Re: [PATCH v2] mm/vma: avoid spurious write locks when mm->mm_lock_seq overflows

[Lorenzo Stoakes (ARM)]

On Mon, Oct 19, 2026 at 10:53:27AM +0100, Pedro Falcato wrote:
> On Fri, Oct 16, 2026 at 12:34:33PM +0100, Lorenzo Stoakes (ARM) wrote:

> > So I think it's fine to just send it (early :) in the merge window.
> > ---
> > v2:
> > * Updated comment in vma_seqcount_is_write_locked() to mention the VMA
> >   being attached.
> > * Renamed reset_vma_seqcounts() to __mm_reset_vma_seqcounts().
> > * Used acquire semantics in vma_start_reads() to avoid race with reset -
> >   there is another acquire immediately after this one so it should just be
> >   noise perf-wise.
> > * Removed stable tag, will do the backports manually (just make the value
> >   64 bits...)
>
> I guess you're fitting this where __vm_anon_pgoff_lo now sits? If so, then
> this patch probably wants backporting to 7.3.

Ack.

> > +/*
> > + * Called with mmap write lock held after mm->mm_lock_seq just overflowed (and
> > + * therefore zero), with all VMA write locks now released.
> > + *
> > + * The stores below follow the smp_wmb() in do_raw_write_seqcount_end(), so
> > + * a reader that observes a reset value also observes this cycle's VMA
> > + * modifications (ordered by the ACQUIRE on vma->vm_lock_seq in
> > + * vma_start_read()).
> > + */
> > +void __mm_reset_vma_seqcounts(struct mm_struct *mm)
> > +{
> > +	struct vm_area_struct *vma;
> > +	VMA_ITERATOR(vmi, mm, 0);
> > +
> > +	mmap_assert_write_locked(mm);
> > +	VM_WARN_ON_ONCE(mm->mm_lock_seq.sequence);
> > +
> > +	/*
> > +	 * Failing to reset means stale vma->vm_lock_seq values could result in
> > +	 * those VMAs becoming spuriously write locked when mm->mm_lock_seq
> > +	 * happens to match their values.
> > +	 *
> > +	 * This is problematic, as it causes the VMA write lock to not exclude
> > +	 * readers, which can result in concurrent readers while a VMA write
> > +	 * lock is held.
> > +	 *
> > +	 * Avoid this by resetting to an even value (indicates no write lock
> > +	 * held).
> > +	 *
> > +	 * Readers will either observe zero (not write locked) or the previous
> > +	 * value, so this is safe.
> > +	 */
> > +	for_each_vma(vmi, vma)
> > +		WRITE_ONCE(vma->vm_lock_seq, 0);
>
> I'm concerned by the possible latency when doing this to many VMAs. Do you
> have any numbers?

No, somebody schloppened a patch for a real issue and I haven't the time to do
even the things I need to do let alone 'here's a new task' stuff :)

However, this is a simple write to every VMA, done at the point the mmap write
lock is held with all VMA write locks dropped.

It was implemented such that:

* No VMA write lock is taken on the VMAs.
* VMA read locks can proceed.

I.e. it amounts to a loop over VMAs and a write to a field.

I don't think you could possibly do more to reduce latency here, and you
absolutely have to update this field across the board.

Under any realistic workloads this will occur at worst ~days intervals, often
far longer, and likely you will see quite some gaps between separate processes
experiencing it.

There's also an upper bound of vm.max_map_count per-process, so it can't explode
into something truly insane.

Most processes don't have that many VMAs, other than certain steam games :) so
it's hard to imagine there really would be that much latency here.

And the latency is occurring on one thread, which is performing an mmap unlock,
so nobody sane will put that on a hot path.

--
Cheers, Lorenzo