Re: [PATCH] sh: mm: fix double mmap_lock release on SIGBUS and SIGSEGV faults

[Karl Mehltretter]

On Mon, Sep 28, 2026 at 02:19:37AM +0100, Karl Mehltretter wrote:
> A process that survives the signal keeps an mm with a corrupted
> mmap_lock. With CONFIG_DEBUG_RWSEMS and lockdep, stress-ng --msync
> (which catches SIGBUS) reports within a minute:
> 
>   WARNING: bad unlock balance detected!
>   stress-ng-msync/54 is trying to release lock (&mm->mmap_lock) at:
>   mm_fault_error+0xd0/0x16c
>   ...
>   DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffff00, ...
> 
> and without them, find_vma() warns that mmap_lock is not held right
> after it was taken. Seen on a custom QEMU model of the SH7785LCR, in
> both 29-bit and 32-bit mode.
> 
> Drop the release from do_sigbus(), whose only caller is
> mm_fault_error(), and use bad_area_nosemaphore() for VM_FAULT_SIGSEGV.
> bad_area() has no users left and goes away.
> 
> Fixes: fb027ada051a ("sh/mm: use helper fault_signal_pending()")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> ---
> 
> Notes:
>     Tested in QEMU on a custom SH7785LCR model, not on hardware.
>     Reproducer: Debian sh4 stress-ng 0.22.01 --msync
> 

A friendly ping on this fix.

I have now also reproduced it with stock QEMU 11.0.2 on the upstream
r2d machine (SH7751R): the unpatched kernel warns after a caught SIGBUS,
while the patched kernel does not.

Also, the stress-ng command in the review notes is incorrect. Use:

  stress-ng --msync 1 --timeout 60s

Thanks,
Karl