From: SJ Park <sj@kernel.org>
To: "David Hildenbrand (Arm)" <david@kernel.org>
Cc: SJ Park <sj@kernel.org>, Johannes Weiner <hannes@cmpxchg.org>,
Michal Hocko <mhocko@kernel.org>, Qi Zheng <qi.zheng@linux.dev>,
Shakeel Butt <shakeel.butt@linux.dev>,
Lorenzo Stoakes <ljs@kernel.org>,
Kairui Song <kasong@tencent.com>, Barry Song <baohua@kernel.org>,
Axel Rasmussen <axelrasmussen@google.com>,
Yuanchu Xie <yuanchu@google.com>, Wei Xu <weixugc@google.com>,
Baoquan He <baoquan.he@linux.dev>,
Baolin Wang <baolin.wang@linux.alibaba.com>,
"Liam R. Howlett" <liam@infradead.org>,
Vlastimil Babka <vbabka@kernel.org>,
Mike Rapoport <rppt@kernel.org>,
Suren Baghdasaryan <surenb@google.com>,
Michal Hocko <mhocko@suse.com>, Kees Cook <kees@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Jann Horn <jannh@google.com>, Pedro Falcato <pfalcato@suse.de>,
Hugh Dickins <hughd@google.com>,
Pasha Tatashin <pasha.tatashin@soleen.com>,
Pratyush Yadav <pratyush@kernel.org>,
"Matthew Wilcox (Oracle)" <willy@infradead.org>,
Jan Kara <jack@suse.cz>, Zi Yan <ziy@nvidia.com>,
Lance Yang <lance.yang@linux.dev>,
Rik van Riel <riel@surriel.com>, Harry Yoo <harry@kernel.org>,
Alistair Popple <apopple@nvidia.com>,
Nico Pache <nico.pache@linux.dev>,
Ryan Roberts <ryan.roberts@arm.com>, Dev Jain <dev.jain@arm.com>,
Usama Arif <usama.arif@linux.dev>,
Kiryl Shutsemau <kas@kernel.org>,
Matthew Brost <matthew.brost@intel.com>,
John Hubbard <jhubbard@nvidia.com>, Peter Xu <peterx@redhat.com>,
Will Deacon <will@kernel.org>,
"Aneesh Kumar K.V" <aneesh.kumar@kernel.org>,
Nick Piggin <npiggin@gmail.com>,
Oscar Salvador <osalvador@suse.de>,
Minchan Kim <minchan@kernel.org>,
Muchun Song <muchun.song@linux.dev>, Xu Xin <xu.xin@linux.dev>,
Chengming Zhou <chengming.zhou@linux.dev>,
Chris Li <chrisl@kernel.org>,
Kemeng Shi <shikemeng@huaweicloud.com>,
Nhat Pham <nphamcs@gmail.com>,
Youngjun Park <youngjun.park@lge.com>,
Gregory Price <gourry@gourry.net>,
Joshua Hahn <joshua.hahnjy@gmail.com>,
Rakie Kim <rakie.kim@sk.com>,
Ying Huang <ying.huang@linux.alibaba.com>,
Jason Gunthorpe <jgg@ziepe.ca>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
kexec@lists.infradead.org, linux-fsdevel@vger.kernel.org,
linux-arch@vger.kernel.org, linux-cxl@vger.kernel.org,
Josef Bacik <josef@toxicpanda.com>,
stable@vger.kernel.org,
Muhammad Usama Anjum <usama.anjum@arm.com>
Subject: Re: [PATCH v2 01/47] mm/mglru: don't use stack pointers when walking PUD and PMD tables
Date: Thu, 29 Oct 2026 17:20:03 -0700 [thread overview]
Message-ID: <20261030002004.154595-1-sj@kernel.org> (raw)
In-Reply-To: <20261029-fixes_core-v2-1-a64ce7f83abb@kernel.org>
'get_maintainer.pl --nogit --nogit-fallback' suggests adding below recipients.
But I can show there are already quite a number of recipients, so I'm just
noting here.
- Brian Geffon <bgeffon@google.com>
- Oleksandr Natalenko <oleksandr@natalenko.name>
- Steven Barrett <steven@liquorix.net>
- Yu Zhao <yuzhao@google.com>
On Thu, 29 Oct 2026 21:32:56 +0100 "David Hildenbrand (Arm)" <david@kernel.org> wrote:
> From: Josef Bacik <josef@toxicpanda.com>
>
> MGLRU passes stack copies of page-table entries in walk_pud_range() and
> walk_pmd_range() when walking to the next level. These copies can become
> stale when khugepaged or MADV_DONTNEED (CONFIG_PT_RECLAIM) removes a PTE
> table concurrently.
>
> This pattern dates back to commit bd74fdaea146 ("mm: multi-gen LRU:
> support page table walks"). Likely, earlier locking masked the latent
> bug. Later changes exposed it: commit 1d65b771bc08 ("mm/khugepaged:
> retract_page_tables() without mmap or vma lock") allowed concurrent
> retraction, and commit cf4a65539c13 ("memcg-v1: no need for memcg locking
> for MGLRU") dropped the walker's outer RCU protection.
>
> The fix is simple, so just fix the original commit so we don't have to
> speculate. To fix it, pass the actual PMD/PUD pointers. This restores the
> RCU-protected lookup and validation against the live PMD. Note that the PUD
> handling is required as well to handle folded page tables correctly in all
> cases.
>
> Fix generated by an LLM and sent by Josef Bacik in private.
>
> [ david: handle walk_pud_range() as well, clarify+simplify description,
> adjust Fixes: ]
Looks all good to me.
>
> Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks")
> Cc: stable@vger.kernel.org
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Reviewed-by: Rik van Riel <riel@surriel.com>
> Reviewed-by: Qi Zheng <qi.zheng@linux.dev>
> Reviewed-by: Dev Jain <dev.jain@arm.com>
> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> Reviewed-by: Kairui Song <kasong@tencent.com>
> Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
> Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
> Reviewed-by: Barry Song <baohua@kernel.org>
> Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
> Reviewed-by: Pedro Falcato <pfalcato@suse.de>
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Thanks,
SJ
[...]
next prev parent reply other threads:[~2026-10-30 0:20 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-29 20:32 [PATCH v2 00/47] mm: various (urgent?) fixes David Hildenbrand (Arm)
2026-10-29 20:32 ` [PATCH v2 01/47] mm/mglru: don't use stack pointers when walking PUD and PMD tables David Hildenbrand (Arm)
2026-10-30 0:20 ` SJ Park [this message]
2026-10-29 20:32 ` [PATCH v2 02/47] fork: take mmap_lock before copying mm_struct David Hildenbrand (Arm)
2026-10-29 20:32 ` [PATCH v2 03/47] mm/memfd: check for real shmem inodes before accessing shmem state David Hildenbrand (Arm)
2026-10-29 20:32 ` [PATCH v2 04/47] mm/memfd: make f_pos accesses atomic David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 05/47] mm/truncate: look again if a folio left the mapping David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 06/47] mm/filemap: read mapping->a_ops->free_folio under i_lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 07/47] mm/filemap: don't lose a folio lock wakeup to a signal David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 08/47] mm/filemap: finish fault cleanup before dropping the fault lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 09/47] mm/rmap: handle device-exclusive entries in folio_referenced_one() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 10/47] mm/huge_memory: fix list corruption when deferred_split_scan() races with deferred_split_folio() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 11/47] mm/huge_memory: properly handle refcounted PUD mappings on fork David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 12/47] mm/huge_memory: fix livelock on device private folio David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 13/47] mm/huge_memory: fix truncate racing with PMD zapping David Hildenbrand (Arm)
2026-10-29 22:37 ` Gregory Price (Meta)
2026-10-29 20:33 ` [PATCH v2 14/47] mm/huge_memory: fix zapping migration entries for device-private THPs David Hildenbrand (Arm)
2026-10-29 22:30 ` Gregory Price (Meta)
2026-10-29 20:33 ` [PATCH v2 15/47] mm/khugepaged: always recheck the pmd in try_collapse_pte_mapped_thp() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 16/47] mm/khugepaged: fix PMD table lock leak " David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 17/47] mm/khugepaged: preserve dirty bits when collapsing PTE-mapped THPs David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 18/47] mm/khugepaged: check if PTE table is empty in try_collapse_pte_mapped_thp() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 19/47] mm/gup: recheck the PUD under PTL in follow_pud_mask() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 20/47] mm/gup: fix clearing folios in memfd_pin_folios() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 21/47] mm/gup: fix out-of-bounds write for nr_pages == 0 in GUP-fast David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 22/47] mm/gup: check for overflow when converting nr_pages to bytes " David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 23/47] mm/userfaultfd: write-lock the VMA before waking waiters when unregistering David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 24/47] mm/userfaultfd: wake all waiters on unregister David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 25/47] mm/userfaultfd: wake waiters when registration modes are removed David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 26/47] mm/userfaultfd: compare exact registration modes before skipping David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 27/47] mm/mmu_gather: fix flushing ranges with 4 GiB or larger David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 28/47] mm/mmu_notifier: finish non-blocking interval invalidation on error David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 29/47] mm/mmu_notifier: set ->mm only after mmgrab() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 30/47] mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 31/47] mm/mremap: recheck PUDs under the page table lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 32/47] mm/mremap: fix moving PUD leaves David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 33/47] mm/memory_hotplug: avoid races in pfn_to_online_page() with dying pgmap David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 34/47] mm/madvise: fix data loss from MADV_FREE on a KSM page David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 35/47] mm/memory: reject remote COW faults on PFN mappings David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 36/47] mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 37/47] mm: fix unkillable fault loop on MAP_DROPPABLE memory David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 38/47] mm: fix deadlock of mremap() against UFFDIO_MOVE David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 39/47] mm/ksm: reset the unstable trees of all nodes David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 40/47] mm/ksm: fix use of a freed anon_vma at swap-in David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 41/47] mm/ksm: check large swap-cache folios before mapping them David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 42/47] mm/vma: call ->may_split() before a partial merge David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 43/47] mm/huge_memory: split huge PUDs when adjusting VMA boundaries David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 44/47] mm/vma: don't leak the charge for stack growth David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 45/47] mm/cma: don't release CMA pages still in use David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 46/47] mm/memory-tiers: unregister empty tiers outside memory_tier_lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 47/47] fs/proc/task_mmu: refuse addresses beyond 32 bits on 32bit David Hildenbrand (Arm)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261030002004.154595-1-sj@kernel.org \
--to=sj@kernel.org \
--cc=aneesh.kumar@kernel.org \
--cc=apopple@nvidia.com \
--cc=axelrasmussen@google.com \
--cc=baohua@kernel.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=baoquan.he@linux.dev \
--cc=chengming.zhou@linux.dev \
--cc=chrisl@kernel.org \
--cc=david@kernel.org \
--cc=dev.jain@arm.com \
--cc=gourry@gourry.net \
--cc=hannes@cmpxchg.org \
--cc=harry@kernel.org \
--cc=hughd@google.com \
--cc=jack@suse.cz \
--cc=jannh@google.com \
--cc=jgg@ziepe.ca \
--cc=jhubbard@nvidia.com \
--cc=josef@toxicpanda.com \
--cc=joshua.hahnjy@gmail.com \
--cc=kas@kernel.org \
--cc=kasong@tencent.com \
--cc=kees@kernel.org \
--cc=kexec@lists.infradead.org \
--cc=lance.yang@linux.dev \
--cc=liam@infradead.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=matthew.brost@intel.com \
--cc=mhocko@kernel.org \
--cc=mhocko@suse.com \
--cc=minchan@kernel.org \
--cc=muchun.song@linux.dev \
--cc=nico.pache@linux.dev \
--cc=nphamcs@gmail.com \
--cc=npiggin@gmail.com \
--cc=osalvador@suse.de \
--cc=pasha.tatashin@soleen.com \
--cc=peterx@redhat.com \
--cc=peterz@infradead.org \
--cc=pfalcato@suse.de \
--cc=pratyush@kernel.org \
--cc=qi.zheng@linux.dev \
--cc=rakie.kim@sk.com \
--cc=riel@surriel.com \
--cc=rppt@kernel.org \
--cc=ryan.roberts@arm.com \
--cc=shakeel.butt@linux.dev \
--cc=shikemeng@huaweicloud.com \
--cc=stable@vger.kernel.org \
--cc=surenb@google.com \
--cc=usama.anjum@arm.com \
--cc=usama.arif@linux.dev \
--cc=vbabka@kernel.org \
--cc=weixugc@google.com \
--cc=will@kernel.org \
--cc=willy@infradead.org \
--cc=xu.xin@linux.dev \
--cc=ying.huang@linux.alibaba.com \
--cc=youngjun.park@lge.com \
--cc=yuanchu@google.com \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox