Thread (5 messages) flat view 5 messages, 4 authors, 11d ago

Re: [PATCH v2] mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish

From: Jann Horn <jannh@google.com>
Date: 2026-09-09 15:26:29

On Tue, Sep 8, 2026 at 2:57 PM Jinjiang Tu [off-list ref] wrote:
quoted hunk ↗ jump to hunk
diff --git a/mm/rmap.c b/mm/rmap.c
index d1819fd69938..f3b21aaa34ee 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -209,7 +209,11 @@ int __anon_vma_prepare(struct vm_area_struct *vma)
        /* page_table_lock to protect against threads */
        spin_lock(&mm->page_table_lock);
        if (likely(!vma->anon_vma)) {
-               vma->anon_vma = anon_vma;
+               /*
+                * Make anon_vma fields visible before anon_vma is published.
+                * Paired with an address dependency in reusable_anon_vma().
+                */
+               smp_store_release(&vma->anon_vma, anon_vma);
Yes, this should go in. There are remaining theoretical issues (we
really should also be using READ_ONCE() in places like unuse_mm(), see
<https://lore.kernel.org/all/20230726214103.3261108-4-jannh@google.com/ (local)>),
but this is the important fix.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help