct *mm, + enum page_walk_lock walk_lock) +{ + if (walk_lock =3D=3D PGWALK_RDLOCK) + mmap_assert_locked(mm); + else + mmap_assert_write_locked(mm); +} + +static inline void process_vma_walk_lock(struct vm_area_struct *vma, + enum page_walk_lock walk_lock) +{ +#ifdef CONFIG_PER_VMA_LOCK + switch (walk_lock) { + case PGWALK_WRLOCK: + vma_start_write(vma); + break; + case PGWALK_WRLOCK_VERIFY: + vma_assert_write_locked(vma); + break; + case PGWALK_RDLOCK: + /* PGWALK_RDLOCK is handled by process_mm_walk_lock */ + break; + } +#endif +} + /** * walk_page_range - walk page table with caller specific callbacks * @mm: mm_struct representing the target process of page table walk @@ -459,7 +486,7 @@ int walk_page_range(struct mm_struct *mm, unsigned long= start, if (!walk.mm) return -EINVAL; =20 - mmap_assert_locked(walk.mm); + process_mm_walk_lock(walk.mm, ops->walk_lock); =20 vma =3D find_vma(walk.mm, start); do { @@ -474,6 +501,7 @@ int walk_page_range(struct mm_struct *mm, unsigned long= start, if (ops->pte_hole) err =3D ops->pte_hole(start, next, -1, &walk); } else { /* inside vma */ + process_vma_walk_lock(vma, ops->walk_lock); walk.vma =3D vma; next =3D min(end, vma->vm_end); vma =3D find_vma(mm, vma->vm_end); @@ -549,7 +577,8 @@ int walk_page_range_vma(struct vm_area_struct *vma, uns= igned long start, if (start < vma->vm_start || end > vma->vm_end) return -EINVAL; =20 - mmap_assert_locked(walk.mm); + process_mm_walk_lock(walk.mm, ops->walk_lock); + process_vma_walk_lock(vma, ops->walk_lock); return __walk_page_range(start, end, &walk); } =20 @@ -566,7 +595,8 @@ int walk_page_vma(struct vm_area_struct *vma, const str= uct mm_walk_ops *ops, if (!walk.mm) return -EINVAL; =20 - mmap_assert_locked(walk.mm); + process_mm_walk_lock(walk.mm, ops->walk_lock); + process_vma_walk_lock(vma, ops->walk_lock); return __walk_page_range(vma->vm_start, vma->vm_end, &walk); } =20 diff --git a/mm/vmscan.c b/mm/vmscan.c index 1080209a568b..3555927df9b5 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4284,6 +4284,7 @@ static void walk_mm(struct lruvec *lruvec, struct mm_= struct *mm, struct lru_gen_ static const struct mm_walk_ops mm_walk_ops =3D { .test_walk =3D should_skip_vma, .p4d_entry =3D walk_pud_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 int err; --=20 2.41.0.585.gd2178a4bd4-goog From nobody Thu Sep 11 13:01:07 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8F53C04E69 for ; Thu, 3 Aug 2023 17:27:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234628AbjHCR1J (ORCPT ); Thu, 3 Aug 2023 13:27:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42374 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234715AbjHCR1C (ORCPT ); Thu, 3 Aug 2023 13:27:02 -0400 Received: from mail-yw1-x114a.google.com (mail-yw1-x114a.google.com [IPv6:2607:f8b0:4864:20::114a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 18E3930C0 for ; Thu, 3 Aug 2023 10:27:01 -0700 (PDT) Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-583a89cccf6so13066897b3.1 for ; Thu, 03 Aug 2023 10:27:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691083620; x=1691688420; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=EHpUmzrQnDN6BdHRPVO0KcfDXP0OZ5FbBAepEsSX9Ig=; b=qxsXQyRbVAeRELuUUtKrCwywC6QQTi8GHNRwTQUgqwaMaE06n28e21MqPJCBZOSeOT Qdy3T1xm+nWsar3PElAyHH4XRbnbh/juQv6pT24VIx/hmG68SRWkDtgsWgv0Vbw+Xq4b +9kLmoit9sN1/gZfKklOc8XhcuoYMFvLaSeXIo/wdsXcRNSNRVLSqWMC8fCCM8aUcWcB aDSUJ5MX9993h31MPorj7ATaoVZTKC0TIpSNDyVZs/SHr6qPtsnYQt8mS3zlcdzRn4PP n6WROk+TAqngChxc1yRkKMEU0NvNbIWVZIRUByrfXNiHMt2U5V4plrf6i9OLozdZrkBK n96Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691083620; x=1691688420; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=EHpUmzrQnDN6BdHRPVO0KcfDXP0OZ5FbBAepEsSX9Ig=; b=XpfoX7FGoxZd4p2HaEp85hljlVpcV50iZ2+wHVKjis43nCw1Qc7/1800/IyvkjDpH1 +buNNp5dmDhAhXTIHaNgtd+f3ogs44I6242VAF7tD7QTTLxFl8mQMnyyNB1BPxb2Wcme FbcR+d/LgUtNGqXrWKDCcqmFBfkxX4ThkECmTR1phik96XyCdN5IQyDFa7Hm3UfAB2Ql ft5M8uzfKaU438JTrmTPcCo8LQpcw2hnmuOOhoel+FG325nLY4RueaoXfkg2PkvoTwuS mUwrYH2UyGho/r4iz7IlXIvmpcqzmiXaYyuvC5SIp38X0upyXVTxwHaGXP5Fb/87diX2 T+6g== X-Gm-Message-State: ABy/qLYdIAMv+wX1YL5X5U2webMi0ZGdmWom8Mhxc9Lvxbft7/kRxdjq EGE2aFngq4Lz2+B4Pj+oggtRyGYeUy0= X-Google-Smtp-Source: APBJJlFJcCahjdAYX9Zx+DEl8b9H6rEwuNU2P9eGDfvhDJtLw9lJ/qnx3rNt/z46v/MM98tnx4xoFSOUp3s= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3dec:ef9e:7bf4:7a6]) (user=surenb job=sendgmr) by 2002:a81:c509:0:b0:573:87b9:7ee9 with SMTP id k9-20020a81c509000000b0057387b97ee9mr191557ywi.4.1691083620320; Thu, 03 Aug 2023 10:27:00 -0700 (PDT) Date: Thu, 3 Aug 2023 10:26:47 -0700 In-Reply-To: <20230803172652.2849981-1-surenb@google.com> Mime-Version: 1.0 References: <20230803172652.2849981-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230803172652.2849981-3-surenb@google.com> Subject: [PATCH v3 2/6] mm: for !CONFIG_PER_VMA_LOCK equate write lock assertion for vma and mmap From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Suren Baghdasaryan , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When CONFIG_PER_VMA_LOCK=3Dn, vma_assert_write_locked() should be equivalent to mmap_assert_write_locked(). Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett --- include/linux/mm.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 406ab9ea818f..262b5f44101d 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -750,7 +750,8 @@ static inline void vma_end_read(struct vm_area_struct *= vma) {} static inline void vma_start_write(struct vm_area_struct *vma) {} static inline bool vma_try_start_write(struct vm_area_struct *vma) { return true; } -static inline void vma_assert_write_locked(struct vm_area_struct *vma) {} +static inline void vma_assert_write_locked(struct vm_area_struct *vma) + { mmap_assert_write_locked(vma->vm_mm); } static inline void vma_mark_detached(struct vm_area_struct *vma, bool detached) {} =20 --=20 2.41.0.585.gd2178a4bd4-goog From nobody Thu Sep 11 13:01:07 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77FEBC04FDF for ; Thu, 3 Aug 2023 17:27:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234823AbjHCR1M (ORCPT ); Thu, 3 Aug 2023 13:27:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234658AbjHCR1E (ORCPT ); Thu, 3 Aug 2023 13:27:04 -0400 Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2EEEB30C2 for ; Thu, 3 Aug 2023 10:27:03 -0700 (PDT) Received: by mail-yb1-xb4a.google.com with SMTP id 3f1490d57ef6-d27ac992539so1282230276.3 for ; Thu, 03 Aug 2023 10:27:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691083622; x=1691688422; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=LfajP5IIbFpg2Y7BQRxvk1sHiLCqjf/rsCkC3jBCtoI=; b=HHki6L/bmVrbbgbTtB9WdMtyro9jT73+cCAxKEfbQcmR3qH9v6ec6CcbLdBDBiHtbD DgkXEJ1VQUd+cMDxmtIXTtXdoPNmy73uD9LZlwIoe2mdEcYq/BSd/gAhOgP0fAm/mz7/ 8v51YuDLWoZ2H6bS1nhWVnhqzAMn395dK93Vn63kHAx/qo6JPUNuF05lCgUdd7cwcCXg Le/Ctgs2wSzsf6ywyFYUPRCg/ETixmQpFAd/6SNe06GNe12jbStG/hoYgMj4KbT0T2lp njpni/PXfMsrjLG8JE43HZ3PBUxm8AfwfKRLkTOdqi08qFkN+w6s2O9SAGVXJ8RtvGZy fOVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691083622; x=1691688422; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=LfajP5IIbFpg2Y7BQRxvk1sHiLCqjf/rsCkC3jBCtoI=; b=drdrzpNXl/Gyfd96B49WomhsHbJZMSTKJ5+HEs0hgJ9SIZnoO0HPUTluJUh54wSCWW dUPber416XL+NnP/sEr5mSnrdurBdOVXwQtFeMvP94JQv/pywHMhG7MUv+RFI68jhyr9 S9mqTu7fLcuSD792kUgAIPTzWtEPXCeflFfqH/kRVs40Y4e3rIdFyoyq3+YdBLBbekN3 40Q4nHD2HrfS+Ijvm4YUt1yg1rHLlF5NT9PYmOk1Y8lL5vMMqYGJSUP33QOAhPWE2dvz Kb/1+IPwGLbKoURKhxg5ZKXxaj0GIY6xGnn3MFJoG9dd7yx8OTElI85HHdk8Bkgkdlb5 PW0w== X-Gm-Message-State: ABy/qLbCqCh5wMH93EM/pw3hb5gfzpTJKmfIOxgVnFrW7MPh2B8/bua5 Do5LzFYE+nYnCUkM+RJ9YAW6fOk6Hbs= X-Google-Smtp-Source: APBJJlERuzjun8O5+88x8UQezAzWCkSvC+SxUAPYIz16CZMGZKaq/Tmi2dNZnAJHx5Bu+iggd6tbtkFAIsk= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3dec:ef9e:7bf4:7a6]) (user=surenb job=sendgmr) by 2002:a05:6902:569:b0:d11:3c58:2068 with SMTP id a9-20020a056902056900b00d113c582068mr132529ybt.2.1691083622391; Thu, 03 Aug 2023 10:27:02 -0700 (PDT) Date: Thu, 3 Aug 2023 10:26:48 -0700 In-Reply-To: <20230803172652.2849981-1-surenb@google.com> Mime-Version: 1.0 References: <20230803172652.2849981-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230803172652.2849981-4-surenb@google.com> Subject: [PATCH v3 3/6] mm: replace mmap with vma write lock assertions when operating on a vma From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Suren Baghdasaryan , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Vma write lock assertion always includes mmap write lock assertion and additional vma lock checks when per-VMA locks are enabled. Replace weaker mmap_assert_write_locked() assertions with stronger vma_assert_write_locked() ones when we are operating on a vma which is expected to be locked. Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett --- mm/hugetlb.c | 2 +- mm/khugepaged.c | 5 +++-- mm/memory.c | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 64a3239b6407..1d871a1167d8 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5028,7 +5028,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, st= ruct mm_struct *src, src_vma->vm_start, src_vma->vm_end); mmu_notifier_invalidate_range_start(&range); - mmap_assert_write_locked(src); + vma_assert_write_locked(src_vma); raw_write_seqcount_begin(&src->write_protect_seq); } else { /* diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 78c8d5d8b628..1e43a56fba31 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1495,7 +1495,7 @@ static int set_huge_pmd(struct vm_area_struct *vma, u= nsigned long addr, }; =20 VM_BUG_ON(!PageTransHuge(hpage)); - mmap_assert_write_locked(vma->vm_mm); + vma_assert_write_locked(vma); =20 if (do_set_pmd(&vmf, hpage)) return SCAN_FAIL; @@ -1525,7 +1525,7 @@ static void collapse_and_free_pmd(struct mm_struct *m= m, struct vm_area_struct *v pmd_t pmd; struct mmu_notifier_range range; =20 - mmap_assert_write_locked(mm); + vma_assert_write_locked(vma); if (vma->vm_file) lockdep_assert_held_write(&vma->vm_file->f_mapping->i_mmap_rwsem); /* @@ -1570,6 +1570,7 @@ int collapse_pte_mapped_thp(struct mm_struct *mm, uns= igned long addr, int count =3D 0, result =3D SCAN_FAIL; int i; =20 + /* Ensure vma can't change, it will be locked below after checks */ mmap_assert_write_locked(mm); =20 /* Fast check before locking page if already PMD-mapped */ diff --git a/mm/memory.c b/mm/memory.c index 603b2f419948..652d99b9858a 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1312,7 +1312,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struc= t vm_area_struct *src_vma) * Use the raw variant of the seqcount_t write API to avoid * lockdep complaining about preemptibility. */ - mmap_assert_write_locked(src_mm); + vma_assert_write_locked(src_vma); raw_write_seqcount_begin(&src_mm->write_protect_seq); } =20 --=20 2.41.0.585.gd2178a4bd4-goog From nobody Thu Sep 11 13:01:07 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50280C001DF for ; Thu, 3 Aug 2023 17:27:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234838AbjHCR1P (ORCPT ); Thu, 3 Aug 2023 13:27:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42418 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234670AbjHCR1G (ORCPT ); Thu, 3 Aug 2023 13:27:06 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 865553581 for ; Thu, 3 Aug 2023 10:27:05 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id 3f1490d57ef6-d1ef70d6a02so1379698276.0 for ; Thu, 03 Aug 2023 10:27:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691083624; x=1691688424; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=520TPAR42nWNvH3iwlw29nIZA75JEpTNGHc6Ua8ufv4=; b=3B64s3BVubEniqIBf5qTeAuU3p0nbnmnuBYsB+RpN6AZa3i3GGRn+/I8B0TAlv2Nks vcgJasJ0d6hq72DZeM0Lcm55BQ6bd/hb6ifugNbYwHXuziylKqPLbEduqiIbOnQiwIfT g0u3Le+LiGigCWodBqgYIs5hzDhaFXFQSJpVsN0EpnORpmgSB4VWx1SGQLrVpR398SXM jj5YOFr/dtJESoBiTGX4JBxqkjM8c4oYCcIgTjq3iohH0dJbfezpHUzECnQsmKYwCHk1 6xSsPFv1N8/zqJ0kI7aEpFrdp9jeZJ3j7FBpEWsso+eK/G/Snk1NGW/K3h+S2znshr9F Fcxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691083624; x=1691688424; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=520TPAR42nWNvH3iwlw29nIZA75JEpTNGHc6Ua8ufv4=; b=K4GxG+pt1uk5sO2tRgDj6xoHbQ6UvJK2OwfU1XA3WeSKtDcwmBw0+9ao53pHMFityD Jxlk/fXabmr8pLy3CwD1meXBSXbxfj5lO9DJBKjY7uAbNXbeESoSrqk8lrvm52CltalI bvm5I5QiMhjD5yum6wSCLIfshRZzCXJuqVBIXn2oIe/YmJX3vf1Kowqgubt/I+eYVQKQ b7AivNEiBdOIV22w2P/jpCj+J9N23DpOVo4tj0ZLZ+dDRvR0SddJ/w3ylGNCvmWVpnlF /yOzJpulQFbhtHau3q6/3XnvudE+ssBoc5JcbWk4ZSkkIapwaRDDJgADagaTRw5P7jFR PjMw== X-Gm-Message-State: ABy/qLZt7K5OqYkO/iRI9MENgtW3b6aUsgRIBWyjRSu/mtcDsoT4ptCm 8Y1V7YQ2PCRHCQft7v4YgsAsSYx5uA8= X-Google-Smtp-Source: APBJJlERLM1xcqSCyBewM6WMczSZdvf6/mfoOsnnM0je8oG7l6a+OZ1VwOuI0MHYyPuiy7m+zNnSmK0xJcM= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3dec:ef9e:7bf4:7a6]) (user=surenb job=sendgmr) by 2002:a25:250a:0:b0:d0a:86fc:536c with SMTP id l10-20020a25250a000000b00d0a86fc536cmr131344ybl.2.1691083624748; Thu, 03 Aug 2023 10:27:04 -0700 (PDT) Date: Thu, 3 Aug 2023 10:26:49 -0700 In-Reply-To: <20230803172652.2849981-1-surenb@google.com> Mime-Version: 1.0 References: <20230803172652.2849981-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230803172652.2849981-5-surenb@google.com> Subject: [PATCH v3 4/6] mm: lock vma explicitly before doing vm_flags_reset and vm_flags_reset_once From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Suren Baghdasaryan , Linus Torvalds Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implicit vma locking inside vm_flags_reset() and vm_flags_reset_once() is not obvious and makes it hard to understand where vma locking is happening. Also in some cases (like in dup_userfaultfd()) vma should be locked earlier than vma_flags modification. To make locking more visible, change these functions to assert that the vma write lock is taken and explicitly lock the vma beforehand. Fix userfaultfd functions which should lock the vma earlier. Suggested-by: Linus Torvalds Signed-off-by: Suren Baghdasaryan --- arch/powerpc/kvm/book3s_hv_uvmem.c | 1 + fs/userfaultfd.c | 6 ++++++ include/linux/mm.h | 10 +++++++--- mm/madvise.c | 5 ++--- mm/mlock.c | 3 ++- mm/mprotect.c | 1 + 6 files changed, 19 insertions(+), 7 deletions(-) diff --git a/arch/powerpc/kvm/book3s_hv_uvmem.c b/arch/powerpc/kvm/book3s_h= v_uvmem.c index 709ebd578394..e2d6f9327f77 100644 --- a/arch/powerpc/kvm/book3s_hv_uvmem.c +++ b/arch/powerpc/kvm/book3s_hv_uvmem.c @@ -410,6 +410,7 @@ static int kvmppc_memslot_page_merge(struct kvm *kvm, ret =3D H_STATE; break; } + vma_start_write(vma); /* Copy vm_flags to avoid partial modifications in ksm_madvise */ vm_flags =3D vma->vm_flags; ret =3D ksm_madvise(vma, vma->vm_start, vma->vm_end, diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 7cecd49e078b..6cde95533dcd 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -667,6 +667,7 @@ static void userfaultfd_event_wait_completion(struct us= erfaultfd_ctx *ctx, mmap_write_lock(mm); for_each_vma(vmi, vma) { if (vma->vm_userfaultfd_ctx.ctx =3D=3D release_new_ctx) { + vma_start_write(vma); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS); @@ -702,6 +703,7 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct = list_head *fcs) =20 octx =3D vma->vm_userfaultfd_ctx.ctx; if (!octx || !(octx->features & UFFD_FEATURE_EVENT_FORK)) { + vma_start_write(vma); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS); return 0; @@ -783,6 +785,7 @@ void mremap_userfaultfd_prep(struct vm_area_struct *vma, atomic_inc(&ctx->mmap_changing); } else { /* Drop uffd context if remap feature not enabled */ + vma_start_write(vma); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS); } @@ -940,6 +943,7 @@ static int userfaultfd_release(struct inode *inode, str= uct file *file) prev =3D vma; } =20 + vma_start_write(vma); userfaultfd_set_vm_flags(vma, new_flags); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; } @@ -1502,6 +1506,7 @@ static int userfaultfd_register(struct userfaultfd_ct= x *ctx, * the next vma was merged into the current one and * the current one has not been updated yet. */ + vma_start_write(vma); userfaultfd_set_vm_flags(vma, new_flags); vma->vm_userfaultfd_ctx.ctx =3D ctx; =20 @@ -1685,6 +1690,7 @@ static int userfaultfd_unregister(struct userfaultfd_= ctx *ctx, * the next vma was merged into the current one and * the current one has not been updated yet. */ + vma_start_write(vma); userfaultfd_set_vm_flags(vma, new_flags); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; =20 diff --git a/include/linux/mm.h b/include/linux/mm.h index 262b5f44101d..2c720c9bb1ae 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -780,18 +780,22 @@ static inline void vm_flags_init(struct vm_area_struc= t *vma, ACCESS_PRIVATE(vma, __vm_flags) =3D flags; } =20 -/* Use when VMA is part of the VMA tree and modifications need coordinatio= n */ +/* + * Use when VMA is part of the VMA tree and modifications need coordination + * Note: vm_flags_reset and vm_flags_reset_once do not lock the vma and + * it should be locked explicitly beforehand. + */ static inline void vm_flags_reset(struct vm_area_struct *vma, vm_flags_t flags) { - vma_start_write(vma); + vma_assert_write_locked(vma); vm_flags_init(vma, flags); } =20 static inline void vm_flags_reset_once(struct vm_area_struct *vma, vm_flags_t flags) { - vma_start_write(vma); + vma_assert_write_locked(vma); WRITE_ONCE(ACCESS_PRIVATE(vma, __vm_flags), flags); } =20 diff --git a/mm/madvise.c b/mm/madvise.c index bfe0e06427bd..507b1d299fec 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -173,9 +173,8 @@ static int madvise_update_vma(struct vm_area_struct *vm= a, } =20 success: - /* - * vm_flags is protected by the mmap_lock held in write mode. - */ + /* vm_flags is protected by the mmap_lock held in write mode. */ + vma_start_write(vma); vm_flags_reset(vma, new_flags); if (!vma->vm_file || vma_is_anon_shmem(vma)) { error =3D replace_anon_vma_name(vma, anon_name); diff --git a/mm/mlock.c b/mm/mlock.c index 479e09d0994c..06bdfab83b58 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -387,6 +387,7 @@ static void mlock_vma_pages_range(struct vm_area_struct= *vma, */ if (newflags & VM_LOCKED) newflags |=3D VM_IO; + vma_start_write(vma); vm_flags_reset_once(vma, newflags); =20 lru_add_drain(); @@ -461,9 +462,9 @@ static int mlock_fixup(struct vma_iterator *vmi, struct= vm_area_struct *vma, * It's okay if try_to_unmap_one unmaps a page just after we * set VM_LOCKED, populate_vma_page_range will bring it back. */ - if ((newflags & VM_LOCKED) && (oldflags & VM_LOCKED)) { /* No work to do, and mlocking twice would be wrong */ + vma_start_write(vma); vm_flags_reset(vma, newflags); } else { mlock_vma_pages_range(vma, start, end, newflags); diff --git a/mm/mprotect.c b/mm/mprotect.c index 3aef1340533a..362e190a8f81 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -657,6 +657,7 @@ mprotect_fixup(struct vma_iterator *vmi, struct mmu_gat= her *tlb, * vm_flags and vm_page_prot are protected by the mmap_lock * held in write mode. */ + vma_start_write(vma); vm_flags_reset(vma, newflags); if (vma_wants_manual_pte_write_upgrade(vma)) mm_cp_flags |=3D MM_CP_TRY_CHANGE_WRITABLE; --=20 2.41.0.585.gd2178a4bd4-goog From nobody Thu Sep 11 13:01:07 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 668A8EB64DD for ; Thu, 3 Aug 2023 17:27:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234925AbjHCR1X (ORCPT ); Thu, 3 Aug 2023 13:27:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234818AbjHCR1L (ORCPT ); Thu, 3 Aug 2023 13:27:11 -0400 Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CC2963C16 for ; Thu, 3 Aug 2023 10:27:07 -0700 (PDT) Received: by mail-yb1-xb4a.google.com with SMTP id 3f1490d57ef6-d074da73c3eso1372781276.3 for ; Thu, 03 Aug 2023 10:27:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691083627; x=1691688427; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=GZEu7FQxJMwmMQ2ZbaGaDze4HsujzOay4eQMS+qpos8=; b=iMlvdhm/bxVV7kv0V79kx1hxAyb+1GfcPnJNgAo6LGdR0bN5ykKWLzgwRkr0IsKULR 2o34cI0Yf3y9b3S2Dr1CwRyv6f01fPNaOoXOCMRAQbhpK1DPGFgCjTrhlWjoMsqAvyL0 8VUIztQRc1OQyCbz5DagmCU/mu3dLq6uVQlfq3eZNISYdHHkvNHZJzuMW6YuKo90+kyC hjZ+CUef9CzPm33relwkpyOY3ShX8wwK6g3JLpiI+W0wl5DrWoPM2vnAEuwmowfvDdjR SwLvk9fJF/d9WaXsmtAEQnK/vJCJQgoZOjJbm+glRWLSwwbs7FTj9oR+NIkDHwsI3k9/ MBMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691083627; x=1691688427; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=GZEu7FQxJMwmMQ2ZbaGaDze4HsujzOay4eQMS+qpos8=; b=gym2yatDLXopktTQ3D5GGwbjbq79JRjNjcfMRG7gmtWdu33WQ8Yy4hRzdd2nJfBpf5 QNCeZdrCERPUsQdaxwC/smGWUOK4gxz+mj0fBHCQ1J3v/v7gVTS8cKYtTQ5+cAOJNDFd uSJ4oOhNM0ir/3mh9dkvFpFLkqNR+NB7vI4Y0F66871fba5Z2eud9Z4aqBh6z14/RChm wLxdXuVFHMcPZoMECuTwbylzqqzEUe2HWvCtgmpCgY1y0HCs5YGDOIa1qmUbOThowWNJ VYhxwotmtxVuci8FBwibJOAKK8wBzL8vsa22o5W1vi1e26uztwkeOwckvkm5wjMpRr4Q CA5A== X-Gm-Message-State: ABy/qLZYA61oBxdtXDzxL71dF4StPrjQ8jDiwTV8OtFpxZfoWLdXLXxt eSDh2W2cWvZXAebZePqETXruNLqmKYc= X-Google-Smtp-Source: APBJJlEm+TAFgwKeycGXNkE9sZYz1YS9giHD/D1paY/qC/rrcXYAkNTs0f2pZWBHAJYKXSdQl1MdNfKRQzw= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3dec:ef9e:7bf4:7a6]) (user=surenb job=sendgmr) by 2002:a25:19c2:0:b0:d0d:1563:58f2 with SMTP id 185-20020a2519c2000000b00d0d156358f2mr129793ybz.2.1691083627024; Thu, 03 Aug 2023 10:27:07 -0700 (PDT) Date: Thu, 3 Aug 2023 10:26:50 -0700 In-Reply-To: <20230803172652.2849981-1-surenb@google.com> Mime-Version: 1.0 References: <20230803172652.2849981-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230803172652.2849981-6-surenb@google.com> Subject: [PATCH v3 5/6] mm: always lock new vma before inserting into vma tree From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Suren Baghdasaryan , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" While it's not strictly necessary to lock a newly created vma before adding it into the vma tree (as long as no further changes are performed to it), it seems like a good policy to lock it and prevent accidental changes after it becomes visible to the page faults. Lock the vma before adding it into the vma tree. Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett --- mm/mmap.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 3937479d0e07..850a39dee075 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -412,6 +412,8 @@ static int vma_link(struct mm_struct *mm, struct vm_are= a_struct *vma) if (vma_iter_prealloc(&vmi)) return -ENOMEM; =20 + vma_start_write(vma); + if (vma->vm_file) { mapping =3D vma->vm_file->f_mapping; i_mmap_lock_write(mapping); @@ -477,7 +479,8 @@ static inline void vma_prepare(struct vma_prepare *vp) vma_start_write(vp->vma); if (vp->adj_next) vma_start_write(vp->adj_next); - /* vp->insert is always a newly created VMA, no need for locking */ + if (vp->insert) + vma_start_write(vp->insert); if (vp->remove) vma_start_write(vp->remove); if (vp->remove2) @@ -3098,6 +3101,7 @@ static int do_brk_flags(struct vma_iterator *vmi, str= uct vm_area_struct *vma, vma->vm_pgoff =3D addr >> PAGE_SHIFT; vm_flags_init(vma, flags); vma->vm_page_prot =3D vm_get_page_prot(flags); + vma_start_write(vma); if (vma_iter_store_gfp(vmi, vma, GFP_KERNEL)) goto mas_store_fail; =20 @@ -3345,7 +3349,6 @@ struct vm_area_struct *copy_vma(struct vm_area_struct= **vmap, get_file(new_vma->vm_file); if (new_vma->vm_ops && new_vma->vm_ops->open) new_vma->vm_ops->open(new_vma); - vma_start_write(new_vma); if (vma_link(mm, new_vma)) goto out_vma_link; *need_rmap_locks =3D false; --=20 2.41.0.585.gd2178a4bd4-goog From nobody Thu Sep 11 13:01:07 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8A18EB64DD for ; Thu, 3 Aug 2023 17:27:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234955AbjHCR11 (ORCPT ); Thu, 3 Aug 2023 13:27:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234930AbjHCR1N (ORCPT ); Thu, 3 Aug 2023 13:27:13 -0400 Received: from mail-yw1-x1149.google.com (mail-yw1-x1149.google.com [IPv6:2607:f8b0:4864:20::1149]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B27943C3D for ; Thu, 3 Aug 2023 10:27:10 -0700 (PDT) Received: by mail-yw1-x1149.google.com with SMTP id 00721157ae682-5844a99c268so13512377b3.2 for ; Thu, 03 Aug 2023 10:27:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691083629; x=1691688429; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=enNugCeOmhfazHyzEjQZvfU7Wp5uGQcTSmtYdGh09Fo=; b=zMcctUOh7tYayLvckt9uz/YiCskGpP+YntI3h+0uVE/02dHvg03tF8YSHbRMyNGfZB vRYvs+C9OZgyahs0ZA60vqFKBKDcsU68jI9QF2xZbnvK1zTGlMYfnt4cUcYYUYYQEZgm QcZToqsbu8sycVp7w2dB3p8Tho375Ac9GC/kb1P9fL5XmVLzXVE4tmVCtIfbtq++EekQ sXwQggrredRKZtR876ti7Xpr8W/4VwmfvILxh9XXU6UIOZhAVePq4SmwRGAaJR1zzKb1 NYBjYG4UWWlZvCyBazMus+wGvZXN0rUGhkIT38Std3TmC/giO7p092GnBqUklLiC2uAW CiUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691083629; x=1691688429; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=enNugCeOmhfazHyzEjQZvfU7Wp5uGQcTSmtYdGh09Fo=; b=NOVYs6xS5KqgzYvK/CFEf2Ykpfhrx17VF3ODcwvIxsDhbbOcA4RhdNNsMSLASHOv8t q8UTZ/GPSh0xI471yafJK5XYIMnl5CaUj2Hz97EJy0kPqPb4jo9Wleo6sFl9S44INUVi tECYEZZyrzkHnKX3TY73h7mGECrb0xcGgqbPHLA93Vm5fK3CyrAxDN0x3eEbTF46B/DA 9VmuNr6WOW3yUEaR34lpzd/YDxgoYlCfBgJZWSt2kgEzpb+FO4LAwBUhoj0i3gEwPkSy Eu7FhuxO6KALcA0xzoxm1JhhxBe5sktFpNWwCjiG2PEM6RLOj3gpncUuFXuDqE0QUU+P 7V9g== X-Gm-Message-State: ABy/qLbk2EQMSILUyI9WM/MUf/ocR6X0nfGWBCPEN0srbB2p6XbihiXr +VK24SBGJlR1tUNLdwRaVpx1GNAp19E= X-Google-Smtp-Source: APBJJlFs+p1+IFx0/LyJPwchu48cnzJ5YCTLzpQdjYobzqCAPy/6bN4ZVrBDwToPCue3BOGsJ6NlQ5kk+iE= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3dec:ef9e:7bf4:7a6]) (user=surenb job=sendgmr) by 2002:a81:ac58:0:b0:579:e07c:2798 with SMTP id z24-20020a81ac58000000b00579e07c2798mr160834ywj.2.1691083629316; Thu, 03 Aug 2023 10:27:09 -0700 (PDT) Date: Thu, 3 Aug 2023 10:26:51 -0700 In-Reply-To: <20230803172652.2849981-1-surenb@google.com> Mime-Version: 1.0 References: <20230803172652.2849981-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230803172652.2849981-7-surenb@google.com> Subject: [PATCH v3 6/6] mm: move vma locking out of vma_prepare and dup_anon_vma From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Suren Baghdasaryan , Linus Torvalds , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vma_prepare() is currently the central place where vmas are being locked before vma_complete() applies changes to them. While this is convenient, it also obscures vma locking and makes it harder to follow the locking rules. Move vma locking out of vma_prepare() and take vma locks explicitly at the locations where vmas are being modified. Move vma locking and replace it with an assertion inside dup_anon_vma() to further clarify the locking pattern inside vma_merge(). Suggested-by: Linus Torvalds Suggested-by: Liam R. Howlett Signed-off-by: Suren Baghdasaryan --- mm/mmap.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 850a39dee075..ae28d6f94c34 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -476,16 +476,6 @@ static inline void init_vma_prep(struct vma_prepare *v= p, */ static inline void vma_prepare(struct vma_prepare *vp) { - vma_start_write(vp->vma); - if (vp->adj_next) - vma_start_write(vp->adj_next); - if (vp->insert) - vma_start_write(vp->insert); - if (vp->remove) - vma_start_write(vp->remove); - if (vp->remove2) - vma_start_write(vp->remove2); - if (vp->file) { uprobe_munmap(vp->vma, vp->vma->vm_start, vp->vma->vm_end); =20 @@ -618,7 +608,7 @@ static inline int dup_anon_vma(struct vm_area_struct *d= st, * anon pages imported. */ if (src->anon_vma && !dst->anon_vma) { - vma_start_write(dst); + vma_assert_write_locked(dst); dst->anon_vma =3D src->anon_vma; return anon_vma_clone(dst, src); } @@ -650,10 +640,12 @@ int vma_expand(struct vma_iterator *vmi, struct vm_ar= ea_struct *vma, bool remove_next =3D false; struct vma_prepare vp; =20 + vma_start_write(vma); if (next && (vma !=3D next) && (end =3D=3D next->vm_end)) { int ret; =20 remove_next =3D true; + vma_start_write(next); ret =3D dup_anon_vma(vma, next); if (ret) return ret; @@ -708,6 +700,8 @@ int vma_shrink(struct vma_iterator *vmi, struct vm_area= _struct *vma, if (vma_iter_prealloc(vmi)) return -ENOMEM; =20 + vma_start_write(vma); + init_vma_prep(&vp, vma); vma_prepare(&vp); vma_adjust_trans_huge(vma, start, end, 0); @@ -940,16 +934,21 @@ struct vm_area_struct *vma_merge(struct vma_iterator = *vmi, struct mm_struct *mm, if (!merge_prev && !merge_next) return NULL; /* Not mergeable. */ =20 + if (prev) + vma_start_write(prev); + res =3D vma =3D prev; remove =3D remove2 =3D adjust =3D NULL; =20 /* Can we merge both the predecessor and the successor? */ if (merge_prev && merge_next && is_mergeable_anon_vma(prev->anon_vma, next->anon_vma, NULL)) { + vma_start_write(next); remove =3D next; /* case 1 */ vma_end =3D next->vm_end; err =3D dup_anon_vma(prev, next); if (curr) { /* case 6 */ + vma_start_write(curr); remove =3D curr; remove2 =3D next; if (!next->anon_vma) @@ -957,6 +956,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *v= mi, struct mm_struct *mm, } } else if (merge_prev) { /* case 2 */ if (curr) { + vma_start_write(curr); err =3D dup_anon_vma(prev, curr); if (end =3D=3D curr->vm_end) { /* case 7 */ remove =3D curr; @@ -966,6 +966,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *v= mi, struct mm_struct *mm, } } } else { /* merge_next */ + vma_start_write(next); res =3D next; if (prev && addr < prev->vm_end) { /* case 4 */ vma_end =3D addr; @@ -983,6 +984,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *v= mi, struct mm_struct *mm, vma_pgoff =3D next->vm_pgoff - pglen; if (curr) { /* case 8 */ vma_pgoff =3D curr->vm_pgoff; + vma_start_write(curr); remove =3D curr; err =3D dup_anon_vma(next, curr); } @@ -2373,6 +2375,9 @@ int __split_vma(struct vma_iterator *vmi, struct vm_a= rea_struct *vma, if (new->vm_ops && new->vm_ops->open) new->vm_ops->open(new); =20 + vma_start_write(vma); + vma_start_write(new); + init_vma_prep(&vp, vma); vp.insert =3D new; vma_prepare(&vp); @@ -3078,6 +3083,8 @@ static int do_brk_flags(struct vma_iterator *vmi, str= uct vm_area_struct *vma, if (vma_iter_prealloc(vmi)) goto unacct_fail; =20 + vma_start_write(vma); + init_vma_prep(&vp, vma); vma_prepare(&vp); vma_adjust_trans_huge(vma, vma->vm_start, addr + len, 0); --=20 2.41.0.585.gd2178a4bd4-goog