From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8476D154425 for ; Wed, 29 Apr 2026 05:36:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777440989; cv=none; b=QiIpdLHSs9BEkEDy+edFhtV0+i1HEZ7tuijS0dWjyxhSiGcAA4uwjgrc99Y5FU/61JJDxFoiAUp4iL4tYFZ4S7G8BG71GjuOAWGqhDPghIWCu6KWmTQB9XcMvE+tFU8Igndpx0pjLPY7kyZlxUeS8ENHvKeEEIOuzBWYzNxPvGY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777440989; c=relaxed/simple; bh=2KLYQ+/nzcxFy3oHDOjcuC2Zhda82OP3HdqVhiEL/Gc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZF9rQVISGMbEIKtp9RMmc8SbOcauMyREGqW9etBtySszCoSE2U1xd+2SE1ObEg6eQ1wFd0JdOADEajf3jfZTcoBluHa/xzEY8EYLI6vkxm5MBMpX0FS8qrCCfZzX3sddf7ewvf5NhCzGi5N/F9rHkv2pnb8JIFw5bqz7wnthfaU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=X8AxRF/v; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="X8AxRF/v" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1882EC2BCC4; Wed, 29 Apr 2026 05:36:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777440989; bh=2KLYQ+/nzcxFy3oHDOjcuC2Zhda82OP3HdqVhiEL/Gc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X8AxRF/vhk6838X2yVI/pCJM2peXtcFAOeEJXdOgTf1UnGASbaLd6ijkfm5B4PUJg Oxv46ZjiRMhsUmUwRJna3flp5W5m+MY7yzqoI2JzPWZ7K77y6w7mY6TWB8iRBikieF wOytqBcGICacqVn/YuJaaA9bHL4nCOL0U8Y/nxd9/tRi2kRwm0AmdtdNsEBM5pf8j7 TQhY0zb8i2qJWJ+efqDD6T96By3Zv0UrFlaIjgjCVIKOY/s+yOjT/gMWLb4i7pwqep ggT+589uLH6ti8NFarhgzzyu1bZT8KfWY/loqGJDTjmvx9URTQ5wBZbmiUA1y21WMR jqzZF2qCSYQ1Q== From: Sasha Levin To: stable@vger.kernel.org Cc: "Lorenzo Stoakes (Oracle)" , "Vlastimil Babka (SUSE)" , Alexander Shishkin , Alexandre Torgue , Al Viro , Arnd Bergmann , Bodo Stroesser , Christian Brauner , Clemens Ladisch , David Hildenbrand , David Howells , Dexuan Cui , Greg Kroah-Hartman , Haiyang Zhang , Jan Kara , Jann Horn , Jonathan Corbet , "K. Y. Srinivasan" , Liam Howlett , Long Li , Marc Dionne , "Martin K. Petersen" , Maxime Coquelin , Michal Hocko , Mike Rapoport , Miquel Raynal , Pedro Falcato , Richard Weinberger , Ryan Roberts , Suren Baghdasaryan , Vignesh Raghavendra , Wei Liu , Andrew Morton , Sasha Levin Subject: [PATCH 7.0.y 2/2] mm: avoid deadlock when holding rmap on mmap_prepare error Date: Wed, 29 Apr 2026 01:36:20 -0400 Message-ID: <20260429053620.3394030-2-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260429053620.3394030-1-sashal@kernel.org> References: <2026042747-cardinal-pellet-094f@gregkh> <20260429053620.3394030-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: "Lorenzo Stoakes (Oracle)" [ Upstream commit f96e1d5f15b7c854a6a9ec1225d68a12fe7dcda6 ] Commit ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc") added the ability for drivers to instruct mm to take actions after the .mmap_prepare callback is complete. To make life simpler and safer, this is done before the VMA/mmap write lock is dropped but when the VMA is completely established. So on error, we simply munmap() the VMA. As part of this implementation, unfortunately a horrible hack had to be implemented to support some questionable behaviour hugetlb relies upon - that is that the file rmap lock is held until the operation is complete. The implementation, for convenience, did this in mmap_action_finish() so both the VMA and mmap_prepare compatibility layer paths would have this correctly handled. However, it turns out there is a mistake here - the rmap lock cannot be held on munmap, as free_pgtables() -> unlink_file_vma_batch_add() -> unlink_file_vma_batch_process() takes the file rmap lock. We therefore currently have a deadlock issue that might arise. Resolve this by leaving it to callers to handle the unmap. The compatibility layer does not support this rmap behaviour, so we simply have it unmap on error after calling mmap_action_complete(). In the VMA implementation, we only perform the unmap after the rmap lock is dropped. This resolves the issue by ensuring the rmap lock is always dropped when the unmap occurs. Link: https://lkml.kernel.org/r/d44248be9da68258b07c2c59d4e73485ee0ca943.1774045440.git.ljs@kernel.org Fixes: ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc") Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Vlastimil Babka (SUSE) Cc: Wei Liu Cc: Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin --- mm/util.c | 12 +++++++----- mm/vma.c | 13 ++++++++++--- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/mm/util.c b/mm/util.c index 62ddf9eabb1f6..e2a51e3cfb249 100644 --- a/mm/util.c +++ b/mm/util.c @@ -1186,7 +1186,13 @@ int compat_vma_mmap(struct file *file, struct vm_area_struct *vma) return err; set_vma_from_desc(vma, &desc); - return mmap_action_complete(vma, &desc.action); + err = mmap_action_complete(vma, &desc.action); + if (err) { + const size_t len = vma_pages(vma) << PAGE_SHIFT; + + do_munmap(current->mm, vma->vm_start, len, NULL); + } + return err; } EXPORT_SYMBOL(compat_vma_mmap); @@ -1279,10 +1285,6 @@ static int mmap_action_finish(struct vm_area_struct *vma, * invoked if we do NOT merge, so we only clean up the VMA we created. */ if (err) { - const size_t len = vma_pages(vma) << PAGE_SHIFT; - - do_munmap(current->mm, vma->vm_start, len, NULL); - if (action->error_hook) { /* We may want to filter the error. */ err = action->error_hook(err); diff --git a/mm/vma.c b/mm/vma.c index cae154a43f555..3f55bc42e7be5 100644 --- a/mm/vma.c +++ b/mm/vma.c @@ -2708,9 +2708,9 @@ static int call_action_complete(struct mmap_state *map, struct mmap_action *action, struct vm_area_struct *vma) { - int ret; + int err; - ret = mmap_action_complete(vma, action); + err = mmap_action_complete(vma, action); /* If we held the file rmap we need to release it. */ if (map->hold_file_rmap_lock) { @@ -2718,7 +2718,14 @@ static int call_action_complete(struct mmap_state *map, i_mmap_unlock_write(file->f_mapping); } - return ret; + + if (err) { + const size_t len = vma_pages(vma) << PAGE_SHIFT; + + do_munmap(current->mm, vma->vm_start, len, NULL); + } + + return err; } static unsigned long __mmap_region(struct file *file, unsigned long addr, -- 2.53.0