diff options
| author | Chris Mason <mason@kernel.org> | 2026-10-31 10:40:07 +0100 |
|---|---|---|
| committer | David Hildenbrand (Arm) <david@kernel.org> | 2026-11-03 20:20:53 +0100 |
| commit | d03df42ddae196f20e9cfb775704e60269eb6b44 (patch) | |
| tree | c894a09e828909aad4ff12c8261f1cb2cfe893eb /include | |
| parent | 9f02ca8c15a74bc9e4e8e05ec089f63cb87cbf75 (diff) | |
mm: fix deadlock of mremap() against UFFDIO_MOVE
With per-VMA locks, UFFDIO_MOVE can run concurrently with mremap()
on different VMAs in the same mm. Those VMAs can share page tables, so
both operations can acquire the same pair of page-table locks.
UFFDIO_MOVE orders the locks by address, while mremap() takes the source
lock first. These conflicting orders can deadlock; mremap() holding
mmap_lock for writing no longer helps.
Move double_pt_lock() and double_pt_unlock() to mm/internal.h and use
them for all page-table moves in mremap(). Preserve the source entry
checks after acquiring both locks. Remove the comments claiming that
exclusive mmap_lock makes lock ordering irrelevant.
In move_ptes(), make sure to just recheck source and destination PMD
after taking the locks and drop the overly-long comment.
Fix generated by an LLM and sent by Chris Mason in private.
[ david: use new helpers consistently; simplify description and comments;
move_ptes() fixup ]
Fixes: 867a43a34ff8 ("userfaultfd: use per-vma locks in userfaultfd operations")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20261031-fixes_core-v3-38-d6437171ecc3@kernel.org
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/userfaultfd_k.h | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h index a14b8a9ffb7b..565e98f342dc 100644 --- a/include/linux/userfaultfd_k.h +++ b/include/linux/userfaultfd_k.h @@ -153,8 +153,6 @@ extern int mrwprotect_range(struct userfaultfd_ctx *ctx, unsigned long start, unsigned long len, bool enable_rwp); /* move_pages */ -void double_pt_lock(spinlock_t *ptl1, spinlock_t *ptl2); -void double_pt_unlock(spinlock_t *ptl1, spinlock_t *ptl2); int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pmd_t dst_pmdval, struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma, |