On Fri, Apr 26, 2024 at 04:51:33PM +0800, Miaohe Lin wrote: > Thorvald reported a WARNING [1]. And the root cause is below race: > > CPU 1 CPU 2 > fork hugetlbfs_fallocate > dup_mmap hugetlbfs_punch_hole > i_mmap_lock_write(mapping); > vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. > i_mmap_unlock_write(mapping); > hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem! > i_mmap_lock_write(mapping); > hugetlb_vmdelete_list > vma_interval_tree_foreach > hugetlb_vma_trylock_write -- Vma_lock is cleared. > tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! > hugetlb_vma_unlock_write -- Vma_lock is assigned!!! > i_mmap_unlock_write(mapping); > > hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside > i_mmap_rwsem lock while vma lock can be used in the same time. Fix this > by deferring linking file vma until vma is fully initialized. Those vmas > should be initialized first before they can be used. > > Link: https://lkml.kernel.org/r/20240410091441.3539905-1-linmiaohe@xxxxxxxxxx > Fixes: 8d9bfb260814 ("hugetlb: add vma based lock for pmd sharing") > Signed-off-by: Miaohe Lin <linmiaohe@xxxxxxxxxx> > Reported-by: Thorvald Natvig <thorvald@xxxxxxxxxx> > Closes: https://lore.kernel.org/linux-mm/20240129161735.6gmjsswx62o4pbja@revolver/T/ [1] > Reviewed-by: Jane Chu <jane.chu@xxxxxxxxxx> > Cc: Christian Brauner <brauner@xxxxxxxxxx> > Cc: Heiko Carstens <hca@xxxxxxxxxxxxx> > Cc: Kent Overstreet <kent.overstreet@xxxxxxxxx> > Cc: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> > Cc: Mateusz Guzik <mjguzik@xxxxxxxxx> > Cc: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx> > Cc: Miaohe Lin <linmiaohe@xxxxxxxxxx> > Cc: Muchun Song <muchun.song@xxxxxxxxx> > Cc: Oleg Nesterov <oleg@xxxxxxxxxx> > Cc: Peng Zhang <zhangpeng.00@xxxxxxxxxxxxx> > Cc: Tycho Andersen <tandersen@xxxxxxxxxxx> > Cc: <stable@xxxxxxxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > (cherry picked from commit 35e351780fa9d8240dd6f7e4f245f9ea37e96c19) > Signed-off-by: Miaohe Lin <linmiaohe@xxxxxxxxxx> > --- > kernel/fork.c | 18 +++++++++--------- > 1 file changed, 9 insertions(+), 9 deletions(-) Both now queued up, thanks. greg k-h
