* [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
@ 2026-04-25 13:35 Sunny Patel
2026-04-25 13:54 ` Andrew Morton
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Sunny Patel @ 2026-04-25 13:35 UTC (permalink / raw)
To: Andrew Morton, David Hildenbrand
Cc: Zi Yan, Matthew Brost, Joshua Hahn, Rakie Kim, Byungchul Park,
Gregory Price, Ying Huang, Alistair Popple, linux-mm,
linux-kernel, Sunny Patel
When check_stable_address_space() fails after the PMD spinlock has
been acquired via pmd_lock(), the code jumps directly to the abort
label, bypassing the spin_unlock() call in unlock_abort. This causes
the PMD spinlock to be permanently held, leading to a deadlock.
Change the goto target from abort to unlock_abort to ensure the
spinlock is always released on this error path.
Signed-off-by: Sunny Patel <nueralspacetech@gmail.com>
---
mm/migrate_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index fbfe5715f635..ab49d4dcdb60 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -850,7 +850,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
ptl = pmd_lock(vma->vm_mm, pmdp);
csa_ret = check_stable_address_space(vma->vm_mm);
if (csa_ret)
- goto abort;
+ goto unlock_abort;
/*
* Check for userfaultfd but do not deliver the fault. Instead,
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
2026-04-25 13:35 [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page Sunny Patel
@ 2026-04-25 13:54 ` Andrew Morton
2026-04-26 0:50 ` Balbir Singh
2026-04-25 14:21 ` Zi Yan
2026-04-27 10:18 ` David Hildenbrand (Arm)
2 siblings, 1 reply; 5+ messages in thread
From: Andrew Morton @ 2026-04-25 13:54 UTC (permalink / raw)
To: Sunny Patel
Cc: David Hildenbrand, Zi Yan, Matthew Brost, Joshua Hahn, Rakie Kim,
Byungchul Park, Gregory Price, Ying Huang, Alistair Popple,
linux-mm, linux-kernel, Balbir Singh
On Sat, 25 Apr 2026 19:05:27 +0530 Sunny Patel <nueralspacetech@gmail.com> wrote:
> When check_stable_address_space() fails after the PMD spinlock has
> been acquired via pmd_lock(), the code jumps directly to the abort
> label, bypassing the spin_unlock() call in unlock_abort. This causes
> the PMD spinlock to be permanently held, leading to a deadlock.
>
> Change the goto target from abort to unlock_abort to ensure the
> spinlock is always released on this error path.
>
> ...
>
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -850,7 +850,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
> ptl = pmd_lock(vma->vm_mm, pmdp);
> csa_ret = check_stable_address_space(vma->vm_mm);
> if (csa_ret)
> - goto abort;
> + goto unlock_abort;
>
> /*
> * Check for userfaultfd but do not deliver the fault. Instead,
whoops.
Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
Cc: <stable@vger.kernel.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
2026-04-25 13:35 [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page Sunny Patel
2026-04-25 13:54 ` Andrew Morton
@ 2026-04-25 14:21 ` Zi Yan
2026-04-27 10:18 ` David Hildenbrand (Arm)
2 siblings, 0 replies; 5+ messages in thread
From: Zi Yan @ 2026-04-25 14:21 UTC (permalink / raw)
To: Sunny Patel
Cc: Andrew Morton, David Hildenbrand, Matthew Brost, Joshua Hahn,
Rakie Kim, Byungchul Park, Gregory Price, Ying Huang,
Alistair Popple, linux-mm, linux-kernel
On 25 Apr 2026, at 9:35, Sunny Patel wrote:
> When check_stable_address_space() fails after the PMD spinlock has
> been acquired via pmd_lock(), the code jumps directly to the abort
> label, bypassing the spin_unlock() call in unlock_abort. This causes
> the PMD spinlock to be permanently held, leading to a deadlock.
>
> Change the goto target from abort to unlock_abort to ensure the
> spinlock is always released on this error path.
>
> Signed-off-by: Sunny Patel <nueralspacetech@gmail.com>
> ---
> mm/migrate_device.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
LGTM.
Acked-by: Zi Yan <ziy@nvidia.com>
--
Best Regards,
Yan, Zi
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
2026-04-25 13:54 ` Andrew Morton
@ 2026-04-26 0:50 ` Balbir Singh
0 siblings, 0 replies; 5+ messages in thread
From: Balbir Singh @ 2026-04-26 0:50 UTC (permalink / raw)
To: Andrew Morton, Sunny Patel
Cc: David Hildenbrand, Zi Yan, Matthew Brost, Joshua Hahn, Rakie Kim,
Byungchul Park, Gregory Price, Ying Huang, Alistair Popple,
linux-mm, linux-kernel
On 4/25/26 23:54, Andrew Morton wrote:
> On Sat, 25 Apr 2026 19:05:27 +0530 Sunny Patel <nueralspacetech@gmail.com> wrote:
>
>> When check_stable_address_space() fails after the PMD spinlock has
>> been acquired via pmd_lock(), the code jumps directly to the abort
>> label, bypassing the spin_unlock() call in unlock_abort. This causes
>> the PMD spinlock to be permanently held, leading to a deadlock.
>>
>> Change the goto target from abort to unlock_abort to ensure the
>> spinlock is always released on this error path.
>>
>> ...
>>
>> --- a/mm/migrate_device.c
>> +++ b/mm/migrate_device.c
>> @@ -850,7 +850,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
>> ptl = pmd_lock(vma->vm_mm, pmdp);
>> csa_ret = check_stable_address_space(vma->vm_mm);
>> if (csa_ret)
>> - goto abort;
>> + goto unlock_abort;
>>
>> /*
>> * Check for userfaultfd but do not deliver the fault. Instead,
>
> whoops.
>
> Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
> Cc: <stable@vger.kernel.org>
Thanks
Acked-by: Balbir Singh <balbirs@nvidia.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
2026-04-25 13:35 [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page Sunny Patel
2026-04-25 13:54 ` Andrew Morton
2026-04-25 14:21 ` Zi Yan
@ 2026-04-27 10:18 ` David Hildenbrand (Arm)
2 siblings, 0 replies; 5+ messages in thread
From: David Hildenbrand (Arm) @ 2026-04-27 10:18 UTC (permalink / raw)
To: Sunny Patel, Andrew Morton
Cc: Zi Yan, Matthew Brost, Joshua Hahn, Rakie Kim, Byungchul Park,
Gregory Price, Ying Huang, Alistair Popple, linux-mm,
linux-kernel
On 4/25/26 15:35, Sunny Patel wrote:
> When check_stable_address_space() fails after the PMD spinlock has
> been acquired via pmd_lock(), the code jumps directly to the abort
> label, bypassing the spin_unlock() call in unlock_abort. This causes
> the PMD spinlock to be permanently held, leading to a deadlock.
>
> Change the goto target from abort to unlock_abort to ensure the
> spinlock is always released on this error path.
>
> Signed-off-by: Sunny Patel <nueralspacetech@gmail.com>
> ---
Thanks!
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
--
Cheers,
David
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-04-27 10:19 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-25 13:35 [PATCH] mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page Sunny Patel
2026-04-25 13:54 ` Andrew Morton
2026-04-26 0:50 ` Balbir Singh
2026-04-25 14:21 ` Zi Yan
2026-04-27 10:18 ` David Hildenbrand (Arm)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox