[PATCH] mips: mm: Allocate tlb_vpn array atomically

[PATCH] mips: mm: Allocate tlb_vpn array atomically

[Stefan Wiehler]

Found by DEBUG_ATOMIC_SLEEP:

  BUG: sleeping function called from invalid context at /include/linux/sched/mm.h:306
  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
  preempt_count: 1, expected: 0
  RCU nest depth: 0, expected: 0
  no locks held by swapper/1/0.
  irq event stamp: 0
  hardirqs last  enabled at (0): [<0000000000000000>] 0x0
  hardirqs last disabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
  softirqs last  enabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
  softirqs last disabled at (0): [<0000000000000000>] 0x0
  CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.119-d79e757675ec-fct #1
  Stack : 800000000290bad8 0000000000000000 0000000000000008 800000000290bae8
          800000000290bae8 800000000290bc78 0000000000000000 0000000000000000
          ffffffff80c80000 0000000000000001 ffffffff80d8dee8 ffffffff810d09c0
          784bb2a7ec10647d 0000000000000010 ffffffff80a6fd60 8000000001d8a9c0
          0000000000000000 0000000000000000 ffffffff80d90000 0000000000000000
          ffffffff80c9e0e8 0000000007ffffff 0000000000000cc0 0000000000000400
          ffffffffffffffff 0000000000000001 0000000000000002 ffffffffc0149ed8
          fffffffffffffffe 8000000002908000 800000000290bae0 ffffffff80a81b74
          ffffffff80129fb0 0000000000000000 0000000000000000 0000000000000000
          0000000000000000 0000000000000000 ffffffff80129fd0 0000000000000000
          ...
  Call Trace:
  [<ffffffff80129fd0>] show_stack+0x60/0x158
  [<ffffffff80a7f894>] dump_stack_lvl+0x88/0xbc
  [<ffffffff8018d3c8>] __might_resched+0x268/0x288
  [<ffffffff803648b0>] __kmem_cache_alloc_node+0x2e0/0x330
  [<ffffffff80302788>] __kmalloc+0x58/0xd0
  [<ffffffff80a81b74>] r4k_tlb_uniquify+0x7c/0x428
  [<ffffffff80143e8c>] tlb_init+0x7c/0x110
  [<ffffffff8012bdb4>] per_cpu_trap_init+0x16c/0x1d0
  [<ffffffff80133258>] start_secondary+0x28/0x128

Fixes: 231ac951faba ("MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Cc: stable@vger.kernel.org
---
 arch/mips/mm/tlb-r4k.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index 44a662536148..645f77e09d5b 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -538,7 +538,7 @@ static void __ref r4k_tlb_uniquify(void)
 
 	tlb_vpn_size = tlbsize * sizeof(*tlb_vpns);
 	tlb_vpns = (use_slab ?
-		    kmalloc(tlb_vpn_size, GFP_KERNEL) :
+		    kmalloc(tlb_vpn_size, GFP_ATOMIC) :
 		    memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns)));
 	if (WARN_ON(!tlb_vpns))
 		return; /* Pray local_flush_tlb_all() is good enough. */
-- 
2.42.0

Re: [PATCH] mips: mm: Allocate tlb_vpn array atomically

[Thomas Bogendoerfer]

On Tue, Mar 10, 2026 at 11:40:24AM +0100, Stefan Wiehler wrote:
> Found by DEBUG_ATOMIC_SLEEP:
> 
>   BUG: sleeping function called from invalid context at /include/linux/sched/mm.h:306
>   in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
>   preempt_count: 1, expected: 0
>   RCU nest depth: 0, expected: 0
>   no locks held by swapper/1/0.
>   irq event stamp: 0
>   hardirqs last  enabled at (0): [<0000000000000000>] 0x0
>   hardirqs last disabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
>   softirqs last  enabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
>   softirqs last disabled at (0): [<0000000000000000>] 0x0
>   CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.119-d79e757675ec-fct #1
>   Stack : 800000000290bad8 0000000000000000 0000000000000008 800000000290bae8
>           800000000290bae8 800000000290bc78 0000000000000000 0000000000000000
>           ffffffff80c80000 0000000000000001 ffffffff80d8dee8 ffffffff810d09c0
>           784bb2a7ec10647d 0000000000000010 ffffffff80a6fd60 8000000001d8a9c0
>           0000000000000000 0000000000000000 ffffffff80d90000 0000000000000000
>           ffffffff80c9e0e8 0000000007ffffff 0000000000000cc0 0000000000000400
>           ffffffffffffffff 0000000000000001 0000000000000002 ffffffffc0149ed8
>           fffffffffffffffe 8000000002908000 800000000290bae0 ffffffff80a81b74
>           ffffffff80129fb0 0000000000000000 0000000000000000 0000000000000000
>           0000000000000000 0000000000000000 ffffffff80129fd0 0000000000000000
>           ...
>   Call Trace:
>   [<ffffffff80129fd0>] show_stack+0x60/0x158
>   [<ffffffff80a7f894>] dump_stack_lvl+0x88/0xbc
>   [<ffffffff8018d3c8>] __might_resched+0x268/0x288
>   [<ffffffff803648b0>] __kmem_cache_alloc_node+0x2e0/0x330
>   [<ffffffff80302788>] __kmalloc+0x58/0xd0
>   [<ffffffff80a81b74>] r4k_tlb_uniquify+0x7c/0x428
>   [<ffffffff80143e8c>] tlb_init+0x7c/0x110
>   [<ffffffff8012bdb4>] per_cpu_trap_init+0x16c/0x1d0
>   [<ffffffff80133258>] start_secondary+0x28/0x128
> 
> Fixes: 231ac951faba ("MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow")
> Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
> Cc: stable@vger.kernel.org
> ---
>  arch/mips/mm/tlb-r4k.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

applied to mips-fixes

Thomas.

-- 
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea.                                                [ RFC1925, 2.3 ]