mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer.patch removed from -mm tree
The quilt patch titled
Subject: mm: fix ASSERT_EXCLUSIVE_BITS by passing memdesc_flags_t by pointer
has been removed from the -mm tree. Its filename was
mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer.patch
This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Hui Zhu <[email protected]>
Subject: mm: fix ASSERT_EXCLUSIVE_BITS by passing memdesc_flags_t by pointer
Date: Tue, 30 Jun 2026 15:08:10 +0800
KCSAN reports a data race between page_to_nid()/folio_pgdat() reading page->flags and folio_trylock()/folio_lock() concurrently doing test_and_set_bit_lock(PG_locked, ...) on the same word, e.g.:
BUG: KCSAN: data-race in __lruvec_stat_mod_folio / shmem_get_folio_gfp
The race is benign: nid/zone bits are set once at page init and never overlap with PG_locked. However, ASSERT_EXCLUSIVE_BITS() inside memdesc_nid/zonenum() was checking a by-value copy of the flags word, not the live page->flags, so it failed to annotate the real access.
Change memdesc_nid(), memdesc_zonenum(), memdesc_section(), and memdesc_is_zone_device() to take a const memdesc_flags_t * and update all callers to pass &page->flags / &folio->flags, so ASSERT_EXCLUSIVE_BITS() operates on the actual shared word.
Guard the ASSERT_EXCLUSIVE_BITS() call in memdesc_zonenum() under ZONES_WIDTH != 0 to avoid a zero-mask check on configs where the zone field is absent. memdesc_section() needs no such guard, since SECTIONS_WIDTH is never 0 wherever SECTION_IN_PAGE_FLAGS is defined. Under CONFIG_NUMA=n, memdesc_nid() itself is stubbed to "return 0" instead of reading page->flags, since NODES_MASK is 0 and the check can never fire; page_to_nid()/folio_nid() now just call memdesc_nid() unconditionally and rely on that stub, instead of duplicating the CONFIG_NUMA split at each call site.
---
include/asm-generic/memory_model.h | 2 +- include/linux/mm.h | 26 ++++++++++++++++++-------- include/linux/mm_inline.h | 4 ++-- include/linux/mmzone.h | 26 ++++++++++++++------------ mm/page_alloc.c | 6 +++--- mm/page_owner.c | 2 +- mm/slab.h | 2 +- mm/sparse.c | 2 +- 8 files changed, 41 insertions(+), 29 deletions(-)
include/asm-generic/memory_model.h renamed from include/asm-generic/memory_model.h~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +1 -1
@@ -53,7 +53,7 @@ static inline int pfn_valid(unsigned lon*/ #define __page_to_pfn (pg) \ ({ const struct page *__pg = (pg); \ - int __sec = memdesc_section(__pg->flags); \ + int __sec = memdesc_section(&__pg->flags); \ (unsigned long)(__pg - __section_mem_map_addr(__nr_to_section(__sec))); \ })
include/linux/mm.h renamed from include/linux/mm.h~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +18 -8
@@ -37,6 +37,7 @@#include <linux/bitmap.h> #include <linux/bitops.h> #include <linux/iommu-debug-pagealloc.h> +#include <linux/kcsan-checks.h> struct mempolicy ;struct anon_vma ;
@@ -2286,22 +2287,30 @@ static inline int page_zone_id(struct pa }#ifdef NODE_NOT_IN_PAGE_FLAGS -int memdesc_nid (memdesc_flags_t mdf); +int memdesc_nid (const memdesc_flags_t *mdf);#else -static inline int memdesc_nid (memdesc_flags_t mdf) +#ifdef CONFIG_NUMA +static inline int memdesc_nid (const memdesc_flags_t *mdf) +{ +ASSERT_EXCLUSIVE_BITS (mdf->f,NODES_MASK <<NODES_PGSHIFT ); +return (mdf->f >>NODES_PGSHIFT ) &NODES_MASK ; +} +#else +static inline int memdesc_nid (const memdesc_flags_t *mdf) { -return (mdf.f >>NODES_PGSHIFT ) &NODES_MASK ; +return 0 ; }#endif +#endif static inline int page_to_nid (const struct page *page) { -return memdesc_nid (PF_POISONED_CHECK (page)->flags); +return memdesc_nid (&(PF_POISONED_CHECK (page)->flags)); }static inline int folio_nid (const struct folio *folio) { -return memdesc_nid (folio->flags); +return memdesc_nid (&folio->flags); }#ifdef CONFIG_NUMA_BALANCING
@@ -2541,12 +2550,13 @@ static inline void set_page_section(stru page->flags.f |= (section & SECTIONS_MASK) << SECTIONS_PGSHIFT; } -static inline unsigned long memdesc_section (memdesc_flags_t mdf) +static inline unsigned long memdesc_section (const memdesc_flags_t *mdf) { -return (mdf.f >>SECTIONS_PGSHIFT ) &SECTIONS_MASK ; +ASSERT_EXCLUSIVE_BITS (mdf->f,SECTIONS_MASK <<SECTIONS_PGSHIFT ); +return (mdf->f >>SECTIONS_PGSHIFT ) &SECTIONS_MASK ; }#else /* !SECTION_IN_PAGE_FLAGS */ -static inline unsigned long memdesc_section (memdesc_flags_t mdf) +static inline unsigned long memdesc_section (const memdesc_flags_t *mdf) {return 0 ; }
include/linux/mm_inline.h renamed from include/linux/mm_inline.h~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +2 -2
@@ -650,7 +650,7 @@ static inline bool vma_has_recency(conststatic inline size_t num_pages_contiguous (struct page **pages,size_t nr_pages) {struct page *cur_page = pages[0 ]; -unsigned long section =memdesc_section (cur_page->flags); +unsigned long section =memdesc_section (&cur_page->flags);size_t i;for (i =1 ; i < nr_pages; i++) {
@@ -660,7 +660,7 @@ static inline size_t num_pages_contiguou* In unproblematic kernel configs, page_to_section() == 0 and * the whole check will get optimized out. */ -if (memdesc_section (cur_page->flags) != section) +if (memdesc_section (&cur_page->flags) != section)break ; }
include/linux/mmzone.h renamed from include/linux/mmzone.h~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +14 -12
@@ -1272,31 +1272,33 @@ static inline bool zone_is_empty(const s#define KASAN_TAG_MASK ((1UL << KASAN_TAG_WIDTH) - 1)#define ZONEID_MASK ((1UL << ZONEID_SHIFT) - 1) -static inline enum zone_type memdesc_zonenum (memdesc_flags_t flags) +static inline enum zone_type memdesc_zonenum (const memdesc_flags_t *flags) { -ASSERT_EXCLUSIVE_BITS (flags.f,ZONES_MASK <<ZONES_PGSHIFT ); -return (flags.f >>ZONES_PGSHIFT ) &ZONES_MASK ; +#if ZONES_WIDTH !=0 +ASSERT_EXCLUSIVE_BITS (flags->f,ZONES_MASK <<ZONES_PGSHIFT ); +#endif +return (flags->f >>ZONES_PGSHIFT ) &ZONES_MASK ; }static inline enum zone_type page_zonenum (const struct page *page) { -return memdesc_zonenum (page->flags); +return memdesc_zonenum (&page->flags); }static inline enum zone_type folio_zonenum (const struct folio *folio) { -return memdesc_zonenum (folio->flags); +return memdesc_zonenum (&folio->flags); }#ifdef CONFIG_ZONE_DEVICE -static inline bool memdesc_is_zone_device (memdesc_flags_t mdf) +static inline bool memdesc_is_zone_device (const memdesc_flags_t *mdf) {return memdesc_zonenum (mdf) ==ZONE_DEVICE ; }static inline struct dev_pagemap *page_pgmap (const struct page *page) { -VM_WARN_ON_ONCE_PAGE (!memdesc_is_zone_device (page->flags), page); +VM_WARN_ON_ONCE_PAGE (!memdesc_is_zone_device (&page->flags), page);return page_folio (page)->pgmap; }
@@ -1311,9 +1313,9 @@ static inline struct dev_pagemap *page_pstatic inline bool zone_device_pages_have_same_pgmap (const struct page *a,const struct page *b) { -if (memdesc_is_zone_device (a->flags) !=memdesc_is_zone_device (b->flags)) +if (memdesc_is_zone_device (&a->flags) !=memdesc_is_zone_device (&b->flags))return false; -if (!memdesc_is_zone_device (a->flags)) +if (!memdesc_is_zone_device (&a->flags))return true;return page_pgmap (a) ==page_pgmap (b); }
@@ -1321,7 +1323,7 @@ static inline bool zone_device_pages_havextern void memmap_init_zone_device (struct zone *,unsigned long ,unsigned long ,struct dev_pagemap *);#else -static inline bool memdesc_is_zone_device (memdesc_flags_t mdf) +static inline bool memdesc_is_zone_device (const memdesc_flags_t *mdf) {return false; }
@@ -1338,12 +1340,12 @@ static inline struct dev_pagemap *page_pstatic inline bool is_zone_device_page (const struct page *page) { -return memdesc_is_zone_device (page->flags); +return memdesc_is_zone_device (&page->flags); }static inline bool folio_is_zone_device (const struct folio *folio) { -return memdesc_is_zone_device (folio->flags); +return memdesc_is_zone_device (&folio->flags); }static inline bool is_zone_movable_page (const struct page *page)
mm/page_alloc.c renamed from mm/page_alloc.c~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +3 -3
@@ -6913,15 +6913,15 @@ static void __free_contig_range_common(ucontinue ; } -if (start &&memdesc_section (page->flags) != start_sec) { +if (start &&memdesc_section (&page->flags) != start_sec) {free_prepared_contig_range (start, i - nr_start); start = page; nr_start = i; - start_sec =memdesc_section (page->flags); + start_sec =memdesc_section (&page->flags); }else if (!start) { start = page; nr_start = i; - start_sec =memdesc_section (page->flags); + start_sec =memdesc_section (&page->flags); } }
mm/page_owner.c renamed from mm/page_owner.c~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +1 -1
@@ -815,7 +815,7 @@ read_page_owner(struct file *file, char*/ if (page_flags.f ==PAGE_POISON_PATTERN ) goto ext_put_continue; - nid =memdesc_nid (page_flags); + nid =memdesc_nid (&page_flags);if (!node_isset (nid, state->nid_filter)) goto ext_put_continue; }
mm/slab.h renamed from mm/slab.h~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +1 -1
@@ -180,7 +180,7 @@ static inline void *slab_address(const sstatic inline int slab_nid (const struct slab *slab) { -return memdesc_nid (slab->flags); +return memdesc_nid (&slab->flags); }static inline pg_data_t *slab_pgdat (const struct slab *slab)
mm/sparse.c renamed from mm/sparse.c~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer +1 -1
@@ -43,7 +43,7 @@ static u8 section_to_node_table[NR_MEM_S static u16 section_to_node_table[NR_MEM_SECTIONS] __cacheline_aligned;#endif -int memdesc_nid (memdesc_flags_t mdf) +int memdesc_nid (const memdesc_flags_t *mdf) {return section_to_node_table[memdesc_section (mdf)]; }
_
Patches currently in -mm which might be from [email protected] are