Re: [PATCH] mm/hugetlb_vmemmap: fix PMD split TLB flush race

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] mm/hugetlb_vmemmap: deadlock from GFP_KERNEL alloc under
  init_mm.mmap_lock
--

commit c4de2ad9c999ebd1524c99a20d1c19a13ab7ec8f
Author: Muchun Song <muchun.song@linux.dev>

mm/hugetlb_vmemmap: fix PMD split TLB flush race

This commit serializes batched vmemmap PMD splitting and its final TLB flush
against concurrent PTE remapping using init_mm.mmap_lock.

> diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
> index ba8e11e399b24..ba6559bef742a 100644
> --- a/mm/hugetlb_vmemmap.c
> +++ b/mm/hugetlb_vmemmap.c
[ ... ]
> @@ -559,6 +565,7 @@ void hugetlb_vmemmap_optimize_folios(struct hstate *h, struct list_head *folio_l
>  	if (list_empty(folio_list))
>  		return;
>  
> +	mmap_write_lock(&init_mm);
>  	list_for_each_entry(folio, folio_list, lru) {
>  		int ret;
>  

[Severity: High]
Can holding init_mm.mmap_lock for write across hugetlb_vmemmap_pteify_folio()
deadlock in memory reclaim?

hugetlb_vmemmap_pteify_folio() walks the kernel page tables and calls
vmemmap_split_pmd() -> pte_alloc_one_kernel(&init_mm), which allocates a page
table with GFP_PGTABLE_KERNEL (GFP_KERNEL).  Reclaim shrinkers such as
ttm_pool_shrinker_scan() take mmap_read_lock(&init_mm) when restoring direct
map attributes via set_pages_wb() -> change_page_attr_set_clr():

hugetlb_vmemmap_optimize_folios()
  mmap_write_lock(&init_mm)
  hugetlb_vmemmap_pteify_folio()
    ...
      vmemmap_split_pmd()
        pte_alloc_one_kernel(&init_mm)  /* GFP_KERNEL */
          <direct reclaim>
            ttm_pool_shrinker_scan()
              ...
                change_page_attr_set_clr()
                  mmap_read_lock(&init_mm)  <-- self-deadlock

Because fs_reclaim nests outside init_mm.mmap_lock, this also triggers a
lockdep splat on the first vmemmap PMD split (including under
mmap_read_lock(&init_mm) in vmemmap_optimize_folio()) and can ABBA deadlock
against kswapd.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110112456.62827-1-songmuchun@bytedance.com?part=1