On Tue, Nov 10, 2026 at 11:24 AM Hao Ge <[email protected]> wrote: > > kmsan_vmap_pages_range_noflush() first maps the shadow pages and then > the origin pages. If the second mapping fails, the first one is left > mapped, and the callers do not roll it back. The next vmap of the > same metadata range hits the stale PTEs again and fails with a > WARN_ON() and -EBUSY in vmap_pages_pte_range(). > > Undo the shadow mapping on that error path, the same way > kmsan_ioremap_page_range() cleans up after a partial failure. > __vunmap_range_noflush() only clears the PTEs; nothing has touched > the shadow mapping, so no TLB flush is needed. > > Fixes: 47ebd0310e89 ("mm: kmsan: handle alloc failures in > kmsan_vmap_pages_range_noflush()") > Cc: [email protected] > Reviewed-by: Suren Baghdasaryan <[email protected]> > Reviewed-by: Dev Jain <[email protected]> > Signed-off-by: Hao Ge <[email protected]> > --- > mm/kmsan/shadow.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/mm/kmsan/shadow.c b/mm/kmsan/shadow.c > index 0c88d89bf0d6..2166086d3dc3 100644 > --- a/mm/kmsan/shadow.c > +++ b/mm/kmsan/shadow.c > @@ -258,6 +258,10 @@ int kmsan_vmap_pages_range_noflush(unsigned long start, > unsigned long end, > o_pages, page_shift); > kmsan_leave_runtime(); > if (mapped) { > + /* Undo the shadow mapping set up above. */ > + kmsan_enter_runtime(); > + __vunmap_range_noflush(shadow_start, shadow_end);
Sorry, there is a problem here. You introduce "can_resched" check to avoid calling cond_resched() later in the series (in patch #7), but at this point __vunmap_range_noflush() can be called with GFP flags which do not allow blocking. Before recent Ulad's change called "kmsan: remove hard-coded GFP_KERNEL flags" this function was called only with GPF_KERNEL but now that's not the case. I think you can move introduction of can_resched flag into this patch. > + kmsan_leave_runtime(); > err = mapped; > goto ret; > } > -- > 2.25.1 >
