From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794636593; b=gm4ehlvW0JDOfoDqpKDYGssIcjIHliYR8XaZoULzoTyuYh5jQZFniO/cJyy/mzJEwVV4 /n1GrbX1yvkONLIi55wxe9GScS4okBAo5atx5IHknrUxv2XUdhO+JcoII/dpGr2OhTk6l Wu3DKIUyLKyJSh6kNZAbPKCM70RDbzzNs33FHxbF5Lp0HPb3aODm1gjiuWN6aUhIvPbiR Ms7QGodTrBGA3bxQmT8KPy4fahBGMxdNo3iIGzA1VZiJIf6pf/Mgx6N0qcMS9a/oaS6Lj TTVKw6MxAOf9GHXc7dBL8fT7htXduHQCCvSqki6bs5rKQAT3dBa5rwIxxEqVKDtgFug== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794636593; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=3KVXR3yLuHVmc3TmOYoyDNSvbtEPu+NQ+Q0QM+bRsho=; b=Ho0LBo/g8hXMzALv9e8HFPs00IjyZ9aRn2eGpuDBPntUl1X5VG2ZpQF3IYo6X7MVzrFQ AnFFu+B501kIg7ogEQAK/v+CzTBwTy2/Gkpdm6a2q9YE3Fa7IXNb1V0q6fOYWEtbIbPXP 7Tm9Z+PUuJgoXnurRZGCn0/h2WOfyq4+jE/ZbiV2PquKF0ehf/8VxBN0YPABYJ7x2bPWX FP+MCaXS+P8SLoFonJXA0K9PpdnK0JuS29Fy6j1rpJBFmc3d7sR1pF5jJy/EX0P/+bDez fTO4nEuOMDlm5/qUZKE39OSt4udlZFZ1pThvtUeZ2a2noYJQOpd/AU6s223xycAO+rQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=RO3x81SJ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12954606A323 for ; Sat, 14 Nov 2026 06:09:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=RO3x81SJ Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE9921F000C5; Sat, 14 Nov 2026 06:09:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794636592; bh=3KVXR3yLuHVmc3TmOYoyDNSvbtEPu+NQ+Q0QM+bRsho=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RO3x81SJL57Gi3fht7mAozW6Rvo8mDJakXhIjiusfsFtafl1VKSm65hXdtmYRlWVO +vNHjE9ZgJekbthiPqqdViKXxVeAbaf+4NdNCiAkhvWK59K5uCbvFsp6YU0rr40gas 5hUHqGj4Kujm/jZee9pT3A8fGaP6KeznWF1CkLyStAsdnf2xQNMf/zN0n6kO6N8sgF is/0A+gdUcHmtmhJKjnHNci2yRdzejuktDXC9ZBSV0k/oEZXA+upe1IvylRjIesWR3 9CyDjdbmLmvYhL70ZNEhJrWYvXnaV3JIFwwXovl0haT1NNhlMi9INlnEqR80NWmjO3 qvGrCatubb9TQ== From: Sasha Levin To: stable@vger.kernel.org Cc: Chris Mason , "Gregory Price (Meta)" , Muhammad Usama Anjum , Zi Yan , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.6.y] mm/huge_memory: fix truncate racing with PMD zapping Date: Sat, 14 Nov 2026 01:09:50 -0500 Message-ID: <20261114060934.3198345-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109201323-failed-6.6-e6a07d29b0a6@kernel.org> References: <20261109201323-failed-6.6-e6a07d29b0a6@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chris Mason [ Upstream commit e6a07d29b0a60f3a4cfe77fe34eeb4b3fb38d6c4 ] zap_huge_pmd_folio() removes the rmap before calling folio_mark_dirty(). If this was the last mapping, truncation can skip unmapping the folio and proceed without waiting for the PMD lock, racing with dirtying. ifs_set_range_dirty() can oops if MADV_DONTNEED races with ftruncate() on XFS, when we get the folio set dirty after it was found to not be mapped anymore. Move folio_mark_dirty() and folio_mark_accessed() before rmap removal, matching the PTE zap path. This keeps the folio mapped while updating its state, so truncation must wait for the page table lock. Fix generated by an LLM and sent by Chris Mason in private. Fixes: fe6cf984939d ("mm/huge_memory: transfer the pmd dirty bit to the folio on zap") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify comment and description ] Reviewed-by: Gregory Price (Meta) Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-13-d6437171ecc3@kernel.org Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) [ sashal: Adapted zap_huge_pmd_folio() changes to zap_huge_pmd() using page_remove_rmap(). ] Signed-off-by: Sasha Levin --- mm/huge_memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 4aa032e96fa60..c9b40d69ff1fd 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1717,8 +1717,6 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, if (pmd_present(orig_pmd)) { page = pmd_page(orig_pmd); - page_remove_rmap(page, vma, true); - VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); VM_BUG_ON_PAGE(!PageHead(page), page); } else if (thp_migration_supported()) { swp_entry_t entry; @@ -1742,6 +1740,12 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, folio_mark_dirty(page_folio(page)); } + /* Remove the rmap after transferring the dirty bit to the folio. */ + if (pmd_present(orig_pmd)) { + page_remove_rmap(page, vma, true); + VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); + } + spin_unlock(ptl); if (flush_needed) tlb_remove_page_size(tlb, page, HPAGE_PMD_SIZE); -- 2.53.0