From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C89AB73463 for ; Tue, 3 Mar 2026 04:15:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772511321; cv=none; b=fkmI060Z0S5hqbKjLfckvTa58/YsodeFL6DN4SXEUjKn7lDJZYTegP89KOarPNxFgq6nSaPeh82mOfI229uluTr+93kC092uQ/oi1A1vAHtqSuoNndeR8QH+kgYe3aYX4K0Avp3qDzMVLBezli5fmzTo8MKUQiVSWQlpybo4e9E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772511321; c=relaxed/simple; bh=r99WSOXBux/L6WMMLanpKKBiooTS1Ssm47KfnrCol5M=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=dzGsSgCS+guotVEWOTHyxtZUqZGS26ZOts7bxBnzZ66lZkpAlNxGfRbkOB9sDO16AkIO4k9ExmL7b4GnXh5akFbUs8qXF933kgKbFFOUvLNZUdiaZ7768o5ntW7tJQBSbT9uj70HR6IAWuJQZ7cJlbEme5ft6Su7IgN3UWafVJ8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=rEhXhkOU; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="rEhXhkOU" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Transfer-Encoding: Content-Type:MIME-Version:References:Message-ID:Subject:Cc:To:From:Date: Sender:Reply-To:Content-ID:Content-Description; bh=AsnfbDJxYriXM7PARNus8j9mg2vbEJtRaMr8poW6b3o=; b=rEhXhkOUg11488tgZY0lTrsHDx jmSxZ0Ct+YWsK7P7AcGjuP5ShwHVdwUp+39IDEu2C2l2sFP6qQMbq0Ia5efpMushHDnuNszdZ1cgN HAnljARuhIaf4QcBsLjZ6W1ulI1ppUq0ALWrCEDt4n1LVDeQ11fvmM6W2z+NaOjDNS/haHjwdYlwd lNmdbSf99SoI0wFVNSGsvOpRKZZecK22vuyJ0j9MSR1GyYNulfG+qmE7fOKpQqW1uphySY64igU2Z jIX5Ntd1OWOqgB25UM7iNGZgetJa1h0/xCYGJJAGyDrow/Uq25rgnjHvMZ79QU5ZPvekVrJsvlVpL NWD6slfA==; Received: from willy by casper.infradead.org with local (Exim 4.98.2 #2 (Red Hat Linux)) id 1vxHA8-0000000ApKH-2wEA; Tue, 03 Mar 2026 04:15:12 +0000 Date: Tue, 3 Mar 2026 04:15:12 +0000 From: Matthew Wilcox To: "liying3@sungrowpower.com" Cc: akpm , linux-mm , linux-kernel , victor7q , David Hildenbrand , Greg Kroah-Hartman Subject: Re: [BUG] mm/mempolicy: possible double-unlock in migrate_to_node() on 6.6 Message-ID: References: <2026030310525141773825@sungrowpower.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <2026030310525141773825@sungrowpower.com> On Tue, Mar 03, 2026 at 10:52:51AM +0800, liying3@sungrowpower.com wrote: > Hi Andrew, > > I found that a fix is required for this submission in branch 6.6. > https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a13b2b9b0b0b04612c7d81e3b3dfb485c5f7abc3 Agreed, although your email should more properly have been directed to David and possibly Greg. Are you going to submit a patch to fix this, or do you prefer that somebody else does it? > Regarding the difference between branches 6.6 and 6.12, in branch 6.6, mmap_read_lock() and mmap_read_unlock() are called outside the migrate_to_node() function. > Therefore, mmap_read_unlock(mm) should not be invoked inside migrate_to_node(); otherwise, it would result in a double unlock of the mm. > diff --git a/mm/mempolicy.c b/mm/mempolicy.c > index 54f1b78d1b2c0f..94c74c594d102a 100644 > --- a/mm/mempolicy.c > +++ b/mm/mempolicy.c > @@ -1071,6 +1071,10 @@ static long migrate_to_node(struct mm_struct *mm, int source, int dest, > VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))); > vma = find_vma(mm, 0); > + if (unlikely(!vma)) { > + mmap_read_unlock(mm); // this line should be deleted > + return 0; > + } > /* > * This does not migrate the range, but isolates all pages that > > > > Best Regards, > Li Ying , Light Storage Group. Senior Embedded Software Engineer > Tel: -； Fax: - > Mobile: +86-15651963981 > liying3@sungrowpower.com > www.sungrowpower.com > SUNGROW POWER SUPPLY Co., Ltd. > Add: No.1699 Xiyou Rd., New & High Technology Industrial Development Zone, Hefei, P. R. China., 230088