From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063150; b=DZLXyOE4vqp0UVJA/bn8C7lzJ5SeyYusgZETQ7MbDlLOt5w0db8b6p2jrmGU74T3Wxzx 90Cp9E/rPk6aHlhMNaUJbKeOCdG4jeqKtHT3eOyrAMZ2rr9cRyHmuFn3aB5l1EKhegbB4 MYJ0K3LlzBBaOyWuy/XgYTaSh3SLbiTrm77STTWuck4bXBssBN9vyg1gEvU+pT8T81DjK KmmXSR5QKL4NZCcO1BSUAl1/26UWOWOYrhWqnxyVbeIsshzhqPQwCyKOi5st7T+4XJqxV sAkJryrZNdqVdewJMn8Yvn2Ft8+qLh+D5aGmQ0iItE/vdxZdTplGlan04M9d1Xduhpg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063150; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=WAU5YbORscdcR67ZeusPlyFsAU114EgLmcpNsmncse0=; b=wo0qMWalgt2k17QSRdJSiaGCkIWOe77TEeosk0sMZYDvXZDbNEW1gZ0aTK3YHn5n4myt H04noTEpjkHs7gw8eh2stzTPRsrRy+kzDp7734Pt0xbfYiEYZvGd6eEhRSJaSWViwahgn SfhJ3BMB8rDMk4qR1GzwkBEyQErABUzZVtYddsZJM/ALPRgJbKudj6vsUL9k1NtYq7xAL OBfODSZgu3M6UOr/u216hzg8X3bwgByuEboBJogXe1vOnfbBW88Ip0Mtl3MCj1vJgHp6n sO5gkVnbDwufhQPmH5RedEU1YasZxU8KcB2pKf1mCvtAgzIdjmoOsz6lvG/URq74KQg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=rGN14M39; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57C06606A331; Sat, 7 Nov 2026 14:52:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=rGN14M39 Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA1351F0089F; Sat, 7 Nov 2026 14:52:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063150; bh=WAU5YbORscdcR67ZeusPlyFsAU114EgLmcpNsmncse0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=rGN14M399e+4ZsS5U/XqLAtw1zTmvxp621TxVkiA3yM0La2kbFscobXsimrXuFA2N 89KsKrgY9DKlEHK14S06t0++dOfIV4ON32wRLDWe+GH1GMnW7ClxCqJp35f4bazxzT 6iuDptLvRIYlt9qu8Iblvi1pAw2Ifs//+ifTGquI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Chengfeng Ye , Andrew Morton , Xu Xin , "David Hildenbrand (Arm)" , Hugh Dickins , Sasha Levin Subject: [PATCH 6.18 375/869] mm/ksm: mark migration stores with WRITE_ONCE() Date: Sat, 7 Nov 2026 08:50:57 -0500 Message-ID: <20261107134905.820909018@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chengfeng Ye [ Upstream commit d3863210464f69c18615cbe400d48a6e53e770d4 ] ksm_get_folio() deliberately samples stable_node->kpfn and folio->mapping without taking the folio lock because the KSM folio may be migrated concurrently. folio_migrate_ksm() updates the same state using plain assignments. The reader can load the old kpfn, then the migrator can store the new kpfn, execute smp_wmb(), and clear the old folio's mapping before the reader checks that mapping. Thus the initial kpfn load can overlap its update and the subsequent mapping load can overlap the clear, with no common lock. This leaves marked READ_ONCE() accesses racing with plain stores. The kernel reported: BUG: KCSAN: data-race in folio_migrate_ksm / ksm_get_folio read (marked) to 0xffff8ce401421330 of 8 bytes by task 48 on cpu 3: ksm_get_folio+0x7f/0x2a0 ksm_scan_thread+0x1635/0x3330 kthread+0x1af/0x1f0 write to 0xffff8ce401421330 of 8 bytes by task 102 on cpu 1: folio_migrate_ksm+0x6a/0xd0 folio_migrate_flags+0x193/0x420 __migrate_folio.isra.0+0x162/0x1a0 migrate_folio+0x4c/0x70 move_to_new_folio+0xd6/0x170 Use WRITE_ONCE() for both stores to pair them with the existing lockless reads. This preserves the existing smp_wmb()/smp_rmb() migration protocol and control flow while preventing compiler transformations of the shared accesses. Link: https://lore.kernel.org/20260824112433.191301-1-nicoyip.dev@gmail.com Fixes: c8d6553b9580 ("ksm: make KSM page migration possible") Signed-off-by: Chengfeng Ye Signed-off-by: Andrew Morton Acked-by: Xu Xin Acked-by: David Hildenbrand (Arm) Cc: Hugh Dickins Cc: Signed-off-by: Sasha Levin --- mm/ksm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index 4f672f4f21407..80274ace8155e 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1065,7 +1065,8 @@ static inline void folio_set_stable_node(struct folio *folio, struct ksm_stable_node *stable_node) { VM_WARN_ON_FOLIO(folio_test_anon(folio) && PageAnonExclusive(&folio->page), folio); - folio->mapping = (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM); + WRITE_ONCE(folio->mapping, + (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM)); } #ifdef CONFIG_SYSFS @@ -3248,7 +3249,7 @@ void folio_migrate_ksm(struct folio *newfolio, struct folio *folio) stable_node = folio_stable_node(folio); if (stable_node) { VM_BUG_ON_FOLIO(stable_node->kpfn != folio_pfn(folio), folio); - stable_node->kpfn = folio_pfn(newfolio); + WRITE_ONCE(stable_node->kpfn, folio_pfn(newfolio)); /* * newfolio->mapping was set in advance; now we need smp_wmb() * to make sure that the new stable_node->kpfn is visible -- 2.53.0