[PATCH] mm: annotate lockless accesses to vm_committed_as_batch

[PATCH] mm: annotate lockless accesses to vm_committed_as_batch

[Mani Tofigh via B4 Relay]

From: Mani Tofigh <mt4022@columbia.edu>

vm_committed_as_batch is read without a lock, and it's only a hint for
how often the per-CPU counts get folded, so racing with an update is
harmless.  Annotate the accesses.

  [    0.953509] BUG: KCSAN: data-race in __vm_enough_memory / mm_compute_batch

  [    0.953645] write to 0xffffffff825165d8 of 4 bytes by task 1 on cpu 0:
  [    0.953692]  mm_compute_batch+0xc2/0x120
  [    0.953781]  mm_compute_batch_init+0x1c/0x20
  ...

  [    0.954325] read to 0xffffffff825165d8 of 4 bytes by task 41 on cpu 1:
  [    0.954373]  __vm_enough_memory+0x24/0x2b0
  [    0.954444]  shmem_inode_acct_blocks+0x1b3/0x230
  ...

  [    0.955288] value changed: 0x00000020 -> 0x00005003

Found with KCSAN while fuzzing under a deterministic hypervisor that's
currently under development.

Signed-off-by: Mani Tofigh <mt4022@columbia.edu>
---
 include/linux/mman.h | 3 ++-
 mm/mm_init.c         | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/linux/mman.h b/include/linux/mman.h
index 389521594c69..66e6c9c335b5 100644
--- a/include/linux/mman.h
+++ b/include/linux/mman.h
@@ -75,7 +75,8 @@ unsigned long vm_memory_committed(void);
 
 static inline void vm_acct_memory(long pages)
 {
-	percpu_counter_add_batch(&vm_committed_as, pages, vm_committed_as_batch);
+	percpu_counter_add_batch(&vm_committed_as, pages,
+				 data_race(vm_committed_as_batch));
 }
 
 static inline void vm_unacct_memory(long pages)
diff --git a/mm/mm_init.c b/mm/mm_init.c
index 41a27860d2f6..81f360db0787 100644
--- a/mm/mm_init.c
+++ b/mm/mm_init.c
@@ -211,7 +211,7 @@ void mm_compute_batch(int overcommit_policy)
 	else
 		memsized_batch = min_t(u64, ram_pages/nr/4, INT_MAX);
 
-	vm_committed_as_batch = max_t(s32, memsized_batch, batch);
+	WRITE_ONCE(vm_committed_as_batch, max_t(s32, memsized_batch, batch));
 }
 
 static int __meminit mm_compute_batch_notifier(struct notifier_block *self,

---
base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
change-id: 20261027-kcsan-mm-c01794559599

Best regards,
--  
Mani Tofigh <mt4022@columbia.edu>

Re: [PATCH] mm: annotate lockless accesses to vm_committed_as_batch

[Andrew Morton]

On Tue, 27 Oct 2026 16:09:01 -0400 Mani Tofigh via B4 Relay <devnull+mt4022.columbia.edu@kernel.org> wrote:

> From: Mani Tofigh <mt4022@columbia.edu>
> 
> vm_committed_as_batch is read without a lock, and it's only a hint for
> how often the per-CPU counts get folded, so racing with an update is
> harmless.  Annotate the accesses.
> 
>   [    0.953509] BUG: KCSAN: data-race in __vm_enough_memory / mm_compute_batch
> 
>   [    0.953645] write to 0xffffffff825165d8 of 4 bytes by task 1 on cpu 0:
>   [    0.953692]  mm_compute_batch+0xc2/0x120
>   [    0.953781]  mm_compute_batch_init+0x1c/0x20
>   ...
> 
>   [    0.954325] read to 0xffffffff825165d8 of 4 bytes by task 41 on cpu 1:
>   [    0.954373]  __vm_enough_memory+0x24/0x2b0
>   [    0.954444]  shmem_inode_acct_blocks+0x1b3/0x230
>   ...
> 
>   [    0.955288] value changed: 0x00000020 -> 0x00005003
> 
> Found with KCSAN while fuzzing under a deterministic hypervisor that's
> currently under development.
>
> ...
>
> --- a/include/linux/mman.h
> +++ b/include/linux/mman.h
> @@ -75,7 +75,8 @@ unsigned long vm_memory_committed(void);
>  
>  static inline void vm_acct_memory(long pages)
>  {
> -	percpu_counter_add_batch(&vm_committed_as, pages, vm_committed_as_batch);
> +	percpu_counter_add_batch(&vm_committed_as, pages,
> +				 data_race(vm_committed_as_batch));
>  }

ok, that'll squish the KCSAN report.  A reasonable change as long as
we're sure this is not-a-bug.

> --- a/mm/mm_init.c
> +++ b/mm/mm_init.c
> @@ -211,7 +211,7 @@ void mm_compute_batch(int overcommit_policy)
>  	else
>  		memsized_batch = min_t(u64, ram_pages/nr/4, INT_MAX);
>  
> -	vm_committed_as_batch = max_t(s32, memsized_batch, batch);
> +	WRITE_ONCE(vm_committed_as_batch, max_t(s32, memsized_batch, batch));
>  }

But why this change?