linux-kernel - Re: [PATCH] mm/migrate: fix hugetlbfs deadlock by respecting lock ordering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87secfqok7.fsf@DESKTOP-5N7EMDA>
Date: Fri, 09 Jan 2026 14:37:28 +0800
From: "Huang, Ying" <ying.huang@...ux.alibaba.com>
To: Jinchao Wang <wangjinchao600@...il.com>
Cc: Matthew Wilcox <willy@...radead.org>,  Andrew Morton
 <akpm@...ux-foundation.org>,  David Hildenbrand <david@...nel.org>,  Zi
 Yan <ziy@...dia.com>,  Matthew Brost <matthew.brost@...el.com>,  Joshua
 Hahn <joshua.hahnjy@...il.com>,  Rakie Kim <rakie.kim@...com>,  Byungchul
 Park <byungchul@...com>,  Gregory Price <gourry@...rry.net>,  Alistair
 Popple <apopple@...dia.com>,  linux-mm@...ck.org,
  linux-kernel@...r.kernel.org,
  syzbot+2d9c96466c978346b55f@...kaller.appspotmail.com
Subject: Re: [PATCH] mm/migrate: fix hugetlbfs deadlock by respecting lock
 ordering

Jinchao Wang <wangjinchao600@...il.com> writes:

> Fix an AB-BA deadlock between hugetlbfs_punch_hole() and page migration.
>
> The deadlock occurs because migration violates the lock ordering defined
> in mm/rmap.c for hugetlbfs:
>
>   * hugetlbfs PageHuge() take locks in this order:
>   * hugetlb_fault_mutex
>   * vma_lock
>   * mapping->i_mmap_rwsem
>   * folio_lock
>
> The following trace illustrates the inversion:
>
> Task A (punch_hole):             Task B (migration):
> --------------------             -------------------
> 1. i_mmap_lock_write(mapping)    1. folio_lock(folio)
> 2. folio_lock(folio)             2. i_mmap_lock_read(mapping)
>    (blocks waiting for B)           (blocks waiting for A)
>
> Task A is blocked in the punch-hole path:
>   hugetlbfs_fallocate
>     hugetlbfs_punch_hole
>       hugetlbfs_zero_partial_page
>         folio_lock
>
> Task B is blocked in the migration path:
>   migrate_pages
>     unmap_and_move_huge_page
>       remove_migration_ptes
>         __rmap_walk_file
>           i_mmap_lock_read
>
> To fix this, adjust unmap_and_move_huge_page() to respect the established
> hierarchy. If i_mmap_rwsem is acquired during try_to_migrate(), hold it
> until remove_migration_ptes() completes.
>
> This utilizes the existing retry logic, which unlocks the folio and
> returns -EAGAIN if hugetlb_folio_mapping_lock_write() fails.
>
> Link: https://lore.kernel.org/all/68e9715a.050a0220.1186a4.000d.GAE@google.com/
> Link: https://lore.kernel.org/all/20260108123957.1123502-2-wangjinchao600@gmail.com
> Reported-by: syzbot+2d9c96466c978346b55f@...kaller.appspotmail.com
> Suggested-by: Matthew Wilcox <willy@...radead.org>
> Signed-off-by: Jinchao Wang <wangjinchao600@...il.com>

Can you provide a "Fixes:" tag?  That is helpful for backporting the bug
fix.

---
Best Regards,
Huang, Ying