From nobody Wed Jun 17 07:37:14 2026 Received: from sender-pp-o93.zoho.in (sender-pp-o93.zoho.in [103.117.158.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7C1086329 for ; Thu, 23 Apr 2026 16:57:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=103.117.158.93 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776963476; cv=pass; b=WqyBM3qo319E19H20cgn8uvf3LXq4xC/xPvcxZLkyfBTMhREeCVYQwHDLShJAgAFOlxXpe6DIAGUHzBXE4KovgMXdxzYU2TkLw2cHOwUiTd5ZIkABxPcfMYuEd7ktYOjPPj4jrnzD5goASCSYth/cgvY0tXjLKiNShPzl15Jo2w= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776963476; c=relaxed/simple; bh=p3bIV9ogbDSrPxpxfbx1i3eoPYfyy1FqssUOkPyOOHA=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=rW4IIFWBNj8+BA10lcEbBeoj3cZX6DFwFvJWTlJrwQD7lx2M/FhYD3MW3rLZvZLHp7qRTsia3lPJcdUkhi92IApooA2+4/Tz3M5vMsJ4XDNykRnrxkvkgaZUMM7UDhZl4slym7wxhXcmON9UXtJL8+DOiUpW/bOoleJsFwDKHyQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=zohomail.in; spf=pass smtp.mailfrom=zohomail.in; dkim=pass (1024-bit key) header.d=zohomail.in header.i=adi.sharma@zohomail.in header.b=xCRe5/FN; arc=pass smtp.client-ip=103.117.158.93 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=zohomail.in Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zohomail.in Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=zohomail.in header.i=adi.sharma@zohomail.in header.b="xCRe5/FN" ARC-Seal: i=1; a=rsa-sha256; t=1776963437; cv=none; d=zohomail.in; s=zohoarc; b=btCkjrEtsyVPsR9+OFVTKWKG5w/pdb67DihR7cde+9rXDhbyS/1nL5dINU/vyW26OJBvT+eP134XXRut1LqdKVI0W6u0Z8lwTREKrGCKb9pKY+1W7+pvBkBBAZsf0qtibD8aZIT8KPX8nbMnFDXOS3sihhT52D312nUVDZOBesM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1776963437; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=bTpepXrqOzl9lhQcjh/bhp9I0cYkCXGZ5uxxx7tU9nE=; b=fdCwGCCCQJoleSToHVJ/IwGcujOjxxNDElYrUUd2egD/j0OZKrvSdltBWhPWQSMC6DK2BybJYEAoIbZii6OBYDYB4jElnQEMzpdjZ3TdtMz7JS5R5lDtbTN2O8htFCGZfMIPDRLwG8z05rq1yZAaaMpTV1BeD307ntF659TWkQA= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=zohomail.in; spf=pass smtp.mailfrom=adi.sharma@zohomail.in; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1776963437; s=zoho; d=zohomail.in; i=adi.sharma@zohomail.in; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=bTpepXrqOzl9lhQcjh/bhp9I0cYkCXGZ5uxxx7tU9nE=; b=xCRe5/FNH9LSMaOEiOOkFOxEhvpbp7tm9+KrlbIYs+NnVEgmSCt0YsXAmoLRlab1 GmlwLyndf/NLms7rtbQqSFjkAiMhP7bahMhxRbURVp5Vwzwjmlp4F/uhJVwCyL9NDC7 UoD+vswN++lrKlri8cYXnnnPCdQJskqVa0pBKxdk= Received: by mx.zoho.in with SMTPS id 1776963434245116.48353661832061; Thu, 23 Apr 2026 22:27:14 +0530 (IST) From: Aditya Sharma To: linux-mm@kvack.org Cc: akpm@linux-foundation.org, david@kernel.org, ljs@kernel.org, Liam.Howlett@oracle.com, vbabka@kernel.org, rppt@kernel.org, surenb@google.com, mhocko@suse.com, linux-kernel@vger.kernel.org, Aditya Sharma Subject: [PATCH v3] mm/memory: update stale locking comments for fault handlers Date: Thu, 23 Apr 2026 22:26:09 +0530 Message-Id: <20260423165609.251787-1-adi.sharma@zohomail.in> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" Update the comments for wp_page_copy(), do_wp_page(), do_swap_page(), do_anonymous_page(), __do_fault(), do_fault(), handle_pte_fault(), __handle_mm_fault(), and handle_mm_fault() to concisely clarify that they can be entered holding either the mmap_lock or the VMA lock, and that the lock may be released upon returning VM_FAULT_RETRY. Additionally, make the following corrections: - In do_anonymous_page(), correct the outdated claim that the function is entered with the PTE "mapped but not yet locked". Since handle_pte_fault() unmaps the empty PTE before routing to do_pte_missing(), the comment now correctly states it is entered with the PTE unmapped and unlocked. - In __do_fault(), update the stale reference from __lock_page_retry() to __folio_lock_or_retry(). Signed-off-by: Aditya Sharma --- v3: - Rephrased the lock state to explicitly say "held" (e.g., "either the VMA=20 lock or the mmap_lock held"). - Shortened the FAULT_FLAG_VMA_LOCK explanation to "(see FAULT_FLAG_VMA_LOC= K)"=20 across all updated comments (per David Hildenbrand). v2: - Simplified the comment to concisely state "either the VMA lock or=20 the mmap_lock" instead of a verbose explanation (per David Hildenbrand). - Expanded the scope to cover 8 other fault handlers in mm/memory.c=20 that suffered from the same stale mmap_lock comments. - Fixed an additional historical inaccuracy in do_anonymous_page()=20 regarding the PTE mapping state on entry. - Updated a stale reference in __do_fault() from __lock_page_retry()=20 to __folio_lock_or_retry(). mm/memory.c | 53 ++++++++++++++++++++++++++++------------------------- 1 file changed, 28 insertions(+), 25 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index c65e82c86..302ccb82e 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3742,8 +3742,8 @@ vm_fault_t __vmf_anon_prepare(struct vm_fault *vmf) * Handle the case of a page which we actually need to copy to a new page, * either due to COW or unsharing. * - * Called with mmap_lock locked and the old page referenced, but - * without the ptl held. + * Called with either the VMA lock or the mmap_lock held (see FAULT_FLAG_V= MA_LOCK) + * and the old page referenced, but without the ptl held. * * High level logic flow: * @@ -4142,9 +4142,9 @@ static bool wp_can_reuse_anon_folio(struct folio *fol= io, * though the page will change only once the write actually happens. This * avoids a few races, and potentially makes it more efficient. * - * We enter with non-exclusive mmap_lock (to exclude vma changes, - * but allow concurrent faults), with pte both mapped and locked. - * We return with mmap_lock still held, but pte unmapped and unlocked. + * We enter with either the VMA lock or the mmap_lock held (see + * FAULT_FLAG_VMA_LOCK) and pte both mapped and locked. We return with + * the same lock still held, but pte unmapped and unlocked. */ static vm_fault_t do_wp_page(struct vm_fault *vmf) __releases(vmf->ptl) @@ -4696,11 +4696,11 @@ static void check_swap_exclusive(struct folio *foli= o, swp_entry_t entry, } =20 /* - * We enter with non-exclusive mmap_lock (to exclude vma changes, - * but allow concurrent faults), and pte mapped but not yet locked. + * We enter with either the VMA lock or the mmap_lock held (see + * FAULT_FLAG_VMA_LOCK), and pte mapped but not yet locked. * We return with pte unmapped and unlocked. * - * We return with the mmap_lock locked or unlocked in the same cases + * We return with the lock locked or unlocked in the same cases * as does filemap_fault(). */ vm_fault_t do_swap_page(struct vm_fault *vmf) @@ -5210,9 +5210,10 @@ static struct folio *alloc_anon_folio(struct vm_faul= t *vmf) } =20 /* - * We enter with non-exclusive mmap_lock (to exclude vma changes, - * but allow concurrent faults), and pte mapped but not yet locked. - * We return with mmap_lock still held, but pte unmapped and unlocked. + * We enter with either the VMA lock or the mmap_lock held (see + * FAULT_FLAG_VMA_LOCK), and pte unmapped and unlocked. + * We return with the lock still held, but pte unmapped and unlocked. + * If VM_FAULT_RETRY is returned, the lock may have been released. */ static vm_fault_t do_anonymous_page(struct vm_fault *vmf) { @@ -5330,9 +5331,10 @@ static vm_fault_t do_anonymous_page(struct vm_fault = *vmf) } =20 /* - * The mmap_lock must have been held on entry, and may have been - * released depending on flags and vma->vm_ops->fault() return value. - * See filemap_fault() and __lock_page_retry(). + * Either the VMA lock or the mmap_lock must have been held on entry, + * and may have been released depending on flags and vma->vm_ops->fault() + * return value. + * See filemap_fault() and __folio_lock_or_retry(). */ static vm_fault_t __do_fault(struct vm_fault *vmf) { @@ -5893,11 +5895,11 @@ static vm_fault_t do_shared_fault(struct vm_fault *= vmf) } =20 /* - * We enter with non-exclusive mmap_lock (to exclude vma changes, - * but allow concurrent faults). - * The mmap_lock may have been released depending on flags and our + * We enter with either the VMA lock or the mmap_lock held (see + * FAULT_FLAG_VMA_LOCK). + * The lock may have been released depending on flags and our * return value. See filemap_fault() and __folio_lock_or_retry(). - * If mmap_lock is released, vma may become invalid (for example + * If the lock is released, vma may become invalid (for example * by other thread calling munmap()). */ static vm_fault_t do_fault(struct vm_fault *vmf) @@ -6264,10 +6266,11 @@ static void fix_spurious_fault(struct vm_fault *vmf, * with external mmu caches can use to update those (ie the Sparc or * PowerPC hashed page tables that act as extended TLBs). * - * We enter with non-exclusive mmap_lock (to exclude vma changes, but allow - * concurrent faults). + * On entry, we hold either the VMA lock or the mmap_lock + * (see FAULT_FLAG_VMA_LOCK). * - * The mmap_lock may have been released depending on flags and our return = value. + * The mmap_lock or VMA lock may have been released depending on flags + * and our return value. * See filemap_fault() and __folio_lock_or_retry(). */ static vm_fault_t handle_pte_fault(struct vm_fault *vmf) @@ -6348,8 +6351,8 @@ static vm_fault_t handle_pte_fault(struct vm_fault *v= mf) =20 /* * On entry, we hold either the VMA lock or the mmap_lock - * (FAULT_FLAG_VMA_LOCK tells you which). If VM_FAULT_RETRY is set in - * the result, the mmap_lock is not held on exit. See filemap_fault() + * (see FAULT_FLAG_VMA_LOCK). If VM_FAULT_RETRY is set in + * the result, the lock is not held on exit. See filemap_fault() * and __folio_lock_or_retry(). */ static vm_fault_t __handle_mm_fault(struct vm_area_struct *vma, @@ -6581,9 +6584,9 @@ static vm_fault_t sanitize_fault_flags(struct vm_area= _struct *vma, =20 /* * By the time we get here, we already hold either the VMA lock or the - * mmap_lock (FAULT_FLAG_VMA_LOCK tells you which). + * mmap_lock (see FAULT_FLAG_VMA_LOCK). * - * The mmap_lock may have been released depending on flags and our + * The lock may have been released depending on flags and our * return value. See filemap_fault() and __folio_lock_or_retry(). */ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long addre= ss, --=20 2.34.1