From: Lance Yang <lance.yang@linux.dev>
To: Usama Arif <usama.arif@linux.dev>
Cc: aarcange@redhat.com, ziy@nvidia.com, david@kernel.org,
baolin.wang@linux.alibaba.com, baohua@kernel.org,
ryan.roberts@arm.com, npache@redhat.com, ljs@kernel.org,
dev.jain@arm.com, linux-mm@kvack.org,
sashiko-bot <sashiko-bot@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
linux-kernel@vger.kernel.org, kernel-team@meta.com,
hannes@cmpxchg.org, shakeel.butt@linux.dev, riel@surriel.com,
liam@infradead.org
Subject: Re: [PATCH] userfaultfd: wait on source PMD during UFFDIO_MOVE
Date: Mon, 6 Jul 2026 10:18:00 +0800 [thread overview]
Message-ID: <eeb3e66a-c140-4347-b86f-c47da2cd9886@linux.dev> (raw)
In-Reply-To: <20260705131231.1499198-1-usama.arif@linux.dev>
On 2026/7/5 21:12, Usama Arif wrote:
> move_pages_huge_pmd() snapshots src_pmdval under src_ptl, drops the lock,
> and, for migration entries, waits with pmd_migration_entry_wait().
>
> Passing &src_pmdval is wrong. pmd_migration_entry_wait() must lock and
> re-read the real page-table PMD; on split-PMD-lock kernels, a stack
> address also resolves to the wrong lock. softleaf_entry_wait_on_locked()
Well spotted!
> then waits without a folio reference, which is safe only while serialized
> against migration-entry removal by the real PT lock.
>
> Pass src_pmd, matching __handle_mm_fault() and hmm_vma_walk_pmd().
>
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/patchset/20260703173903.3789516-1-usama.arif%40linux.dev?part=8
> Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
> Signed-off-by: Usama Arif <usama.arif@linux.dev>
> ---
As Andrew and Baolin pointed out, this should go to stable ;)
With that,
Reviewed-by: Lance Yang <lance.yang@linux.dev>
next prev parent reply other threads:[~2026-07-06 2:18 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-05 13:12 [PATCH] userfaultfd: wait on source PMD during UFFDIO_MOVE Usama Arif
2026-07-05 19:08 ` Rik van Riel
2026-07-05 19:24 ` Andrew Morton
2026-07-06 1:05 ` Baolin Wang
2026-07-06 2:18 ` Lance Yang [this message]
2026-07-06 9:00 ` David Hildenbrand (Arm)
2026-07-11 8:13 ` Lorenzo Stoakes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=eeb3e66a-c140-4347-b86f-c47da2cd9886@linux.dev \
--to=lance.yang@linux.dev \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=baohua@kernel.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=david@kernel.org \
--cc=dev.jain@arm.com \
--cc=hannes@cmpxchg.org \
--cc=kernel-team@meta.com \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=npache@redhat.com \
--cc=riel@surriel.com \
--cc=ryan.roberts@arm.com \
--cc=sashiko-bot@kernel.org \
--cc=shakeel.butt@linux.dev \
--cc=usama.arif@linux.dev \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.