* Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()
From: Robin Murphy @ 2026-07-07 14:15 UTC (permalink / raw)
To: Mike Rapoport
Cc: Will Deacon, Thierry Reding, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Jonathan Hunter, David Airlie, Simona Vetter,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
Sowjanya Komatineni, Luca Ceresoli, Mikko Perttunen, Yury Norov,
Rasmus Villemoes, Russell King, Alexander Gordeev,
Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, Andrew Morton,
David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Suren Baghdasaryan, Michal Hocko,
Marek Szyprowski, Sumit Semwal, Benjamin Gaignard, Brian Starkey,
John Stultz, T.J. Mercier, Christian König, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Catalin Marinas,
Thierry Reding, devicetree, linux-tegra, linux-kernel, dri-devel,
linux-media, linux-arm-kernel, linux-s390, linux-mm, iommu,
linaro-mm-sig, linux-trace-kernel, Thierry Reding, Chun Ng
In-Reply-To: <ak0A6eLp0Pw8iKK0@kernel.org>
On 07/07/2026 2:36 pm, Mike Rapoport wrote:
> On Tue, Jul 07, 2026 at 02:17:29PM +0100, Robin Murphy wrote:
>>
>> Given the precedent of memblock_mark_nomap(), as long as the reusable
>> reserved-memory regions also get split into distinct memblocks, then it
>> seems like in principle we ought to be able to give them a new
>> MEMBLOCK_PTEMAP (or whatever) flag which could then be picked up in
>> map_mem() without needing to override force_pte_mapping() globally?
>
> Please don't. _nomap() caused enough pain.
Indeed I was there for pretty much the whole pfn_valid() saga :)
Bad example maybe - in this case the only actual similarity to nomap
would be the fact that it would also be set by the of_reserved_mem code
based on what it finds in DT; in all other aspects it should be
functionally closer to something like MEMBLOCK_RSRV_NOINIT, i.e. just
carrying information through the mm init phase, then ceasing to matter
at all once the linear mapping is done.
Cheers,
Robin.
^ permalink raw reply
* Re: [PATCH v2 2/4] mm/mlock: wait for migration to finish when mlocking a folio
From: Lorenzo Stoakes @ 2026-07-07 14:33 UTC (permalink / raw)
To: Wandun Chen
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-3-chenwandun1@gmail.com>
On Tue, Jul 07, 2026 at 08:59:23PM +0800, Wandun Chen wrote:
> From: Wandun Chen <chenwandun@lixiang.com>
>
> In RT kernels, sysctl_compact_unevictable_allowed is false by default,
> when the mlock/mlockall system call try to lock all the present page,
> the mlock_pte_range function skips non-present entries. If these
> non-present entries are migration entries, and the migration is not
> guaranteed to have completed before the mlock/mlockall, it may result
> in a page fault on subsequent access, which then waits for the
> migration to finish, causing spike latency in RT kernels.
Is this really noticable and measurable?
I suppose not too many ranges should be mock
>
> Fix it by waiting for the migration to complete during the mlock/mlockall
> syscall when sysctl_compact_unevictable_allowed is false.
Probably better to reference the sysctl itself rather than an arbitrary varible
name.
>
> Fixes: 90d07210ab55 ("mm: mlock: use folios and a folio batch internally")
Again I have no idea why you chose this as the fixes target, especially for
this?
But in any case, why is this separate from the previous commit? I sthis an
entirely separate fix?
> Suggested-by: Vlastimil Babka <vbabka@suse.cz>
> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
> Link: https://lore.kernel.org/lkml/c8793c0f-7156-4cb7-9e6e-7909397e2fff@kernel.org/#t
A nit but please strip that #t.
> ---
> mm/mlock.c | 23 +++++++++++++++++++++--
> 1 file changed, 21 insertions(+), 2 deletions(-)
>
> diff --git a/mm/mlock.c b/mm/mlock.c
> index 97e49038d8d3..ac65de40b22b 100644
> --- a/mm/mlock.c
> +++ b/mm/mlock.c
> @@ -25,6 +25,7 @@
> #include <linux/memcontrol.h>
> #include <linux/mm_inline.h>
> #include <linux/secretmem.h>
> +#include <linux/compaction.h>
>
> #include "internal.h"
>
> @@ -361,8 +362,17 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
>
> ptl = pmd_trans_huge_lock(pmd, vma);
> if (ptl) {
> - if (!pmd_present(*pmd))
> + if (!pmd_present(*pmd)) {
> + if (unlikely((vma->vm_flags & VM_LOCKED) &&
-> vma_test(vma, VMA_LOCKED_BIT)...
What is the basis for your unlikely()? Don't use likely()/unlikely() just
because it feels right. Leave them out unless you have actual profiling data to
prove it.
Remove it please.
But I'm also confused here - why are you checking for VMAs that already had
VMA_LOCKED_BIT set when you are about to set it?
Surely this shouldn't be predicated on VMA_LOCKED_BIT?
> + !compaction_allow_unevictable() &&
Why do we care about compaction here? Are we assuming the softleaf migration
entry is present only for compaction reasons?
So these migration entries could be there for any reason? Does it matter? Is it
such a big deal, on mlock, to wait for migration entries? I think probably not.
But then maybe some weird workload gets affected... hmm.
> + softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
Use pmd_is_migration_entry()? :)
And technically you should use pmdp_get() I think? Maybe a situation where we
don't care/need the READ_ONCE() though.
> + spin_unlock(ptl);
> + pmd_migration_entry_wait(vma->vm_mm, pmd);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
This code is really disgusting, let's please not just copy/paste open-coded
nested horror shows like this.
A good rule of thumb is if you see a bunch of code 'poking out' like this and
certainly if you copy/paste it or something very much like it, break it out into
a function.
So:
static bool wait_for_migration(const struct vm_area_struct *vma, softleaf_t entry)
{
>>>> As above I'm not sure should even be checking this?
if (!vma_test(vma, VMA_LOCKED_BIT))
return false;
>>>> As above I'm not sure this makes sense?
if (compaction_allowed_unevictable())
return false;
return softleaf_is_migration(entry);
}
Then call it like:
if (ptl) {
const pmd_t pmd = pmdp_get(pmd);
if (!pmd_present(pmd)) {
const softleaf_t entry = softleaf_from_pmd(pmd);
if (!wait_for_migration(vma, entry))
goto out;
spin_unlock(ptl);
pmd_migration_entry_wait(vma->vm_mm, pmd);
walk->action = ACTION_AGAIN;
return 0;
}
if (is_huge_zero_pmd(pmd))
goto out;
(etc. going *pmd -> pmd)
But we could probably do even better than that, and assuming your dubious checks
above aren't needed, we don't even need a helper then:
if (ptl) {
const pmd_t pmd = pmdp_get(pmd); // possibly just *pmd?
const softleaf_t entry = softleaf_from_pmd(pmd);
if (softleaf_is_migration(entry)) {
/* Wait for migration entries. */
spin_unlock(ptl);
pmd_migration_entry_wait(vma->vm_mm, pmd);
walk->action = ACTION_AGAIN;
return 0;
}
if (!pmd_present(pmd))
goto out;
etc.
And similar for the PTE stuff below.
This works because softleaf_from_pmd() (and pte) will give you a 'none' softleaf
if the entry is not a softlaf entry. So you can unconditionally call it on a
PMD.
> goto out;
> + }
> if (is_huge_zero_pmd(*pmd))
> goto out;
> folio = pmd_folio(*pmd);
> @@ -383,8 +393,17 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
>
> for (pte = start_pte; addr != end; pte++, addr += PAGE_SIZE) {
> ptent = ptep_get(pte);
> - if (!pte_present(ptent))
> + if (!pte_present(ptent)) {
> + if (unlikely((vma->vm_flags & VM_LOCKED) &&
> + !compaction_allow_unevictable() &&
> + softleaf_is_migration(softleaf_from_pte(ptent)))) {
> + pte_unmap_unlock(start_pte, ptl);
> + migration_entry_wait(vma->vm_mm, pmd, addr);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> continue;
> + }
> folio = vm_normal_folio(vma, addr, ptent);
> if (!folio || folio_is_zone_device(folio))
> continue;
> --
> 2.43.0
>
Thanks, Lorenzo
^ permalink raw reply
* Re: [PATCH] ring-buffer: serialize read-page order with subbuffer resize
From: Steven Rostedt @ 2026-07-07 14:36 UTC (permalink / raw)
To: Yousef Alhouseen
Cc: mhiramat, mathieu.desnoyers, petr.pavlu, linux-trace-kernel,
linux-kernel
In-Reply-To: <CAMuQ4bUNbCM7oxnrXaT_oAoX+Guoo4_Bu0eO5dLR3OZ62Eu0Xg@mail.gmail.com>
On Tue, 30 Jun 2026 14:16:48 -0700
Yousef Alhouseen <alhouseenyousef@gmail.com> wrote:
> Agreed. I’ll add an explicit resize-in-progress flag, set it around
> the order transition, and make the external read-page
> allocation/free/read paths reject work while it is set. I’ll check the
> flag under the locks that serialize each path so it cannot race the
> transition, then compile and test the resulting v2.
Did you ever get around to sending a v2?
-- Steve
^ permalink raw reply
* Re: [PATCH 01/30] mm: move vma_start_pgoff() into mm.h and clean up
From: David Hildenbrand (Arm) @ 2026-07-07 14:41 UTC (permalink / raw)
To: Lorenzo Stoakes, Andrew Morton
Cc: Russell King, Dinh Nguyen, Simon Schuster,
James E . J . Bottomley, Helge Deller, Jarkko Sakkinen,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
Ian Abbott, H Hartley Sweeten, Lucas Stach, David Airlie,
Simona Vetter, Patrik Jakobsson, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Rob Clark, Dmitry Baryshkov, Tomi Valkeinen,
Thierry Reding, Mikko Perttunen, Jonathan Hunter,
Christian Koenig, Huang Rui, Ankit Agrawal, Alex Williamson,
Alexander Viro, Christian Brauner, Dan Williams, Muchun Song,
Oscar Salvador, Suren Baghdasaryan, Liam R . Howlett,
Matthew Wilcox, Marek Szyprowski, Peter Zijlstra,
Arnaldo Carvalho de Melo, Namhyung Kim, Masami Hiramatsu,
Oleg Nesterov, Steven Rostedt, SeongJae Park, Miaohe Lin,
Hugh Dickins, Mike Rapoport, Kees Cook, Paolo Bonzini,
linux-kernel, linux-arm-kernel, linux-parisc, linux-sgx, etnaviv,
dri-devel, linux-arm-msm, freedreno, linux-tegra, kvm,
linux-fsdevel, nvdimm, linux-mm, iommu, linux-perf-users,
linux-trace-kernel, kasan-dev, damon, Pedro Falcato, Rik van Riel,
Harry Yoo, Jann Horn
In-Reply-To: <b28b698df4c009e85c4728446ca5863d8e633164.1782735110.git.ljs@kernel.org>
On 6/29/26 14:23, Lorenzo Stoakes wrote:
> vma_last_pgoff() already lives there, so it's a bit odd to keep
> vma_start_pgoff() in mm/interval_tree.c. Move them together.
>
> These each return unsigned long, which pgoff_t is typedef'd to. Make this
> consistent and have these functions return pgoff_t instead.
>
> Additionally, express vma_last_pgoff() in terms of vma_start_pgoff(), since
> we wrap the vma->vm_pgoff access, we may as well use it here.
>
> Also while we're here, const-ify the VMA and cleanup a bit.
>
> No functional change intended.
>
> Signed-off-by: Lorenzo Stoakes <ljs@kernel.org>
> ---
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
--
Cheers,
David
^ permalink raw reply
* Re: [PATCH] tracing/user_events: fix use-after-free of enabler in user_event_mm_dup()
From: Steven Rostedt @ 2026-07-07 14:42 UTC (permalink / raw)
To: Michael Bommarito
Cc: Beau Belgrave, XIAO WU, Masami Hiramatsu, Mathieu Desnoyers,
linux-trace-kernel, linux-kernel, stable
In-Reply-To: <CAJJ9bXzJpYRE-NjOjiArpuJWGnFXr+jq7ukbEEdEhK9YPCbYrQ@mail.gmail.com>
On Mon, 6 Jul 2026 16:11:03 -0400
Michael Bommarito <michael.bommarito@gmail.com> wrote:
> On Mon, Jul 6, 2026 at 4:06 PM Steven Rostedt <rostedt@goodmis.org> wrote:
> > I'm taking in the OP patch, but this looks like a separate issue.
> >
> > Any update on this?
>
> Sorry, had gone fishing. I'll have v2 in the next day or so
>
Ah, you're going to send a new version. I'll drop the one I pulled then.
-- Steve
^ permalink raw reply
* Re: [PATCH] tracing/user_events: fix use-after-free of enabler in user_event_mm_dup()
From: Michael Bommarito @ 2026-07-07 14:43 UTC (permalink / raw)
To: Steven Rostedt
Cc: Beau Belgrave, XIAO WU, Masami Hiramatsu, Mathieu Desnoyers,
linux-trace-kernel, linux-kernel, stable
In-Reply-To: <20260707104205.582db193@gandalf.local.home>
> Ah, you're going to send a new version. I'll drop the one I pulled then.
Saw your pull for-linus and I was just about to send a separate patch
set for the second UAF with a ktest (as 2/2). I can do either way,
just let me know which is easier
^ permalink raw reply
* Re: [PATCH 02/30] mm: add kdoc comments for vma_start/last_pgoff()
From: David Hildenbrand (Arm) @ 2026-07-07 14:46 UTC (permalink / raw)
To: Lorenzo Stoakes, Andrew Morton
Cc: Russell King, Dinh Nguyen, Simon Schuster,
James E . J . Bottomley, Helge Deller, Jarkko Sakkinen,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
Ian Abbott, H Hartley Sweeten, Lucas Stach, David Airlie,
Simona Vetter, Patrik Jakobsson, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Rob Clark, Dmitry Baryshkov, Tomi Valkeinen,
Thierry Reding, Mikko Perttunen, Jonathan Hunter,
Christian Koenig, Huang Rui, Ankit Agrawal, Alex Williamson,
Alexander Viro, Christian Brauner, Dan Williams, Muchun Song,
Oscar Salvador, Suren Baghdasaryan, Liam R . Howlett,
Matthew Wilcox, Marek Szyprowski, Peter Zijlstra,
Arnaldo Carvalho de Melo, Namhyung Kim, Masami Hiramatsu,
Oleg Nesterov, Steven Rostedt, SeongJae Park, Miaohe Lin,
Hugh Dickins, Mike Rapoport, Kees Cook, Paolo Bonzini,
linux-kernel, linux-arm-kernel, linux-parisc, linux-sgx, etnaviv,
dri-devel, linux-arm-msm, freedreno, linux-tegra, kvm,
linux-fsdevel, nvdimm, linux-mm, iommu, linux-perf-users,
linux-trace-kernel, kasan-dev, damon, Pedro Falcato, Rik van Riel,
Harry Yoo, Jann Horn
In-Reply-To: <8c618dfd7de419e3b797b8bd1cd921d4c5b8878b.1782735110.git.ljs@kernel.org>
On 6/29/26 14:23, Lorenzo Stoakes wrote:
> Describe what vma_start_pgoff() and vma_last_pgoff() actually provide in
> detail.
>
> This is in order that we can differentiate this between functions that will
> be added in a subsequent patch which provide a different page offset.
>
> No functional change intended.
>
> Signed-off-by: Lorenzo Stoakes <ljs@kernel.org>
> ---
> include/linux/mm.h | 26 ++++++++++++++++++++++++++
> 1 file changed, 26 insertions(+)
>
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index 059144435729..2f00c75e66bd 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -4278,11 +4278,37 @@ static inline unsigned long vma_pages(const struct vm_area_struct *vma)
> return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
> }
>
> +/**
> + * vma_start_pgoff() - Get the page offset of the start of @vma
> + * @vma: The VMA whose page offset is required.
> + *
> + * If the VMA is file-backed, this is the page offset into the file.
> + *
> + * If the VMA is anonymous, this is the virtual page offset of the start of the
> + * VMA - if unfaulted, then vma->vm_start >> PAGE_SHIFT, if faulted then the
> + * virtual page offset at the time of first fault.
> + *
> + * Note that if @vma is a MAP_PRIVATE file-backed mapping, then this returns the
> + * file offset.
There is the ugly case of @vma being a MAP_PRIVATE PFNMAP mapping, where it
returns something different.
(remap_pfn_range_prepare_vma() -> vma->vm_pgoff set to PFN)
--
Cheers,
David
^ permalink raw reply
* Re: [PATCH v2 4/4] mm/mlock: migrate folios out of CMA when mlocking a range
From: Lorenzo Stoakes @ 2026-07-07 14:54 UTC (permalink / raw)
To: Wandun Chen
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-5-chenwandun1@gmail.com>
On Tue, Jul 07, 2026 at 08:59:25PM +0800, Wandun Chen wrote:
> From: Wandun Chen <chenwandun@lixiang.com>
>
> The region covered by mlock[all] may contain CMA pages. cma_alloc installs
> migration entries in the page table, if a memory access occurs at this
> point, it must wait for the migration to complete, which may cause
> latency spikes on the RT kernels.
>
> Try to move the migration cost into the mlock[all] caller, which is
> typically a setup path. So reduce the chance of latency spikes on RT
> kernels by migrating the currently mapped CMA pages out of CMA region.
'reduce the chances of latency' so do you have any data to back this invasive
change or not?
And for RT, but nothing in here at all checks for RT? You're using this
compaction sysctl as an RT check somehow? That's gross.
This doesn't feel like the right solution.
>
> Suggested-by: Frank van der Linden <fvdl@google.com>
> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
> Link: https://lore.kernel.org/all/CAPTztWZpnX1j8-7yeppVUsxE=O9hbVeqricDjZt8_pnN7a-kBQ@mail.gmail.com/#t
> ---
> mm/mlock.c | 119 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 118 insertions(+), 1 deletion(-)
>
> diff --git a/mm/mlock.c b/mm/mlock.c
> index ac65de40b22b..f56c685533f5 100644
> --- a/mm/mlock.c
> +++ b/mm/mlock.c
> @@ -25,6 +25,7 @@
> #include <linux/memcontrol.h>
> #include <linux/mm_inline.h>
> #include <linux/secretmem.h>
> +#include <linux/migrate.h>
> #include <linux/compaction.h>
>
> #include "internal.h"
> @@ -428,6 +429,119 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
> return 0;
> }
>
> +#ifdef CONFIG_CMA
Ugh yuck. This is horrible. Why are we polluting mlock.c with CMA stuff?
Also no comment?
> +static int mlock_collect_migratable_pte_range(pmd_t *pmd, unsigned long addr,
> + unsigned long end, struct mm_walk *walk)
> +{
You've literally copy/pasted mlock_pte_range(), this is disgusting.
Please don't copy/paste code like this, this isn't PHP, it's the kernel, it's
completely unacceptable.
> + struct vm_area_struct *vma = walk->vma;
> + struct list_head *folio_list = walk->private;
> + spinlock_t *ptl;
> + pte_t *start_pte, *pte;
> + pte_t ptent;
> + struct folio *folio;
> + unsigned int step = 1;
> +
> + if (!(vma->vm_flags & VM_LOCKED))
Once again vma_test(vma, VMA_LOCKED_BIT) please.
But also, again (since you copy/pasted), why? You're literally mlocking here...
You going for that 'mlocking already mlocked ranges' sweet spot or am I missing
something?
> + return 0;
> +
> + ptl = pmd_trans_huge_lock(pmd, vma);
> + if (ptl) {
> + if (!pmd_present(*pmd)) {
> + if (unlikely(softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
OK so you're not actually checking for CMA here at all, you're just doing the
migration wait stuff... again here? What?
> + spin_unlock(ptl);
> + pmd_migration_entry_wait(vma->vm_mm, pmd);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> + goto out;
> + }
> + if (is_huge_zero_pmd(*pmd))
> + goto out;
> + folio = pmd_folio(*pmd);
> + if (folio_is_zone_device(folio))
> + goto out;
> + if (is_migrate_cma_page(&folio->page))
Err isn't this per-page, and you just checked that this is a huge folio, and
you're only checking the first page? That seems wrong?
> + isolate_folio_to_list(folio, folio_list);
Then you just take the whole folio?
It's really horrible that you're burying this in copy/pasted code from the rest.
> + goto out;
> + }
> +
> + start_pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
> + if (!start_pte) {
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> +
> + for (pte = start_pte; addr != end; pte += step, addr += step * PAGE_SIZE) {
> + step = 1;
> + ptent = ptep_get(pte);
> + if (!pte_present(ptent)) {
> + if (unlikely(softleaf_is_migration(softleaf_from_pte(ptent)))) {
> + pte_unmap_unlock(start_pte, ptl);
> + migration_entry_wait(vma->vm_mm, pmd, addr);
BTW I also wonder if we have guaranteed forward progress here if say a migration
happened to migrate back and forth again across a range...?
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
Again, since you copy/pasted, same comment - this is disgusting.
And again I'm confused why you're waiting here again after you did it previously
due to the previous commit that already does it?
And why for a non-CMA range, if somebody happens to set CONFIG_CMA they now get
this done twice?
> + continue;
> + }
> + folio = vm_normal_folio(vma, addr, ptent);
> + if (!folio || folio_is_zone_device(folio))
> + continue;
> + step = folio_mlock_step(folio, pte, addr, end);
> + if (is_migrate_cma_page(&folio->page))
> + continue;
You mean ! surely?
Why are you inverting this vs. the above? you replied to the patch so maybe you
correct this there.
> + isolate_folio_to_list(folio, folio_list);
And again you bury the actual point of this in one easily missed line and zero
comments.
No.
> + }
> + pte_unmap(start_pte);
> +out:
> + spin_unlock(ptl);
> + cond_resched();
> + return 0;
> +}
Yeah this is just completely unacceptable. You have to find a way to deduplicate
code. Copy/paste code dumps are not ok.
But at the same time, you're dumping CMA crap in core mm mlock code which is
horrible, you've also dumped some migration code so you're really mixing things
up here horribly, and it doesn't seem justified?
> +
> +static const struct mm_walk_ops mlock_collect_migratable_ops = {
> + .pmd_entry = mlock_collect_migratable_pte_range,
> + .walk_lock = PGWALK_RDLOCK,
> +};
> +
> +static void mlock_migrate_cma_range(unsigned long start, unsigned long len)
> +{
> + struct mm_struct *mm = current->mm;
> + unsigned long end = start + len;
> + LIST_HEAD(folio_list);
> + struct migration_target_control mtc = {
> + .nid = NUMA_NO_NODE,
> + .gfp_mask = GFP_HIGHUSER | __GFP_NOWARN,
> + .reason = MR_SYSCALL,
> + };
> +
> + if (compaction_allow_unevictable())
> + return;
Again you're assuming compaction for some reason. Why?
It feels like you're just gating specific behaviour for your workload on this
flag and assuming that's ok.
> +
> + lru_cache_disable();
What, why?
> +
> + if (mmap_read_lock_killable(mm))
> + goto out;
OK so you got a fatal signal and you don't bother telling anybody about it and
just skip migration?...
> +
Weird whitespace...
> + walk_page_range(mm, start, end, &mlock_collect_migratable_ops,
> + &folio_list);
> + mmap_read_unlock(mm);
> +
> + if (list_empty(&folio_list))
> + goto out;
> +
> + if (migrate_pages(&folio_list, alloc_migration_target, NULL,
> + (unsigned long)&mtc, MIGRATE_SYNC, MR_SYSCALL, NULL))
> + putback_movable_pages(&folio_list);
> +out:
> + lru_cache_enable();
> +}
> +#else
> +static inline void mlock_migrate_cma_range(unsigned long start,
inline in a .c file? Why? Drop it.
> + unsigned long len)
> +{
> +}
> +#endif /* CONFIG_CMA */
> +
> /*
> * mlock_vma_pages_range() - mlock any pages already in the range,
> * or munlock all pages in the range.
> @@ -678,6 +792,7 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla
> error = __mm_populate(start, len, 0);
> if (error)
> return __mlock_posix_error_return(error);
> + mlock_migrate_cma_range(start, len);
Err, unconditionally?
> return 0;
> }
>
> @@ -790,8 +905,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
> capable(CAP_IPC_LOCK))
> ret = apply_mlockall_flags(flags);
> mmap_write_unlock(current->mm);
> - if (!ret && (flags & MCL_CURRENT))
> + if (!ret && (flags & MCL_CURRENT)) {
> mm_populate(0, TASK_SIZE);
> + mlock_migrate_cma_range(0, TASK_SIZE);
Err what? Why are you doing this? You're forcing a wait on migration of
literally everything across the whole of the process whether or not they're CMA
ranges, but as a one time thing?
> + }
>
> return ret;
> }
> --
> 2.43.0
>
In general this feels like the wrong solution for a specific workload that
sticks horrible stuff in core mm and I don't really love it :)
Thanks, Lorenzo
^ permalink raw reply
* Re: [PATCH v2 4/4] mm/mlock: migrate folios out of CMA when mlocking a range
From: Lorenzo Stoakes @ 2026-07-07 14:57 UTC (permalink / raw)
To: Wandun
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <bd88f65e-000b-4dde-92f7-28af6a34e977@gmail.com>
On Tue, Jul 07, 2026 at 09:36:17PM +0800, Wandun wrote:
<snip>
> > diff --git a/mm/mlock.c b/mm/mlock.c
> > index ac65de40b22b..f56c685533f5 100644
> > --- a/mm/mlock.c
> > +++ b/mm/mlock.c
<snip>
> > +static int mlock_collect_migratable_pte_range(pmd_t *pmd, unsigned long addr,
> > + unsigned long end, struct mm_walk *walk)
> > +{
> > + struct vm_area_struct *vma = walk->vma;
> > + struct list_head *folio_list = walk->private;
> > + spinlock_t *ptl;
> > + pte_t *start_pte, *pte;
> > + pte_t ptent;
> > + struct folio *folio;
> > + unsigned int step = 1;
> > +
> > + if (!(vma->vm_flags & VM_LOCKED))
> > + return 0;
> > +
> > + ptl = pmd_trans_huge_lock(pmd, vma);
> > + if (ptl) {
> > + if (!pmd_present(*pmd)) {
> > + if (unlikely(softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
> > + spin_unlock(ptl);
> > + pmd_migration_entry_wait(vma->vm_mm, pmd);
> > + walk->action = ACTION_AGAIN;
> > + return 0;
> > + }
> > + goto out;
> > + }
> > + if (is_huge_zero_pmd(*pmd))
> > + goto out;
> > + folio = pmd_folio(*pmd);
> > + if (folio_is_zone_device(folio))
> > + goto out;
> > + if (is_migrate_cma_page(&folio->page))
> > + isolate_folio_to_list(folio, folio_list);
> > + goto out;
> > + }
> > +
> > + start_pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
> > + if (!start_pte) {
> > + walk->action = ACTION_AGAIN;
> > + return 0;
> > + }
> > +
> > + for (pte = start_pte; addr != end; pte += step, addr += step * PAGE_SIZE) {
> > + step = 1;
> > + ptent = ptep_get(pte);
> > + if (!pte_present(ptent)) {
> > + if (unlikely(softleaf_is_migration(softleaf_from_pte(ptent)))) {
> > + pte_unmap_unlock(start_pte, ptl);
> > + migration_entry_wait(vma->vm_mm, pmd, addr);
> > + walk->action = ACTION_AGAIN;
> > + return 0;
> > + }
> > + continue;
> > + }
> > + folio = vm_normal_folio(vma, addr, ptent);
> > + if (!folio || folio_is_zone_device(folio))
> > + continue;
> > + step = folio_mlock_step(folio, pte, addr, end);
> > + if (is_migrate_cma_page(&folio->page))
> Here should be, sorry about this.
> if (!is_migrate_cma_page(&folio->page))
> continue;
But above you do the:
if (is_migrate_cma_page(&folio->page))
isolate_folio_to_list(folio, folio_list);
Pattern :) so these should be consistent. But you're copy/pasting and need to
not do that so it's kind of by the by.
Anyway, yes I assumed you meant this. But see the main review, I am not really a
fan of the implementation, overall.
>
> Best regards
> Wandun
Thanks, Lorenzo
^ permalink raw reply
* Re: [PATCH] tracing: Fix NULL pointer dereference in func_set_flag()
From: Steven Rostedt @ 2026-07-07 15:14 UTC (permalink / raw)
To: Yuanhe Shu
Cc: Masami Hiramatsu, Mathieu Desnoyers, linux-kernel,
linux-trace-kernel, sashiko-bot@kernel.org,
sashiko-reviews@lists.linux.dev
In-Reply-To: <20260624061715.1445655-1-xiangzao@linux.alibaba.com>
From: https://sashiko.dev/#/patchset/20260624061715.1445655-1-xiangzao%40linux.alibaba.com
> commit 2140381622b995438751cdb59eb4bae6923f6a60
> Author: Yuanhe Shu <xiangzao@linux.alibaba.com>
> tracing: Fix NULL pointer dereference in func_set_flag()
> This commit fixes a NULL pointer dereference in func_set_flag() by
> moving the tracer type check before dereferencing tr->current_trace_flags.
> > diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
> > index f283391a4dc80..cd37f20137581 100644
> > --- a/kernel/trace/trace_functions.c
> > +++ b/kernel/trace/trace_functions.c
> > @@ -458,12 +458,12 @@ func_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
> > ftrace_func_t func;
> > u32 new_flags;
> >
> > - /* Do nothing if already set. */
> > - if (!!set == !!(tr->current_trace_flags->val & bit))
> > + /* We can change this flag only when current tracer is function. */
> > + if (tr->current_trace != &function_trace)
> > return 0;
> >
> > - /* We can change this flag only when not running. */
> > - if (tr->current_trace != &function_trace)
> > + /* Do nothing if already set. */
> > + if (!!set == !!(tr->current_trace_flags->val & bit))
> > return 0;
>
> This isn't a bug introduced by this patch, but while reviewing this fix for
> tr->current_trace_flags, I noticed a similar NULL pointer dereference
> can occur in print_graph_function() in kernel/trace/trace_functions_graph.c.
> If a user enables the function_graph tracer, populating the ring buffer
> with graph events, and then switches to a tracer that lacks flags and
> does not automatically clear the ring buffer (such as hwlat, osnoise, or
> timerlat), tr->current_trace_flags becomes NULL.
> When the user subsequently reads the trace buffer, the fallback event handler
> calls print_graph_function(), which unconditionally dereferences
> tr->current_trace_flags:
>
> kernel/trace/trace_functions_graph.c:print_graph_function() {
> struct trace_array *tr = iter->tr;
> return print_graph_function_flags(iter, tr->current_trace_flags->val);
> }
>
> Does this unconditional dereference of tr->current_trace_flags->val also
> need a similar safety check to prevent a kernel crash?
No, because even though hwlat, osnoise and timerlat may not clear the main
ring buffer, it reads it differently. Thus the print_graph_function will
not be called.
Unless you can figure out a way to get to that function with one of those
other tracers?
-- Steve
^ permalink raw reply
* Re: [PATCH] tracing: Add "within" filter for call-stack-based event filtering
From: Steven Rostedt @ 2026-07-07 15:20 UTC (permalink / raw)
To: Chen Jun
Cc: mhiramat, mathieu.desnoyers, linux-kernel, linux-trace-kernel,
sashiko-bot@kernel.org, sashiko-reviews@lists.linux.dev
In-Reply-To: <20260608145556.94931-1-chenjun102@huawei.com>
From: https://sashiko.dev/#/patchset/20260608145556.94931-1-chenjun102%40huawei.com
> commit dfbe6e67884d4ff73b44c46b51995f1945758a89
> Author: Chen Jun <chenjun102@huawei.com>
> tracing: Add "within" filter for call-stack-based event filtering
> This commit introduces a "within" filter predicate for trace events, allowing
> users to filter events based on whether a specific function appears in the
> current call stack. It uses kallsyms_lookup_name() to resolve the function to
> an address range during setup, and stack_trace_save() to capture the stack at
> runtime to evaluate the filter condition.
>
> > diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
> > index 609325f579427..34e1a7f0b3cd0 100644
> > --- a/kernel/trace/trace_events_filter.c
> > +++ b/kernel/trace/trace_events_filter.c
> [ ... ]
> > @@ -1009,6 +1010,22 @@ static int filter_pred_function(struct filter_pred *pred, void *event)
> > return pred->op == OP_EQ ? ret : !ret;
> > }
> >
> > +/* Filter predicate for within. */
> > +static int filter_pred_within(struct filter_pred *pred, void *event)
> > +{
> > +#ifdef CONFIG_STACKTRACE
> > + unsigned long entries[16];
> > + unsigned int nr_entries;
> > + int i;
> > +
> > + nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 0);
>
> Is an array size of 16 entries sufficient here? Since the skipnr parameter is
> 0, several of these frames will be consumed by internal tracing and filter
> evaluation functions (such as filter_pred_within() and
> trace_event_buffer_commit()).
>
> This leaves very few slots for the actual call chain, meaning higher-level
> functions like "vfs_read" will likely be truncated from the stack trace.
> Could this cause the filter condition to evaluate to false incorrectly,
> missing the events we are trying to capture?
>
This is a current limitation that may be dealt with in the future.
> > + for (i = 0; i < nr_entries; i++)
> > + if (pred->val <= entries[i] && entries[i] < pred->val2)
> > + return !pred->not;
> > +#endif
> > + return pred->not;
> > +}
>
> [ ... ]
> > @@ -2002,10 +2021,28 @@ static int parse_pred(const char *str, void *data,
> >
> > } else if (field->filter_type == FILTER_DYN_STRING) {
> > pred->fn_num = FILTER_PRED_FN_STRLOC;
> > - } else if (field->filter_type == FILTER_RDYN_STRING)
> > + } else if (field->filter_type == FILTER_RDYN_STRING) {
> > pred->fn_num = FILTER_PRED_FN_STRRELLOC;
> > - else {
> > + } else if (field->filter_type == FILTER_WITHIN) {
> > + unsigned long func;
> > +
> > + if (op == OP_GLOB)
> > + goto err_free;
>
> Does this goto need a preceding call to parse_error()? Other error paths in
> this function initialize the error state before jumping to err_free.
> Without it, users might see an unhelpful generic error message instead of a
> syntax error indicating that the glob operator isn't supported here.
This is a legitimate issue.
Chen, can you send a v2 and add a proper error message here?
Thanks,
-- Steve
> > +
> > + pred->fn_num = FILTER_PRED_FN_WITHIN;
> > + func = kallsyms_lookup_name(pred->regex->pattern);
^ permalink raw reply
* Re: [PATCH] tracing/user_events: fix use-after-free of enabler in user_event_mm_dup()
From: Steven Rostedt @ 2026-07-07 15:27 UTC (permalink / raw)
To: Michael Bommarito
Cc: Beau Belgrave, XIAO WU, Masami Hiramatsu, Mathieu Desnoyers,
linux-trace-kernel, linux-kernel, stable
In-Reply-To: <CAJJ9bXy78yKmOb+x-THk4EwJxY=0si04YAMtmOu-SzarVJwRBQ@mail.gmail.com>
On Tue, 7 Jul 2026 10:43:40 -0400
Michael Bommarito <michael.bommarito@gmail.com> wrote:
> > Ah, you're going to send a new version. I'll drop the one I pulled then.
>
> Saw your pull for-linus and I was just about to send a separate patch
> set for the second UAF with a ktest (as 2/2). I can do either way,
> just let me know which is easier
I'll drop it and take your new one.
-- Steve
^ permalink raw reply
page: | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox