From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585732; b=V8kmBcu0nb3ngM1hhnLXme3AcHOM43cDEl63ihuEFetP6b3JjQzlDNoXJrw8+LZZFnOY fdxFq3OOkSVHh1+C4pe7IMGVF2oIbkgRbt5VnijwR606QZ/7KDHhBOnL4+eLKxg0Ycrkz stnKAv/vBt254V+yM2gnZbT5LBf5m9PlnKUhVfCf9S5foM2jlUk92LrJaebSUxAxb+//1 uNBJ4ue9b65ijFCz1F1uJfBjggIy2/nbviCoizYJSJ/Y3wXoLirUzLeSyM2c3KjsaFmEB X0XNKzZmf/IhAhWzhyNEWqAJ5RuuejbXtB/cZg7lJ+MutNtJkq24RUZeJqQFIkUM4vQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585732; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=UjNM5MYfwED24p91YB41wWFFllQmijMqPUXAEIuXVDo=; b=qSJSFq4A+rTtkYiIbgfrMkGvB2OOLyRyhbR7WZGOvyWi5BjTI59JcX5HpEyb+8miX8JX /JukpdTP32mIUWFB1US7n8ekMcHMTJs0BDL4FmJbPzflJBoKqRdaYuQUAeb555r6DBCdK DE2GcdzJ8tIfgbhQ5nctTuuOfaA+LLTiQ7wVxQCa7rwhyvfBYcb2sDRo/z7cY9MHfy+Sj un4iC6M/+Kx4dDmMmcJDVV4DbnlU3+HN/e/8O0Kht1h85FXqvG9J8E27Tg/w/8NTb574L +gXLzDUcKEE7CMPOdpjTqFRl4PZkYg6AcoMjsyBqUWNA1oRUQzuv7SXejmfDwNEsh3Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="Dn/Gmy9F"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD1D3606EB82; Fri, 13 Nov 2026 16:02:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Dn/Gmy9F Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6FEAE1F000C4; Fri, 13 Nov 2026 16:02:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585732; bh=UjNM5MYfwED24p91YB41wWFFllQmijMqPUXAEIuXVDo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Dn/Gmy9Fm7SvxgA3T8dOt2qHcOudqP8RCXS6h9guA6G1a5ayk+ydcBqfXKnEIA/EA rSIUNpI5qwrV/muKR6yQ4JSIXOsRhwb6NkRvHacoUIMD8KSBxYHgFq/F/oDt+AB9nB vuCkeAOPItjp9Sz40nRjym4EWfA9CHFaJNMgqkio= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+16bf7cd0ebeb1de93aa5@syzkaller.appspotmail.com, Lance Yang , Pedro Falcato , "David Hildenbrand (Arm)" , Zi Yan , Baolin Wang , Sasha Levin Subject: [PATCH 7.3 333/507] khugepaged: fix readahead lock inversion in collapse_file() Date: Fri, 13 Nov 2026 10:50:37 -0500 Message-ID: <20261113153806.718914082@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Lance Yang [ Upstream commit eadce52a9ef657d561b3e76c9b5f178bd99735f5 ] collapse_file() can call page_cache_sync_readahead() while still holding source folios locked. If truncate holds mapping->invalidate_lock exclusively and waits for one of those folios, readahead waits for invalidate_lock and neither side can make progress. We need to release those folio locks before starting readahead. On a page cache miss, roll back first, populate the collapse range, and retry once. Doing readahead after rollback avoids an extra pass when all folios are already present. If another miss occurs on retry, give up rather than keep retrying while truncate or reclaim removes folios. Keep page_cache_sync_readahead() and wait for read I/O with filemap_lock_folio(), releasing each folio before moving to the next. The existing uptodate check during collapse still handles read errors. Shmem uses shmem_get_folio() for swapin and fallocated folios without taking mapping->invalidate_lock, so it is unaffected. Reported-by: syzbot+16bf7cd0ebeb1de93aa5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=16bf7cd0ebeb1de93aa5 Fixes: 730633f0b7f9 ("mm: Protect operations adding pages to page cache with invalidate_lock") Cc: stable@vger.kernel.org Signed-off-by: Lance Yang Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand (Arm) Acked-by: Zi Yan Reviewed-by: Baolin Wang Link: https://patch.msgid.link/20261026152013.10511-1-lance.yang@linux.dev Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Sasha Levin --- mm/khugepaged.c | 44 +++++++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 11 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 8fc8f79641ea5..47ed64f51748f 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -2261,6 +2261,8 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER); enum scan_result result = SCAN_SUCCEED; int nr_none = 0; + bool do_readahead = false; + bool readahead_done = false; /* * MADV_COLLAPSE ignores shmem huge config, so do not check shmem @@ -2278,6 +2280,10 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, mapping_set_update(&xas, mapping); +retry: + result = SCAN_SUCCEED; + do_readahead = false; + xas_set_order(&xas, start, HPAGE_PMD_ORDER); __folio_set_locked(new_folio); if (is_shmem) __folio_set_swapbacked(new_folio); @@ -2342,17 +2348,9 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, } } else { /* !is_shmem */ if (!folio || xa_is_value(folio)) { - xas_unlock_irq(&xas); - page_cache_sync_readahead(mapping, &file->f_ra, - file, index, - end - index); - /* drain lru cache to help folio_isolate_lru() */ - lru_add_drain(); - folio = filemap_lock_folio(mapping, index); - if (IS_ERR(folio)) { - result = SCAN_FAIL; - goto xa_unlocked; - } + do_readahead = !readahead_done; + result = SCAN_FAIL; + goto xa_locked; } else if (folio_test_dirty(folio)) { /* * This page is dirty because it hasn't @@ -2679,6 +2677,30 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, new_folio->mapping = NULL; folio_unlock(new_folio); + + /* Readahead may take invalidate_lock; source folios are unlocked. */ + if (do_readahead) { + for (index = start; index < end;) { + folio = filemap_lock_folio(mapping, index); + if (IS_ERR(folio)) { + page_cache_sync_readahead(mapping, &file->f_ra, + file, index, end - index); + folio = filemap_lock_folio(mapping, index); + if (IS_ERR(folio)) { + result = SCAN_FAIL; + goto out_put; + } + } + index = folio_next_index(folio); + folio_unlock(folio); + folio_put(folio); + } + /* Drain the local LRU batch before retrying isolation. */ + lru_add_drain(); + readahead_done = true; + goto retry; + } +out_put: folio_put(new_folio); out: VM_BUG_ON(!list_empty(&pagelist)); -- 2.53.0