[BUG] mm/mempolicy: possible double-unlock in migrate_to_node() on 6.6

[BUG] mm/mempolicy: possible double-unlock in migrate_to_node() on 6.6

[liying3]

[-- Attachment #1: Type: text/plain, Size: 1300 bytes --]

Hi Andrew,

I found that a fix is required for this submission in branch 6.6.
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a13b2b9b0b0b04612c7d81e3b3dfb485c5f7abc3 

Regarding the difference between branches 6.6 and 6.12, in branch 6.6, mmap_read_lock() and mmap_read_unlock() are called outside the migrate_to_node() function. 
Therefore, mmap_read_unlock(mm) should not be invoked inside migrate_to_node(); otherwise, it would result in a double unlock of the mm.
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 54f1b78d1b2c0f..94c74c594d102a 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1071,6 +1071,10 @@ static long migrate_to_node(struct mm_struct *mm, int source, int dest,
VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)));
vma = find_vma(mm, 0);
+ if (unlikely(!vma)) {
+ mmap_read_unlock(mm); // this line should be deleted
+ return 0;
+ }
/*
* This does not migrate the range, but isolates all pages that



Best Regards,
Li Ying , Light Storage Group.  Senior Embedded Software Engineer
Tel: -； Fax: -
Mobile: +86-15651963981
liying3@sungrowpower.com 
www.sungrowpower.com
SUNGROW POWER SUPPLY Co., Ltd. 
Add: No.1699 Xiyou Rd., New & High Technology Industrial Development Zone, Hefei, P. R. China., 230088

[-- Attachment #2: Type: text/html, Size: 55196 bytes --]

Re: [BUG] mm/mempolicy: possible double-unlock in migrate_to_node() on 6.6

[Matthew Wilcox]

On Tue, Mar 03, 2026 at 10:52:51AM +0800, liying3@sungrowpower.com wrote:
> Hi Andrew,
> 
> I found that a fix is required for this submission in branch 6.6.
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a13b2b9b0b0b04612c7d81e3b3dfb485c5f7abc3 

Agreed, although your email should more properly have been directed to
David and possibly Greg.  Are you going to submit a patch to fix this,
or do you prefer that somebody else does it?

> Regarding the difference between branches 6.6 and 6.12, in branch 6.6, mmap_read_lock() and mmap_read_unlock() are called outside the migrate_to_node() function. 
> Therefore, mmap_read_unlock(mm) should not be invoked inside migrate_to_node(); otherwise, it would result in a double unlock of the mm.
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 54f1b78d1b2c0f..94c74c594d102a 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -1071,6 +1071,10 @@ static long migrate_to_node(struct mm_struct *mm, int source, int dest,
> VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)));
> vma = find_vma(mm, 0);
> + if (unlikely(!vma)) {
> + mmap_read_unlock(mm); // this line should be deleted
> + return 0;
> + }
> /*
> * This does not migrate the range, but isolates all pages that
> 
> 
> 
> Best Regards,
> Li Ying , Light Storage Group.  Senior Embedded Software Engineer
> Tel: -； Fax: -
> Mobile: +86-15651963981
> liying3@sungrowpower.com 
> www.sungrowpower.com
> SUNGROW POWER SUPPLY Co., Ltd. 
> Add: No.1699 Xiyou Rd., New & High Technology Industrial Development Zone, Hefei, P. R. China., 230088

Re: [BUG] mm/mempolicy: possible double-unlock in migrate_to_node() on 6.6

[David Hildenbrand (Arm)]

On 3/3/26 05:15, Matthew Wilcox wrote:
> On Tue, Mar 03, 2026 at 10:52:51AM +0800, liying3@sungrowpower.com wrote:
>> Hi Andrew,
>>
>> I found that a fix is required for this submission in branch 6.6.
>> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a13b2b9b0b0b04612c7d81e3b3dfb485c5f7abc3 
> 
> Agreed, although your email should more properly have been directed to
> David and possibly Greg.  Are you going to submit a patch to fix this,
> or do you prefer that somebody else does it?
> 
>> Regarding the difference between branches 6.6 and 6.12, in branch 6.6, mmap_read_lock() and mmap_read_unlock() are called outside the migrate_to_node() function. 
>> Therefore, mmap_read_unlock(mm) should not be invoked inside migrate_to_node(); otherwise, it would result in a double unlock of the mm.
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index 54f1b78d1b2c0f..94c74c594d102a 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -1071,6 +1071,10 @@ static long migrate_to_node(struct mm_struct *mm, int source, int dest,
>> VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)));
>> vma = find_vma(mm, 0);
>> + if (unlikely(!vma)) {
>> + mmap_read_unlock(mm); // this line should be deleted
>> + return 0;
>> + }

Right, that unlock must go. Let me know if I should prepare a fix.

-- 
Cheers,

David

Re: Re: [BUG] mm/mempolicy: possible double-unlock in migrate_to_node() on 6.6

[liying3]

[-- Attachment #1: Type: text/plain, Size: 2006 bytes --]

Thanks for your confirm, please help to process it.



Best Regards,
Li Ying , Light Storage Group.  Senior Embedded Software Engineer
Tel: -； Fax: -
Mobile: +86-15651963981
liying3@sungrowpower.com 
www.sungrowpower.com
SUNGROW POWER SUPPLY Co., Ltd. 
Add: No.1699 Xiyou Rd., New & High Technology Industrial Development Zone, Hefei, P. R. China., 230088
 
From: David Hildenbrand (Arm)
Date: 2026-03-03 17:04
To: Matthew Wilcox; liying3@sungrowpower.com
CC: akpm; linux-mm; linux-kernel; victor7q; Greg Kroah-Hartman
Subject: Re: [BUG] mm/mempolicy: possible double-unlock in migrate_to_node() on 6.6
On 3/3/26 05:15, Matthew Wilcox wrote:
> On Tue, Mar 03, 2026 at 10:52:51AM +0800, liying3@sungrowpower.com wrote:
>> Hi Andrew,
>>
>> I found that a fix is required for this submission in branch 6.6.
>> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a13b2b9b0b0b04612c7d81e3b3dfb485c5f7abc3 
> 
> Agreed, although your email should more properly have been directed to
> David and possibly Greg.  Are you going to submit a patch to fix this,
> or do you prefer that somebody else does it?
> 
>> Regarding the difference between branches 6.6 and 6.12, in branch 6.6, mmap_read_lock() and mmap_read_unlock() are called outside the migrate_to_node() function. 
>> Therefore, mmap_read_unlock(mm) should not be invoked inside migrate_to_node(); otherwise, it would result in a double unlock of the mm.
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index 54f1b78d1b2c0f..94c74c594d102a 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -1071,6 +1071,10 @@ static long migrate_to_node(struct mm_struct *mm, int source, int dest,
>> VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)));
>> vma = find_vma(mm, 0);
>> + if (unlikely(!vma)) {
>> + mmap_read_unlock(mm); // this line should be deleted
>> + return 0;
>> + }
 
Right, that unlock must go. Let me know if I should prepare a fix.
 
-- 
Cheers,
 
David

[-- Attachment #2: Type: text/html, Size: 50089 bytes --]