Re: [PATCH 1/2] mm: Add vma_start_write_killable()

[Matthew Wilcox <willy@infradead.org>]

On Mon, Nov 03, 2025 at 06:03:45PM +0000, Matthew Wilcox (Oracle) wrote:
> @@ -58,15 +60,17 @@ static inline bool __vma_enter_locked(struct vm_area_struct *vma, bool detaching
>  	 * vm_refcnt. mmap_write_lock prevents racing with vma_mark_attached().
>  	 */
>  	if (!refcount_add_not_zero(VMA_LOCK_OFFSET, &vma->vm_refcnt))
> -		return false;
> +		return 0;
>  
>  	rwsem_acquire(&vma->vmlock_dep_map, 0, 0, _RET_IP_);
> -	rcuwait_wait_event(&vma->vm_mm->vma_writer_wait,
> +	err = rcuwait_wait_event(&vma->vm_mm->vma_writer_wait,
>  		   refcount_read(&vma->vm_refcnt) == tgt_refcnt,
> -		   TASK_UNINTERRUPTIBLE);
> +		   state);
> +	if (err)
> +		return err;
>  	lock_acquired(&vma->vmlock_dep_map, _RET_IP_);
>  
> -	return true;
> +	return 1;

I'll wait a couple more days for review before sending v2, but the fix
for the syzbot issue is:

@@ -66,8 +71,10 @@ static inline int __vma_enter_locked(struct vm_area_struct *vma,
        err = rcuwait_wait_event(&vma->vm_mm->vma_writer_wait,
                   refcount_read(&vma->vm_refcnt) == tgt_refcnt,
                   state);
-       if (err)
+       if (err) {
+               rwsem_release(&vma->vmlock_dep_map, _RET_IP_);
                return err;
+       }
        lock_acquired(&vma->vmlock_dep_map, _RET_IP_);

        return 1;