Re: [PATCH] mm/khugepaged: free unused page table when setting a huge PMD fails

[Kiryl Shutsemau <kas@kernel.org>]

On Thu, Nov 05, 2026 at 01:16:05PM +0100, David Hildenbrand (Arm) wrote:
> do_set_pmd() can allocate vmf.prealloc_pte on architectures that need a
> deposited page table, such as PowerPC with the hash MMU. If the PMD is
> no longer empty when it takes the PMD lock, it returns VM_FAULT_FALLBACK
> without consuming that table.
> 
> Since collapse_pte_mapped_thp() uses mmap_read_lock(), a concurrent
> userfaultfd operation can install a PTE table before taking the folio
> lock. If that races with set_huge_pmd(), the unused preallocated table
> is lost when its local vm_fault goes out of scope.
> 
> Free vmf.prealloc_pte on failure, as do_fault() already does. Successful
> PMD installation consumes the table and clears the pointer.
> 
> Having to do this cleanup outside of do_set_pmd() is rather nasty, but
> other callers depend on it already having been allocated. This needs a
> cleanup at some point.

I hate this being outside of do_set_pmd().

What about making do_set_pmd() freeing ->prealloc_pte if it was
allocated inside? Nothing changes for caller.

        bool allocated = false;
        ...
        if (arch_needs_pgtable_deposit() && !vmf->prealloc_pte) {
                vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
                if (!vmf->prealloc_pte)
                        return VM_FAULT_OOM;
                allocated = true;
        }
        ...
out:
        spin_unlock(vmf->ptl);
        if (ret && allocated) {
                pte_free(vma->vm_mm, vmf->prealloc_pte);
                vmf->prealloc_pte = NULL;
        }
        return ret;

-- 
  Kiryl Shutsemau / Kirill A. Shutemov