* Lorenzo Stoakes lorenzo.stoakes@oracle.com [251113 05:45]:
On Thu, Nov 13, 2025 at 12:04:19AM +0000, Matthew Wilcox wrote:
On Wed, Nov 12, 2025 at 03:06:38PM +0000, Lorenzo Stoakes wrote:
Any time the rcu read lock is dropped, the maple state must be invalidated. Resetting the address and state to MA_START is the safest course of action, which will result in the next operation starting from the top of the tree.
Since we all missed it I do wonder if we need some super clear comment saying 'hey if you drop + re-acquire RCU lock you MUST revalidate mas state by doing 'blah'.
I mean, this really isn't an RCU thing. This is also bad:
spin_lock(a); p = *q; spin_unlock(a); spin_lock(a); b = *p;
p could have been freed while you didn't hold lock a. Detecting this kind of thing needs compiler assistence (ie Rust) to let you know that you don't have the right to do that any more.
Right but in your example the use of the pointers is _realy clear_. In the mas situation, the pointers are embedded in the helper struct, there's a state machine, etc. so it's harder to catch this.
We could modify the above example to use a helper struct and the same problem would arise...
There's already a state machine embedded in it, and I think the confusing bit, at least for me, was a line of thinking like - 'oh there's all this logic that figures out what's going on and if there's an error rewalks and etc. - so it'll handle this case too'.
Obviously, very much wrong.
Generally I wonder if, when dealing with VMAs, we shouldn't just use the VMA iterator anyway? Whenever I see 'naked' mas stuff I'm always a little confused as to why.
I am not sure why this was left as maple state either. But translating it to the vma iterator would result in the same bug. The locking story would be the same. There isn't much to the vma iterator, it will just call the mas_ functions for you.
In other code, the maple state is used when we need to do special operations that would be the single user of a vma iterator function. I suspect this was the case here at some point.
I think one source of confusion for me with maple tree operations is - what to do if we are in a position where some kind of reset is needed?
So even if I'd realised 'aha we need to reset this' it wouldn't be obvious to me that we ought to set to the address.
I think that's a separate problem.
Sure but I think there's a broader issue around confusion arising around mas state and when we need to do one thing or another, there were a number of issues that arose in the past where people got confused about what to do with vma iterator state.
I think it's a difficult problem - we're both trying to abstract stuff here but also retain performance, which is a trade-off.
+++ b/mm/mmap_lock.c @@ -257,6 +257,7 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm, if (PTR_ERR(vma) == -EAGAIN) { count_vm_vma_lock_event(VMA_LOCK_MISS); /* The area was replaced with another one */
mas_set(&mas, address);I wonder if we could detect that the RCU lock was released (+ reacquired) in mas_walk() in a debug mode, like CONFIG_VM_DEBUG_MAPLE_TREE?
Dropping and reacquiring the RCU read lock should have been a big red flag. I didn't have time to review the patches, but if I had, I would
I think if you have 3 mm developers who all work with VMAs all the time missing this, that's a signal that something is confusing here :)
So the issue is we all thought dropping the RCU lock would be OK, and mas_walk(...) would 'somehow' do the right thing. See above for why I think perhaps that happened.
But again, I feel like we could replace the maple state with any helper struct and this could also be missed.
I'm not sure there's an easy way to remove this class of errors without changing the basic tooling to be rust or the like...
vma_start_read() is inherently complicated because of what it does without taking the mmap lock. Dealing with a potential failure/retry is equally messy.
The locking is impossible to do in a clean way since one caller does not take the rcu read lock itself, but may return without it held in many scenarios.
have suggested passing the mas down to the routine that drops the rcu read lock so it can be invalidated before dropping the readlock.
This would require changing vma_start_read(), which is called by both lock_vma_under_rcu() and lock_next_vma().
We could make them consistent and have lock_vma_under_rcu() do something like:
VMA_ITERATOR(vmi, mm, address);
...
rcu_read_lock(); vma = vma_start_read(&vmi);
And have vma_start_read() handle the:
if (!vma) { rcu_read_unlock(); goto inval; }
Case we have in lock_vma_under_rcu() now.
We'd need to keep:
vma = vma_next(vmi); if (!vma) return NULL;
In lock_next_vma().
Then you could have:
err: /* Reset so state is valid if reused. */ vmi_iter_reset(vmi); rcu_read_unlock();
In vma_start_read().
Assuming any/all of this is correct :)
I _think_ based on what Liam said in other sub-thread the reset should work here (perhaps not quite maximally efficient).
No, don't do that. If you want to go this route, use vma_iter_set() in the error label to set the address. Which means that we'll need to pass the vma iterator and the address into vma_star_read() from both callers.
And may as well add this in vma_start_read()..
err_unstable: vma_iter_set(&vmi, address);
If we risk perhaps relying on the optimiser to help us or hope no real perf impact perhaps we could do both by also having the 'set address' bit happen in lock_vma_under_rcu() also e.g.:
VMA_ITERATOR(vmi, mm, address);
...
retry: rcu_read_lock(); vma_iter_set(&vmi, address); vma = vma_start_read(&vmi);
lock_next_vma() also calls vma_iter_set() in the -EAGAIN case, so passing both through might make more sense.
Let me know if any of this is sane... :)
The locking on this function makes it virtually impossible to reuse for anything beyond the two users it has today. Passing the iterator down might remind people of what to do if the function itself changes. It does seem like the right way of handling this, since we can't clean up the locking.
Thanks, Liam