From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794517262; b=p67OTugTKZLaDO1MZDIHLPSaeno1WWK8myxq01qsvFI6uc3KLkKn3xC6Lxhh1ABQ6r42 cnTu3mtDLBvij8IMaJnVXXWZnNHR9HXrDfnHdCs3fqvm0z+QuWV9xGQTmlXFRr4oij8rZ A29YWTxdEh1Xd0QGShOvlYh3k632E/Mt3zEOeFXX79bgbJgoQ8u5FYqTCRVQMaAE38cH6 IEPuMUuKCQ6Lb1Zu5xFPx31Xmj07uZ68m0YN6kpSKGBNBMkPk4tj/O+eU5ABDWsd8SK05 z3THk8giarD13JZ4UK+1Sc8I7zqyilArIV0cO8iyqoY63z+7iff+4s37T3Q2aPSXpIA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794517262; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=n9AC9m/U5sc5j+SMiPjyEVWLeF4QDi/C8e8aFNL1ddU=; b=bqkuc47RkcxZ5hJ/tBA84QvUUM8jKlQAtcFxVfOzJTzoWetWmiIK9pxvP4Xd5OJgp+G2 zWbzovAjfwcxeVAa+XGtO6IORV2/NKeEh2wxDBl7Waml/ILM8Fiy7oqjwpiUSk8yxkb04 bZeJNGyFKF00b67eudysyV57n1uFkRxyISudiE7V1CvyFnCc2XW8aNkMD1rmAbHXo8oOy PGtNx4L+/bbhfA3AsgLEHW6GIxknGwxk6p5JnTJuPPJSVHA6s31Y8L+cGWGnIgRClUT4c 6i2iiKwtGJizH4xJFJLb9hKQW91i4dIGwJxMY7KSPGjqjJEKHS0GVstuVGgovvWm+cw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=czlrVsHD; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E352A606A31C for ; Thu, 12 Nov 2026 21:01:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=czlrVsHD Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91A3D1F000C4; Thu, 12 Nov 2026 21:01:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794517261; bh=n9AC9m/U5sc5j+SMiPjyEVWLeF4QDi/C8e8aFNL1ddU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=czlrVsHDi9BpLJap0DPaA6g3B4sERCQudTkxrPW4HThhxgl16mMQTFQxMShU2V9bH re4Cf4t7JVau28VfWRKEXtYXuafrJqtzuiXB3nlgcwaG25XLJAjhkIytgdmQO0Ccyl BxzJSXN5lLNKGp5ujisn8JIE0qah0jA7o0tq9J7tJOXF/XqQVnyJIz/8/ucisb5apX rKPO4QRURwbcivZDmkrzTWBHkdJcnASpKz5J/IdPiX1bxzpiyYvNfkPcNqP8bpnW+O vMvI209ZQ7iUmEkO0OzOPn8qsdjjAZTWryIrbRigYGDqN0v5p0j2+eVrQGLaQ5kzUS bSjtpukbIKnCA== From: Sasha Levin To: stable@vger.kernel.org Cc: Josef Bacik , "Lorenzo Stoakes (ARM)" , Pedro Falcato , Muhammad Usama Anjum , Lance Yang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.6.y] mm/mremap: fix moving PUD leaves Date: Thu, 12 Nov 2026 16:00:59 -0500 Message-ID: <20261112205952.3707803-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109201341-failed-6.6-440c8779757f@kernel.org> References: <20261109201341-failed-6.6-440c8779757f@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Josef Bacik [ Upstream commit 440c8779757f09f290770b1d361dc1516a9d0b3e ] pud_none_or_clear_bad() only really works on page tables. PUD leaves confuse the check and make us clear the page table entry and print a warning. Since commit aed877c2b4257 ("device/dax: properly refcount device dax pages when mapping"), this also leaks device-DAX folio references, mapcounts and RSS accounting, resulting in "Bad rss-counter state" warnings on exit. Allow PUD leaves in get_old_pud(). If a PUD leaf cannot be moved as a whole or the move fails, split it. This unmaps it with proper accounting instead of treating the leaf entry as a PMD table. Keep using pud_trans_huge() for now, in the future this code should be cleaned up to just check for PUD leaves. Fix generated by an LLM and sent by Josef Bacik in private. Fixes: a00cc7d9dd93 ("mm, x86: add support for PUD-sized transparent hugepages") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik Reviewed-by: Lorenzo Stoakes (ARM) [ david: fallthrough after splitting ] Reviewed-by: Pedro Falcato Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-32-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Signed-off-by: David Hildenbrand (Arm) [ sashal: adapted PUD handling to use explicit helper arguments and retain separate pud_devmap() checks ] Signed-off-by: Sasha Levin --- mm/mremap.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/mm/mremap.c b/mm/mremap.c index 0739a31b54eed..b0caaa96a3f1a 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -47,7 +47,8 @@ static pud_t *get_old_pud(struct mm_struct *mm, unsigned long addr) return NULL; pud = pud_offset(p4d, addr); - if (pud_none_or_clear_bad(pud)) + if (!pud_trans_huge(*pud) && !pud_devmap(*pud) && + pud_none_or_clear_bad(pud)) return NULL; return pud; @@ -565,12 +566,11 @@ unsigned long move_page_tables(struct vm_area_struct *vma, if (!new_pud) break; if (pud_trans_huge(*old_pud) || pud_devmap(*old_pud)) { - if (extent == HPAGE_PUD_SIZE) { - move_pgt_entry(HPAGE_PUD, vma, old_addr, new_addr, - old_pud, new_pud, need_rmap_locks); - /* We ignore and continue on error? */ + if (extent == HPAGE_PUD_SIZE && + move_pgt_entry(HPAGE_PUD, vma, old_addr, new_addr, + old_pud, new_pud, need_rmap_locks)) continue; - } + split_huge_pud(vma, old_pud, old_addr); } else if (IS_ENABLED(CONFIG_HAVE_MOVE_PUD) && extent == PUD_SIZE) { if (move_pgt_entry(NORMAL_PUD, vma, old_addr, new_addr, -- 2.53.0