[PATCH v2] mm/rmap: don't discard lazyfree THPs at PMD level

[PATCH v2] mm/rmap: don't discard lazyfree THPs at PMD level

[Zi Yan]

__discard_anon_folio_pmd_locked() clears a lazyfree THP's PMD before it
determines whether the folio can be discarded, and restores it if the folio
is dirty or has extra references. It is done under only the PMD lock and
the anon_vma read lock inside try_to_unmap_one() and no mmap lock is held.
The temporarily none PMD causes UAF.

A parallel munmap() or mremap() is supposed to serialize with it on the PMD
lock, but zap_pmd_range() (called by munmap()) and move_page_tables()
(called by mremap()) do not take the lock when they see the temporarily
none PMD and skip the PMD. There is no more page table walk after the none
PMD is restored:

- munmap(): free_pgtables() waits in unlink_anon_vmas() for the anon_vma
  lock, then free_pmd_range() drops the restored PMD as bad without
  removing the rmap, so the folio keeps a stale mapcount.

- whole-VMA MREMAP_DONTUNMAP: dontunmap_complete() unlinks the source VMA
  from its anon_vma while the restored PMD still maps the folio.

- plain mremap(): the THP is not moved but unmapped, so the THP's data is
  lost.

In the first two cases, the folio stays mapped, but no VMA that maps it is
linked to its anon_vma. When the anon_vma is freed, it is still reachable
when one rmap walks the folio. Racing lazyfree reclaim against
MREMAP_DONTUNMAP as an unprivileged user reproduces a KASAN use-after-free
in folio_lock_anon_vma_read() as reported in the Closes link.

One solution is to use an invalidated PMD instead of a cleared one until
the discard is committed, but it needs arch fixes first.
1. GUP-fast still follows an invalidated PMD on riscv, LoongArch and s390.
2. sparc64 miscounts thp_pte_count when an invalidated PMD is set again or
   cleared.

To keep the fix simple for backport, stop discarding lazyfree THPs at PMD
level instead. try_to_unmap_one() splits the PMD and discards the folio at
PTE level.

unmap_huge_pmd_locked() and __discard_anon_folio_pmd_locked() are left in
place, unused, to minimize this fix for backport and the invalidated PMD
approach is planned as a follow-up series to use them again.

Fixes: 735ecdfaf4e8 ("mm/vmscan: avoid split lazyfree THP during shrink_folio_list()")
Reported-by: Kyle Zeng <kylebot@openai.com>
Closes: https://lore.kernel.org/r/20261009165214.40212-2-kylebot@openai.com
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Kyle Zeng <kylebot@openai.com>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Zi Yan <ziy@nvidia.com>
---
The proposed fix[1] requires additional arch code fixes[2]. Disable it
first for stable fix. The function will be re-enabled along with arch code
fixes.

Link: https://lore.kernel.org/all/20261009165214.40212-2-kylebot@openai.com/ [1]
Link: https://lore.kernel.org/all/DM0II2QHWWS1.2RXEJXC8S0101@nvidia.com/ [2]
---
Changes in v2:
1. added more details on how UAF can happen.
2. provides more details on why the invalidated PMD approach is not used.
3. explained why unmap_huge_pmd_locked() and
   __discard_anon_folio_pmd_locked() are left unused.
- Link to v1: https://patch.msgid.link/20261009-lazyfree-stable-fix-v1-1-70997958ef8d@nvidia.com
---
 mm/rmap.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/mm/rmap.c b/mm/rmap.c
index 805db93fe0428..1131b76bbbc28 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -2275,17 +2275,6 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
 		}
 
 		if (!pvmw.pte) {
-			if (folio_test_lazyfree(folio)) {
-				if (unmap_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, folio))
-					goto walk_done;
-				/*
-				 * unmap_huge_pmd_locked has either already marked
-				 * the folio as swap-backed or decided to retain it
-				 * due to GUP or speculative references.
-				 */
-				goto walk_abort;
-			}
-
 			if (flags & TTU_SPLIT_HUGE_PMD) {
 				/*
 				 * We temporarily have to drop the PTL and

---
base-commit: 8b38ed9ab5b09c8ba168cbcc49524e9b380ee5c4
change-id: 20261009-lazyfree-stable-fix-67712b2049dd

Best regards,
--  
Yan, Zi

Re: [PATCH v2] mm/rmap: don't discard lazyfree THPs at PMD level

[Lorenzo Stoakes (ARM)]

On Mon, Oct 12, 2026 at 10:20:16PM -0400, Zi Yan wrote:
> __discard_anon_folio_pmd_locked() clears a lazyfree THP's PMD before it
> determines whether the folio can be discarded, and restores it if the folio
> is dirty or has extra references. It is done under only the PMD lock and
> the anon_vma read lock inside try_to_unmap_one() and no mmap lock is held.
> The temporarily none PMD causes UAF.
>
> A parallel munmap() or mremap() is supposed to serialize with it on the PMD
> lock, but zap_pmd_range() (called by munmap()) and move_page_tables()
> (called by mremap()) do not take the lock when they see the temporarily
> none PMD and skip the PMD. There is no more page table walk after the none
> PMD is restored:
>
> - munmap(): free_pgtables() waits in unlink_anon_vmas() for the anon_vma
>   lock, then free_pmd_range() drops the restored PMD as bad without
>   removing the rmap, so the folio keeps a stale mapcount.
>
> - whole-VMA MREMAP_DONTUNMAP: dontunmap_complete() unlinks the source VMA
>   from its anon_vma while the restored PMD still maps the folio.
>
> - plain mremap(): the THP is not moved but unmapped, so the THP's data is
>   lost.
>
> In the first two cases, the folio stays mapped, but no VMA that maps it is
> linked to its anon_vma. When the anon_vma is freed, it is still reachable
> when one rmap walks the folio. Racing lazyfree reclaim against
> MREMAP_DONTUNMAP as an unprivileged user reproduces a KASAN use-after-free
> in folio_lock_anon_vma_read() as reported in the Closes link.
>
> One solution is to use an invalidated PMD instead of a cleared one until
> the discard is committed, but it needs arch fixes first.
> 1. GUP-fast still follows an invalidated PMD on riscv, LoongArch and s390.
> 2. sparc64 miscounts thp_pte_count when an invalidated PMD is set again or
>    cleared.
>
> To keep the fix simple for backport, stop discarding lazyfree THPs at PMD
> level instead. try_to_unmap_one() splits the PMD and discards the folio at
> PTE level.
>
> unmap_huge_pmd_locked() and __discard_anon_folio_pmd_locked() are left in
> place, unused, to minimize this fix for backport and the invalidated PMD
> approach is planned as a follow-up series to use them again.
>

Amazing, thanks for that! All LGTM.

> Fixes: 735ecdfaf4e8 ("mm/vmscan: avoid split lazyfree THP during shrink_folio_list()")
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Closes: https://lore.kernel.org/r/20261009165214.40212-2-kylebot@openai.com
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Reviewed-by: Kyle Zeng <kylebot@openai.com>
> Reviewed-by: Lance Yang <lance.yang@linux.dev>
> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> ---
> The proposed fix[1] requires additional arch code fixes[2]. Disable it
> first for stable fix. The function will be re-enabled along with arch code
> fixes.
>
> Link: https://lore.kernel.org/all/20261009165214.40212-2-kylebot@openai.com/ [1]
> Link: https://lore.kernel.org/all/DM0II2QHWWS1.2RXEJXC8S0101@nvidia.com/ [2]
> ---
> Changes in v2:
> 1. added more details on how UAF can happen.
> 2. provides more details on why the invalidated PMD approach is not used.
> 3. explained why unmap_huge_pmd_locked() and
>    __discard_anon_folio_pmd_locked() are left unused.
> - Link to v1: https://patch.msgid.link/20261009-lazyfree-stable-fix-v1-1-70997958ef8d@nvidia.com
> ---
>  mm/rmap.c | 11 -----------
>  1 file changed, 11 deletions(-)
>
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 805db93fe0428..1131b76bbbc28 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -2275,17 +2275,6 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
>  		}
>
>  		if (!pvmw.pte) {
> -			if (folio_test_lazyfree(folio)) {
> -				if (unmap_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, folio))
> -					goto walk_done;
> -				/*
> -				 * unmap_huge_pmd_locked has either already marked
> -				 * the folio as swap-backed or decided to retain it
> -				 * due to GUP or speculative references.
> -				 */
> -				goto walk_abort;
> -			}
> -
>  			if (flags & TTU_SPLIT_HUGE_PMD) {
>  				/*
>  				 * We temporarily have to drop the PTL and
>
> ---
> base-commit: 8b38ed9ab5b09c8ba168cbcc49524e9b380ee5c4
> change-id: 20261009-lazyfree-stable-fix-67712b2049dd
>
> Best regards,
> --
> Yan, Zi
>

--
Cheers, Lorenzo