Linux-mm Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Hao Ge <hao.ge@linux.dev>
To: Suren Baghdasaryan <surenb@google.com>,
	Uladzislau Rezki <urezki@gmail.com>,
	Madhavan Srinivasan <maddy@linux.ibm.com>,
	Michael Ellerman <mpe@ellerman.id.au>,
	Nicholas Piggin <npiggin@gmail.com>,
	"Christophe Leroy (CS GROUP)" <chleroy@kernel.org>,
	"Ritesh Harjani (IBM)" <ritesh.list@gmail.com>,
	Shrikanth Hegde <sshegde@linux.ibm.com>,
	Alexander Potapenko <glider@google.com>,
	Marco Elver <elver@google.com>,
	Dmitry Vyukov <dvyukov@google.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Dennis Zhou <dennis@kernel.org>, Tejun Heo <tj@kernel.org>,
	Christoph Lameter <cl@gentwo.org>
Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org,
	kasan-dev@googlegroups.com, linux-mm@kvack.org,
	Hao Ge <hao.ge@linux.dev>
Subject: [PATCH v2 0/5] mm/vmalloc: make the mapping functions undo their partial mappings
Date: Mon, 19 Oct 2026 13:45:25 +0800	[thread overview]
Message-ID: <20261019054531.87652-1-hao.ge@linux.dev> (raw)

__vmap_pages_range_noflush() and friends can install some PTEs before
failing and leave them mapped, and the kernel callers do not agree on
who cleans them up. pcpu_map_pages() and kmsan_ioremap_page_range()
roll back what they mapped before the failure, while
vm_module_tags_populate() and the __GFP_NOFAIL retry loop in
__vmalloc_area_node() rely on the mapping functions cleaning up and
do not call anything like vunmap_range() themselves. When the same
range is mapped again, the attempt hits the leftovers and fails, with
a BUG() in vmap_pte_range() for huge mappings and a warning on the
small-page path.

After discussing with Suren and Ulad [1], we move the rollback into the
mapping functions. A failed vmap leaves nothing mapped, and the
callers no longer clean up after it.

[1] https://lore.kernel.org/all/20260915070001.113559-3-hao.ge@linux.dev/

Patch 1 is the KMSAN part. The shadow and the origin of a range
are mapped by two separate calls, so the rollback there has to
cover both. Patch 2 is its disabled-KMSAN counterpart. Patch 3 adds
the rollback to __vmap_pages_range_noflush() and vmap_page_range().
Patches 4 and 5 drop the powerpc and percpu cleanups that are not
needed anymore.

Changes since v1:
 - Add patch 2. Sashiko reported that an empty range that hits patch 3's
   WARN_ON_ONCE() trips __vunmap_range_noflush()'s BUG_ON() through
   kmsan_vunmap_range_noflush() when kmsan=0. Patch 2 adds the
   kmsan_enabled check the unmap side was missing.
 - Pick up Reviewed-by tags from Suren and Ulad on patches 1, 4 and 5.
 - Add Cc: stable to patch 3.

v1 link: https://lore.kernel.org/all/20261009063619.112313-1-hao.ge@linux.dev/

Hao Ge (5):
  mm/kmsan: undo the shadow mapping when the origin mapping fails
  mm/kmsan: skip vunmap_range_noflush when KMSAN is disabled
  mm/vmalloc: undo partial mappings inside the mapping functions
  powerpc: drop redundant unmaps of failed vmap mappings
  mm/percpu: stop unmapping the CPU that failed to map

 arch/powerpc/kernel/isa-bridge.c |  5 ++--
 arch/powerpc/kernel/pci_64.c     |  4 +--
 mm/kmsan/hooks.c                 |  3 +++
 mm/kmsan/shadow.c                |  4 +++
 mm/percpu-vm.c                   |  5 ++--
 mm/vmalloc.c                     | 44 +++++++++++++++++++++++---------
 6 files changed, 45 insertions(+), 20 deletions(-)

-- 
2.25.1



             reply	other threads:[~2026-10-19  5:44 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-19  5:45 Hao Ge [this message]
2026-10-19  5:45 ` [PATCH v2 1/5] mm/kmsan: undo the shadow mapping when the origin mapping fails Hao Ge
2026-10-19 14:54   ` Dev Jain
2026-10-19  5:45 ` [PATCH v2 2/5] mm/kmsan: skip vunmap_range_noflush when KMSAN is disabled Hao Ge
2026-10-19 15:22   ` Dev Jain
2026-10-19  5:45 ` [PATCH v2 3/5] mm/vmalloc: undo partial mappings inside the mapping functions Hao Ge
2026-10-19  5:45 ` [PATCH v2 4/5] powerpc: drop redundant unmaps of failed vmap mappings Hao Ge
2026-10-19  5:45 ` [PATCH v2 5/5] mm/percpu: stop unmapping the CPU that failed to map Hao Ge

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261019054531.87652-1-hao.ge@linux.dev \
    --to=hao.ge@linux.dev \
    --cc=akpm@linux-foundation.org \
    --cc=chleroy@kernel.org \
    --cc=cl@gentwo.org \
    --cc=dennis@kernel.org \
    --cc=dvyukov@google.com \
    --cc=elver@google.com \
    --cc=glider@google.com \
    --cc=kasan-dev@googlegroups.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=linuxppc-dev@lists.ozlabs.org \
    --cc=maddy@linux.ibm.com \
    --cc=mpe@ellerman.id.au \
    --cc=npiggin@gmail.com \
    --cc=ritesh.list@gmail.com \
    --cc=sshegde@linux.ibm.com \
    --cc=surenb@google.com \
    --cc=tj@kernel.org \
    --cc=urezki@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox