From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 802FB3F99EA for ; Tue, 31 Mar 2026 14:01:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774965687; cv=none; b=TXEb26BK+8sIwtLAKwqL5uKLZiMzcq7erttB2qsGL35Hz+6rZZTvCXLyeHgtkeSO+Fi+4b0zOJpKA2e+8t1EJyQLW8qWeIBTYkox0od73nZNy5q6su7/0oKCtsEx/PW9pBsvbGQmuw7kaaB8XZS5Wwade0YSDRgkVp7VsgkTDFk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774965687; c=relaxed/simple; bh=3QNAlIt/WGhu+lu5S3zjSgStPUULTKuWD0FUaxX7abQ=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=dYLU3QM8YSLpLWiLdZS7yZVx1ASqqcbakjDQQLH4bkws6bMGWcnDPk5Esn12PUBmtlHfsqTnJoknzZL7KY8dpNBcpMvI+WWaJ4aqNYnxMTIwEYRz67q1bELL2oety8rpZb9n8eMlnzHOCUe93XeZpzw+6JnmvT1BzKycVxk3MyM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=H/p5VStt; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="H/p5VStt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DD91C19423; Tue, 31 Mar 2026 14:01:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774965687; bh=3QNAlIt/WGhu+lu5S3zjSgStPUULTKuWD0FUaxX7abQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=H/p5VSttub3eCYiW7dnMryStndIsldqT0G5v03so+IsVIEJr7dR0Ar4GYeUX+HSqf dpkH3E0kz7iudg4DNN0GQzl42wqHsR2jpfs434VnnY/Y15/ENQVmiCHoTgIrtqiJ6B kRfs4ZJW4TTl2NjMnT5UU0nyZ4AhrAlRJFCgjIuIecaVD9uVK5MgKhVO6BPvugLD2c KRveICMxn+VVI89419/ztbMkxtu7Xsxhpzg+qX0Hnh6fO5ZJdmGW9ZkTcoI21SyPgm C1v3QZifqNJM9N4PljR8dX71gk5VTtdte2j1uYTzsGYzBHqeyGGaTjOydzMJUgR4FJ +jPqf4pX5g2RQ== Date: Tue, 31 Mar 2026 15:01:24 +0100 From: "Lorenzo Stoakes (Oracle)" To: Nico Pache Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, aarcange@redhat.com, akpm@linux-foundation.org, anshuman.khandual@arm.com, apopple@nvidia.com, baohua@kernel.org, baolin.wang@linux.alibaba.com, byungchul@sk.com, catalin.marinas@arm.com, cl@gentwo.org, corbet@lwn.net, dave.hansen@linux.intel.com, david@kernel.org, dev.jain@arm.com, gourry@gourry.net, hannes@cmpxchg.org, hughd@google.com, jackmanb@google.com, jack@suse.cz, jannh@google.com, jglisse@google.com, joshua.hahnjy@gmail.com, kas@kernel.org, lance.yang@linux.dev, Liam.Howlett@oracle.com, lorenzo.stoakes@oracle.com, mathieu.desnoyers@efficios.com, matthew.brost@intel.com, mhiramat@kernel.org, mhocko@suse.com, peterx@redhat.com, pfalcato@suse.de, rakie.kim@sk.com, raquini@redhat.com, rdunlap@infradead.org, richard.weiyang@gmail.com, rientjes@google.com, rostedt@goodmis.org, rppt@kernel.org, ryan.roberts@arm.com, shivankg@amd.com, sunnanyong@huawei.com, surenb@google.com, thomas.hellstrom@linux.intel.com, tiwai@suse.de, usamaarif642@gmail.com, vbabka@suse.cz, vishal.moola@gmail.com, wangkefeng.wang@huawei.com, will@kernel.org, willy@infradead.org, yang@os.amperecomputing.com, ying.huang@linux.alibaba.com, ziy@nvidia.com, zokeefe@google.com Subject: Re: [PATCH mm-unstable v4 5/5] mm/khugepaged: unify khugepaged and madv_collapse with collapse_single_pmd() Message-ID: <7760c811-e100-4d40-9217-0813c28314be@lucifer.local> References: <20260325114022.444081-1-npache@redhat.com> <20260325114022.444081-6-npache@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260325114022.444081-6-npache@redhat.com> OK we need a fairly urgent fix for this as this has triggered a syzbot. See [0] for an analysis. I show inline where the issue is, and attach a fix-patch for the bug. [0]: https://lore.kernel.org/all/e1cb33b8-c1f7-4972-8628-3a2169077d6e@lucifer.local/ See below for details. Cheers, Lorenzo On Wed, Mar 25, 2026 at 05:40:22AM -0600, Nico Pache wrote: > The khugepaged daemon and madvise_collapse have two different > implementations that do almost the same thing. Create collapse_single_pmd > to increase code reuse and create an entry point to these two users. > > Refactor madvise_collapse and collapse_scan_mm_slot to use the new > collapse_single_pmd function. To help reduce confusion around the > mmap_locked variable, we rename mmap_locked to lock_dropped in the > collapse_scan_mm_slot() function, and remove the redundant mmap_locked > in madvise_collapse(); this further unifies the code readiblity. the > SCAN_PTE_MAPPED_HUGEPAGE enum is no longer reachable in the > madvise_collapse() function, so we drop it from the list of "continuing" > enums. > > This introduces a minor behavioral change that is most likely an > undiscovered bug. The current implementation of khugepaged tests > collapse_test_exit_or_disable() before calling collapse_pte_mapped_thp, > but we weren't doing it in the madvise_collapse case. By unifying these > two callers madvise_collapse now also performs this check. We also modify > the return value to be SCAN_ANY_PROCESS which properly indicates that this > process is no longer valid to operate on. > > By moving the madvise_collapse writeback-retry logic into the helper > function we can also avoid having to revalidate the VMA. > > We guard the khugepaged_pages_collapsed variable to ensure its only > incremented for khugepaged. > > As requested we also convert a VM_BUG_ON to a VM_WARN_ON. > > Reviewed-by: Lorenzo Stoakes (Oracle) > Reviewed-by: Lance Yang > Reviewed-by: Baolin Wang > Acked-by: David Hildenbrand (Arm) > Signed-off-by: Nico Pache > --- > mm/khugepaged.c | 142 ++++++++++++++++++++++++------------------------ > 1 file changed, 72 insertions(+), 70 deletions(-) > > diff --git a/mm/khugepaged.c b/mm/khugepaged.c > index 3728a2cf133c..d06d84219e1b 100644 > --- a/mm/khugepaged.c > +++ b/mm/khugepaged.c > @@ -1257,7 +1257,7 @@ static enum scan_result collapse_huge_page(struct mm_struct *mm, unsigned long a > > static enum scan_result collapse_scan_pmd(struct mm_struct *mm, > struct vm_area_struct *vma, unsigned long start_addr, > - bool *mmap_locked, struct collapse_control *cc) > + bool *lock_dropped, struct collapse_control *cc) > { > pmd_t *pmd; > pte_t *pte, *_pte; > @@ -1432,7 +1432,7 @@ static enum scan_result collapse_scan_pmd(struct mm_struct *mm, > result = collapse_huge_page(mm, start_addr, referenced, > unmapped, cc); > /* collapse_huge_page will return with the mmap_lock released */ > - *mmap_locked = false; > + *lock_dropped = true; > } > out: > trace_mm_khugepaged_scan_pmd(mm, folio, referenced, > @@ -2424,6 +2424,67 @@ static enum scan_result collapse_scan_file(struct mm_struct *mm, > return result; > } > > +/* > + * Try to collapse a single PMD starting at a PMD aligned addr, and return > + * the results. > + */ > +static enum scan_result collapse_single_pmd(unsigned long addr, > + struct vm_area_struct *vma, bool *lock_dropped, > + struct collapse_control *cc) > +{ > + struct mm_struct *mm = vma->vm_mm; > + bool triggered_wb = false; > + enum scan_result result; > + struct file *file; > + pgoff_t pgoff; > + > + mmap_assert_locked(mm); > + > + if (vma_is_anonymous(vma)) { > + result = collapse_scan_pmd(mm, vma, addr, lock_dropped, cc); > + goto end; > + } > + > + file = get_file(vma->vm_file); > + pgoff = linear_page_index(vma, addr); > + > + mmap_read_unlock(mm); > + *lock_dropped = true; > +retry: > + result = collapse_scan_file(mm, addr, file, pgoff, cc); > + > + /* > + * For MADV_COLLAPSE, when encountering dirty pages, try to writeback, > + * then retry the collapse one time. > + */ > + if (!cc->is_khugepaged && result == SCAN_PAGE_DIRTY_OR_WRITEBACK && > + !triggered_wb && mapping_can_writeback(file->f_mapping)) { > + const loff_t lstart = (loff_t)pgoff << PAGE_SHIFT; > + const loff_t lend = lstart + HPAGE_PMD_SIZE - 1; > + > + filemap_write_and_wait_range(file->f_mapping, lstart, lend); > + triggered_wb = true; > + goto retry; > + } > + fput(file); > + > + if (result == SCAN_PTE_MAPPED_HUGEPAGE) { > + mmap_read_lock(mm); > + if (collapse_test_exit_or_disable(mm)) > + result = SCAN_ANY_PROCESS; > + else > + result = try_collapse_pte_mapped_thp(mm, addr, > + !cc->is_khugepaged); > + if (result == SCAN_PMD_MAPPED) > + result = SCAN_SUCCEED; > + mmap_read_unlock(mm); > + } > +end: > + if (cc->is_khugepaged && result == SCAN_SUCCEED) > + ++khugepaged_pages_collapsed; > + return result; > +} > + > static void collapse_scan_mm_slot(unsigned int progress_max, > enum scan_result *result, struct collapse_control *cc) > __releases(&khugepaged_mm_lock) > @@ -2485,46 +2546,21 @@ static void collapse_scan_mm_slot(unsigned int progress_max, > VM_BUG_ON(khugepaged_scan.address & ~HPAGE_PMD_MASK); > > while (khugepaged_scan.address < hend) { > - bool mmap_locked = true; > + bool lock_dropped = false; > > cond_resched(); > if (unlikely(collapse_test_exit_or_disable(mm))) > goto breakouterloop; > > - VM_BUG_ON(khugepaged_scan.address < hstart || > + VM_WARN_ON_ONCE(khugepaged_scan.address < hstart || > khugepaged_scan.address + HPAGE_PMD_SIZE > > hend); > - if (!vma_is_anonymous(vma)) { > - struct file *file = get_file(vma->vm_file); > - pgoff_t pgoff = linear_page_index(vma, > - khugepaged_scan.address); > - > - mmap_read_unlock(mm); > - mmap_locked = false; > - *result = collapse_scan_file(mm, > - khugepaged_scan.address, file, pgoff, cc); > - fput(file); > - if (*result == SCAN_PTE_MAPPED_HUGEPAGE) { > - mmap_read_lock(mm); > - if (collapse_test_exit_or_disable(mm)) > - goto breakouterloop; > - *result = try_collapse_pte_mapped_thp(mm, > - khugepaged_scan.address, false); > - if (*result == SCAN_PMD_MAPPED) > - *result = SCAN_SUCCEED; > - mmap_read_unlock(mm); > - } > - } else { > - *result = collapse_scan_pmd(mm, vma, > - khugepaged_scan.address, &mmap_locked, cc); > - } > - > - if (*result == SCAN_SUCCEED) > - ++khugepaged_pages_collapsed; > > + *result = collapse_single_pmd(khugepaged_scan.address, > + vma, &lock_dropped, cc); > /* move to next address */ > khugepaged_scan.address += HPAGE_PMD_SIZE; > - if (!mmap_locked) > + if (lock_dropped) > /* > * We released mmap_lock so break loop. Note > * that we drop mmap_lock before all hugepage > @@ -2799,7 +2835,6 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, > unsigned long hstart, hend, addr; > enum scan_result last_fail = SCAN_FAIL; > int thps = 0; > - bool mmap_locked = true; > > BUG_ON(vma->vm_start > start); > BUG_ON(vma->vm_end < end); > @@ -2821,13 +2856,11 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, > > for (addr = hstart; addr < hend; addr += HPAGE_PMD_SIZE) { > enum scan_result result = SCAN_FAIL; > - bool triggered_wb = false; > > -retry: > - if (!mmap_locked) { > + if (*lock_dropped) { > cond_resched(); > mmap_read_lock(mm); > - mmap_locked = true; > + *lock_dropped = false; So this is the bug. 'lock_dropped' needs to record if the lock was _ever_ dropped, not if it is _currently_ dropped. This is probably a mea culpa on my part on review, so apologies. See below for a fix-patch. > result = hugepage_vma_revalidate(mm, addr, false, &vma, > cc); > if (result != SCAN_SUCCEED) { > @@ -2837,45 +2870,14 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, > > hend = min(hend, vma->vm_end & HPAGE_PMD_MASK); > } > - mmap_assert_locked(mm); > - if (!vma_is_anonymous(vma)) { > - struct file *file = get_file(vma->vm_file); > - pgoff_t pgoff = linear_page_index(vma, addr); > > - mmap_read_unlock(mm); > - mmap_locked = false; > - *lock_dropped = true; > - result = collapse_scan_file(mm, addr, file, pgoff, cc); > - > - if (result == SCAN_PAGE_DIRTY_OR_WRITEBACK && !triggered_wb && > - mapping_can_writeback(file->f_mapping)) { > - loff_t lstart = (loff_t)pgoff << PAGE_SHIFT; > - loff_t lend = lstart + HPAGE_PMD_SIZE - 1; > - > - filemap_write_and_wait_range(file->f_mapping, lstart, lend); > - triggered_wb = true; > - fput(file); > - goto retry; > - } > - fput(file); > - } else { > - result = collapse_scan_pmd(mm, vma, addr, &mmap_locked, cc); > - } > - if (!mmap_locked) > - *lock_dropped = true; > + result = collapse_single_pmd(addr, vma, lock_dropped, cc); > > -handle_result: > switch (result) { > case SCAN_SUCCEED: > case SCAN_PMD_MAPPED: > ++thps; > break; > - case SCAN_PTE_MAPPED_HUGEPAGE: > - BUG_ON(mmap_locked); > - mmap_read_lock(mm); > - result = try_collapse_pte_mapped_thp(mm, addr, true); > - mmap_read_unlock(mm); > - goto handle_result; > /* Whitelisted set of results where continuing OK */ > case SCAN_NO_PTE_TABLE: > case SCAN_PTE_NON_PRESENT: > @@ -2898,7 +2900,7 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, > > out_maybelock: > /* Caller expects us to hold mmap_lock on return */ > - if (!mmap_locked) > + if (*lock_dropped) > mmap_read_lock(mm); > out_nolock: > mmap_assert_locked(mm); > -- > 2.53.0 > Fix patch follows: ----8<---- >From a4dfc7718a15035449f344a0bc7f58e449366405 Mon Sep 17 00:00:00 2001 From: "Lorenzo Stoakes (Oracle)" Date: Tue, 31 Mar 2026 13:11:18 +0100 Subject: [PATCH] mm/khugepaged: fix issue with tracking lock We are incorrectly treating lock_dropped to track both whether the lock is currently held and whether or not the lock was ever dropped. Update this change to account for this. Signed-off-by: Lorenzo Stoakes (Oracle) --- mm/khugepaged.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index d21348b85a59..b8452dbdb043 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -2828,6 +2828,7 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, unsigned long hstart, hend, addr; enum scan_result last_fail = SCAN_FAIL; int thps = 0; + bool mmap_unlocked = false; BUG_ON(vma->vm_start > start); BUG_ON(vma->vm_end < end); @@ -2850,10 +2851,11 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, for (addr = hstart; addr < hend; addr += HPAGE_PMD_SIZE) { enum scan_result result = SCAN_FAIL; - if (*lock_dropped) { + if (mmap_unlocked) { cond_resched(); mmap_read_lock(mm); - *lock_dropped = false; + mmap_unlocked = false; + *lock_dropped = true; result = hugepage_vma_revalidate(mm, addr, false, &vma, cc); if (result != SCAN_SUCCEED) { @@ -2864,7 +2866,7 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, hend = min(hend, vma->vm_end & HPAGE_PMD_MASK); } - result = collapse_single_pmd(addr, vma, lock_dropped, cc); + result = collapse_single_pmd(addr, vma, &mmap_unlocked, cc); switch (result) { case SCAN_SUCCEED: @@ -2893,8 +2895,10 @@ int madvise_collapse(struct vm_area_struct *vma, unsigned long start, out_maybelock: /* Caller expects us to hold mmap_lock on return */ - if (*lock_dropped) + if (mmap_unlocked) { + *lock_dropped = true; mmap_read_lock(mm); + } out_nolock: mmap_assert_locked(mm); mmdrop(mm); -- 2.53.0