From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590455; b=A4yd5SBew1rG16ahUSWgn3FrDFm51MKCoGXGjhWgp/gPDTvKqMt+kS2W37LbCzZ7lfrz WN9/PFRQ3Y5x4Dqu5/FqtZ5Z44dWw7wgjAMXl7nUtAAU95GhaQSZnjRjl/qaAi089G6Qw 121g5e/VbGI/cBCSLCIJL+C97KbFpZLf8Nur5LI8FcUQw7CX+dxDYiFk39oWNoqAVjYer aD8kW3r8fgUsYG+eQJTS7w49xd6Dq4V2PyBdMgXzqEvHc7HWvV1eDHGsd/UQe6Hoytw+h 3j9kGbSNukU3Y9NjjvbqX/BeLahH1EayKvL9qF6i8Agmni4hvgcelaUtxi7IM2WJw7A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590455; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=tSHKQkPig97FcxZTB1eX3c5VIFjO02GIfjSzfJNUJf0=; b=I5DkAcd2QsF35jYfQgULL/d9CX/DnpjDh/gEfRPLAgwRNmiWpjjOSIj7AEcURsapxU+D Nyv5kEzY//C2MEepSIRFPPT389/y9Dojbq1peZtDWP9qUbisgQci5hEnWnVnX3ThDbaV+ oMl/77pkU1pNVaN2WmDzvEOqWHEb+ANyYG+15lUGj+AZM+PjPM+RszvUjB38MEi2/jA0R mt63+B99v2d3KZoK9C4mF+1dGNUHZnGgB2jIGH3UW9S0w8Vm6vCVf5yqUuGxhrKzLrucY acUfkSG1bLLA8k9zKEffCsvPvV+UmAetYY0xt+0F4IJwAK47cqqS2siXYyN6+q2jWYw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=yFE1OVj7; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27A926071416; Fri, 13 Nov 2026 17:20:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=yFE1OVj7 Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB6D41F000C6; Fri, 13 Nov 2026 17:20:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590455; bh=tSHKQkPig97FcxZTB1eX3c5VIFjO02GIfjSzfJNUJf0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=yFE1OVj7WhZ1H4S2bJIrIJL934YioZmNPfrLZpdi9RNwi4s9u0vK0awi+g7o14k9u 5Xhim3q3mO5ab7D+m8P5ZsJiLxRciJ2WXlP6A+RCy0xvKOvH0mjEdQ0wbsYArNwldu H+QZ43pZJH9nGtuX5TatPOjRLswyGA6zA5/PwGkc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Josef Bacik , "Gregory Price (Meta)" , Muhammad Usama Anjum , Lance Yang , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.18 370/686] mm/khugepaged: fix PMD table lock leak in try_collapse_pte_mapped_thp() Date: Fri, 13 Nov 2026 10:48:23 -0500 Message-ID: <20261113153833.456532096@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Josef Bacik [ Upstream commit db38b902307e687219ec765ef51a6ef459746c87 ] For a private mapping with userfaultfd, try_collapse_pte_mapped_thp() takes the PMD table lock before it maps the page table for the second time. If that (pte_offset_map_rw_nolock) fails, because the page table vanished in the meantime due to concurrent page table reclaim, it leaves through the abort label, where the PMD table lock is unlocked if it differs from PTE table lock. In case the PMD table lock and the PTE table lock match, which is the case without CONFIG_SPLIT_PTE_PTLOCKS after pte_offset_map_rw_nolock() failed, we miss to unlock the PMD table. To fix it, forget the PTE table lock when we unmap+unlock the PTE table. Fix generated by an LLM and sent by Josef Bacik in private. Fixes: 6375e95f381e ("mm: pgtable: reclaim empty PTE page in madvise(MADV_DONTNEED)") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik [ david: move the ptl = NULL handling; rewrite description, drop wrong comments ] Reviewed-by: Gregory Price (Meta) Tested-by: Gregory Price (Meta) Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-16-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Sasha Levin --- mm/khugepaged.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 573e4063eaf60..3a866347a1cf1 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1555,7 +1555,7 @@ int collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr, result = SCAN_FAIL; start_pte = pte_offset_map_lock(mm, pmd, haddr, &ptl); - if (!start_pte) /* mmap_lock + page lock should prevent this */ + if (!start_pte) goto drop_folio; /* step 1: check all mapped PTEs are to the right huge page */ @@ -1586,6 +1586,7 @@ int collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr, } pte_unmap_unlock(start_pte, ptl); + ptl = NULL; mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, haddr, haddr + HPAGE_PMD_SIZE); mmu_notifier_invalidate_range_start(&range); @@ -1603,7 +1604,7 @@ int collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr, pml = pmd_lock(mm, pmd); start_pte = pte_offset_map_rw_nolock(mm, pmd, haddr, &pgt_pmd, &ptl); - if (!start_pte) /* mmap_lock + page lock should prevent this */ + if (!start_pte) goto abort; if (!pml) spin_lock(ptl); -- 2.53.0