Re: [PATCH v7 1/4] mm: Make lazy MMU mode context-aware

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Setting `walk->action = ACTION_AGAIN` when `pte_offset_map_lock()` fails creates an infinite loop for non-present PMD migration entries.
--

--- Patch [1]: [PATCH v7 1/4] mm: Make lazy MMU mode context-aware ---
commit 1d7b684aa5a3ef0f53973a6ad48d5f71e845692f
Author: Alexander Gordeev <agordeev@linux.ibm.com>

mm: Make lazy MMU mode context-aware

This commit introduces lazy_mmu_mode_enable_with_ptes(), which provides the
process address space and page table being operated on. This enables s390
and other architectures to apply specific optimizations when entering lazy
MMU mode.

> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 5c54aebe21182..b8c8d7dda0950 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -2883,7 +2883,7 @@ static int pagemap_scan_pmd_entry(pmd_t *pmd, unsigned long start,
>  		return 0;
>  	}
>  
> -	lazy_mmu_mode_enable();
> +	lazy_mmu_mode_enable_with_ptes(vma->vm_mm, start, end, start_pte);

[Severity: High]
This is a pre-existing issue, but since you are modifying
pagemap_scan_pmd_entry() here, I wanted to ask about the page table lock
failure path just above this change.

If the lock fails to map the page table (for instance, because of a
non-present PMD migration entry during concurrent transparent hugepage
migration), the code sets the walk action to retry:

    if (!pte) {
        walk->action = ACTION_AGAIN;
        return 0;
    }

Because pte_offset_map_lock() will fail non-transiently for migration
entries, does setting ACTION_AGAIN here create an infinite loop?

Could a local user trigger this by reading /proc/pid/pagemap concurrently
with a page migration, causing the thread to hang indefinitely? It seems
that gracefully skipping the failure by returning 0 without setting
ACTION_AGAIN might be safer.

This same ACTION_AGAIN retry pattern on lock failure appears in several
other callbacks:
- smaps_pte_range(), clear_refs_pte_range(), and pagemap_pmd_range() in
  fs/proc/task_mmu.c
- mincore_pte_range() in mm/mincore.c
- mlock_pte_range() in mm/mlock.c
- queue_folios_pte_range() in mm/mempolicy.c

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786956464.git.agordeev@linux.ibm.com?part=1