From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794517557; b=r6ktnZXAKfgsrVOJ1Zq9UvrX7tUA1e9DOfZFuxaoNOgDr9MrVccEjNwinT4o/2ulDx4D nKThWuc3xwNeUTr/sq5OcnZmGcMJbtq3ky8Ix3zhe199n5aVFKdra2i0vlHOlYPcZ710x 8tv28aCv/4GC0L8mbi+xiFsu2xNwE+icsj5YE401f3yWXLXJ4rOAywLzgATC5QxuZ+x7C waYaJ0P8CAK4c966ZUMf1NFY8R5jvE7RzKq5HZ1slZhEG8NQRUyaMbWsNXCyJqzqbCDW9 7OMpV4NU58+WPL5yR3N7A8hQ9TslUdF5Fgg0i8DT7qJyaYjc+M7Z+9gZSWyxFVndyhA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794517557; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=9O4yP8/nfU3JZ3lTxf1NxPoOTQpA7q0XRRCwNFnHkzM=; b=Xo02OgOxEj8cj0gPlr4PLGtardFN3WIBhG9dNfBzdwI2T7fZz8XjwqJtCKdBFuvd3a1i qJcTBlV9KUlv8a5g2sUqRqBliM2BCtLpJzJCB6lbU48B47zovxrsP0qPszieUQBzZvPie VV0uZncxVrP505FIoi+VLC/8yPgJt6snOGazKSYqsl7Mw9UIr6NmJtprrJMPXomS8jOUt 8MYffPgGaLnYPp078b/6N2Fy7Bs9+yOvZZlSkj/xiMJteXAbtWF162FiOjLrlDnPYa/gq fIPgDIgJezr6NLwdRBfMBxMEmPtzLwU/uPant1xlFIKm2WLsiOXBMzBaYEGbRyGmrfw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=AchTtJKn; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F9C6606A31C for ; Thu, 12 Nov 2026 21:05:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=AchTtJKn Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A1F81F000C4; Thu, 12 Nov 2026 21:05:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794517556; bh=9O4yP8/nfU3JZ3lTxf1NxPoOTQpA7q0XRRCwNFnHkzM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AchTtJKnZrKOaWnghbF0DKgyW4Lxl+MjBSXoKC+1kxN1rR53ymhe3bFA7YTga+Isz vY4PoC6YKySZd50YYBbyEauaLgcwGlwC9FvcZUQz+JhLld/QkIH2rTY2ajsdThxdPx BaxRF7uMJP18R6OPpW8UNAnihCVgvkTM63j3Nsg0dD7yBQmHz2bSvNyPSbvtPhaqYk NVYyirl5wNUkaD2iQ9qKOsq5MSUCMk7YzMlJJES38OMZyXBULK7wgF9W4/mPJGDDwg fEzf5lfOJPGsoDN8r0j5dbOj0eE4usk9QUEH4JPOBSwK58g7wJi+hn0+BwD928Kybr 4FmZD2cEsfTxg== From: Sasha Levin To: stable@vger.kernel.org Cc: Josef Bacik , "Lorenzo Stoakes (ARM)" , Pedro Falcato , Muhammad Usama Anjum , Lance Yang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.1.y] mm/mremap: fix moving PUD leaves Date: Thu, 12 Nov 2026 16:05:54 -0500 Message-ID: <20261112210452.3756418-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109201838-failed-6.1-440c8779757f@kernel.org> References: <20261109201838-failed-6.1-440c8779757f@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Josef Bacik [ Upstream commit 440c8779757f09f290770b1d361dc1516a9d0b3e ] pud_none_or_clear_bad() only really works on page tables. PUD leaves confuse the check and make us clear the page table entry and print a warning. Since commit aed877c2b4257 ("device/dax: properly refcount device dax pages when mapping"), this also leaks device-DAX folio references, mapcounts and RSS accounting, resulting in "Bad rss-counter state" warnings on exit. Allow PUD leaves in get_old_pud(). If a PUD leaf cannot be moved as a whole or the move fails, split it. This unmaps it with proper accounting instead of treating the leaf entry as a PMD table. Keep using pud_trans_huge() for now, in the future this code should be cleaned up to just check for PUD leaves. Fix generated by an LLM and sent by Josef Bacik in private. Fixes: a00cc7d9dd93 ("mm, x86: add support for PUD-sized transparent hugepages") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik Reviewed-by: Lorenzo Stoakes (ARM) [ david: fallthrough after splitting ] Reviewed-by: Pedro Falcato Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-32-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Signed-off-by: David Hildenbrand (Arm) [ sashal: adapted PUD handling to explicit VMA and address arguments while preserving pud_devmap() support ] Signed-off-by: Sasha Levin --- mm/mremap.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/mm/mremap.c b/mm/mremap.c index ec66e7be8afea..cc0eb5489e89a 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -47,7 +47,8 @@ static pud_t *get_old_pud(struct mm_struct *mm, unsigned long addr) return NULL; pud = pud_offset(p4d, addr); - if (pud_none_or_clear_bad(pud)) + if (!pud_trans_huge(*pud) && !pud_devmap(*pud) && + pud_none_or_clear_bad(pud)) return NULL; return pud; @@ -547,12 +548,11 @@ unsigned long move_page_tables(struct vm_area_struct *vma, if (!new_pud) break; if (pud_trans_huge(*old_pud) || pud_devmap(*old_pud)) { - if (extent == HPAGE_PUD_SIZE) { - move_pgt_entry(HPAGE_PUD, vma, old_addr, new_addr, - old_pud, new_pud, need_rmap_locks); - /* We ignore and continue on error? */ + if (extent == HPAGE_PUD_SIZE && + move_pgt_entry(HPAGE_PUD, vma, old_addr, new_addr, + old_pud, new_pud, need_rmap_locks)) continue; - } + split_huge_pud(vma, old_pud, old_addr); } else if (IS_ENABLED(CONFIG_HAVE_MOVE_PUD) && extent == PUD_SIZE) { if (move_pgt_entry(NORMAL_PUD, vma, old_addr, new_addr, -- 2.53.0