From: Lance Yang <lance.yang@linux.dev>
To: david@kernel.org
Cc: akpm@linux-foundation.org, liam@infradead.org, ljs@kernel.org,
vbabka@kernel.org, jannh@google.com, pfalcato@suse.de,
muchun.song@linux.dev, osalvador@suse.de, linmiaohe@huawei.com,
nao.horiguchi@gmail.com, agl@us.ibm.com, mel@csn.ul.ie,
riel@surriel.com, peterx@redhat.com, kas@kernel.org,
rppt@kernel.org, josef@toxicpanda.com, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH 10/10] mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA
Date: Sun, 18 Oct 2026 16:34:31 +0800 [thread overview]
Message-ID: <20261018083431.15699-1-lance.yang@linux.dev> (raw)
In-Reply-To: <20261015-urgent_fixes-v1-10-42796911043b@kernel.org>
On Thu, Oct 15, 2026 at 06:07:16PM +0200, David Hildenbrand (Arm) wrote:
>In case we fail to move the page tables, for example, because we fail
>to allocate a page table, we actually keep the old VMA.
>
>Calling fixup_hugetlb_reservations() on the old VMA is wrong. Fix it
>by just calling it on the VMA that will be removed.
>
>The user-visible impact is that the VMA loses its reservations, meaning
>that the existing reservations get stranded (leaked) and new hugetlb folios
>that are getting allocated in the VMA cannot make use of the
>reservations, failing these allocations.
>
>Fixes: b714ccb02a76 ("mm/mremap: complete refactor of move_vma()")
>Cc: stable@vger.kernel.org
>Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
>Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
>---
Reviewed-by: Lance Yang <lance.yang@linux.dev>
next prev parent reply other threads:[~2026-10-18 8:34 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 16:07 [PATCH 00/10] mm: various (urgent?) fixes David Hildenbrand (Arm)
2026-10-15 16:07 ` [PATCH 01/10] mm/vma: don't leak the commit charge on mmap failure David Hildenbrand (Arm)
2026-10-15 17:54 ` Pedro Falcato
2026-10-15 18:53 ` David Hildenbrand (Arm)
2026-10-16 8:34 ` Jose A. Perez de Azpillaga
2026-10-18 6:06 ` Lance Yang
2026-10-15 16:07 ` [PATCH 02/10] mm/hugetlb: fix use-after-free of a new anon folio David Hildenbrand (Arm)
2026-10-16 7:16 ` Muchun Song
2026-10-18 6:16 ` Lance Yang
2026-10-15 16:07 ` [PATCH 03/10] mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte() David Hildenbrand (Arm)
2026-10-16 7:18 ` Muchun Song
2026-10-18 6:22 ` Lance Yang
2026-10-15 16:07 ` [PATCH 04/10] mm/hugetlb: unmap the page where the other VMA maps it David Hildenbrand (Arm)
2026-10-16 9:49 ` Muchun Song
2026-10-18 6:43 ` Lance Yang
2026-10-15 16:07 ` [PATCH 05/10] mm/hugetlb: don't clear the resv_map of a VMA whose lock is held David Hildenbrand (Arm)
2026-10-16 9:52 ` Muchun Song
2026-10-18 6:53 ` Lance Yang
2026-10-15 16:07 ` [PATCH 06/10] mm/hugetlb: fix endless write fault on a leftover uffd bit David Hildenbrand (Arm)
2026-10-15 20:10 ` Lorenzo Stoakes (ARM)
2026-10-18 7:11 ` Lance Yang
2026-10-15 16:07 ` [PATCH 07/10] mm/hugetlb: tolerate uffd bits set without uffd for PROT_NONE PTEs David Hildenbrand (Arm)
2026-10-15 20:13 ` Lorenzo Stoakes (ARM)
2026-10-18 7:59 ` Lance Yang
2026-10-15 16:07 ` [PATCH 08/10] mm/hugetlb: tolerate UFFD_WP markers outside uffd-wp VMAs David Hildenbrand (Arm)
2026-10-15 19:47 ` Lorenzo Stoakes (ARM)
2026-10-18 8:07 ` Lance Yang
2026-10-15 16:07 ` [PATCH 09/10] mm/hugetlb: don't leave a uffd-wp marker when zapping an RWP entry David Hildenbrand (Arm)
2026-10-15 19:45 ` Lorenzo Stoakes (ARM)
2026-10-18 8:21 ` Lance Yang
2026-10-15 16:07 ` [PATCH 10/10] mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA David Hildenbrand (Arm)
2026-10-16 9:53 ` Muchun Song
2026-10-18 8:34 ` Lance Yang [this message]
2026-10-16 7:15 ` [PATCH 00/10] mm: various (urgent?) fixes Muchun Song
2026-10-16 7:40 ` David Hildenbrand (Arm)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261018083431.15699-1-lance.yang@linux.dev \
--to=lance.yang@linux.dev \
--cc=agl@us.ibm.com \
--cc=akpm@linux-foundation.org \
--cc=david@kernel.org \
--cc=jannh@google.com \
--cc=josef@toxicpanda.com \
--cc=kas@kernel.org \
--cc=liam@infradead.org \
--cc=linmiaohe@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=mel@csn.ul.ie \
--cc=muchun.song@linux.dev \
--cc=nao.horiguchi@gmail.com \
--cc=osalvador@suse.de \
--cc=peterx@redhat.com \
--cc=pfalcato@suse.de \
--cc=riel@surriel.com \
--cc=rppt@kernel.org \
--cc=stable@vger.kernel.org \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.