Re: [PATCH v2 1/4] mm: fix missing page-table destructor in pagetable_free()

From: Muchun Song <muchun.song@linux.dev>
To: "Jose A. Perez de Azpillaga" <azpijr@gmail.com>
Cc: "Andrew Morton" <akpm@linux-foundation.org>,
	"Muchun Song" <songmuchun@bytedance.com>,
	"David Hildenbrand" <david@kernel.org>,
	"Oscar Salvador" <osalvador@suse.de>,
	"Dave Hansen" <dave.hansen@intel.com>,
	"Paul Walmsley" <pjw@kernel.org>,
	"Palmer Dabbelt" <palmer@dabbelt.com>,
	"Albert Ou" <aou@eecs.berkeley.edu>,
	"Alexandre Ghiti" <alex@ghiti.fr>,
	"Björn Töpel" <bjorn@rivosinc.com>,
	"Catalin Marinas" <catalin.marinas@arm.com>,
	"Will Deacon" <will@kernel.org>,
	"Mark Rutland" <mark.rutland@arm.com>,
	"Kevin Brodsky" <kevin.brodsky@arm.com>,
	"Alexander Gordeev" <agordeev@linux.ibm.com>,
	"Alistair Popple" <apopple@nvidia.com>,
	linux-mm@kvack.org, linux-riscv@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH v2 1/4] mm: fix missing page-table destructor in pagetable_free()
Date: Tue, 13 Oct 2026 14:33:49 +0800	[thread overview]
Message-ID: <2B2F2818-9309-450B-A2A4-9F53D802F1C6@linux.dev> (raw)
In-Reply-To: <3ab63358-8bbe-4457-b21c-bb81bca804cc@gmail.com>

> On Oct 13, 2026, at 01:21, Jose A. Perez de Azpillaga <azpijr@gmail.com> wrote:
> 
> On 10/12/26 2:55 PM, Muchun Song wrote:
>> 
>> 
>>> On Oct 12, 2026, at 19:15, Jose A. Perez de Azpillaga <azpijr@gmail.com> wrote:
>>> 
>>> On Sat, Oct 10, 2026 at 07:24:54PM +0800, Muchun Song wrote:
>>>> Since commit 49f599666420 ("mm: call ctor/dtor for kernel PTEs"),
>>>> pte_alloc_one_kernel() runs the page-table constructor for kernel PTE
>>>> tables.
>>>> 
>>>> HVO (HugeTLB Vmemmap Optimization) uses pte_alloc_one_kernel() when
>>>> splitting a PMD. Restoring the vmemmap backing pages does not collapse
>>>> the PTE table, so a later memory hot-remove eventually frees it through
>>>> pagetable_free() on x86-64. That releases the page without running the
>>>> matching destructor and leaves NR_PAGETABLE elevated.
>>>> 
>>>> Make pagetable_free() detect constructor-backed pages and run the
>>>> destructor before releasing their memory to fix the problem.
>>>> 
>>>> Fixes: 49f599666420 ("mm: call ctor/dtor for kernel PTEs")
>>>> Cc: stable@vger.kernel.org
>>> 
>>> is the x86 case covered for 6.16-6.18? as far as I can see, x86
>>> free_pagetable() only uses pagetable_free() since bf9e4e30f353
>>> ("x86/mm: use pagetable_free()") in v6.19, so the backport wouldn't
>>> change anything there. or am I missing something?
>> 
>> Yes, you are absolutely right — thanks for catching this.
>> 
>> I double-checked and indeed x86's free_pagetable() only starts using
>> pagetable_free() since bf9e4e30f353 ("x86/mm: use pagetable_free()"),
>> which landed in v6.19. So for 6.16-6.18 the prerequisite is not present
>> and the backport would be a no-op there.
>> 
>> The correct trailer is:
>> 
>> Cc: <stable@vger.kernel.org> # 6.16-6.18: bf9e4e30f353: x86/mm: use pagetable_free()
> 
> also, bf9e4e30f353 alone leaks PMD-sized vmemmap pages on those trees,
> it needs 39406c05f8f1 ("x86/mm: Fix freeing of PMD-sized vmemmap pages")
> as well :)

Yeah, you are so meticulous.

> 
> Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
> 

Thanks.

> -- 
> cheers,
> jose a. p-a