[PATCH] mm: bypass datarace check

From: Guilherme Giacomo Simoes

Date: Wed Sep 09 2026 - 08:17:06 EST


Despiste kcsan point to a possible race condition problem, this is a
safe race condition due the access memory ordering, since
spin_lock(&mm->page_table_lock) have ACQUIRE semantics and ensure the
ordering mapping.

Create a new function called vma_is_faulted(), that return a
data_race(vma->anon_vma) to bypass kcsan

Signed-off-by: Guilherme Giacomo Simoes <trintaeoitogc@xxxxxxxxx>
---
mm/memory.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 6b8280cfc1db..d85d67927400 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3800,6 +3800,25 @@ static inline vm_fault_t vmf_can_call_fault(const struct vm_fault *vmf)
return VM_FAULT_RETRY;
}

+/**
+ * vma_is_faulted - check if a vma has been faulted
+ * @vma: the vma to check
+ *
+ * This is a lockless access that may race with __anon_vma_prepare().
+ * The race is safe because:
+ * - The fault handler ensures that the mapping of memory is ordered.
+ * - If we read NULL, the caller will re-check
+ * - The page_table_lock provides ACQUIRE semantics for memory ordering
+ *
+ * Return: true if vma->anon_vma is non-NULL, false otherwise
+ */
+static inline bool vma_is_faulted(const struct vm_area_struct *vma)
+{
+ /* Lockless check - safe because we re-validate under page_table_lock */
+ return data_race(vma->anon_vma);
+}
+
+
/**
* __vmf_anon_prepare - Prepare to handle an anonymous fault.
* @vmf: The vm_fault descriptor passed from the fault handler.
@@ -3819,8 +3838,7 @@ vm_fault_t __vmf_anon_prepare(struct vm_fault *vmf)
{
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret = 0;
-
- if (likely(vma->anon_vma))
+ if (likely(vma_is_faulted(vma)))
return 0;
if (vmf->flags & FAULT_FLAG_VMA_LOCK) {
if (!mmap_read_trylock(vma->vm_mm))
--
2.52.0