From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-232.mta0.migadu.com [91.218.175.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6FDBD483BC8 for ; Mon, 19 Oct 2026 05:44:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.232 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792388711; cv=none; b=OU8aKsNlZ4/P+QqNuQ7IDb2rPlCGodhADIDafPeIOEWOrftMRlvYlEI0v77QoHkCcjBeSZh717KlzzNAHcU3eNYrtY/qwLEKKZ+inRQ+/9iDwPO9omjxD/QTAqug2xSe8PsC/UejjVfYluaha5gi1T9oIjF+bKLU+eSMhRk3pOQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792388711; c=relaxed/simple; bh=NgIDSiBf+W9hFun6Xtj0W0UuOklbtmBkmOYHyjYvVA0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=FPWdGW3h2SMtP6zt/yD1LfxYk3pFwcwNkbLneg+Nfgyv1QWvMV6hhKJ66AAUHsfCyKkH3TmPYuKmpVSo5nagqd1VpShvO3KqXk9zuFYUZv9EPOyw7DQb0vjBY6DkkByLOEebYzRfxVUFbAPJ469A+1PbLweFyC+3RoVqpL7Zabo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=HOww4fgF; arc=none smtp.client-ip=91.218.175.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="HOww4fgF" X-Envelope-To: stable@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=NgIDSiBf+W9hFun6Xtj0W0UuOklbtmBkmOYHyjYvVA0=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1792388669; v=1; x=1792993469; b=HOww4fgFjV71Hz7vsm2uGaKVLDEyT4i59txhBK7XXLFycSg+wlY58DA94D/PHxKKnnkySoBL vwpBIicBxftFZdtzPMBsdQcXx9epQFKEND/TmOlWiuMgxgc3YoYQQrh99e/y6FXkX6BaZJ3ZPC8 nLtYWKqTbJbLOz5GtkJGTfSg= X-Envelope-To: stable@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 30a8a1b7f0517040; Mon, 19 Oct 2026 05:44:29 +0000 X-Mizu-Trace-ID: 30a8a1b7f0517040 X-Migadu-Flow: FLOW_OUT From: Hao Ge To: Suren Baghdasaryan , Uladzislau Rezki , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , "Christophe Leroy (CS GROUP)" , "Ritesh Harjani (IBM)" , Shrikanth Hegde , Alexander Potapenko , Marco Elver , Dmitry Vyukov , Andrew Morton , Dennis Zhou , Tejun Heo , Christoph Lameter Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, Hao Ge , stable@vger.kernel.org Subject: [PATCH v2 1/5] mm/kmsan: undo the shadow mapping when the origin mapping fails Date: Mon, 19 Oct 2026 13:45:26 +0800 Message-Id: <20261019054531.87652-2-hao.ge@linux.dev> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20261019054531.87652-1-hao.ge@linux.dev> References: <20261019054531.87652-1-hao.ge@linux.dev> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit kmsan_vmap_pages_range_noflush() first maps the shadow pages and then the origin pages. If the second mapping fails, the first one is left mapped, and the callers do not roll it back. The next vmap of the same metadata range hits the stale PTEs again and BUG()s on the huge mapping path, or gets -EBUSY with a WARN_ON() on the small page one. Undo the shadow mapping on that error path, the same way kmsan_ioremap_page_range() cleans up after a partial failure. __vunmap_range_noflush() only clears the PTEs; nothing has touched the shadow mapping, so no TLB flush is needed. Fixes: 47ebd0310e89 ("mm: kmsan: handle alloc failures in kmsan_vmap_pages_range_noflush()") Cc: stable@vger.kernel.org Reviewed-by: Suren Baghdasaryan Signed-off-by: Hao Ge --- mm/kmsan/shadow.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/kmsan/shadow.c b/mm/kmsan/shadow.c index 0c88d89bf0d6..2166086d3dc3 100644 --- a/mm/kmsan/shadow.c +++ b/mm/kmsan/shadow.c @@ -258,6 +258,10 @@ int kmsan_vmap_pages_range_noflush(unsigned long start, unsigned long end, o_pages, page_shift); kmsan_leave_runtime(); if (mapped) { + /* Undo the shadow mapping set up above. */ + kmsan_enter_runtime(); + __vunmap_range_noflush(shadow_start, shadow_end); + kmsan_leave_runtime(); err = mapped; goto ret; } -- 2.25.1