Re: [PATCH] mm/hugetlb_vmemmap: fix PMD split TLB flush race

[Muchun Song <muchun.song@linux.dev>]

> On Nov 10, 2026, at 20:01, sashiko-bot@kernel.org wrote:
> 
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [High] mm/hugetlb_vmemmap: deadlock from GFP_KERNEL alloc under
>  init_mm.mmap_lock
> --
> 
> commit c4de2ad9c999ebd1524c99a20d1c19a13ab7ec8f
> Author: Muchun Song <muchun.song@linux.dev>
> 
> mm/hugetlb_vmemmap: fix PMD split TLB flush race
> 
> This commit serializes batched vmemmap PMD splitting and its final TLB flush
> against concurrent PTE remapping using init_mm.mmap_lock.
> 
>> diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
>> index ba8e11e399b24..ba6559bef742a 100644
>> --- a/mm/hugetlb_vmemmap.c
>> +++ b/mm/hugetlb_vmemmap.c
> [ ... ]
>> @@ -559,6 +565,7 @@ void hugetlb_vmemmap_optimize_folios(struct hstate *h, struct list_head *folio_l
>> 	if (list_empty(folio_list))
>> 		return;
>> 
>> +	mmap_write_lock(&init_mm);
>> 	list_for_each_entry(folio, folio_list, lru) {
>> 		int ret;
>> 
> 
> [Severity: High]
> Can holding init_mm.mmap_lock for write across hugetlb_vmemmap_pteify_folio()
> deadlock in memory reclaim?

A valid point, I'll fix it ASAP.

THanks.

> 
> hugetlb_vmemmap_pteify_folio() walks the kernel page tables and calls
> vmemmap_split_pmd() -> pte_alloc_one_kernel(&init_mm), which allocates a page
> table with GFP_PGTABLE_KERNEL (GFP_KERNEL).  Reclaim shrinkers such as
> ttm_pool_shrinker_scan() take mmap_read_lock(&init_mm) when restoring direct
> map attributes via set_pages_wb() -> change_page_attr_set_clr():
> 
> hugetlb_vmemmap_optimize_folios()
>  mmap_write_lock(&init_mm)
>  hugetlb_vmemmap_pteify_folio()
>    ...
>      vmemmap_split_pmd()
>        pte_alloc_one_kernel(&init_mm)  /* GFP_KERNEL */
>          <direct reclaim>
>            ttm_pool_shrinker_scan()
>              ...
>                change_page_attr_set_clr()
>                  mmap_read_lock(&init_mm)  <-- self-deadlock
> 
> Because fs_reclaim nests outside init_mm.mmap_lock, this also triggers a
> lockdep splat on the first vmemmap PMD split (including under
> mmap_read_lock(&init_mm) in vmemmap_optimize_folio()) and can ABBA deadlock
> against kswapd.
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261110112456.62827-1-songmuchun@bytedance.com?part=1