mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page

[PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page

Posted by Sunny Patel 1 month, 3 weeks ago

When check_stable_address_space() fails after the PMD spinlock has
been acquired via pmd_lock(), the code jumps directly to the abort
label, bypassing the spin_unlock() call in unlock_abort. This causes
the PMD spinlock to be permanently held, leading to a deadlock.

Change the goto target from abort to unlock_abort to ensure the
spinlock is always released on this error path.

Signed-off-by: Sunny Patel <nueralspacetech@gmail.com>
---
 mm/migrate_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index fbfe5715f635..ab49d4dcdb60 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -850,7 +850,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
 	ptl = pmd_lock(vma->vm_mm, pmdp);
 	csa_ret = check_stable_address_space(vma->vm_mm);
 	if (csa_ret)
-		goto abort;
+		goto unlock_abort;
 
 	/*
 	 * Check for userfaultfd but do not deliver the fault. Instead,
-- 
2.43.0

Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page

Posted by David Hildenbrand (Arm) 1 month, 3 weeks ago

On 4/25/26 15:35, Sunny Patel wrote:
> When check_stable_address_space() fails after the PMD spinlock has
> been acquired via pmd_lock(), the code jumps directly to the abort
> label, bypassing the spin_unlock() call in unlock_abort. This causes
> the PMD spinlock to be permanently held, leading to a deadlock.
> 
> Change the goto target from abort to unlock_abort to ensure the
> spinlock is always released on this error path.
> 
> Signed-off-by: Sunny Patel <nueralspacetech@gmail.com>
> ---

Thanks!

Acked-by: David Hildenbrand (Arm) <david@kernel.org>

-- 
Cheers,

David

Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page

Posted by Zi Yan 1 month, 3 weeks ago

On 25 Apr 2026, at 9:35, Sunny Patel wrote:

> When check_stable_address_space() fails after the PMD spinlock has
> been acquired via pmd_lock(), the code jumps directly to the abort
> label, bypassing the spin_unlock() call in unlock_abort. This causes
> the PMD spinlock to be permanently held, leading to a deadlock.
>
> Change the goto target from abort to unlock_abort to ensure the
> spinlock is always released on this error path.
>
> Signed-off-by: Sunny Patel <nueralspacetech@gmail.com>
> ---
>  mm/migrate_device.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
LGTM.

Acked-by: Zi Yan <ziy@nvidia.com>


--
Best Regards,
Yan, Zi

Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page

Posted by Andrew Morton 1 month, 3 weeks ago

On Sat, 25 Apr 2026 19:05:27 +0530 Sunny Patel <nueralspacetech@gmail.com> wrote:

> When check_stable_address_space() fails after the PMD spinlock has
> been acquired via pmd_lock(), the code jumps directly to the abort
> label, bypassing the spin_unlock() call in unlock_abort. This causes
> the PMD spinlock to be permanently held, leading to a deadlock.
> 
> Change the goto target from abort to unlock_abort to ensure the
> spinlock is always released on this error path.
> 
> ...
>
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -850,7 +850,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
>  	ptl = pmd_lock(vma->vm_mm, pmdp);
>  	csa_ret = check_stable_address_space(vma->vm_mm);
>  	if (csa_ret)
> -		goto abort;
> +		goto unlock_abort;
>  
>  	/*
>  	 * Check for userfaultfd but do not deliver the fault. Instead,

whoops.

Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
Cc: <stable@vger.kernel.org>

Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page

Posted by Balbir Singh 1 month, 3 weeks ago

On 4/25/26 23:54, Andrew Morton wrote:
> On Sat, 25 Apr 2026 19:05:27 +0530 Sunny Patel <nueralspacetech@gmail.com> wrote:
> 
>> When check_stable_address_space() fails after the PMD spinlock has
>> been acquired via pmd_lock(), the code jumps directly to the abort
>> label, bypassing the spin_unlock() call in unlock_abort. This causes
>> the PMD spinlock to be permanently held, leading to a deadlock.
>>
>> Change the goto target from abort to unlock_abort to ensure the
>> spinlock is always released on this error path.
>>
>> ...
>>
>> --- a/mm/migrate_device.c
>> +++ b/mm/migrate_device.c
>> @@ -850,7 +850,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
>>  	ptl = pmd_lock(vma->vm_mm, pmdp);
>>  	csa_ret = check_stable_address_space(vma->vm_mm);
>>  	if (csa_ret)
>> -		goto abort;
>> +		goto unlock_abort;
>>  
>>  	/*
>>  	 * Check for userfaultfd but do not deliver the fault. Instead,
> 
> whoops.
> 
> Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
> Cc: <stable@vger.kernel.org>


Thanks

Acked-by: Balbir Singh <balbirs@nvidia.com>