Re: [PATCH 15/15] RFC: mm/hugetlb: delay anon folio rmap removal until after the TLB flush

[sashiko-bot@kernel.org]

> After fork(), parent and child map anonymous folios read-only shared
> by CoW. On a write fault, hugetlb_wp() reuses an anonymous page instead of
> copying it if its mapcount is 1. As documented, switching to the safer
> refcount would cause more harm than help with these scarce resources.
> 
> munmap() and MADV_DONTNEED unmap such folios and decrement the mapcount
> before the TLB is flushed. Until then, another thread of the process can
> still read the page through a stale TLB entry:
> 
>     child: reader        child: munmap()       parent: writer
>     =============        ===============       ==============
>     reads the page
>                          clears the entry
>                          mapcount drops to 1
>                                                store to the page
> [ ... ]
> for applications with different parent vs. child trust boundaries.
> 
> Fixes: 24669e58477e ("hugetlb: use mmu_gather instead of a temporary linked list for accumulating pages")
> Reported-by: Chris Mason <mason@kernel.org>
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261028-fixes_hugetlb-v1-0-a0a033db180f@kernel.org?part=15