From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f47.google.com (mail-yx1-f47.google.com [74.125.224.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1499B3438A4 for ; Sat, 22 Aug 2026 16:38:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787416740; cv=none; b=Pod/8Vo6zlDrQQYulSa6eVlfcfZZMTI0o9Arfbdcvov60RR9qeR4vY1F7osi28EtDIqmTFDHHPFfF3nC+2YV+yDgY0kpXXeZ1my9Aj4+9RCH9mcRl1MSf+K5TT3vmvHBxzjYU3DGrjqwmaMaq9knYzAzoy/IC+9ZBmUx0HyVoYU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787416740; c=relaxed/simple; bh=jzX9FQbRZLAz8TJ6bfi3wr6ZHiA++k30d/stZ1RdYkI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=JdLkQfREU/v63pjQ7gi5XGOAjFEyoOmYWs34SZGYX8FEX37ZLtrU/EVx1vJLqC4fPyJeJjJF2Cc8ISoKeAM1kRK5/5Vpc3kRBRJgl3dqYLbD8Pq1I5o4QytjCJ1I++Wc4NZNeDkQ/dp9qWcy/de6iFPoftejk3XYstkaaPzxtuo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EoajzDrp; arc=none smtp.client-ip=74.125.224.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EoajzDrp" Received: by mail-yx1-f47.google.com with SMTP id 956f58d0204a3-66b0230bcc2so206981d50.3 for ; Sat, 22 Aug 2026 09:38:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787416737; x=1788021537; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=g7kLVYi/u6oDHfqj97goW0adMfCQDYdgNJj4eCuKJKQ=; b=EoajzDrpJI+S4gY5ENVAW2gHk5s2Fo88MrcTfs/I88EOracHdsSQNRHPvinKlOZpvM DcTaXT2ZeU8n2QMsaTO899Ltmx+PftX5ReotGygFjicT8ErdJ1MkWHq6X9XOlUxqoGB8 REN9uiKaVlpWfRaPTjKRKfyOjG7dclapknXFykaVi/EhINtJTUClzLndwOGwd2x9/bAZ ZqIpJn9os3G1dcyyRFYmNVtIIkghn09CXkf8gLJeLVP9K/CkwCdvWf2Z23NwofPWJI9O skv95u7FhAj8XjyMoxiCgEltq5tvZ0lwNE5ke7DWBScCEFm92/L9R/7Uv+eZNyX8zzLd dbdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787416737; x=1788021537; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=g7kLVYi/u6oDHfqj97goW0adMfCQDYdgNJj4eCuKJKQ=; b=MIwh+x4qzD+UjxBoDgmfFr7IKW2waI062omFV2H+URYnQ3EgN7we60taBfjfEfr3Jl doIzbo0Y/7/YWbkWMgCLAf+vbBMUjPKkyfDH76ru0dhyzJPFdd+bzWqk9zYlQS4Eyh0w TTAxtA7iE9GrwIMzWngLD5wkHjRpNmSQdHdGVWAD/Z0UQaE4fRgBuhh7reMmd/sP6/o+ ZpfrBF9z7L1Uq+LYRfVfcZRNXHbGNkKEh26qRuVhEUodOYhL9z4AGw1NZg80fYaXB0j6 7yZzjlIQmESz4EQnI9mVQfpnOSou8iGk6RT0mcYaYkeFwEXYjFn2XgT3ftjvv2ML9Chy 6a4Q== X-Forwarded-Encrypted: i=1; AHgh+RpfvnExzaCnatq7CwyF/DhWpZXQV5c6hIGuH1Y31V5FzES5sYDK07HfPrxN+eXEIWFuCP3qbC/8ju6aI7Y=@vger.kernel.org X-Gm-Message-State: AFuF++nNPqd/SAMmvQdot7WETbcv8p1NnaVuVVLdp7YhW6uO75jglSuH zm2I5e3wtlQ+qR7GRZ9rcicEMyh8lCJ/HcaIx6aDZxCr+99TJedUCJMe X-Gm-Gg: AR+sD11IxiuJZ5tsCuDnBzI5SvLfrfn+fVrLE+hZpcciH3cyQzcg4jB/sn2cGJbQykU rSQ/3lXOQVpCKIrM5aRYuf5WErMVKqq5nxijxB58Qo7IXsrFzX7ySmCYJla8UwBmjjsCZM12/cQ RuuTT8t8Kr6aJvSAtVUrQda6Jk3rgl21MIkKB165kTosCNQSwvgnSL05KKonA75ORTnoPryUPzx fzNegykOMG78SgiYUkzK3Rqw/Ng5sczijEF1IuW9yI3D9XGgr0K2aDqnbTguVR0VL/ayIhXeswq KXvDU0ANzwzx6Pq6gbc8Utb+fGUoBRENEyWkPWHwKjou3nSmF3HMpIC7Tikj28YFEcLzv2PbKtQ S1eOQ8QAC0RVc/uV531GwHe5Pnsu70X3bJxq5Le248PumEa5YcdYY/sHs33/4ugvjgLKm/gn8cv On4Pe+nPnA1FfwnTy+QLezmzbj+xdJbf6eokcQVlnmFVZl6otYX87IHiFWM1rR5tl8QYfHLHr0I Er56GSdE8Tw0k2fMQoRMEarF5wbR7lwmUdA+I7Wlu+lN6WLArRNw24= X-Received: by 2002:a05:690c:6b86:b0:820:100e:1abb with SMTP id 00721157ae682-849f7d0c986mr57211377b3.4.1787416736602; Sat, 22 Aug 2026 09:38:56 -0700 (PDT) Received: from localhost.localdomain (45.78.65.84.16clouds.com. [45.78.65.84]) by smtp.gmail.com with ESMTPSA id 00721157ae682-84ca518899csm12628707b3.2.2026.08.22.09.38.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Aug 2026 09:38:56 -0700 (PDT) From: Chengfeng Ye To: Andrew Morton , David Hildenbrand , Xu Xin , Chengming Zhou , Hugh Dickins Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Chengfeng Ye Subject: [PATCH] mm/ksm: mark migration stores with WRITE_ONCE() Date: Sun, 23 Aug 2026 00:38:46 +0800 Message-ID: <20260822163846.3747787-1-nicoyip.dev@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ksm_get_folio() deliberately samples stable_node->kpfn and folio->mapping without taking the folio lock because the KSM folio may be migrated concurrently. folio_migrate_ksm() updates the same state using plain assignments. The reader can load the old kpfn, then the migrator can store the new kpfn, execute smp_wmb(), and clear the old folio's mapping before the reader checks that mapping. Thus the initial kpfn load can overlap its update and the subsequent mapping load can overlap the clear, with no common lock. This leaves marked READ_ONCE() accesses racing with plain stores. The kernel reported: BUG: KCSAN: data-race in folio_migrate_ksm / ksm_get_folio read (marked) to 0xffff8ce401421330 of 8 bytes by task 48 on cpu 3: ksm_get_folio+0x7f/0x2a0 ksm_scan_thread+0x1635/0x3330 kthread+0x1af/0x1f0 write to 0xffff8ce401421330 of 8 bytes by task 102 on cpu 1: folio_migrate_ksm+0x6a/0xd0 folio_migrate_flags+0x193/0x420 __migrate_folio.isra.0+0x162/0x1a0 migrate_folio+0x4c/0x70 move_to_new_folio+0xd6/0x170 Use WRITE_ONCE() for both stores to pair them with the existing lockless reads. This preserves the existing smp_wmb()/smp_rmb() migration protocol and control flow while preventing compiler transformations of the shared accesses. Signed-off-by: Chengfeng Ye --- mm/ksm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index b4142746777e..bec6fea0fdb4 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1116,7 +1116,8 @@ static inline void folio_set_stable_node(struct folio *folio, struct ksm_stable_node *stable_node) { VM_WARN_ON_FOLIO(folio_test_anon(folio) && PageAnonExclusive(&folio->page), folio); - folio->mapping = (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM); + WRITE_ONCE(folio->mapping, + (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM)); } #ifdef CONFIG_SYSFS @@ -3318,7 +3319,7 @@ void folio_migrate_ksm(struct folio *newfolio, struct folio *folio) stable_node = folio_stable_node(folio); if (stable_node) { VM_BUG_ON_FOLIO(stable_node->kpfn != folio_pfn(folio), folio); - stable_node->kpfn = folio_pfn(newfolio); + WRITE_ONCE(stable_node->kpfn, folio_pfn(newfolio)); /* * newfolio->mapping was set in advance; now we need smp_wmb() * to make sure that the new stable_node->kpfn is visible -- 2.43.0