On Tue, May 21, 2024 at 11:56:54AM +0200, David Hildenbrand wrote: > On 21.05.24 09:34, Oscar Salvador wrote: > > hugetlb_wp calls vmf_anon_prepare() after having allocated a page, which > > means that we might need to call restore_reserve_on_error() upon error. > > vmf_anon_prepare() releases the vma lock before returning, but > > restore_reserve_on_error() expects the vma lock to be held by the caller. > > > > Fix it by calling vmf_anon_prepare() before allocating the page. > > > > Signed-off-by: Oscar Salvador <osalvador@xxxxxxx> > > Fixes: 9acad7ba3e25 ("hugetlb: use vmf_anon_prepare() instead of anon_vma_prepare()") > > --- > > I did not hit this bug, I just spotted this because I was looking at hugetlb_wp > > for some other reason. And I did not want to get creative to see if I could > > trigger this so I could get a backtrace. > > My assumption is that we could trigger this if 1) this was a shared mapping, > > so no anon_vma and 2) we call in GUP code with FOLL_WRITE, which would cause > > the FLAG_UNSHARE to be passed, so we will end up in hugetlb_wp(). > > FOLL_WRITE should never result in FLAG_UNSHARE. You are right. It was quite early when I looked at this and I managed to confuse myself when reading hugetlb_follow_page_mask(). > The joy of hugetlb reservation code. > > LGTM thanks David! -- Oscar Salvador SUSE Labs