Re: [PATCH v5] selftests/mm: add folio_split() and filemap_get_entry() race test

[Zi Yan <ziy@nvidia.com>]

Hi Andrew,

In case you missed this v5. It addressed David comments on v4.

In terms of sashiko review[1] on this one,

1. the false sharing one can be ignored, I can use this test to reliably
reproduce the issue in the old kernels.

2. the thp_cleanup_handler() one has been addressed before and
the chance of causing an issue should be very low.

Thanks.


[1] https://sashiko.dev/#/patchset/20260323163717.184107-1-ziy%40nvidia.com

On 23 Mar 2026, at 12:37, Zi Yan wrote:

> The added folio_split_race_test is a modified C port of the race condition
> test from [1]. The test creates shmem huge pages, where the main thread
> punches holes in the shmem to cause folio_split() in the kernel and
> a set of 16 threads reads the shmem to cause filemap_get_entry() in the
> kernel. filemap_get_entry() reads the folio and xarray split by
> folio_split() locklessly. The original test[2] is written in rust and uses
> memfd (shmem backed). This C port uses shmem directly and use a single
> process.
>
> Note: the initial rust to C conversion is done by Cursor.
>
> Link: https://lore.kernel.org/all/CAKNNEtw5_kZomhkugedKMPOG-sxs5Q5OLumWJdiWXv+C9Yct0w@mail.gmail.com/ [1]
> Link: https://github.com/dfinity/thp-madv-remove-test [2]
> Co-developed-by: Bas van Dijk <bas@dfinity.org>
> Signed-off-by: Bas van Dijk <bas@dfinity.org>
> Co-developed-by: Adam Bratschi-Kaye <adam.bratschikaye@dfinity.org>
> Signed-off-by: Adam Bratschi-Kaye <adam.bratschikaye@dfinity.org>
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> ---
> From V4:
> 1. added missing .gitignore entry.
> 2. used PRIu64 for all uint64_t.
> 3. added pthread_barrier_t to ensure main thread starts to punch holes when
>    all reader threads are spawned.
> 4. converted size_t to uint64_t.
> 5. used thp_availabe() instead of thp_is_enabled().
> 6. added a check on read_pmd_pagesize() to skip the test if pmd_pagesize
>    is 0.
> 7. removed static test information.
> 8. started iter from 0 instead of 1.
> 9. simplified test failure checking code.
> 10. added missing Co-developed-by.
>
> From V3:
> 1. fixed for loop stepping issue
> 2. used PRIu64 instead of %zu for uint64_t.
>
> From V2:
> 1. simplied the program by removing fork.
>
> From V1:
> 1. added prctl(PR_SET_PDEATHSIG, SIGTERM) to avoid child looping
>    forever.
> 2. removed page_idx % PUNCH_INTERVAL >= 0, since it is a nop. Added a
>    comment.
> 3. added a child process status check to prevent parent looping forever
>    and record that as a failure.
> 4. used ksft_exit_skip() instead of ksft_finished() when the program is
>    not running as root.
> 5. restored THP settings properly when the program exits abnormally.
>
>  tools/testing/selftests/mm/.gitignore         |   1 +
>  tools/testing/selftests/mm/Makefile           |   1 +
>  .../selftests/mm/folio_split_race_test.c      | 297 ++++++++++++++++++
>  tools/testing/selftests/mm/run_vmtests.sh     |   2 +
>  4 files changed, 301 insertions(+)
>  create mode 100644 tools/testing/selftests/mm/folio_split_race_test.c
>
> diff --git a/tools/testing/selftests/mm/.gitignore b/tools/testing/selftests/mm/.gitignore
> index 83ad9454dd9d1..b0c30c5ee9e30 100644
> --- a/tools/testing/selftests/mm/.gitignore
> +++ b/tools/testing/selftests/mm/.gitignore
> @@ -61,3 +61,4 @@ guard-regions
>  merge
>  prctl_thp_disable
>  rmap
> +folio_split_race_test
> diff --git a/tools/testing/selftests/mm/Makefile b/tools/testing/selftests/mm/Makefile
> index 7a5de4e9bf520..cd24596cdd27e 100644
> --- a/tools/testing/selftests/mm/Makefile
> +++ b/tools/testing/selftests/mm/Makefile
> @@ -105,6 +105,7 @@ TEST_GEN_FILES += droppable
>  TEST_GEN_FILES += guard-regions
>  TEST_GEN_FILES += merge
>  TEST_GEN_FILES += rmap
> +TEST_GEN_FILES += folio_split_race_test
>
>  ifneq ($(ARCH),arm64)
>  TEST_GEN_FILES += soft-dirty
> diff --git a/tools/testing/selftests/mm/folio_split_race_test.c b/tools/testing/selftests/mm/folio_split_race_test.c
> new file mode 100644
> index 0000000000000..ff026f183ac7e
> --- /dev/null
> +++ b/tools/testing/selftests/mm/folio_split_race_test.c
> @@ -0,0 +1,297 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * The test creates shmem PMD huge pages, fills all pages with known patterns,
> + * then continuously verifies non-punched pages with 16 threads. Meanwhile, the
> + * main thread punches holes via MADV_REMOVE on the shmem.
> + *
> + * It tests the race condition between folio_split() and filemap_get_entry(),
> + * where the hole punches on shmem lead to folio_split() and reading the shmem
> + * lead to filemap_get_entry().
> + */
> +
> +#define _GNU_SOURCE
> +#include <errno.h>
> +#include <inttypes.h>
> +#include <linux/mman.h>
> +#include <pthread.h>
> +#include <stdatomic.h>
> +#include <stdbool.h>
> +#include <stdint.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/mman.h>
> +#include <signal.h>
> +#include <unistd.h>
> +#include "vm_util.h"
> +#include "kselftest.h"
> +#include "thp_settings.h"
> +
> +uint64_t page_size;
> +uint64_t pmd_pagesize;
> +#define NR_PMD_PAGE 5
> +#define FILE_SIZE (pmd_pagesize * NR_PMD_PAGE)
> +#define TOTAL_PAGES (FILE_SIZE / page_size)
> +
> +/* Every N-th to N+M-th pages are punched; not aligned with huge page boundaries. */
> +#define PUNCH_INTERVAL 50 /* N */
> +#define PUNCH_SIZE_FACTOR 3 /* M */
> +
> +#define NUM_READER_THREADS 16
> +#define FILL_BYTE 0xAF
> +#define NUM_ITERATIONS 100
> +
> +/* Shared control block: control reading threads and record stats */
> +struct shared_ctl {
> +	atomic_uint_fast32_t stop;
> +	atomic_uint_fast64_t reader_failures;
> +	atomic_uint_fast64_t reader_verified;
> +	pthread_barrier_t barrier;
> +};
> +
> +static void fill_page(unsigned char *base, size_t page_idx)
> +{
> +	unsigned char *page_ptr = base + page_idx * page_size;
> +	uint64_t idx = (uint64_t)page_idx;
> +
> +	memset(page_ptr, FILL_BYTE, page_size);
> +	memcpy(page_ptr, &idx, sizeof(idx));
> +}
> +
> +/* Returns true if valid, false if corrupted. */
> +static bool check_page(unsigned char *base, uint64_t page_idx)
> +{
> +	unsigned char *page_ptr = base + page_idx * page_size;
> +	uint64_t expected_idx = (uint64_t)page_idx;
> +	uint64_t got_idx;
> +
> +	memcpy(&got_idx, page_ptr, 8);
> +
> +	if (got_idx != expected_idx) {
> +		uint64_t off;
> +		int all_zero = 1;
> +
> +		for (off = 0; off < page_size; off++) {
> +			if (page_ptr[off] != 0) {
> +				all_zero = 0;
> +				break;
> +			}
> +		}
> +		if (all_zero) {
> +			ksft_print_msg("CORRUPTED: page %" PRIu64
> +				       " (huge page %" PRIu64
> +				       ") is ALL ZEROS\n",
> +				       page_idx,
> +				       (page_idx * page_size) / pmd_pagesize);
> +		} else {
> +			ksft_print_msg("CORRUPTED: page %" PRIu64
> +				       " (huge page %" PRIu64
> +				       "): expected idx %" PRIu64
> +				       ", got %" PRIu64 "\n",
> +				       page_idx,
> +				       (page_idx * page_size) / pmd_pagesize,
> +				       page_idx, got_idx);
> +		}
> +		return false;
> +	}
> +	return true;
> +}
> +
> +struct reader_arg {
> +	unsigned char *base;
> +	struct shared_ctl *ctl;
> +	int tid;
> +	atomic_uint_fast64_t *failures;
> +	atomic_uint_fast64_t *verified;
> +};
> +
> +static void *reader_thread(void *arg)
> +{
> +	struct reader_arg *ra = (struct reader_arg *)arg;
> +	unsigned char *base = ra->base;
> +	struct shared_ctl *ctl = ra->ctl;
> +	int tid = ra->tid;
> +	atomic_uint_fast64_t *failures = ra->failures;
> +	atomic_uint_fast64_t *verified = ra->verified;
> +	uint64_t page_idx;
> +
> +	pthread_barrier_wait(&ctl->barrier);
> +
> +	while (atomic_load_explicit(&ctl->stop, memory_order_acquire) == 0) {
> +		for (page_idx = (size_t)tid; page_idx < TOTAL_PAGES;
> +		     page_idx += NUM_READER_THREADS) {
> +			/*
> +			 * page_idx % PUNCH_INTERVAL is in [0, PUNCH_INTERVAL),
> +			 * skip [0, PUNCH_SIZE_FACTOR)
> +			 */
> +			if (page_idx % PUNCH_INTERVAL < PUNCH_SIZE_FACTOR)
> +				continue;
> +			if (check_page(base, page_idx))
> +				atomic_fetch_add_explicit(verified, 1,
> +							  memory_order_relaxed);
> +			else
> +				atomic_fetch_add_explicit(failures, 1,
> +							  memory_order_relaxed);
> +		}
> +		if (atomic_load_explicit(failures, memory_order_relaxed) > 0)
> +			break;
> +	}
> +
> +	return NULL;
> +}
> +
> +static void create_readers(pthread_t *threads, struct reader_arg *args,
> +			   unsigned char *base, struct shared_ctl *ctl)
> +{
> +	int i;
> +
> +	for (i = 0; i < NUM_READER_THREADS; i++) {
> +		args[i].base = base;
> +		args[i].ctl = ctl;
> +		args[i].tid = i;
> +		args[i].failures = &ctl->reader_failures;
> +		args[i].verified = &ctl->reader_verified;
> +		if (pthread_create(&threads[i], NULL, reader_thread,
> +				   &args[i]) != 0)
> +			ksft_exit_fail_msg("pthread_create failed\n");
> +	}
> +}
> +
> +/* Run a single iteration. Returns total number of corrupted pages. */
> +static uint64_t run_iteration(void)
> +{
> +	uint64_t reader_failures, reader_verified;
> +	struct reader_arg args[NUM_READER_THREADS];
> +	pthread_t threads[NUM_READER_THREADS];
> +	unsigned char *mmap_base;
> +	struct shared_ctl ctl;
> +	uint64_t i;
> +
> +	memset(&ctl, 0, sizeof(struct shared_ctl));
> +
> +	mmap_base = mmap(NULL, FILE_SIZE, PROT_READ | PROT_WRITE,
> +			 MAP_SHARED | MAP_ANONYMOUS, -1, 0);
> +
> +	if (mmap_base == MAP_FAILED)
> +		ksft_exit_fail_msg("mmap failed: %d\n", errno);
> +
> +	if (madvise(mmap_base, FILE_SIZE, MADV_HUGEPAGE) != 0)
> +		ksft_exit_fail_msg("madvise(MADV_HUGEPAGE) failed: %d\n",
> +				   errno);
> +
> +	for (i = 0; i < TOTAL_PAGES; i++)
> +		fill_page(mmap_base, i);
> +
> +	if (!check_huge_shmem(mmap_base, NR_PMD_PAGE, pmd_pagesize))
> +		ksft_exit_fail_msg("No shmem THP is allocated\n");
> +
> +	if (pthread_barrier_init(&ctl.barrier, NULL, NUM_READER_THREADS + 1) != 0)
> +		ksft_exit_fail_msg("pthread_barrier_init failed\n");
> +
> +	create_readers(threads, args, mmap_base, &ctl);
> +
> +	/* Wait for all reader threads to be ready before punching holes. */
> +	pthread_barrier_wait(&ctl.barrier);
> +
> +	for (i = 0; i < TOTAL_PAGES; i++) {
> +		if (i % PUNCH_INTERVAL != 0)
> +			continue;
> +		if (madvise(mmap_base + i * page_size,
> +			    PUNCH_SIZE_FACTOR * page_size, MADV_REMOVE) != 0) {
> +			ksft_exit_fail_msg(
> +				"madvise(MADV_REMOVE) failed on page %" PRIu64 ": %d\n",
> +				i, errno);
> +		}
> +
> +		i += PUNCH_SIZE_FACTOR - 1;
> +	}
> +
> +	atomic_store_explicit(&ctl.stop, 1, memory_order_release);
> +
> +	for (i = 0; i < NUM_READER_THREADS; i++)
> +		pthread_join(threads[i], NULL);
> +
> +	pthread_barrier_destroy(&ctl.barrier);
> +
> +	reader_failures = atomic_load_explicit(&ctl.reader_failures,
> +					       memory_order_acquire);
> +	reader_verified = atomic_load_explicit(&ctl.reader_verified,
> +					       memory_order_acquire);
> +	if (reader_failures)
> +		ksft_print_msg("Child: %" PRIu64 " pages verified, %" PRIu64 " failures\n",
> +			       reader_verified, reader_failures);
> +
> +	munmap(mmap_base, FILE_SIZE);
> +
> +	return reader_failures;
> +}
> +
> +static void thp_cleanup_handler(int signum)
> +{
> +	thp_restore_settings();
> +	/*
> +	 * Restore default handler and re-raise the signal to exit.
> +	 * This is to ensure the test process exits with the correct
> +	 * status code corresponding to the signal.
> +	 */
> +	signal(signum, SIG_DFL);
> +	raise(signum);
> +}
> +
> +static void thp_settings_cleanup(void)
> +{
> +	thp_restore_settings();
> +}
> +
> +int main(void)
> +{
> +	struct thp_settings current_settings;
> +	uint64_t corrupted_pages;
> +	uint64_t iter;
> +
> +	ksft_print_header();
> +
> +	page_size = getpagesize();
> +	pmd_pagesize = read_pmd_pagesize();
> +
> +	if (!thp_available() || !pmd_pagesize)
> +		ksft_exit_skip("Transparent Hugepages not available\n");
> +
> +	if (geteuid() != 0)
> +		ksft_exit_skip("Please run the test as root\n");
> +
> +	thp_save_settings();
> +	/* make sure thp settings are restored */
> +	if (atexit(thp_settings_cleanup) != 0)
> +		ksft_exit_fail_msg("atexit failed\n");
> +
> +	signal(SIGINT, thp_cleanup_handler);
> +	signal(SIGTERM, thp_cleanup_handler);
> +
> +	thp_read_settings(&current_settings);
> +	current_settings.shmem_enabled = SHMEM_ADVISE;
> +	thp_write_settings(&current_settings);
> +
> +	ksft_set_plan(1);
> +
> +	ksft_print_msg("folio split race test\n");
> +
> +	for (iter = 0; iter < NUM_ITERATIONS; iter++) {
> +		corrupted_pages = run_iteration();
> +		if (corrupted_pages > 0)
> +			break;
> +	}
> +
> +	if (iter < NUM_ITERATIONS)
> +		ksft_test_result_fail("FAILED on iteration %" PRIu64
> +				      ": %" PRIu64
> +				      " pages corrupted by MADV_REMOVE!\n",
> +				      iter, corrupted_pages);
> +	else
> +		ksft_test_result_pass("All %d iterations passed\n",
> +				      NUM_ITERATIONS);
> +
> +	ksft_exit(iter == NUM_ITERATIONS);
> +
> +	return 0;
> +}
> diff --git a/tools/testing/selftests/mm/run_vmtests.sh b/tools/testing/selftests/mm/run_vmtests.sh
> index 606558cc3b098..530980fdf3227 100755
> --- a/tools/testing/selftests/mm/run_vmtests.sh
> +++ b/tools/testing/selftests/mm/run_vmtests.sh
> @@ -553,6 +553,8 @@ if [ -n "${MOUNTED_XFS}" ]; then
>      rm -f ${XFS_IMG}
>  fi
>
> +CATEGORY="thp" run_test ./folio_split_race_test
> +
>  CATEGORY="migration" run_test ./migration
>
>  CATEGORY="mkdirty" run_test ./mkdirty
> -- 
> 2.53.0


Best Regards,
Yan, Zi