From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794050929; b=siMVEo+wp3tql+4oz1lMRYyVprXa8juF/5MfcZmWWrIO5c8TyrcocN8TE76PsIJFyo5J Le2WuTettj9wyUynPLCzDJVnfDz7aXFn6gUND+rhRjz5GxQS3gCX32nGnFTBoZd7nbuTZ GsvyHoXcXpt7qUu3gtmPKErL6JKnd/bpz42EECrDvf4xuBUCB2lKnxZN38yXiWm4VG0KL bPWrWfJjfK1t3lFLKjkB3ToyFPoH9bwksrddQdyonbkRabJqH78wfBESqHZMCdEVtUC/j wgOm76M3cRwczctTGlrNwVhZAL9Y5dbDfovIT8HcxE+IvIii6Ech+DO+JQDYBbP0o+Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794050929; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=X6ErNIke0D47EGTyymDPQTFtJzVKE4yZxGz8N8Gf5ow=; b=P640DIlvur1IGSdXfNN6to/DpbblyLzTocOLcdaLVy9XIIwVOczOU/vJpCXQvnmTbSB8 SWfDOtERMAp/Bfx6CbmSTkmEXwMFhbhgZ+hFqRTKIk9Qxdppo/5Lr1jd/YXHy4GhFkMjH gAAlK6mRp3QtgB/T62LuXKof7msIU7D8ldfvgGl+0GCshTNtS67YMKU/y1jzWpI7p5mXA spjjHId5QTYempEQvKpxOeNXqrtRQF59kOyJ3lv/PM3flldnQksdf8XGpQdVaVh+FQz9u zNWWnu064aZhUhJFnworEkw9sIhGGYLMJYo6ISgNpuXyQjw0baDp9JmXX0qMC7oDYVA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b="RjFX/q6F"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1728606D80D for ; Sat, 7 Nov 2026 11:28:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=RjFX/q6F Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A12D1F008A2; Sat, 7 Nov 2026 11:28:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794050928; bh=X6ErNIke0D47EGTyymDPQTFtJzVKE4yZxGz8N8Gf5ow=; h=From:To:Cc:Subject:Date; b=RjFX/q6FC2LQ2dKOBy4S98gfrW3HCJ1v7oz/gS9ppWLyTDsN2Lz4zklbrZ0gurW0U UG8iapRZsUSKZLAqID2CU57Vi/f41UseSPwp983U5d9HSFum3ZgZSBL5+uxVza8Om6 tXYzwxxFIz0IBbK+LdasLt8HFPvCRu4VJlAh/0Acjr/WbSfhB35yhjzV5bh2Mcsxq3 FJ7Do+2oDtMjm5RWuZ+5YHgjnAsd0c3BlJj9YGHLYk6/tz7RyUTQ3rlsPYbR23I+BE y4tjMv1owArGlrW3T1v3s9txS5BU3wnoWe9UT61S7brT5joroA1xj/t4J9q3F0DHEA 3SCLe/V9y6Hmw== From: Sasha Levin To: kylebot@openai.com, akpm@linux-foundation.org, david@kernel.org, ljs@kernel.org, riel@surriel.com, liam@infradead.org, vbabka@kernel.org, harry@kernel.org, jannh@google.com, lance.yang@linux.dev Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] mm/page_vma_mapped: continue past nonmatching huge PMDs" failed to apply to 5.10-stable tree Date: Sat, 7 Nov 2026 06:28:46 -0500 Message-ID: <20261107062846-failed-5.10-1a2993227e8a@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 1a2993227e8a27fc4cdea305bbdae82d290bc885 # git commit -s git send-email --to '' --in-reply-to '20261107062846-failed-5.10-1a2993227e8a@kernel.org' --subject-prefix 'PATCH 5.10.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From 1a2993227e8a27fc4cdea305bbdae82d290bc885 Mon Sep 17 00:00:00 2001 From: Kyle Zeng Date: Thu, 15 Oct 2026 18:15:49 -0700 Subject: [PATCH] mm/page_vma_mapped: continue past nonmatching huge PMDs A PTE-mapped large folio can straddle PMD boundaries after an unaligned mremap(). If the first part is discarded and replaced with an unrelated huge PMD, page_vma_mapped_walk() stops instead of looking for the rest of the folio in subsequent PMDs. This also affects migration entries. A walk that stops at an unrelated huge PMD can leave migration PTEs behind when migration or an anonymous folio split restores the mappings. Those entries do not hold mapping references and can outlive the source folio. This issue can lead to memory corruption and I have a reproducer for it. Skip the current PMD rather than ending the walk on a flag or PFN mismatch. Do the same if the PMD became nonpresent before the locked recheck. Release the PMD lock, clear the per-PMD state and advance with step_forward(), so the existing range limit controls termination. This covers present, migration and device-private huge PMDs while preserving the matching-PMD and split-to-PTE paths. Link: https://lore.kernel.org/20261016011549.61146-1-kylebot@openai.com Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()") Signed-off-by: Kyle Zeng Signed-off-by: Andrew Morton Acked-by: David Hildenbrand (Arm) Assisted-by: LLM Cc: Lorenzo Stoakes Cc: Rik van Riel Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Harry Yoo Cc: Jann Horn Cc: Lance Yang Cc: --- mm/page_vma_mapped.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c index 8408aee7571b5..e6b6170c2f4f7 100644 --- a/mm/page_vma_mapped.c +++ b/mm/page_vma_mapped.c @@ -265,28 +265,28 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) softleaf_t entry; if (!(pvmw->flags & PVMW_MIGRATION)) - return not_found(pvmw); + goto next_pmd; entry = softleaf_from_pmd(pmde); if (!check_pmd(softleaf_to_pfn(entry), pvmw)) - return not_found(pvmw); + goto next_pmd; return true; } else if (pmd_is_device_private_entry(pmde)) { softleaf_t entry; if (pvmw->flags & PVMW_MIGRATION) - return not_found(pvmw); + goto next_pmd; entry = softleaf_from_pmd(pmde); if (!check_pmd(softleaf_to_pfn(entry), pvmw)) - return not_found(pvmw); + goto next_pmd; return true; } else if (!pmd_present(pmde)) { - return not_found(pvmw); + goto next_pmd; } if (likely(pmd_trans_huge(pmde))) { if (pvmw->flags & PVMW_MIGRATION) - return not_found(pvmw); + goto next_pmd; if (!check_pmd(pmd_pfn(pmde), pvmw)) - return not_found(pvmw); + goto next_pmd; return true; } /* THP/device-private pmd was split under us: handle on pte level */ @@ -299,8 +299,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) (pvmw->nr_pages >= HPAGE_PMD_NR)) sync_with_folio_pmd_zap(mm, pvmw->pmd); - step_forward(pvmw, PMD_SIZE); - continue; + goto next_pmd; } if (!map_pte(pvmw, &pmde, &ptl)) { if (!pvmw->pte) @@ -343,6 +342,17 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) pvmw->ptl = ptl; } goto this_pte; +next_pmd: + /* + * A large folio can be PTE-mapped across PMDs, so a + * nonmatching PMD does not end the walk. + */ + if (pvmw->ptl) { + spin_unlock(pvmw->ptl); + pvmw->ptl = NULL; + } + pvmw->pmd = NULL; + step_forward(pvmw, PMD_SIZE); } while (pvmw->address < end); return false; -- 2.53.0