From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1EE8653B32E; Wed, 23 Sep 2026 14:48:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790174902; cv=none; b=ZhfEYcLXJC/jMbQTcYVkkkx5IgKUXFMW+4B0IuK0TK0CImCzXgbLImTF5bSJS+hejOAzmuQ0Y0zwOhRqjCNdiUqxFvlr6K187gNYg6Y1UYaQlidynp/8xJvRIsAFOojozdpacmxlq9ycldmXp5uquvL7JKWG/EciQ4I2KT/Go60= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790174902; c=relaxed/simple; bh=8B0auiOdW1vs3V0Z5wSzkjYkvWtF8h1Qqk+DqvciCDs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=G24eMFwOiZuTAR2lOB06ZEEsZAfcfaxF5tuNG4g1105e896GCHBg9NjLR5ysgt1Qf9JgrLCYS+d8NDW34rIudGp78Qa0DLlZiVo0x3k25TEq+PfEuDzNmqhPihf/YXkDUu4gZrcQPdm5AXRdFIEECVG49+vRbenWTxOVtfnCJOg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aYEmBhrP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="aYEmBhrP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63B2F1F000FF; Wed, 23 Sep 2026 14:48:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790174900; bh=rt4KQeoqwDx2rCF2LX9D1sqJS5XS8oW1tbMKQRo0lnA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aYEmBhrPeMV0Au4cq7k330rPsNTB8UNWNm+DqyJs1Vm/J8n/9N1ZRKgosoYEy0JuJ R4XLSE+ueZ+PtKGY9cDO810q5xBrAbMuM2MMMoK2gPqLz1CFH1YeKUD8RkDQjSxB3j 0p6fa1vf46jEft3agxjfv5rbRiBEewEI4ubz+/w0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shakeel Butt , syzbot+cd2073ee6d958a8d0fcd@syzkaller.appspotmail.com, Hugh Dickins , Jann Horn , "Liam R. Howlett" , Lorenzo Stoakes , "Matthew Wilcox (Oracle)" , Pedro Falcato , Vlastimil Babka , Andrew Morton Subject: [PATCH 6.18 260/398] mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() Date: Wed, 23 Sep 2026 16:05:34 +0200 Message-ID: <20260923140650.152824554@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260923140643.441954610@linuxfoundation.org> References: <20260923140643.441954610@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shakeel Butt commit e14a3454806468b086fe2e4ca2e1bff95b528531 upstream. NR_MLOCK is updated from interrupt context. __free_pages_prepare() clears a stray PG_mlocked and adjusts NR_MLOCK, and a folio can reach it with the flag still set from a bio completion handler: __free_pages_ok+0x6af/0x7a0 __bio_release_pages+0xde/0x260 __iomap_dio_bio_end_io+0x16e/0x1a0 blk_update_request+0x14b/0x3d0 blk_mq_end_request+0x18/0x30 blk_done_softirq+0x49/0x60 The folio gets there like this. A MAP_SHARED file mapping is mlocked, so its page cache folios carry PG_mlocked, and an O_DIRECT write sourced from that mapping GUP-pins those same folios. munlock() then runs mlock_vma_pages_range(), which clears VM_LOCKED before walking the page tables to munlock each folio. A concurrent hole punch reaches the folio through the rmap (i_mmap_rwsem, not mmap_lock) and can land inside that window: __folio_remove_rmap() -> munlock_vma_folio() sees VM_LOCKED already clear, so it neither queues the folio on the mlock batch nor takes a reference, and the pte it clears makes the pending mlock_pte_range() walk skip the folio at its !pte_present() check. filemap_remove_folio() then drops the page cache reference, leaving the bio's pin as the last one, released from the completion handler above. So __zone_stat_mod_folio() here needs interrupts disabled, not merely preemption, and __munlock_folio() has a path where they are not: when the folio has already been taken off the LRU by somebody else the function jumps straight to the counter update without taking the lruvec lock. The read-modify-write of the per-CPU NR_MLOCK diff can then be interrupted by the softirq above, and one of the two decrements is lost, leaving Mlocked in /proc/meminfo permanently overstated. Use zone_stat_mod_folio(). mod_zone_state()'s this_cpu_try_cmpxchg() is atomic against a same-CPU interrupt and retries, and on the path where the lruvec lock is held its cost is negligible next to the lock itself. The UNEVICTABLE_PG* events are deliberately left on the __ accessors: they occupy different vm_event_states slots from the UNEVICTABLE_PGCLEARED that __free_pages_prepare() bumps, and nothing updates those two from interrupt context. Link: https://lore.kernel.org/20260901180109.3797944-1-shakeel.butt@linux.dev Fixes: 2fbb0c10d1e8 ("mm/munlock: mlock_page() munlock_page() batch by pagevec") Signed-off-by: Shakeel Butt Reported-by: syzbot+cd2073ee6d958a8d0fcd@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-mm/6a931c5a.08e933ee.dbf97.0093.GAE@google.com/ Acked-by: Hugh Dickins Cc: Jann Horn Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Pedro Falcato Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- mm/mlock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/mlock.c +++ b/mm/mlock.c @@ -141,7 +141,7 @@ static struct lruvec *__munlock_folio(st munlock: if (folio_test_clear_mlocked(folio)) { - __zone_stat_mod_folio(folio, NR_MLOCK, -nr_pages); + zone_stat_mod_folio(folio, NR_MLOCK, -nr_pages); if (isolated || !folio_test_unevictable(folio)) __count_vm_events(UNEVICTABLE_PGMUNLOCKED, nr_pages); else