Re: [PATCH] mm: bypass datarace check

[Lorenzo Stoakes (ARM)]

On Wed, Sep 09, 2026 at 06:29:43PM -0300, Guilherme Giacomo Simoes wrote:
> "Lorenzo Stoakes (ARM)" <ljs@xxxxxxxxxx> wrote:
> > I started review below but honestly this patch is confused in multiple ways
> > and it's not entirely clear you really understand what's going on here.
> I can be wrong, but was understand that due the order that the code was write
> probably the data race problem will not happen.
>
> The reader (__vmf_anon_prepare()):
> ```
> if (likely(vma->anon_vma)) // lockless check
> 	return 0;              // OK
>
> // if the check above fail
>
> if (!__anon_vma_prepare(vma)) // called the __anon_vma_prepare
>     return 0;
>
> ```
>
> inside __anon_vma_prepare()
> ```
> spin_lock(&mm->page_table_lock); //ACQUIRE semantics
>
> if (likely(!vma->anon_vma)) // re-check under lock
>     // ... alloc all
>
> spin_unlock(&mm->page_table_lock);
> ```
>
> This is safe because, if `if (likely(vma->anon_vma))` return NULL, we will got
> the mmap_lock and then page_table_lock.

I mean yes but it's complicated (the anon rmap is like this all over, it's
complicated for _everybody_ which is part of why I am working to change it).

There are 2 cases basically for _attached_ VMAS - mmap/vma write lock held
(you are the only thread that has access to the vma by definition) or mmap read
lock held in which case it's an optimistic check that must be re-checked with
mm->page_table_lock held to get exclusivity.

And it turns out that _all of mm_ screwed up some aspect of this also see:

https://lore.kernel.org/all/20260908122924.554373-1-tujinjiang@xxxxxxxxxx/

>
> The critical re-check inside __anon_vma_prepare() happens under spin_lock(...)
> with has ACQUIRE semantics.
> With ACQUIRE semantics , the cpu (or compiler, I don't know) cannot reorder the
> memory access acress the lock boundary.
>
> I'm right?

Well the issue with acquire/release semantics is that instructions that are
outside of a critical section can be re-ordered within the critical section.

See my analysis here:

https://lore.kernel.org/all/ap6ybQeSg_rrmC95@gremlin/

(Again we were all confused about it! Memory barriers are very counterintuitive)

>
> >
> > It's also basically implementing what we suggested.
> >
> > So at this point I think it's easier if I send the patch with a:
> >
> > Reported-by:
> > Closes:
> >
> > tag -> you, this patch.
> >
> > Thanks!
> ok, no problem

Thanks, sorry about that but I feel in general, it's super sensitive and
confusing this and it's the best way in this case.

>
> > On Wed, Sep 09, 2026 at 08:57:23AM -0300, Guilherme Giacomo Simoes wrote:
> > > Despiste kcsan point to a possible race condition problem, this is a
> >
> > Typos  -> Despite, point -> points
> Hmm, is not the first time that any person points my english mistakes... I will
> improve this point, thank you for yout jints

No worries, I make typos all the time and have no excuses for it :)

>
> > > safe race condition due the access memory ordering, since
> > > spin_lock(&mm->page_table_lock) have ACQUIRE semantics and ensure the
> > > ordering mapping.
> >
> > This sentence is a bit confused. Acquire semantics mean absolutely nothing
> > unless paired with another operation and etc. etc.
> missing full stop, my bad.
>
> > Needs a:
> >
> > Suggested-by: Pedro Falcato <pfalcato@xxxxxxx>
> Yeah, I forget
>
> >
> > Also:
> >
> > Assisted-by: LLM?
> > The list below reads very LLM-ish so I have to ask did you use one etc. etc.
> >
> > https://docs.kernel.org/process/coding-assistants.html
> >
> > Perhaps given I am suggesting a lot here a:
> I don't have installed any llm (not even cursor), I just use a deepseek,
> chatgpt, etc.. to clear up a few questions. (maybe I should start use this to
> help me with english too)

Ah sorry, there's such a wave of it and the list seemed that way, I guess
because you had it help on the language it flagged it up :)

>
> > There are other places where this check is done and etc.
> I would should checked this, sorry. Anxiety.

Understandable, this is delicate stuff!

>
> Thanks Lorenzo for your review, help and patience

No worries! :)


--
Cheers, Lorenzo