From nobody Thu Apr 16 20:57:25 2026 Received: from mxct.zte.com.cn (mxct.zte.com.cn [183.62.165.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86E4729E0F6 for ; Fri, 10 Apr 2026 08:03:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=183.62.165.209 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775808190; cv=none; b=c6C3192gKN281vYtEyWpoTRz0WDBhuNRYRxw7gduFlVJmiGzShB2IrroBImX17nAZKnfSf9+GlSi6lpEAOdMyvPHW/QWa3PXM9TZP00MCHDtM1vMmGMICqE+98nF7ixbTaD8vYn4q8lSrKUcCTjb+0T1nBnH2mNJxRxi9Tyqgho= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775808190; c=relaxed/simple; bh=+nVUKcrxi050AB4XLdQUXPLg2EW2HiFPxfzky7NC530=; h=Message-ID:Date:Mime-Version:From:To:Cc:Subject:Content-Type; b=OIBHyBQaz1uOjMXxUBA/17NcXia0GA0ZdV2esglgg8Zpxed8iOwrWTbHUydZGFXWUP4x8+d3mlsozhrDGUZsXr8oO/cbnUfkBnkGo9jUON3ArpzHo5lWuseDqEp0utCxPH5TpYDJRzOojsUiDCykdTbYdn4xgiKSt7smBeGwHEI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn; spf=pass smtp.mailfrom=zte.com.cn; arc=none smtp.client-ip=183.62.165.209 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zte.com.cn Received: from mse-fl2.zte.com.cn (unknown [10.5.228.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mxct.zte.com.cn (FangMail) with ESMTPS id 4fsTnD5hwJz4xPSP; Fri, 10 Apr 2026 16:02:56 +0800 (CST) Received: from njb2app05.zte.com.cn ([10.55.22.121]) by mse-fl2.zte.com.cn with SMTP id 63A82LUU084046; Fri, 10 Apr 2026 16:02:47 +0800 (+08) (envelope-from jiang.kun2@zte.com.cn) Received: from mapi (njb2app06[null]) by mapi (Zmail) with MAPI id mid204; Fri, 10 Apr 2026 16:02:49 +0800 (CST) X-Zmail-TransId: 2afe69d8aea9b13-cb0e8 X-Mailer: Zmail v1.0 Message-ID: <20260410160249749i98jwNgNLmLMKRNVeoKVe@zte.com.cn> Date: Fri, 10 Apr 2026 16:02:49 +0800 (CST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 From: To: , , , , , Cc: , , , , , Subject: =?UTF-8?B?W1BBVENIIHYyXSBtbS9tYWR2aXNlOiBwcmVmZXIgVk1BIGxvY2sgZm9yIE1BRFZfUkVNT1ZF?= X-MAIL: mse-fl2.zte.com.cn 63A82LUU084046 X-TLS: YES X-SPF-DOMAIN: zte.com.cn X-ENVELOPE-SENDER: jiang.kun2@zte.com.cn X-SPF: None X-SOURCE-IP: 10.5.228.133 unknown Fri, 10 Apr 2026 16:02:56 +0800 X-Fangmail-Anti-Spam-Filtered: true X-Fangmail-MID-QID: 69D8AEB0.000/4fsTnD5hwJz4xPSP Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jiang Kun MADV_REMOVE prefers the per-VMA read lock for single-VMA, local-mm, non-UFFD-armed ranges, avoiding mmap_lock contention for such ranges. However, calling into the filesystem while holding vm_lock (VMA lock) can create lock ordering issues. syzbot reported a possible deadlock in blkdev_fallocate() when vfs_fallocate() is called under vm_lock. Fix this by dropping the VMA lock before invoking vfs_fallocate(), after taking an extra reference to the file. Keep the existing mmap_lock fallback path and its userfaultfd coordination unchanged. Repeated benchmark runs show no regression in the uncontended case, and show benefit once mmap_lock contention is introduced. Link: https://ci.syzbot.org/series/30acb9df-ca55-4cbf-81ed-89b84da8edc1 Link: https://lore.kernel.org/all/aWcZCwz__qwwKbxw@casper.infradead.org/ Signed-off-by: Jiang Kun Signed-off-by: Yaxin Wang --- mm/madvise.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/mm/madvise.c b/mm/madvise.c index 69708e953cf5..0932579bccb4 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1008,8 +1008,6 @@ static long madvise_remove(struct madvise_behavior *m= adv_behavior) unsigned long start =3D madv_behavior->range.start; unsigned long end =3D madv_behavior->range.end; - mark_mmap_lock_dropped(madv_behavior); - if (vma->vm_flags & VM_LOCKED) return -EINVAL; @@ -1025,6 +1023,20 @@ static long madvise_remove(struct madvise_behavior *= madv_behavior) offset =3D (loff_t)(start - vma->vm_start) + ((loff_t)vma->vm_pgoff << PAGE_SHIFT); + /* Avoid calling into the filesystem while holding a VMA lock. */ + if (madv_behavior->lock_mode =3D=3D MADVISE_VMA_READ_LOCK) { + get_file(f); + vma_end_read(vma); + madv_behavior->vma =3D NULL; + error =3D vfs_fallocate(f, + FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, + offset, end - start); + fput(f); + return error; + } + + mark_mmap_lock_dropped(madv_behavior); + /* * Filesystem's fallocate may need to take i_rwsem. We need to * explicitly grab a reference because the vma (and hence the @@ -1677,7 +1689,8 @@ int madvise_walk_vmas(struct madvise_behavior *madv_b= ehavior) if (madv_behavior->lock_mode =3D=3D MADVISE_VMA_READ_LOCK && try_vma_read_lock(madv_behavior)) { error =3D madvise_vma_behavior(madv_behavior); - vma_end_read(madv_behavior->vma); + if (madv_behavior->vma) + vma_end_read(madv_behavior->vma); return error; } @@ -1746,7 +1759,6 @@ static enum madvise_lock_mode get_lock_mode(struct ma= dvise_behavior *madv_behavi return MADVISE_NO_LOCK; switch (madv_behavior->behavior) { - case MADV_REMOVE: case MADV_WILLNEED: case MADV_COLD: case MADV_PAGEOUT: @@ -1754,6 +1766,7 @@ static enum madvise_lock_mode get_lock_mode(struct ma= dvise_behavior *madv_behavi case MADV_POPULATE_WRITE: case MADV_COLLAPSE: return MADVISE_MMAP_READ_LOCK; + case MADV_REMOVE: case MADV_GUARD_INSTALL: case MADV_GUARD_REMOVE: case MADV_DONTNEED: --=20 2.53.0