From nobody Sun Feb 8 19:56:12 2026 Received: from mxhk.zte.com.cn (mxhk.zte.com.cn [160.30.148.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4626F2FE056 for ; Wed, 14 Jan 2026 03:24:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=160.30.148.34 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768361072; cv=none; b=m7m+/8hu37nkSqeGnR+6M34qgZl/hhjGH/tDDK6JXPlHmT57DzxT7t2gusKhg+zNph+SH8UQjw6phJAydi/RsHBKF4GB/JPtHwOb9n67e5YAK/o9isJ+F+WRLJthVmGIO76fjVprbSACOF7ic8HFJ8VUs0l35dreveY+YrgiNy0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768361072; c=relaxed/simple; bh=iQ2HZstshV9VwENnoBtCfIZKn/VEuuxEwmmsJ3ACb2w=; h=Message-ID:Date:Mime-Version:From:To:Cc:Subject:Content-Type; b=kGv8Nh3MEq8Vzy9CWrTG+SY8jPQl9by4AJC0vZuruplpXribOaPDuyARIBXHccQhaQoPZkng+wB0UXOfpRSifhSeFmMkoOymONP5AacETzgKJf4Jb/viJ4BcXLRr3l1fTGUKhh9UanBR+L1ORwQCLU7CgGimD4hk10wJBMcc9+U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn; spf=pass smtp.mailfrom=zte.com.cn; arc=none smtp.client-ip=160.30.148.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zte.com.cn Received: from mse-fl2.zte.com.cn (unknown [10.5.228.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mxhk.zte.com.cn (FangMail) with ESMTPS id 4drWgc3QpTz6Fy6F; Wed, 14 Jan 2026 11:24:28 +0800 (CST) Received: from xaxapp02.zte.com.cn ([10.88.97.241]) by mse-fl2.zte.com.cn with SMTP id 60E3OG20017867; Wed, 14 Jan 2026 11:24:16 +0800 (+08) (envelope-from wang.yaxin@zte.com.cn) Received: from mapi (xaxapp04[null]) by mapi (Zmail) with MAPI id mid32; Wed, 14 Jan 2026 11:24:17 +0800 (CST) X-Zmail-TransId: 2afb69670c61485-b4fe3 X-Mailer: Zmail v1.0 Message-ID: <202601141124178748cM66DJW2fzNea7Uym1mG@zte.com.cn> Date: Wed, 14 Jan 2026 11:24:17 +0800 (CST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 From: To: , , , Cc: , , , , , , , , , , , , Subject: =?UTF-8?B?W1BBVENIIGxpbnV4LW5leHRdIG1tL21hZHZpc2U6IHByZWZlciBWTUEgbG9jayBmb3IgTUFEVl9SRU1PVkU=?= X-MAIL: mse-fl2.zte.com.cn 60E3OG20017867 X-TLS: YES X-SPF-DOMAIN: zte.com.cn X-ENVELOPE-SENDER: wang.yaxin@zte.com.cn X-SPF: None X-SOURCE-IP: 10.5.228.133 unknown Wed, 14 Jan 2026 11:24:29 +0800 X-Fangmail-Anti-Spam-Filtered: true X-Fangmail-MID-QID: 69670C6C.001/4drWgc3QpTz6Fy6F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jiang Kun MADV_REMOVE currently runs under the process-wide mmap_read_lock() and temporarily drops and reacquires it around filesystem hole-punching. For single-VMA, local-mm, non-UFFD-armed ranges we can safely operate under the finer-grained per-VMA read lock to reduce contention and lock hold time, while preserving semantics. This patch: - Switches MADV_REMOVE to prefer MADVISE_VMA_READ_LOCK via get_lock_mode(). - Adds a branch in madvise_remove(): * Under VMA lock: avoid mark_mmap_lock_dropped() and mmap lock churn; take a file reference and call vfs_fallocate() directly. * Under mmap read lock fallback: preserve existing behavior including userfaultfd_remove() coordination and temporary mmap_read_unlock/lock around vfs_fallocate(). Constraints and fallback: - try_vma_read_lock() enforces single VMA, local mm, and userfaultfd not armed (userfaultfd_armed(vma) =3D=3D false). If any condition fails, we fall back to mmap_read_lock(mm) and use the original path. - Semantics are unchanged: permission checks, VM_LOCKED rejection, shared-may-write requirement, error propagation all remain as before. Signed-off-by: Jiang Kun Signed-off-by: Yaxin Wang --- mm/madvise.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/mm/madvise.c b/mm/madvise.c index 6bf7009fa5ce..279ec5169879 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1015,7 +1015,19 @@ static long madvise_remove(struct madvise_behavior *= madv_behavior) unsigned long start =3D madv_behavior->range.start; unsigned long end =3D madv_behavior->range.end; - mark_mmap_lock_dropped(madv_behavior); + /* + * Prefer VMA read lock path: when operating under VMA lock, we avoid + * dropping/reacquiring the mmap lock and directly perform the filesystem + * operation while the VMA is read-locked. We still take and drop a file + * reference to protect against concurrent file changes. + * + * When operating under mmap read lock (fallback), preserve existing + * behaviour: mark lock dropped, coordinate with userfaultfd_remove(), + * temporarily drop mmap_read_lock around vfs_fallocate(), and then + * reacquire it. + */ + if (madv_behavior->lock_mode =3D=3D MADVISE_MMAP_READ_LOCK) + mark_mmap_lock_dropped(madv_behavior); if (vma->vm_flags & VM_LOCKED) return -EINVAL; @@ -1033,12 +1045,19 @@ static long madvise_remove(struct madvise_behavior = *madv_behavior) + ((loff_t)vma->vm_pgoff << PAGE_SHIFT); /* - * Filesystem's fallocate may need to take i_rwsem. We need to - * explicitly grab a reference because the vma (and hence the - * vma's reference to the file) can go away as soon as we drop - * mmap_lock. + * Execute filesystem punch-hole under appropriate locking. + * - VMA lock path: no mmap lock held; call vfs_fallocate() directly. + * - mmap lock path: follow existing protocol including UFFD coordination + * and temporary mmap_read_unlock/lock around the filesystem call. */ get_file(f); + if (madv_behavior->lock_mode =3D=3D MADVISE_VMA_READ_LOCK) { + error =3D vfs_fallocate(f, + FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, + offset, end - start); + fput(f); + return error; + } if (userfaultfd_remove(vma, start, end)) { /* mmap_lock was not released by userfaultfd_remove() */ mmap_read_unlock(mm); @@ -1754,7 +1773,6 @@ static enum madvise_lock_mode get_lock_mode(struct ma= dvise_behavior *madv_behavi return MADVISE_NO_LOCK; switch (madv_behavior->behavior) { - case MADV_REMOVE: case MADV_WILLNEED: case MADV_COLD: case MADV_PAGEOUT: @@ -1762,6 +1780,7 @@ static enum madvise_lock_mode get_lock_mode(struct ma= dvise_behavior *madv_behavi case MADV_POPULATE_WRITE: case MADV_COLLAPSE: return MADVISE_MMAP_READ_LOCK; + case MADV_REMOVE: case MADV_GUARD_INSTALL: case MADV_GUARD_REMOVE: case MADV_DONTNEED: --=20 2.43.5