Re: [PATCH] sh: mm: fix double mmap_lock release on SIGBUS and SIGSEGV faults

[John Paul Adrian Glaubitz]

Hi Karl,

On Fri, 2026-10-16 at 11:46 +0200, Karl Mehltretter wrote:
> On Mon, Sep 28, 2026 at 02:19:37AM +0100, Karl Mehltretter wrote:
> > A process that survives the signal keeps an mm with a corrupted
> > mmap_lock. With CONFIG_DEBUG_RWSEMS and lockdep, stress-ng --msync
> > (which catches SIGBUS) reports within a minute:
> > 
> >   WARNING: bad unlock balance detected!
> >   stress-ng-msync/54 is trying to release lock (&mm->mmap_lock) at:
> >   mm_fault_error+0xd0/0x16c
> >   ...
> >   DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffff00, ...
> > 
> > and without them, find_vma() warns that mmap_lock is not held right
> > after it was taken. Seen on a custom QEMU model of the SH7785LCR, in
> > both 29-bit and 32-bit mode.
> > 
> > Drop the release from do_sigbus(), whose only caller is
> > mm_fault_error(), and use bad_area_nosemaphore() for VM_FAULT_SIGSEGV.
> > bad_area() has no users left and goes away.
> > 
> > Fixes: fb027ada051a ("sh/mm: use helper fault_signal_pending()")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: LLM
> > Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> > ---
> > 
> > Notes:
> >     Tested in QEMU on a custom SH7785LCR model, not on hardware.
> >     Reproducer: Debian sh4 stress-ng 0.22.01 --msync
> > 
> 
> A friendly ping on this fix.
> 
> I have now also reproduced it with stock QEMU 11.0.2 on the upstream
> r2d machine (SH7751R): the unpatched kernel warns after a caught SIGBUS,
> while the patched kernel does not.
> 
> Also, the stress-ng command in the review notes is incorrect. Use:
> 
>   stress-ng --msync 1 --timeout 60s

I'm trying to get this reviewed in the weekend. I'm not forgetting about
patches as I'll always check what's on patchwork and pick everything up
that I haven't taken yet [1].

Adrian

> [1] https://patchwork.kernel.org/project/linux-sh/list/

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913