From nobody Wed Sep 10 02:49:37 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCE71C001DF for ; Fri, 4 Aug 2023 15:28:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231345AbjHDP2P (ORCPT ); Fri, 4 Aug 2023 11:28:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232173AbjHDP1x (ORCPT ); Fri, 4 Aug 2023 11:27:53 -0400 Received: from mail-yw1-x1149.google.com (mail-yw1-x1149.google.com [IPv6:2607:f8b0:4864:20::1149]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DAAC5273 for ; Fri, 4 Aug 2023 08:27:31 -0700 (PDT) Received: by mail-yw1-x1149.google.com with SMTP id 00721157ae682-5734d919156so23218687b3.3 for ; Fri, 04 Aug 2023 08:27:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691162850; x=1691767650; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=71RLrK6Mb0aadLJnf8lNJkVJrOaKPnZ5THHnlI7+5Ec=; b=OHf2SZobpNzn3AGlr6KHtFV9ESL4KxTr1l448yH9mfHvQG6rFU7J2YifJS5llv2qPx PpgHeIlHU/6JTwXmumhaYwk1tXnlkjfVAFvV/PNzhQvXyGLkw0h2qL6sB8QTiwLXjuXe QdlIpLvwVjorrNCnM7IkC9Q1YluqlB2JrQO5HGkBispCXY7osl72PquRvgCbSYCjs0jf 8Q95VPHGibzWinw6bzA8chJFtlGe0RKXiavh8yMQCk1IFVfCD14UeIn7BThOkhTmJPVm P2JTYb8TjIzrhuRM6un7ppDVABmVHXJtK9xrW64xmqQjF3c4HViHrKlUAuSC+BXjxETY aA6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691162850; x=1691767650; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=71RLrK6Mb0aadLJnf8lNJkVJrOaKPnZ5THHnlI7+5Ec=; b=Dt4nigtCUhJdRr4ZlYK1JzbBufGRZvSEYo355abLNL1jTSoR462wvvaBaTCSZh+AwZ Q4lVi0wJkeFP9FY5nhr7kUrlF6/NIZ6nypO75q/usg5tHq+dDiTCKcHKSPXPFKaiRQ9K TYQMRLiPZiZsxEF2423Shz9n7L7eqPZX/XDhWAzQrMT7ezYKaNYnqtyCf8k0ATIaZ/dw DlEOp1bI7uBKuHUNbEzZ9NJKxFad7xkqTsehnMstYRYu0OJt024U2mgj/KCP4ZzoRlu6 nS0FWQjPvIeww+qTNOeWImPo/egnICi3xlGQhGu78Hf+nOMr3O18ou9OuAwTstlUsuhh 957g== X-Gm-Message-State: AOJu0YyX7Tw4EcLnbOi3C1zvE7c5eEeVOKqAC2xuyBBD7IEaAte9MM1+ FRbAuAc8HunjVzp0GN3BePY0vIJZSxM= X-Google-Smtp-Source: AGHT+IFVEJGKTS/dGtb/l3tzkS7ijMf8ddxWQeKeC3bm0h05Pt8naF6mq9QSK0V52/6gQBVKwWbsDIHjIxs= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:43a7:a50f:b0fd:a068]) (user=surenb job=sendgmr) by 2002:a81:ad65:0:b0:56c:e2da:f440 with SMTP id l37-20020a81ad65000000b0056ce2daf440mr16559ywk.0.1691162850307; Fri, 04 Aug 2023 08:27:30 -0700 (PDT) Date: Fri, 4 Aug 2023 08:27:19 -0700 In-Reply-To: <20230804152724.3090321-1-surenb@google.com> Mime-Version: 1.0 References: <20230804152724.3090321-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230804152724.3090321-2-surenb@google.com> Subject: [PATCH v4 1/6] mm: enable page walking API to lock vmas during the walk From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, kernel-team@android.com, Suren Baghdasaryan , Linus Torvalds Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" walk_page_range() and friends often operate under write-locked mmap_lock. With introduction of vma locks, the vmas have to be locked as well during such walks to prevent concurrent page faults in these areas. Add an additional member to mm_walk_ops to indicate locking requirements for the walk. Cc: stable@vger.kernel.org # 6.4.x Suggested-by: Linus Torvalds Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan --- arch/powerpc/mm/book3s64/subpage_prot.c | 1 + arch/riscv/mm/pageattr.c | 1 + arch/s390/mm/gmap.c | 5 ++++ fs/proc/task_mmu.c | 5 ++++ include/linux/pagewalk.h | 11 ++++++++ mm/damon/vaddr.c | 2 ++ mm/hmm.c | 1 + mm/ksm.c | 25 ++++++++++------- mm/madvise.c | 3 +++ mm/memcontrol.c | 2 ++ mm/memory-failure.c | 1 + mm/mempolicy.c | 22 +++++++++------ mm/migrate_device.c | 1 + mm/mincore.c | 1 + mm/mlock.c | 1 + mm/mprotect.c | 1 + mm/pagewalk.c | 36 ++++++++++++++++++++++--- mm/vmscan.c | 1 + 18 files changed, 100 insertions(+), 20 deletions(-) diff --git a/arch/powerpc/mm/book3s64/subpage_prot.c b/arch/powerpc/mm/book= 3s64/subpage_prot.c index 0dc85556dec5..ec98e526167e 100644 --- a/arch/powerpc/mm/book3s64/subpage_prot.c +++ b/arch/powerpc/mm/book3s64/subpage_prot.c @@ -145,6 +145,7 @@ static int subpage_walk_pmd_entry(pmd_t *pmd, unsigned = long addr, =20 static const struct mm_walk_ops subpage_walk_ops =3D { .pmd_entry =3D subpage_walk_pmd_entry, + .walk_lock =3D PGWALK_WRLOCK_VERIFY, }; =20 static void subpage_mark_vma_nohuge(struct mm_struct *mm, unsigned long ad= dr, diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c index ea3d61de065b..161d0b34c2cb 100644 --- a/arch/riscv/mm/pageattr.c +++ b/arch/riscv/mm/pageattr.c @@ -102,6 +102,7 @@ static const struct mm_walk_ops pageattr_ops =3D { .pmd_entry =3D pageattr_pmd_entry, .pte_entry =3D pageattr_pte_entry, .pte_hole =3D pageattr_pte_hole, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mas= k, diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 9c8af31be970..906a7bfc2a78 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -2514,6 +2514,7 @@ static int thp_split_walk_pmd_entry(pmd_t *pmd, unsig= ned long addr, =20 static const struct mm_walk_ops thp_split_walk_ops =3D { .pmd_entry =3D thp_split_walk_pmd_entry, + .walk_lock =3D PGWALK_WRLOCK_VERIFY, }; =20 static inline void thp_split_mm(struct mm_struct *mm) @@ -2565,6 +2566,7 @@ static int __zap_zero_pages(pmd_t *pmd, unsigned long= start, =20 static const struct mm_walk_ops zap_zero_walk_ops =3D { .pmd_entry =3D __zap_zero_pages, + .walk_lock =3D PGWALK_WRLOCK, }; =20 /* @@ -2655,6 +2657,7 @@ static const struct mm_walk_ops enable_skey_walk_ops = =3D { .hugetlb_entry =3D __s390_enable_skey_hugetlb, .pte_entry =3D __s390_enable_skey_pte, .pmd_entry =3D __s390_enable_skey_pmd, + .walk_lock =3D PGWALK_WRLOCK, }; =20 int s390_enable_skey(void) @@ -2692,6 +2695,7 @@ static int __s390_reset_cmma(pte_t *pte, unsigned lon= g addr, =20 static const struct mm_walk_ops reset_cmma_walk_ops =3D { .pte_entry =3D __s390_reset_cmma, + .walk_lock =3D PGWALK_WRLOCK, }; =20 void s390_reset_cmma(struct mm_struct *mm) @@ -2728,6 +2732,7 @@ static int s390_gather_pages(pte_t *ptep, unsigned lo= ng addr, =20 static const struct mm_walk_ops gather_pages_ops =3D { .pte_entry =3D s390_gather_pages, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 507cd4e59d07..ef6ee330e3be 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -758,12 +758,14 @@ static int smaps_hugetlb_range(pte_t *pte, unsigned l= ong hmask, static const struct mm_walk_ops smaps_walk_ops =3D { .pmd_entry =3D smaps_pte_range, .hugetlb_entry =3D smaps_hugetlb_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static const struct mm_walk_ops smaps_shmem_walk_ops =3D { .pmd_entry =3D smaps_pte_range, .hugetlb_entry =3D smaps_hugetlb_range, .pte_hole =3D smaps_pte_hole, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* @@ -1245,6 +1247,7 @@ static int clear_refs_test_walk(unsigned long start, = unsigned long end, static const struct mm_walk_ops clear_refs_walk_ops =3D { .pmd_entry =3D clear_refs_pte_range, .test_walk =3D clear_refs_test_walk, + .walk_lock =3D PGWALK_WRLOCK, }; =20 static ssize_t clear_refs_write(struct file *file, const char __user *buf, @@ -1622,6 +1625,7 @@ static const struct mm_walk_ops pagemap_ops =3D { .pmd_entry =3D pagemap_pmd_range, .pte_hole =3D pagemap_pte_hole, .hugetlb_entry =3D pagemap_hugetlb_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* @@ -1935,6 +1939,7 @@ static int gather_hugetlb_stats(pte_t *pte, unsigned = long hmask, static const struct mm_walk_ops show_numa_ops =3D { .hugetlb_entry =3D gather_hugetlb_stats, .pmd_entry =3D gather_pte_stats, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/include/linux/pagewalk.h b/include/linux/pagewalk.h index 27a6df448ee5..27cd1e59ccf7 100644 --- a/include/linux/pagewalk.h +++ b/include/linux/pagewalk.h @@ -6,6 +6,16 @@ =20 struct mm_walk; =20 +/* Locking requirement during a page walk. */ +enum page_walk_lock { + /* mmap_lock should be locked for read to stabilize the vma tree */ + PGWALK_RDLOCK =3D 0, + /* vma will be write-locked during the walk */ + PGWALK_WRLOCK =3D 1, + /* vma is expected to be already write-locked during the walk */ + PGWALK_WRLOCK_VERIFY =3D 2, +}; + /** * struct mm_walk_ops - callbacks for walk_page_range * @pgd_entry: if set, called for each non-empty PGD (top-level) entry @@ -66,6 +76,7 @@ struct mm_walk_ops { int (*pre_vma)(unsigned long start, unsigned long end, struct mm_walk *walk); void (*post_vma)(struct mm_walk *walk); + enum page_walk_lock walk_lock; }; =20 /* diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c index 2fcc9731528a..e0e59d420fca 100644 --- a/mm/damon/vaddr.c +++ b/mm/damon/vaddr.c @@ -386,6 +386,7 @@ static int damon_mkold_hugetlb_entry(pte_t *pte, unsign= ed long hmask, static const struct mm_walk_ops damon_mkold_ops =3D { .pmd_entry =3D damon_mkold_pmd_entry, .hugetlb_entry =3D damon_mkold_hugetlb_entry, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void damon_va_mkold(struct mm_struct *mm, unsigned long addr) @@ -525,6 +526,7 @@ static int damon_young_hugetlb_entry(pte_t *pte, unsign= ed long hmask, static const struct mm_walk_ops damon_young_ops =3D { .pmd_entry =3D damon_young_pmd_entry, .hugetlb_entry =3D damon_young_hugetlb_entry, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static bool damon_va_young(struct mm_struct *mm, unsigned long addr, diff --git a/mm/hmm.c b/mm/hmm.c index 855e25e59d8f..277ddcab4947 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -562,6 +562,7 @@ static const struct mm_walk_ops hmm_walk_ops =3D { .pte_hole =3D hmm_vma_walk_hole, .hugetlb_entry =3D hmm_vma_walk_hugetlb_entry, .test_walk =3D hmm_vma_walk_test, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /** diff --git a/mm/ksm.c b/mm/ksm.c index ba266359da55..00c21fb4d94e 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -455,6 +455,12 @@ static int break_ksm_pmd_entry(pmd_t *pmd, unsigned lo= ng addr, unsigned long nex =20 static const struct mm_walk_ops break_ksm_ops =3D { .pmd_entry =3D break_ksm_pmd_entry, + .walk_lock =3D PGWALK_RDLOCK, +}; + +static const struct mm_walk_ops break_ksm_lock_vma_ops =3D { + .pmd_entry =3D break_ksm_pmd_entry, + .walk_lock =3D PGWALK_WRLOCK, }; =20 /* @@ -470,16 +476,17 @@ static const struct mm_walk_ops break_ksm_ops =3D { * of the process that owns 'vma'. We also do not want to enforce * protection keys here anyway. */ -static int break_ksm(struct vm_area_struct *vma, unsigned long addr) +static int break_ksm(struct vm_area_struct *vma, unsigned long addr, bool = lock_vma) { vm_fault_t ret =3D 0; + const struct mm_walk_ops *ops =3D lock_vma ? + &break_ksm_lock_vma_ops : &break_ksm_ops; =20 do { int ksm_page; =20 cond_resched(); - ksm_page =3D walk_page_range_vma(vma, addr, addr + 1, - &break_ksm_ops, NULL); + ksm_page =3D walk_page_range_vma(vma, addr, addr + 1, ops, NULL); if (WARN_ON_ONCE(ksm_page < 0)) return ksm_page; if (!ksm_page) @@ -565,7 +572,7 @@ static void break_cow(struct ksm_rmap_item *rmap_item) mmap_read_lock(mm); vma =3D find_mergeable_vma(mm, addr); if (vma) - break_ksm(vma, addr); + break_ksm(vma, addr, false); mmap_read_unlock(mm); } =20 @@ -871,7 +878,7 @@ static void remove_trailing_rmap_items(struct ksm_rmap_= item **rmap_list) * in cmp_and_merge_page on one of the rmap_items we would be removing. */ static int unmerge_ksm_pages(struct vm_area_struct *vma, - unsigned long start, unsigned long end) + unsigned long start, unsigned long end, bool lock_vma) { unsigned long addr; int err =3D 0; @@ -882,7 +889,7 @@ static int unmerge_ksm_pages(struct vm_area_struct *vma, if (signal_pending(current)) err =3D -ERESTARTSYS; else - err =3D break_ksm(vma, addr); + err =3D break_ksm(vma, addr, lock_vma); } return err; } @@ -1029,7 +1036,7 @@ static int unmerge_and_remove_all_rmap_items(void) if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma) continue; err =3D unmerge_ksm_pages(vma, - vma->vm_start, vma->vm_end); + vma->vm_start, vma->vm_end, false); if (err) goto error; } @@ -2530,7 +2537,7 @@ static int __ksm_del_vma(struct vm_area_struct *vma) return 0; =20 if (vma->anon_vma) { - err =3D unmerge_ksm_pages(vma, vma->vm_start, vma->vm_end); + err =3D unmerge_ksm_pages(vma, vma->vm_start, vma->vm_end, true); if (err) return err; } @@ -2668,7 +2675,7 @@ int ksm_madvise(struct vm_area_struct *vma, unsigned = long start, return 0; /* just ignore the advice */ =20 if (vma->anon_vma) { - err =3D unmerge_ksm_pages(vma, start, end); + err =3D unmerge_ksm_pages(vma, start, end, true); if (err) return err; } diff --git a/mm/madvise.c b/mm/madvise.c index 886f06066622..bfe0e06427bd 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -233,6 +233,7 @@ static int swapin_walk_pmd_entry(pmd_t *pmd, unsigned l= ong start, =20 static const struct mm_walk_ops swapin_walk_ops =3D { .pmd_entry =3D swapin_walk_pmd_entry, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void shmem_swapin_range(struct vm_area_struct *vma, @@ -534,6 +535,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, =20 static const struct mm_walk_ops cold_walk_ops =3D { .pmd_entry =3D madvise_cold_or_pageout_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void madvise_cold_page_range(struct mmu_gather *tlb, @@ -757,6 +759,7 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned = long addr, =20 static const struct mm_walk_ops madvise_free_walk_ops =3D { .pmd_entry =3D madvise_free_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static int madvise_free_single_vma(struct vm_area_struct *vma, diff --git a/mm/memcontrol.c b/mm/memcontrol.c index e8ca4bdcb03c..315fd5f45e3c 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6024,6 +6024,7 @@ static int mem_cgroup_count_precharge_pte_range(pmd_t= *pmd, =20 static const struct mm_walk_ops precharge_walk_ops =3D { .pmd_entry =3D mem_cgroup_count_precharge_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm) @@ -6303,6 +6304,7 @@ static int mem_cgroup_move_charge_pte_range(pmd_t *pm= d, =20 static const struct mm_walk_ops charge_walk_ops =3D { .pmd_entry =3D mem_cgroup_move_charge_pte_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 static void mem_cgroup_move_charge(void) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index ece5d481b5ff..6bfb762facab 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -831,6 +831,7 @@ static int hwpoison_hugetlb_range(pte_t *ptep, unsigned= long hmask, static const struct mm_walk_ops hwp_walk_ops =3D { .pmd_entry =3D hwpoison_pte_range, .hugetlb_entry =3D hwpoison_hugetlb_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/mm/mempolicy.c b/mm/mempolicy.c index c53f8beeb507..ec2eaceffd74 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -718,6 +718,14 @@ static const struct mm_walk_ops queue_pages_walk_ops = =3D { .hugetlb_entry =3D queue_folios_hugetlb, .pmd_entry =3D queue_folios_pte_range, .test_walk =3D queue_pages_test_walk, + .walk_lock =3D PGWALK_RDLOCK, +}; + +static const struct mm_walk_ops queue_pages_lock_vma_walk_ops =3D { + .hugetlb_entry =3D queue_folios_hugetlb, + .pmd_entry =3D queue_folios_pte_range, + .test_walk =3D queue_pages_test_walk, + .walk_lock =3D PGWALK_WRLOCK, }; =20 /* @@ -738,7 +746,7 @@ static const struct mm_walk_ops queue_pages_walk_ops = =3D { static int queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long= end, nodemask_t *nodes, unsigned long flags, - struct list_head *pagelist) + struct list_head *pagelist, bool lock_vma) { int err; struct queue_pages qp =3D { @@ -749,8 +757,10 @@ queue_pages_range(struct mm_struct *mm, unsigned long = start, unsigned long end, .end =3D end, .first =3D NULL, }; + const struct mm_walk_ops *ops =3D lock_vma ? + &queue_pages_lock_vma_walk_ops : &queue_pages_walk_ops; =20 - err =3D walk_page_range(mm, start, end, &queue_pages_walk_ops, &qp); + err =3D walk_page_range(mm, start, end, ops, &qp); =20 if (!qp.first) /* whole range in hole */ @@ -1078,7 +1088,7 @@ static int migrate_to_node(struct mm_struct *mm, int = source, int dest, vma =3D find_vma(mm, 0); VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))); queue_pages_range(mm, vma->vm_start, mm->task_size, &nmask, - flags | MPOL_MF_DISCONTIG_OK, &pagelist); + flags | MPOL_MF_DISCONTIG_OK, &pagelist, false); =20 if (!list_empty(&pagelist)) { err =3D migrate_pages(&pagelist, alloc_migration_target, NULL, @@ -1321,12 +1331,8 @@ static long do_mbind(unsigned long start, unsigned l= ong len, * Lock the VMAs before scanning for pages to migrate, to ensure we don't * miss a concurrently inserted page. */ - vma_iter_init(&vmi, mm, start); - for_each_vma_range(vmi, vma, end) - vma_start_write(vma); - ret =3D queue_pages_range(mm, start, end, nmask, - flags | MPOL_MF_INVERT, &pagelist); + flags | MPOL_MF_INVERT, &pagelist, true); =20 if (ret < 0) { err =3D ret; diff --git a/mm/migrate_device.c b/mm/migrate_device.c index 8365158460ed..d5f492356e3e 100644 --- a/mm/migrate_device.c +++ b/mm/migrate_device.c @@ -279,6 +279,7 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp, static const struct mm_walk_ops migrate_vma_walk_ops =3D { .pmd_entry =3D migrate_vma_collect_pmd, .pte_hole =3D migrate_vma_collect_hole, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/mm/mincore.c b/mm/mincore.c index b7f7a516b26c..dad3622cc963 100644 --- a/mm/mincore.c +++ b/mm/mincore.c @@ -176,6 +176,7 @@ static const struct mm_walk_ops mincore_walk_ops =3D { .pmd_entry =3D mincore_pte_range, .pte_hole =3D mincore_unmapped_range, .hugetlb_entry =3D mincore_hugetlb, + .walk_lock =3D PGWALK_RDLOCK, }; =20 /* diff --git a/mm/mlock.c b/mm/mlock.c index 0a0c996c5c21..479e09d0994c 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -371,6 +371,7 @@ static void mlock_vma_pages_range(struct vm_area_struct= *vma, { static const struct mm_walk_ops mlock_walk_ops =3D { .pmd_entry =3D mlock_pte_range, + .walk_lock =3D PGWALK_WRLOCK_VERIFY, }; =20 /* diff --git a/mm/mprotect.c b/mm/mprotect.c index 6f658d483704..3aef1340533a 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -568,6 +568,7 @@ static const struct mm_walk_ops prot_none_walk_ops =3D { .pte_entry =3D prot_none_pte_entry, .hugetlb_entry =3D prot_none_hugetlb_entry, .test_walk =3D prot_none_test, + .walk_lock =3D PGWALK_WRLOCK, }; =20 int diff --git a/mm/pagewalk.c b/mm/pagewalk.c index 2022333805d3..9b2d23fbf4d3 100644 --- a/mm/pagewalk.c +++ b/mm/pagewalk.c @@ -400,6 +400,33 @@ static int __walk_page_range(unsigned long start, unsi= gned long end, return err; } =20 +static inline void process_mm_walk_lock(struct mm_struct *mm, + enum page_walk_lock walk_lock) +{ + if (walk_lock =3D=3D PGWALK_RDLOCK) + mmap_assert_locked(mm); + else + mmap_assert_write_locked(mm); +} + +static inline void process_vma_walk_lock(struct vm_area_struct *vma, + enum page_walk_lock walk_lock) +{ +#ifdef CONFIG_PER_VMA_LOCK + switch (walk_lock) { + case PGWALK_WRLOCK: + vma_start_write(vma); + break; + case PGWALK_WRLOCK_VERIFY: + vma_assert_write_locked(vma); + break; + case PGWALK_RDLOCK: + /* PGWALK_RDLOCK is handled by process_mm_walk_lock */ + break; + } +#endif +} + /** * walk_page_range - walk page table with caller specific callbacks * @mm: mm_struct representing the target process of page table walk @@ -459,7 +486,7 @@ int walk_page_range(struct mm_struct *mm, unsigned long= start, if (!walk.mm) return -EINVAL; =20 - mmap_assert_locked(walk.mm); + process_mm_walk_lock(walk.mm, ops->walk_lock); =20 vma =3D find_vma(walk.mm, start); do { @@ -474,6 +501,7 @@ int walk_page_range(struct mm_struct *mm, unsigned long= start, if (ops->pte_hole) err =3D ops->pte_hole(start, next, -1, &walk); } else { /* inside vma */ + process_vma_walk_lock(vma, ops->walk_lock); walk.vma =3D vma; next =3D min(end, vma->vm_end); vma =3D find_vma(mm, vma->vm_end); @@ -549,7 +577,8 @@ int walk_page_range_vma(struct vm_area_struct *vma, uns= igned long start, if (start < vma->vm_start || end > vma->vm_end) return -EINVAL; =20 - mmap_assert_locked(walk.mm); + process_mm_walk_lock(walk.mm, ops->walk_lock); + process_vma_walk_lock(vma, ops->walk_lock); return __walk_page_range(start, end, &walk); } =20 @@ -566,7 +595,8 @@ int walk_page_vma(struct vm_area_struct *vma, const str= uct mm_walk_ops *ops, if (!walk.mm) return -EINVAL; =20 - mmap_assert_locked(walk.mm); + process_mm_walk_lock(walk.mm, ops->walk_lock); + process_vma_walk_lock(vma, ops->walk_lock); return __walk_page_range(vma->vm_start, vma->vm_end, &walk); } =20 diff --git a/mm/vmscan.c b/mm/vmscan.c index 1080209a568b..3555927df9b5 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4284,6 +4284,7 @@ static void walk_mm(struct lruvec *lruvec, struct mm_= struct *mm, struct lru_gen_ static const struct mm_walk_ops mm_walk_ops =3D { .test_walk =3D should_skip_vma, .p4d_entry =3D walk_pud_range, + .walk_lock =3D PGWALK_RDLOCK, }; =20 int err; --=20 2.41.0.585.gd2178a4bd4-goog From nobody Wed Sep 10 02:49:37 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4869CC001DB for ; Fri, 4 Aug 2023 15:28:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230197AbjHDP2T (ORCPT ); Fri, 4 Aug 2023 11:28:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58028 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232192AbjHDP1y (ORCPT ); Fri, 4 Aug 2023 11:27:54 -0400 Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C8CF527F for ; Fri, 4 Aug 2023 08:27:33 -0700 (PDT) Received: by mail-yb1-xb4a.google.com with SMTP id 3f1490d57ef6-d390abf3319so2425810276.0 for ; Fri, 04 Aug 2023 08:27:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691162852; x=1691767652; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=EHpUmzrQnDN6BdHRPVO0KcfDXP0OZ5FbBAepEsSX9Ig=; b=hVA3/ZpFJEmsauiGAaXBbjIpfsmpWfR3fbsRgVp5rAEKSt/9A6Xd3kd/eO3AJKJZGn 3AC2ZtIRwv64xHd6WForq8/KFn/Rx8J0hO2y9EPElGCTjTZlFAkT/InmtwUwzE1eqnYK kJASoqtH6CN0ybpUSytgjtDaJ9liKxmHr1g1t4U6N9jwmAFqgwbXaE7cZYKwslngmO8u IcikEpTE0wWzJ4jIGpYVyW//mlltwrZAHvNVNKEreIx7RlfWw5qL77YBxevZNGlJfhg9 fpzNtyDU3iTuo29Qe3cFV5Vv2NkySasem1meuIOuN49ZkF8grQs850+nFjQFoo4gac+A WX/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691162852; x=1691767652; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=EHpUmzrQnDN6BdHRPVO0KcfDXP0OZ5FbBAepEsSX9Ig=; b=jqgmKhhceBfm4o84/JqILlILI1lM3AJuhz4/sGVLAKUlD/Gizxwp1qmdY986AOvjfp 1YrQKKKMsvtr/8IqmipS9wAxXtelPhElSR7tQV5hXcY+nys8ExD3VYUOBvUdf76iN7G8 R0poIVnCfSpgnTwEoVXDHKFkjxs4LR8MX0vTqinS/0PN98P8MfXVbgnhys4O4YimIM1k 6hSxK0obuFi5tr8C5x8XwaJdQAbhpieLjGA7H7ZKXG8v351LVfQaUpcaFOb3BWxjak80 yeWFErXqaerA+CZMsL/zSX6HBYGTzBmgflsPHMDuFEbAIqQfz8dqa5i4rmTc0LA22m6u gYgQ== X-Gm-Message-State: AOJu0YwS3Pr/CuQ5dbFMyUJLV0tDUbhURZmf5dNMe4Xv7qG3rmWl3vE4 9Ur/7krvbSiimWtamNA1fy4oDCbwL7I= X-Google-Smtp-Source: AGHT+IFqHpzaEQ49U8hAJkm1uL5RaOqEsE7NFQT8Ocv+VjqN2lk1j8DiU0ekVvKXC1nMsrd6uQfY/SIVGJo= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:43a7:a50f:b0fd:a068]) (user=surenb job=sendgmr) by 2002:a25:aa4e:0:b0:d45:1b81:1154 with SMTP id s72-20020a25aa4e000000b00d451b811154mr7593ybi.2.1691162852582; Fri, 04 Aug 2023 08:27:32 -0700 (PDT) Date: Fri, 4 Aug 2023 08:27:20 -0700 In-Reply-To: <20230804152724.3090321-1-surenb@google.com> Mime-Version: 1.0 References: <20230804152724.3090321-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230804152724.3090321-3-surenb@google.com> Subject: [PATCH v4 2/6] mm: for !CONFIG_PER_VMA_LOCK equate write lock assertion for vma and mmap From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, kernel-team@android.com, Suren Baghdasaryan , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When CONFIG_PER_VMA_LOCK=3Dn, vma_assert_write_locked() should be equivalent to mmap_assert_write_locked(). Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett --- include/linux/mm.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 406ab9ea818f..262b5f44101d 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -750,7 +750,8 @@ static inline void vma_end_read(struct vm_area_struct *= vma) {} static inline void vma_start_write(struct vm_area_struct *vma) {} static inline bool vma_try_start_write(struct vm_area_struct *vma) { return true; } -static inline void vma_assert_write_locked(struct vm_area_struct *vma) {} +static inline void vma_assert_write_locked(struct vm_area_struct *vma) + { mmap_assert_write_locked(vma->vm_mm); } static inline void vma_mark_detached(struct vm_area_struct *vma, bool detached) {} =20 --=20 2.41.0.585.gd2178a4bd4-goog From nobody Wed Sep 10 02:49:37 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42090C04FDF for ; Fri, 4 Aug 2023 15:28:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229780AbjHDP23 (ORCPT ); Fri, 4 Aug 2023 11:28:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232216AbjHDP14 (ORCPT ); Fri, 4 Aug 2023 11:27:56 -0400 Received: from mail-yw1-x1149.google.com (mail-yw1-x1149.google.com [IPv6:2607:f8b0:4864:20::1149]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B34365593 for ; Fri, 4 Aug 2023 08:27:35 -0700 (PDT) Received: by mail-yw1-x1149.google.com with SMTP id 00721157ae682-586a6269dbfso15062797b3.1 for ; Fri, 04 Aug 2023 08:27:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691162854; x=1691767654; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=LfajP5IIbFpg2Y7BQRxvk1sHiLCqjf/rsCkC3jBCtoI=; b=jZlRzwl/sZxeKY0Q22GmSPxgFIqyr2sjFjG2dJWAnROoCqd561GTzeSUKMtg/2mqt1 ggyBLLrU1fznQHJEpV6iArmu4q/1ElFb+5c8i813a5QvYsRPPftZDP04yYsFkEpBfTFv biqZHQTtxZS7XMj4IKe/OZIiQ2Hzx3Sc4KiQkuiuVJ83Jibh5wp9rdvvqebLNTk9QL7W NA08SkaqEcu5wURtIv2bzCzal6v9uxf83gQzzLLvQVI6Kfk5jLDfOArO5bHqXdZSMQ1C ssQWic0dvDYtH0HIwM19ShxQ3BVwkNI58J3XyBg9Vj3lhfWdSX5jmfTA1qFRH0njGemz MjSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691162854; x=1691767654; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=LfajP5IIbFpg2Y7BQRxvk1sHiLCqjf/rsCkC3jBCtoI=; b=KX6Zj6hFPOtQiYKA8dapnpdgCtyF6gGauWXwmXFMypE5Dlli7iqr0fA25HhSqHE60J RRd3nfh9nhwyIOcTKFIG3VPFDxaOmS8+WGXxWRI7oR0fdfaJYZX2vC3MdNbGSa3uykiJ SfQQ49HlJ96Mv8jEkp8/Ist3ew50Xgw9ENGQotlgKAw3zYBeRd+SVaO8C/jDID++ODS/ d/5VSFesu6rr7TAl0pg8xSPf4nk6CbhOLOQ/LNwRRFxExCd7bE1nrxUdRIBx283PEHdF 3kG4DnvUWhyk9pAKcEfaquW97qPLiPyjF5CGxquGn/wWyINHepqe1oCgZHRdVcmf/hmN X9Yg== X-Gm-Message-State: AOJu0YyJuDR6vgjCkKr/l0YFBtgXHdxDbhboUvehqQT/RDI0Fa3bxLEU VnPgkYdR2j3MukMUmpVuJvFVRuTtoG0= X-Google-Smtp-Source: AGHT+IHa9ndTaenWukiguHAw5+MvFDtv8DkvZBd31Rp3irRnrIogFfiHRjgfkWXCeFLeklAX7f0FtCBLNkg= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:43a7:a50f:b0fd:a068]) (user=surenb job=sendgmr) by 2002:a05:690c:448a:b0:583:9d8d:fb0d with SMTP id gr10-20020a05690c448a00b005839d8dfb0dmr1503ywb.0.1691162854651; Fri, 04 Aug 2023 08:27:34 -0700 (PDT) Date: Fri, 4 Aug 2023 08:27:21 -0700 In-Reply-To: <20230804152724.3090321-1-surenb@google.com> Mime-Version: 1.0 References: <20230804152724.3090321-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230804152724.3090321-4-surenb@google.com> Subject: [PATCH v4 3/6] mm: replace mmap with vma write lock assertions when operating on a vma From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, kernel-team@android.com, Suren Baghdasaryan , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Vma write lock assertion always includes mmap write lock assertion and additional vma lock checks when per-VMA locks are enabled. Replace weaker mmap_assert_write_locked() assertions with stronger vma_assert_write_locked() ones when we are operating on a vma which is expected to be locked. Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett --- mm/hugetlb.c | 2 +- mm/khugepaged.c | 5 +++-- mm/memory.c | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 64a3239b6407..1d871a1167d8 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5028,7 +5028,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, st= ruct mm_struct *src, src_vma->vm_start, src_vma->vm_end); mmu_notifier_invalidate_range_start(&range); - mmap_assert_write_locked(src); + vma_assert_write_locked(src_vma); raw_write_seqcount_begin(&src->write_protect_seq); } else { /* diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 78c8d5d8b628..1e43a56fba31 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1495,7 +1495,7 @@ static int set_huge_pmd(struct vm_area_struct *vma, u= nsigned long addr, }; =20 VM_BUG_ON(!PageTransHuge(hpage)); - mmap_assert_write_locked(vma->vm_mm); + vma_assert_write_locked(vma); =20 if (do_set_pmd(&vmf, hpage)) return SCAN_FAIL; @@ -1525,7 +1525,7 @@ static void collapse_and_free_pmd(struct mm_struct *m= m, struct vm_area_struct *v pmd_t pmd; struct mmu_notifier_range range; =20 - mmap_assert_write_locked(mm); + vma_assert_write_locked(vma); if (vma->vm_file) lockdep_assert_held_write(&vma->vm_file->f_mapping->i_mmap_rwsem); /* @@ -1570,6 +1570,7 @@ int collapse_pte_mapped_thp(struct mm_struct *mm, uns= igned long addr, int count =3D 0, result =3D SCAN_FAIL; int i; =20 + /* Ensure vma can't change, it will be locked below after checks */ mmap_assert_write_locked(mm); =20 /* Fast check before locking page if already PMD-mapped */ diff --git a/mm/memory.c b/mm/memory.c index 603b2f419948..652d99b9858a 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1312,7 +1312,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struc= t vm_area_struct *src_vma) * Use the raw variant of the seqcount_t write API to avoid * lockdep complaining about preemptibility. */ - mmap_assert_write_locked(src_mm); + vma_assert_write_locked(src_vma); raw_write_seqcount_begin(&src_mm->write_protect_seq); } =20 --=20 2.41.0.585.gd2178a4bd4-goog From nobody Wed Sep 10 02:49:37 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69280C04FDF for ; Fri, 4 Aug 2023 15:28:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230147AbjHDP2b (ORCPT ); Fri, 4 Aug 2023 11:28:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232234AbjHDP2C (ORCPT ); Fri, 4 Aug 2023 11:28:02 -0400 Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D58F45589 for ; Fri, 4 Aug 2023 08:27:37 -0700 (PDT) Received: by mail-yb1-xb4a.google.com with SMTP id 3f1490d57ef6-d27ac992539so2228964276.3 for ; Fri, 04 Aug 2023 08:27:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691162857; x=1691767657; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=520TPAR42nWNvH3iwlw29nIZA75JEpTNGHc6Ua8ufv4=; b=TyIdh0Xc7bjO/FKNU6ggV/1Dv2MMNNGLkgGiA1/wDC4kswrAYhcsNTWyI3nJOXhJeP aqsdLhrq6CUrp6q3DossAbcj51QnYlaAgR/aq+EsQJ3GN3Goge3dO8goY6tsWeahbwLY Emnw4tOdwC3ADtuaCKz1puhigXXZzjx89Nbekny2jzBpX5vMePV4JC0cjOazLXCBYExZ v6vsGj8x/91TJQOhZ43Nfe9PYgY1043oenv1qnEYngwp8wioDACX0eYyz//e76Lw3d64 gfVCR97aftdiX0XPkdD7dGCrEAiTfg0V+/tVEv94gIvaHCopa5EQ7aDwdogtXW1JtUu0 wsaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691162857; x=1691767657; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=520TPAR42nWNvH3iwlw29nIZA75JEpTNGHc6Ua8ufv4=; b=anCevZ3h9NpTEYEPAf4qrugEfvQCdLt1u8LdxYJWaQcrNSO7IXYRXnneoc+4Q9UOZM CgaX1SnjeM9rpCKC1BDOs4sVT3kjgK8LeRcSH7WA1YMEoxmaYDGPYq+Y8fjGm+P3TpFW U+Vuazf/m0kZPoCuKkeOb9srWfu+y+OW2oic04n7Ox8ZvqjurOhxINJNtNvoh+TZDqgD 8nb0G0I9HbVujqwlnhQCKcChVbs3lhzTpq+LERlu9B9EBGOl9GGkTPlLvHPt62WDsoir UhiIx+63tI0975IVltDB+nc40My/MEH0ehlsRSTW75erPWurg5/NrdGNoQfUnv1f3d4N cQtQ== X-Gm-Message-State: AOJu0YwTJ9Ub017Rpi7DUCeuHFUFlasGHqs2tymndbbR42Lp+rLGbG80 Of5cY5GhPK+vL68JRaIBUKRS13JwuG0= X-Google-Smtp-Source: AGHT+IGlTGXhVU4fUQkbJkgfXB3PlqbjxRUP6W6WYZII59aJQ9IDvYRKiBgp8gXvPph741ZWOBMBJXs8JB4= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:43a7:a50f:b0fd:a068]) (user=surenb job=sendgmr) by 2002:a25:ce94:0:b0:cf9:3564:33cc with SMTP id x142-20020a25ce94000000b00cf9356433ccmr10206ybe.13.1691162857007; Fri, 04 Aug 2023 08:27:37 -0700 (PDT) Date: Fri, 4 Aug 2023 08:27:22 -0700 In-Reply-To: <20230804152724.3090321-1-surenb@google.com> Mime-Version: 1.0 References: <20230804152724.3090321-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230804152724.3090321-5-surenb@google.com> Subject: [PATCH v4 4/6] mm: lock vma explicitly before doing vm_flags_reset and vm_flags_reset_once From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, kernel-team@android.com, Suren Baghdasaryan , Linus Torvalds Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implicit vma locking inside vm_flags_reset() and vm_flags_reset_once() is not obvious and makes it hard to understand where vma locking is happening. Also in some cases (like in dup_userfaultfd()) vma should be locked earlier than vma_flags modification. To make locking more visible, change these functions to assert that the vma write lock is taken and explicitly lock the vma beforehand. Fix userfaultfd functions which should lock the vma earlier. Suggested-by: Linus Torvalds Signed-off-by: Suren Baghdasaryan --- arch/powerpc/kvm/book3s_hv_uvmem.c | 1 + fs/userfaultfd.c | 6 ++++++ include/linux/mm.h | 10 +++++++--- mm/madvise.c | 5 ++--- mm/mlock.c | 3 ++- mm/mprotect.c | 1 + 6 files changed, 19 insertions(+), 7 deletions(-) diff --git a/arch/powerpc/kvm/book3s_hv_uvmem.c b/arch/powerpc/kvm/book3s_h= v_uvmem.c index 709ebd578394..e2d6f9327f77 100644 --- a/arch/powerpc/kvm/book3s_hv_uvmem.c +++ b/arch/powerpc/kvm/book3s_hv_uvmem.c @@ -410,6 +410,7 @@ static int kvmppc_memslot_page_merge(struct kvm *kvm, ret =3D H_STATE; break; } + vma_start_write(vma); /* Copy vm_flags to avoid partial modifications in ksm_madvise */ vm_flags =3D vma->vm_flags; ret =3D ksm_madvise(vma, vma->vm_start, vma->vm_end, diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 7cecd49e078b..6cde95533dcd 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -667,6 +667,7 @@ static void userfaultfd_event_wait_completion(struct us= erfaultfd_ctx *ctx, mmap_write_lock(mm); for_each_vma(vmi, vma) { if (vma->vm_userfaultfd_ctx.ctx =3D=3D release_new_ctx) { + vma_start_write(vma); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS); @@ -702,6 +703,7 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct = list_head *fcs) =20 octx =3D vma->vm_userfaultfd_ctx.ctx; if (!octx || !(octx->features & UFFD_FEATURE_EVENT_FORK)) { + vma_start_write(vma); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS); return 0; @@ -783,6 +785,7 @@ void mremap_userfaultfd_prep(struct vm_area_struct *vma, atomic_inc(&ctx->mmap_changing); } else { /* Drop uffd context if remap feature not enabled */ + vma_start_write(vma); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS); } @@ -940,6 +943,7 @@ static int userfaultfd_release(struct inode *inode, str= uct file *file) prev =3D vma; } =20 + vma_start_write(vma); userfaultfd_set_vm_flags(vma, new_flags); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; } @@ -1502,6 +1506,7 @@ static int userfaultfd_register(struct userfaultfd_ct= x *ctx, * the next vma was merged into the current one and * the current one has not been updated yet. */ + vma_start_write(vma); userfaultfd_set_vm_flags(vma, new_flags); vma->vm_userfaultfd_ctx.ctx =3D ctx; =20 @@ -1685,6 +1690,7 @@ static int userfaultfd_unregister(struct userfaultfd_= ctx *ctx, * the next vma was merged into the current one and * the current one has not been updated yet. */ + vma_start_write(vma); userfaultfd_set_vm_flags(vma, new_flags); vma->vm_userfaultfd_ctx =3D NULL_VM_UFFD_CTX; =20 diff --git a/include/linux/mm.h b/include/linux/mm.h index 262b5f44101d..2c720c9bb1ae 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -780,18 +780,22 @@ static inline void vm_flags_init(struct vm_area_struc= t *vma, ACCESS_PRIVATE(vma, __vm_flags) =3D flags; } =20 -/* Use when VMA is part of the VMA tree and modifications need coordinatio= n */ +/* + * Use when VMA is part of the VMA tree and modifications need coordination + * Note: vm_flags_reset and vm_flags_reset_once do not lock the vma and + * it should be locked explicitly beforehand. + */ static inline void vm_flags_reset(struct vm_area_struct *vma, vm_flags_t flags) { - vma_start_write(vma); + vma_assert_write_locked(vma); vm_flags_init(vma, flags); } =20 static inline void vm_flags_reset_once(struct vm_area_struct *vma, vm_flags_t flags) { - vma_start_write(vma); + vma_assert_write_locked(vma); WRITE_ONCE(ACCESS_PRIVATE(vma, __vm_flags), flags); } =20 diff --git a/mm/madvise.c b/mm/madvise.c index bfe0e06427bd..507b1d299fec 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -173,9 +173,8 @@ static int madvise_update_vma(struct vm_area_struct *vm= a, } =20 success: - /* - * vm_flags is protected by the mmap_lock held in write mode. - */ + /* vm_flags is protected by the mmap_lock held in write mode. */ + vma_start_write(vma); vm_flags_reset(vma, new_flags); if (!vma->vm_file || vma_is_anon_shmem(vma)) { error =3D replace_anon_vma_name(vma, anon_name); diff --git a/mm/mlock.c b/mm/mlock.c index 479e09d0994c..06bdfab83b58 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -387,6 +387,7 @@ static void mlock_vma_pages_range(struct vm_area_struct= *vma, */ if (newflags & VM_LOCKED) newflags |=3D VM_IO; + vma_start_write(vma); vm_flags_reset_once(vma, newflags); =20 lru_add_drain(); @@ -461,9 +462,9 @@ static int mlock_fixup(struct vma_iterator *vmi, struct= vm_area_struct *vma, * It's okay if try_to_unmap_one unmaps a page just after we * set VM_LOCKED, populate_vma_page_range will bring it back. */ - if ((newflags & VM_LOCKED) && (oldflags & VM_LOCKED)) { /* No work to do, and mlocking twice would be wrong */ + vma_start_write(vma); vm_flags_reset(vma, newflags); } else { mlock_vma_pages_range(vma, start, end, newflags); diff --git a/mm/mprotect.c b/mm/mprotect.c index 3aef1340533a..362e190a8f81 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -657,6 +657,7 @@ mprotect_fixup(struct vma_iterator *vmi, struct mmu_gat= her *tlb, * vm_flags and vm_page_prot are protected by the mmap_lock * held in write mode. */ + vma_start_write(vma); vm_flags_reset(vma, newflags); if (vma_wants_manual_pte_write_upgrade(vma)) mm_cp_flags |=3D MM_CP_TRY_CHANGE_WRITABLE; --=20 2.41.0.585.gd2178a4bd4-goog From nobody Wed Sep 10 02:49:37 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77F68C001DB for ; Fri, 4 Aug 2023 15:28:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229607AbjHDP2g (ORCPT ); Fri, 4 Aug 2023 11:28:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229686AbjHDP2E (ORCPT ); Fri, 4 Aug 2023 11:28:04 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C73A49D4 for ; Fri, 4 Aug 2023 08:27:40 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id 3f1490d57ef6-d1ebc896bd7so2183764276.2 for ; Fri, 04 Aug 2023 08:27:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691162859; x=1691767659; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=GZEu7FQxJMwmMQ2ZbaGaDze4HsujzOay4eQMS+qpos8=; b=HmgF4Vu/z2UFpEEa5aNZa6sedWXmoJ/DZmFFNhEk4pWiLAQkZQVorYTQctKH3uDMLD mj3Hcmc2cHw9IvvhBack7cSbpm6kW8wjEkPiKsi66CbqYjjpDQLrQ5x1+cVpu8yMv2a9 XNBPj0bNqztWfJDeTb2l4iWSdIBL8kDpukfn8vzY9BFDRsihRFmI5G/xZTOwo4NUFRLU +ynAJ9lUkfrprv3GNKOEl6hufYJxWORcGXt0DMN24lgUdh8KXq9YdjamSzLozV9syQ99 NFeV7GUgWtYSH9/+ggUPmVVqbv4d2kVlEfEv2775n79aqrLFQ+3AD73ymHXIu0XeY1Mj vSlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691162859; x=1691767659; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=GZEu7FQxJMwmMQ2ZbaGaDze4HsujzOay4eQMS+qpos8=; b=lR33Cn9yp5Xrjrhv0qwwdeQ1s10po1rVBAFCtyL/wVNLD7qAtVVzp9hAkANBrgImzN kYWc1u/rlSpU9Cdn2F1KOMhszI8dLrk5XmO5Wmd9TNj6LmcUVzS1llRi7jqjE/JSvgsT 31fFUvULAW152lxJzTOkCChYM0wJaUQyzeJJe+DSvkuutxU24/ubKNS8l3n4VVLma88w BOngpfQR+IXGbqw3m30eNBiKRHPDZoJJg8FHFwUIfP7B2i9707RnFaCTP+bEcLYYK3Hk B2wGaTUnUFwBuGRHY4oHHW9Qw9cDQtGlqqHJDXoMNujS8vyBQFf+IK3kcT5W/1OtbZ4S fazQ== X-Gm-Message-State: AOJu0YyJylTLX5qCiN4UNIhXj/TLBxPFqzXxCEMOWeVwtMp45mtTLODq vvkBw9MWV3kvY2wgmlHJlO7Bqx5x0g0= X-Google-Smtp-Source: AGHT+IHAOVPLc3SFAGSwKHt32pNTYMZjrIqM5CAxOwvtZsJvngxPNlrnfOqcpU9flEZvax2zIpplAXOvcxs= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:43a7:a50f:b0fd:a068]) (user=surenb job=sendgmr) by 2002:a05:6902:1614:b0:d0d:c74a:a6c0 with SMTP id bw20-20020a056902161400b00d0dc74aa6c0mr10191ybb.2.1691162859317; Fri, 04 Aug 2023 08:27:39 -0700 (PDT) Date: Fri, 4 Aug 2023 08:27:23 -0700 In-Reply-To: <20230804152724.3090321-1-surenb@google.com> Mime-Version: 1.0 References: <20230804152724.3090321-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230804152724.3090321-6-surenb@google.com> Subject: [PATCH v4 5/6] mm: always lock new vma before inserting into vma tree From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, kernel-team@android.com, Suren Baghdasaryan , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" While it's not strictly necessary to lock a newly created vma before adding it into the vma tree (as long as no further changes are performed to it), it seems like a good policy to lock it and prevent accidental changes after it becomes visible to the page faults. Lock the vma before adding it into the vma tree. Suggested-by: Jann Horn Signed-off-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett --- mm/mmap.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 3937479d0e07..850a39dee075 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -412,6 +412,8 @@ static int vma_link(struct mm_struct *mm, struct vm_are= a_struct *vma) if (vma_iter_prealloc(&vmi)) return -ENOMEM; =20 + vma_start_write(vma); + if (vma->vm_file) { mapping =3D vma->vm_file->f_mapping; i_mmap_lock_write(mapping); @@ -477,7 +479,8 @@ static inline void vma_prepare(struct vma_prepare *vp) vma_start_write(vp->vma); if (vp->adj_next) vma_start_write(vp->adj_next); - /* vp->insert is always a newly created VMA, no need for locking */ + if (vp->insert) + vma_start_write(vp->insert); if (vp->remove) vma_start_write(vp->remove); if (vp->remove2) @@ -3098,6 +3101,7 @@ static int do_brk_flags(struct vma_iterator *vmi, str= uct vm_area_struct *vma, vma->vm_pgoff =3D addr >> PAGE_SHIFT; vm_flags_init(vma, flags); vma->vm_page_prot =3D vm_get_page_prot(flags); + vma_start_write(vma); if (vma_iter_store_gfp(vmi, vma, GFP_KERNEL)) goto mas_store_fail; =20 @@ -3345,7 +3349,6 @@ struct vm_area_struct *copy_vma(struct vm_area_struct= **vmap, get_file(new_vma->vm_file); if (new_vma->vm_ops && new_vma->vm_ops->open) new_vma->vm_ops->open(new_vma); - vma_start_write(new_vma); if (vma_link(mm, new_vma)) goto out_vma_link; *need_rmap_locks =3D false; --=20 2.41.0.585.gd2178a4bd4-goog From nobody Wed Sep 10 02:49:37 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D15FCC001DB for ; Fri, 4 Aug 2023 15:28:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229600AbjHDP2k (ORCPT ); Fri, 4 Aug 2023 11:28:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229685AbjHDP2F (ORCPT ); Fri, 4 Aug 2023 11:28:05 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D921A49E5 for ; Fri, 4 Aug 2023 08:27:42 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id 3f1490d57ef6-d05883d850fso2183674276.3 for ; Fri, 04 Aug 2023 08:27:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691162862; x=1691767662; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=okHSXq0SYkri7E0to28JFQj9dGiLp+hbVT5qT1e9xdU=; b=Ze27H+8OOQhF7Oj+2ZOk+cY5b5gFDys4DfQgVT60v89OD7qi5UeZ/cauYLk5j1Z+GU XzmqYz49Fo48ZGd45wNkV/OWAGwTfMj8sHgA+WLxLRz9FINm38B5BG9wrka8I8py53e4 JxZXr7fPwYEz6xiF3SpxqoYBrBtxE6j/MgIItpyaYxeW+m/Vd5hX9SE2Cml3lUFOZW6r WM0e0CYffNX/JyZR7vi5OUlMXdaHPpAW0Kgep2I5V112BkSAgUR3PqlHz5NH22t6usrn YTi2zd8kbs4j6hx+FeLjGtgIsVutMy1LiPSegd4snkm0AH19LFF/qxuEmA9dhEOGf0FI 5fXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691162862; x=1691767662; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=okHSXq0SYkri7E0to28JFQj9dGiLp+hbVT5qT1e9xdU=; b=i8s+hGS59c9rGrIzJ7iAtfI6ruftLTSzaSz2lZy6rPiZULutLj0qsLnpg8cwAAsZr7 JBuOqDIFPcJyFJTcf5w5B2nbJ26EvVsXkNtfwEy1hQE+zp+TksvrAFMK8oV/fHVMZ3+/ A7vjCvBc6KluSk8wihoww7hGLMt3OtbQS/rDm4UAFY1PbrH/0ZKtJFJEla0WyHwvR/eQ Gj0iaojWBNYRdt4gV6h0SmffmM5zDCWmbD0KEMSF5MsMI5d0dsII1+fzRlw7saeTI6Dk +fFtz6ygq5Y3WdjDOeNFvKLtX5dfA45ZViW82XeGPEN89t1/zPiDkyIULsi1TaC73JAM sPVg== X-Gm-Message-State: AOJu0YzS12RwtXsrsH5VljVXvGH5I/R2dV3+FtPJjIK+AVDc2WiXfMCm vytyH001kSxnH6qBBW/JehTZg/FlybU= X-Google-Smtp-Source: AGHT+IGWFF8LV12V45AQ8PHaqPReOn9OGTO6qHNI1IHy9jYdCHxrz4hNZdLqwTqM3hhHqBDlThuUA+9rLzA= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:43a7:a50f:b0fd:a068]) (user=surenb job=sendgmr) by 2002:a05:6902:1614:b0:d0d:c74a:a6c0 with SMTP id bw20-20020a056902161400b00d0dc74aa6c0mr10193ybb.2.1691162861553; Fri, 04 Aug 2023 08:27:41 -0700 (PDT) Date: Fri, 4 Aug 2023 08:27:24 -0700 In-Reply-To: <20230804152724.3090321-1-surenb@google.com> Mime-Version: 1.0 References: <20230804152724.3090321-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.585.gd2178a4bd4-goog Message-ID: <20230804152724.3090321-7-surenb@google.com> Subject: [PATCH v4 6/6] mm: move vma locking out of vma_prepare and dup_anon_vma From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: torvalds@linux-foundation.org, jannh@google.com, willy@infradead.org, liam.howlett@oracle.com, david@redhat.com, peterx@redhat.com, ldufour@linux.ibm.com, vbabka@suse.cz, michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, hannes@cmpxchg.org, dave@stgolabs.net, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, kernel-team@android.com, Suren Baghdasaryan , Linus Torvalds , "Liam R . Howlett" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vma_prepare() is currently the central place where vmas are being locked before vma_complete() applies changes to them. While this is convenient, it also obscures vma locking and makes it harder to follow the locking rules. Move vma locking out of vma_prepare() and take vma locks explicitly at the locations where vmas are being modified. Move vma locking and replace it with an assertion inside dup_anon_vma() to further clarify the locking pattern inside vma_merge(). Suggested-by: Linus Torvalds Suggested-by: Liam R. Howlett Signed-off-by: Suren Baghdasaryan --- mm/mmap.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 850a39dee075..16661427d3e8 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -476,16 +476,6 @@ static inline void init_vma_prep(struct vma_prepare *v= p, */ static inline void vma_prepare(struct vma_prepare *vp) { - vma_start_write(vp->vma); - if (vp->adj_next) - vma_start_write(vp->adj_next); - if (vp->insert) - vma_start_write(vp->insert); - if (vp->remove) - vma_start_write(vp->remove); - if (vp->remove2) - vma_start_write(vp->remove2); - if (vp->file) { uprobe_munmap(vp->vma, vp->vma->vm_start, vp->vma->vm_end); =20 @@ -618,7 +608,7 @@ static inline int dup_anon_vma(struct vm_area_struct *d= st, * anon pages imported. */ if (src->anon_vma && !dst->anon_vma) { - vma_start_write(dst); + vma_assert_write_locked(dst); dst->anon_vma =3D src->anon_vma; return anon_vma_clone(dst, src); } @@ -650,10 +640,12 @@ int vma_expand(struct vma_iterator *vmi, struct vm_ar= ea_struct *vma, bool remove_next =3D false; struct vma_prepare vp; =20 + vma_start_write(vma); if (next && (vma !=3D next) && (end =3D=3D next->vm_end)) { int ret; =20 remove_next =3D true; + vma_start_write(next); ret =3D dup_anon_vma(vma, next); if (ret) return ret; @@ -708,6 +700,8 @@ int vma_shrink(struct vma_iterator *vmi, struct vm_area= _struct *vma, if (vma_iter_prealloc(vmi)) return -ENOMEM; =20 + vma_start_write(vma); + init_vma_prep(&vp, vma); vma_prepare(&vp); vma_adjust_trans_huge(vma, start, end, 0); @@ -940,16 +934,21 @@ struct vm_area_struct *vma_merge(struct vma_iterator = *vmi, struct mm_struct *mm, if (!merge_prev && !merge_next) return NULL; /* Not mergeable. */ =20 + if (merge_prev) + vma_start_write(prev); + res =3D vma =3D prev; remove =3D remove2 =3D adjust =3D NULL; =20 /* Can we merge both the predecessor and the successor? */ if (merge_prev && merge_next && is_mergeable_anon_vma(prev->anon_vma, next->anon_vma, NULL)) { + vma_start_write(next); remove =3D next; /* case 1 */ vma_end =3D next->vm_end; err =3D dup_anon_vma(prev, next); if (curr) { /* case 6 */ + vma_start_write(curr); remove =3D curr; remove2 =3D next; if (!next->anon_vma) @@ -957,6 +956,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *v= mi, struct mm_struct *mm, } } else if (merge_prev) { /* case 2 */ if (curr) { + vma_start_write(curr); err =3D dup_anon_vma(prev, curr); if (end =3D=3D curr->vm_end) { /* case 7 */ remove =3D curr; @@ -966,8 +966,10 @@ struct vm_area_struct *vma_merge(struct vma_iterator *= vmi, struct mm_struct *mm, } } } else { /* merge_next */ + vma_start_write(next); res =3D next; if (prev && addr < prev->vm_end) { /* case 4 */ + vma_start_write(prev); vma_end =3D addr; adjust =3D next; adj_start =3D -(prev->vm_end - addr); @@ -983,6 +985,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *v= mi, struct mm_struct *mm, vma_pgoff =3D next->vm_pgoff - pglen; if (curr) { /* case 8 */ vma_pgoff =3D curr->vm_pgoff; + vma_start_write(curr); remove =3D curr; err =3D dup_anon_vma(next, curr); } @@ -2373,6 +2376,9 @@ int __split_vma(struct vma_iterator *vmi, struct vm_a= rea_struct *vma, if (new->vm_ops && new->vm_ops->open) new->vm_ops->open(new); =20 + vma_start_write(vma); + vma_start_write(new); + init_vma_prep(&vp, vma); vp.insert =3D new; vma_prepare(&vp); @@ -3078,6 +3084,8 @@ static int do_brk_flags(struct vma_iterator *vmi, str= uct vm_area_struct *vma, if (vma_iter_prealloc(vmi)) goto unacct_fail; =20 + vma_start_write(vma); + init_vma_prep(&vp, vma); vma_prepare(&vp); vma_adjust_trans_huge(vma, vma->vm_start, addr + len, 0); --=20 2.41.0.585.gd2178a4bd4-goog