On Mon, Feb 06, 2023 at 08:28:56PM +0900, David Stevens wrote: > @@ -1747,6 +1748,7 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, > XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER); > int nr_none = 0, result = SCAN_SUCCEED; > bool is_shmem = shmem_file(file); > + bool i_mmap_locked = false; you don't need this ... > + * While iterating, we may drop the page cache lock multiple times. It > + * is safe to replace pages in the page cache with hpage while doing so > + * because nobody is able to map or otherwise access the content of > + * hpage until we unlock it. However, we cannot insert hpage into empty > + * indicies until we know we won't have to drop the page cache lock "indices". > @@ -1967,6 +1974,46 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, > put_page(page); > goto xa_unlocked; > } > + > + if (nr_none) { > + struct vm_area_struct *vma; > + int nr_none_check = 0; > + > + xas_unlock_irq(&xas); > + i_mmap_lock_read(mapping); > + i_mmap_locked = true; > + xas_lock_irq(&xas); > + > + xas_set(&xas, start); > + for (index = start; index < end; index++) { > + if (!xas_next(&xas)) > + nr_none_check++; > + } > + > + if (nr_none != nr_none_check) { > + result = SCAN_PAGE_FILLED; ... you can unlock the i_mmap_lock here before the goto. I think you need to add a case in madvise_collapse_errno(). It should probably return -EBUSY, I would think?