From: "David Hildenbrand (Arm)" <david@kernel.org>
To: SJ Park <sj@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>,
Michal Hocko <mhocko@kernel.org>, Qi Zheng <qi.zheng@linux.dev>,
Shakeel Butt <shakeel.butt@linux.dev>,
Lorenzo Stoakes <ljs@kernel.org>,
Kairui Song <kasong@tencent.com>, Barry Song <baohua@kernel.org>,
Axel Rasmussen <axelrasmussen@google.com>,
Yuanchu Xie <yuanchu@google.com>, Wei Xu <weixugc@google.com>,
Baoquan He <baoquan.he@linux.dev>,
Baolin Wang <baolin.wang@linux.alibaba.com>,
"Liam R. Howlett" <liam@infradead.org>,
Vlastimil Babka <vbabka@kernel.org>,
Mike Rapoport <rppt@kernel.org>,
Suren Baghdasaryan <surenb@google.com>,
Michal Hocko <mhocko@suse.com>, Kees Cook <kees@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Jann Horn <jannh@google.com>, Pedro Falcato <pfalcato@suse.de>,
Hugh Dickins <hughd@google.com>,
Pasha Tatashin <pasha.tatashin@soleen.com>,
Pratyush Yadav <pratyush@kernel.org>,
"Matthew Wilcox (Oracle)" <willy@infradead.org>,
Jan Kara <jack@suse.cz>, Zi Yan <ziy@nvidia.com>,
Lance Yang <lance.yang@linux.dev>,
Rik van Riel <riel@surriel.com>, Harry Yoo <harry@kernel.org>,
Alistair Popple <apopple@nvidia.com>,
Nico Pache <nico.pache@linux.dev>,
Ryan Roberts <ryan.roberts@arm.com>, Dev Jain <dev.jain@arm.com>,
Usama Arif <usama.arif@linux.dev>,
Kiryl Shutsemau <kas@kernel.org>,
Matthew Brost <matthew.brost@intel.com>,
John Hubbard <jhubbard@nvidia.com>, Peter Xu <peterx@redhat.com>,
Will Deacon <will@kernel.org>,
"Aneesh Kumar K.V" <aneesh.kumar@kernel.org>,
Nick Piggin <npiggin@gmail.com>,
Oscar Salvador <osalvador@suse.de>,
Minchan Kim <minchan@kernel.org>,
Muchun Song <muchun.song@linux.dev>, Xu Xin <xu.xin@linux.dev>,
Chengming Zhou <chengming.zhou@linux.dev>,
Chris Li <chrisl@kernel.org>,
Kemeng Shi <shikemeng@huaweicloud.com>,
Nhat Pham <nphamcs@gmail.com>,
Youngjun Park <youngjun.park@lge.com>,
Gregory Price <gourry@gourry.net>,
Joshua Hahn <joshua.hahnjy@gmail.com>,
Rakie Kim <rakie.kim@sk.com>,
Ying Huang <ying.huang@linux.alibaba.com>,
Jason Gunthorpe <jgg@ziepe.ca>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
kexec@lists.infradead.org, linux-fsdevel@vger.kernel.org,
linux-arch@vger.kernel.org, linux-cxl@vger.kernel.org,
Josef Bacik <josef@toxicpanda.com>,
stable@vger.kernel.org
Subject: Re: [PATCH v2 27/47] mm/mmu_gather: fix flushing ranges with 4 GiB or larger
Date: Fri, 30 Oct 2026 12:19:46 +0100 [thread overview]
Message-ID: <6ac05dd8-321a-4c2e-bce8-bd7ffcac9eac@kernel.org> (raw)
In-Reply-To: <48a66134-3522-4b81-adca-4e76d52dc391@kernel.org>
On 10/30/26 12:15, David Hildenbrand (Arm) wrote:
> On 10/30/26 01:57, SJ Park wrote:
>> On Thu, 29 Oct 2026 21:33:22 +0100 "David Hildenbrand (Arm)" <david@kernel.org> wrote:
>>
>>> From: Josef Bacik <josef@toxicpanda.com>
>>>
>>> __tlb_adjust_range() takes the size of the range which has to be flushed
>>> as an unsigned int. Its callers, tlb_flush_{pte,pmd,pud,p4d}_range(), get
>>> and pass an unsigned long. Consequently, a range that is 4 GiB or larger
>>> gets truncated, possibly to 0.
>>>
>>> On arm64 with hugetlb, a 64k kernel can have 16 GiB hugetlb folios
>>> mapped contiguously at the PMD level and flush them when unmapping, and a
>>> 16k kernel can flush 64 GiB PUDs through tlb_unshare_pmd_ptdesc(). So
>>> at least these two scenarios are affected.
>>>
>>> Fix it by flushing the proper range instead of the truncated one by
>>> properly using "unsigned long" for range_size.
>>
>> Makes sense to me.
>>
>>>
>>> Fix generated by an LLM and sent by Josef Bacik in private.
>>>
>>> Fixes: b528e4b6405b ("mm/hugetlb: add tlb_remove_hugetlb_entry for handling hugetlb pages")
>>> Fixes: 8ce720d5bd91 ("mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather")
>>> Cc: stable@vger.kernel.org
>>> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
>>> Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
>>> [ david: use two-tab indent, simplify description ]
>>
>> It seems the convention [1] is to put the above modification note right before
>> the last S-o-b: of David. Maybe you forgot moving it after adding R-b: and
>> T-b: from great reviewers?
>
> It's "b4 trailers" that apparently messes this up. I don't think it really
> matters (some move it above all trailers), but I'll fix this up when applying.
Thinking again, I *think* this order is correct.
People reviewed and tested with these changes.
it would be something different if I modify a patch while applying it. Because
then, what people reviewed and tested would be different to the original version.
--
Cheers,
David
next prev parent reply other threads:[~2026-10-30 11:20 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-29 20:32 [PATCH v2 00/47] mm: various (urgent?) fixes David Hildenbrand (Arm)
2026-10-29 20:32 ` [PATCH v2 01/47] mm/mglru: don't use stack pointers when walking PUD and PMD tables David Hildenbrand (Arm)
2026-10-30 0:20 ` SJ Park
2026-10-30 10:21 ` David Hildenbrand (Arm)
2026-10-29 20:32 ` [PATCH v2 02/47] fork: take mmap_lock before copying mm_struct David Hildenbrand (Arm)
2026-10-30 0:34 ` SJ Park
2026-10-29 20:32 ` [PATCH v2 03/47] mm/memfd: check for real shmem inodes before accessing shmem state David Hildenbrand (Arm)
2026-10-30 11:33 ` Pratyush Yadav
2026-10-30 12:06 ` David Hildenbrand (Arm)
2026-10-30 12:29 ` Pratyush Yadav
2026-10-29 20:32 ` [PATCH v2 04/47] mm/memfd: make f_pos accesses atomic David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 05/47] mm/truncate: look again if a folio left the mapping David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 06/47] mm/filemap: read mapping->a_ops->free_folio under i_lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 07/47] mm/filemap: don't lose a folio lock wakeup to a signal David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 08/47] mm/filemap: finish fault cleanup before dropping the fault lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 09/47] mm/rmap: handle device-exclusive entries in folio_referenced_one() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 10/47] mm/huge_memory: fix list corruption when deferred_split_scan() races with deferred_split_folio() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 11/47] mm/huge_memory: properly handle refcounted PUD mappings on fork David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 12/47] mm/huge_memory: fix livelock on device private folio David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 13/47] mm/huge_memory: fix truncate racing with PMD zapping David Hildenbrand (Arm)
2026-10-29 22:37 ` Gregory Price (Meta)
2026-10-29 20:33 ` [PATCH v2 14/47] mm/huge_memory: fix zapping migration entries for device-private THPs David Hildenbrand (Arm)
2026-10-29 22:30 ` Gregory Price (Meta)
2026-10-30 11:10 ` David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 15/47] mm/khugepaged: always recheck the pmd in try_collapse_pte_mapped_thp() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 16/47] mm/khugepaged: fix PMD table lock leak " David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 17/47] mm/khugepaged: preserve dirty bits when collapsing PTE-mapped THPs David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 18/47] mm/khugepaged: check if PTE table is empty in try_collapse_pte_mapped_thp() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 19/47] mm/gup: recheck the PUD under PTL in follow_pud_mask() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 20/47] mm/gup: fix clearing folios in memfd_pin_folios() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 21/47] mm/gup: fix out-of-bounds write for nr_pages == 0 in GUP-fast David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 22/47] mm/gup: check for overflow when converting nr_pages to bytes " David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 23/47] mm/userfaultfd: write-lock the VMA before waking waiters when unregistering David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 24/47] mm/userfaultfd: wake all waiters on unregister David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 25/47] mm/userfaultfd: wake waiters when registration modes are removed David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 26/47] mm/userfaultfd: compare exact registration modes before skipping David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 27/47] mm/mmu_gather: fix flushing ranges with 4 GiB or larger David Hildenbrand (Arm)
2026-10-30 0:57 ` SJ Park
2026-10-30 11:15 ` David Hildenbrand (Arm)
2026-10-30 11:19 ` David Hildenbrand (Arm) [this message]
2026-10-29 20:33 ` [PATCH v2 28/47] mm/mmu_notifier: finish non-blocking interval invalidation on error David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 29/47] mm/mmu_notifier: set ->mm only after mmgrab() David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 30/47] mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 31/47] mm/mremap: recheck PUDs under the page table lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 32/47] mm/mremap: fix moving PUD leaves David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 33/47] mm/memory_hotplug: avoid races in pfn_to_online_page() with dying pgmap David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 34/47] mm/madvise: fix data loss from MADV_FREE on a KSM page David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 35/47] mm/memory: reject remote COW faults on PFN mappings David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 36/47] mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 37/47] mm: fix unkillable fault loop on MAP_DROPPABLE memory David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 38/47] mm: fix deadlock of mremap() against UFFDIO_MOVE David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 39/47] mm/ksm: reset the unstable trees of all nodes David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 40/47] mm/ksm: fix use of a freed anon_vma at swap-in David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 41/47] mm/ksm: check large swap-cache folios before mapping them David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 42/47] mm/vma: call ->may_split() before a partial merge David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 43/47] mm/huge_memory: split huge PUDs when adjusting VMA boundaries David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 44/47] mm/vma: don't leak the charge for stack growth David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 45/47] mm/cma: don't release CMA pages still in use David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 46/47] mm/memory-tiers: unregister empty tiers outside memory_tier_lock David Hildenbrand (Arm)
2026-10-29 20:33 ` [PATCH v2 47/47] fs/proc/task_mmu: refuse addresses beyond 32 bits on 32bit David Hildenbrand (Arm)
2026-10-30 11:19 ` [PATCH v2 00/47] mm: various (urgent?) fixes Muhammad Usama Anjum
2026-10-30 11:35 ` David Hildenbrand (Arm)
2026-10-30 12:12 ` Muhammad Usama Anjum
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ac05dd8-321a-4c2e-bce8-bd7ffcac9eac@kernel.org \
--to=david@kernel.org \
--cc=aneesh.kumar@kernel.org \
--cc=apopple@nvidia.com \
--cc=axelrasmussen@google.com \
--cc=baohua@kernel.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=baoquan.he@linux.dev \
--cc=chengming.zhou@linux.dev \
--cc=chrisl@kernel.org \
--cc=dev.jain@arm.com \
--cc=gourry@gourry.net \
--cc=hannes@cmpxchg.org \
--cc=harry@kernel.org \
--cc=hughd@google.com \
--cc=jack@suse.cz \
--cc=jannh@google.com \
--cc=jgg@ziepe.ca \
--cc=jhubbard@nvidia.com \
--cc=josef@toxicpanda.com \
--cc=joshua.hahnjy@gmail.com \
--cc=kas@kernel.org \
--cc=kasong@tencent.com \
--cc=kees@kernel.org \
--cc=kexec@lists.infradead.org \
--cc=lance.yang@linux.dev \
--cc=liam@infradead.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=matthew.brost@intel.com \
--cc=mhocko@kernel.org \
--cc=mhocko@suse.com \
--cc=minchan@kernel.org \
--cc=muchun.song@linux.dev \
--cc=nico.pache@linux.dev \
--cc=nphamcs@gmail.com \
--cc=npiggin@gmail.com \
--cc=osalvador@suse.de \
--cc=pasha.tatashin@soleen.com \
--cc=peterx@redhat.com \
--cc=peterz@infradead.org \
--cc=pfalcato@suse.de \
--cc=pratyush@kernel.org \
--cc=qi.zheng@linux.dev \
--cc=rakie.kim@sk.com \
--cc=riel@surriel.com \
--cc=rppt@kernel.org \
--cc=ryan.roberts@arm.com \
--cc=shakeel.butt@linux.dev \
--cc=shikemeng@huaweicloud.com \
--cc=sj@kernel.org \
--cc=stable@vger.kernel.org \
--cc=surenb@google.com \
--cc=usama.arif@linux.dev \
--cc=vbabka@kernel.org \
--cc=weixugc@google.com \
--cc=will@kernel.org \
--cc=willy@infradead.org \
--cc=xu.xin@linux.dev \
--cc=ying.huang@linux.alibaba.com \
--cc=youngjun.park@lge.com \
--cc=yuanchu@google.com \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox