From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 5CB7860A2616 for ; Thu, 29 Oct 2026 20:36:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Wn33W2jS Received: by kanga.kvack.org (Postfix) id 7C32F6B05C6; Thu, 29 Oct 2026 16:36:45 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7994F6B05C7; Thu, 29 Oct 2026 16:36:45 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6AFAC6B05C8; Thu, 29 Oct 2026 16:36:45 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 4B4F66B05C6 for ; Thu, 29 Oct 2026 16:36:45 -0400 (EDT) Received: from smtpin01.hostedemail.com (lb01a-stub [10.200.18.249]) by unirelay06.hostedemail.com (Postfix) with ESMTP id D6ABFA805D for ; Thu, 29 Oct 2026 20:36:44 +0000 (UTC) X-FDA: 85376822328.01.96FF0FB Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by imf07.hostedemail.com (Postfix) with ESMTP id 06EEF40006 for ; Thu, 29 Oct 2026 20:36:42 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20260515 header.b=Wn33W2jS; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf07.hostedemail.com: domain of david@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=david@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1793306203; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=q5vK/qK4XuBQrL53cs9TeuLxUrSX2eJpWdLNS5EZvqY=; b=BWBl/mSFZlGoffEpW+UPCK+VeQDfVfpYpmz+d9Ob+Vr68qBCvS5e/R4P+TivxB+9j+WAQj ZRM11t336IHMI1POnF6R+ZrqDPOtinx40P/QXvnKPeROotJZdcHSCxNQz78wZuPXtt9Ups 5z0BA133IQ8A1fO3iqRW+JJqf1LYzUc= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20260515 header.b=Wn33W2jS; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf07.hostedemail.com: domain of david@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=david@kernel.org ARC-Seal: i=1; a=rsa-sha256; d=hostedemail.com; s=arc-20220608; cv=none; t=1793306203; b=D0rU+T5a/p15U16TC5OTsvWNIvYkgqE7bnmZiVSTsgjHbqzUADleqbQhvIDjvqe3kR7xD1 QXffTB4JJatFaLwSQL58prGKHHJCiDoRuTJTeeSE55kna8ILZLdvO5Z3TussuHcvCcbBPP RWKSYmT9rYxdK3pzr0sQ+3FpZqht7Ec= Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 3E89240F48; Thu, 29 Oct 2026 20:36:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B39EF1F01816; Thu, 29 Oct 2026 20:36:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793306202; bh=q5vK/qK4XuBQrL53cs9TeuLxUrSX2eJpWdLNS5EZvqY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Wn33W2jSO7FMd6s0f6J+WahGrG50HQ170ETyv6hs47qSO1TwExsP9mS9I9/sBR3+c 7wsvODaM9WxAO5Rc5MJD34QTdFNd4D08AlxQyrVme7gS4+H0uLmPkOVIJZg7RTVfdc zaLgXKXLjTgdZKdtfmg0AFBGu9Ssc9s+ntFiFxRAjCvlss1/LcmLsBYqtdrqVGlRG0 9CDMyd4sYfaUFqKRB9NscT9OhnDRrKnXImU+vH5BiOtbyQW/e/5qy85Fn5d/9xx7cr Su1TurTVFKrvkJSSNlOjYBJx5bpNzRnX2gPRMqdkL8WXnfFrlviI2cmvyyjoLIzbjy 7x2DRkHzJkQnw== From: "David Hildenbrand (Arm)" Date: Thu, 29 Oct 2026 21:33:08 +0100 Subject: [PATCH v2 13/47] mm/huge_memory: fix truncate racing with PMD zapping X-Archived-By: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261029-fixes_core-v2-13-a64ce7f83abb@kernel.org> References: <20261029-fixes_core-v2-0-a64ce7f83abb@kernel.org> In-Reply-To: <20261029-fixes_core-v2-0-a64ce7f83abb@kernel.org> To: Andrew Morton , Johannes Weiner , Michal Hocko , Qi Zheng , Shakeel Butt , Lorenzo Stoakes , Kairui Song , Barry Song , Axel Rasmussen , Yuanchu Xie , Wei Xu , Baoquan He , Baolin Wang , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Kees Cook , Peter Zijlstra , Jann Horn , Pedro Falcato , Hugh Dickins , Pasha Tatashin , Pratyush Yadav , "Matthew Wilcox (Oracle)" , Jan Kara , Zi Yan , Lance Yang , Rik van Riel , Harry Yoo , Alistair Popple , Nico Pache , Ryan Roberts , Dev Jain , Usama Arif , Kiryl Shutsemau , Matthew Brost , John Hubbard , Peter Xu , Will Deacon , "Aneesh Kumar K.V" , Nick Piggin , Oscar Salvador , Minchan Kim , Muchun Song , Xu Xin , Chengming Zhou , Chris Li , Kemeng Shi , Nhat Pham , Youngjun Park , Gregory Price , Joshua Hahn , Rakie Kim , Ying Huang , Jason Gunthorpe Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-cxl@vger.kernel.org, Chris Mason , stable@vger.kernel.org, "David Hildenbrand (Arm)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2058; i=david@kernel.org; h=from:subject:message-id; bh=whzXA4Qm4HXSA1pqm4tcjWrVcDozZ04CivHfstsAKVQ=; b=owGbwMvMwCF2/OVpCdfQ3ZWMp9WSGLIer221D+SO8q1Sly3O/b/h+7nDEu/kw7iWNp/nM7Vet HgP39H4jlIWBjEOBlkxRZag4PsGL1+uq61242OGmcPKBDKEgYtTAG6yEMM/UwX358mXle/zSWT1 C8a7zAkNVfL6do+z7XPyZJFLRnKKDL+YK/rkNSuXzGoxr93d/TuuL1y5+PQNd8e8cyxz3n6uMeQ BAA== X-Developer-Key: i=david@kernel.org; a=openpgp; fpr=1BD9CAAD735C4C3A460DFCCA4DDE10F700FF835A X-Rspamd-Queue-Id: 06EEF40006 X-Stat-Signature: fetiwx7ecrh4sh7h9fpeqza8fuz7q7w6 X-Rspamd-Server: rspam06 X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_PASS, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=4.0.1 X-Rspam-User: X-HE-Tag: 1793306202-925739 X-HE-Meta: U2FsdGVkX19W5POXhgyA1L/I6oxqj5bSbrT90ZA87i4csJ+d/ktP7irsqrKxfYuxu5nUgxuAfsvjS3c90MEb+o0yGZ6/kHLri0ngLKUu0RgPyp6Td6Ak7HRsiDikJb1lkkheehtQ5b08vHerp8SDTQJrxY1PB/lmb0Vqw+zaPB8aIpWQdERZfkZZGndWHifaR5cT4hV90edYijvaKA+/ewidhQXBVSPd/bsp+ojqRZZG+X+JoqAH2CgFzAGPK8h+Z2+dMjqOihzijluZiolII/qeDUB4e0KuQZH5KOqHAmq0zhri0QyTpRiLlucLVMMPOBNYv6cF4p89PL3OfgMFvZ7DCECr6ELxS/k/xCcqCxRiTDCSHT0eSqKVmjtj9KqQMNAI+zl89v5N2uxzuJbWvuAksh0hBuN/XasvvEfLQn4Pkog/bAHm9SRmmwryRGqXu4iqYbjUxUkGFSk/K1+o22t88E2aYTFxwjkayU8ZXLtXnBffMGmqljVz+uqhhpRJj4tY1BbBCBgD48I+mW5zD7ucOwEUcdgjWG6kvQ4RCLvPbspbtTjgqHFNntS8NJchBGUDyOIh2f7fo7splH84Wjzbkdg8l3PPPuJUNBPFIIlX/JBmhqrHdFL54EPe/xZMyrF/wLuc3a1ktgzgLFgSbBG4QQsxrmHBBTNAC38VSEdnR9RCQtkiG2sSEmqLciHLJ0jnHe/cyA1jgr/5fWEFxRH6QQ3sZUVR1pR45gIKyTyZHF5w4jY84uaao8QHS6VlTYQtlnj/dJlJD7YigrJH5xL5JALViQ4asI32e/wK/PUoHtBAxU/Hj+7cWjSpFfV2BUHxJfZxdJf3itC4DUyt0JUvkrGx4C+fWVYcru4m4Brj6bfrkkGKyyFrA1UgW0/ksYBsTVyTZJFPlHXox0/rItVPozyaUfMTRH/m2ZkzF8e6fmMolBFh8U2k8szQCMGTUEUWOSSwsApLKu+ybLb oLv+WDR2 KISQ7cEd6FwLshL7uchKc8qvgIj9Lji8LXT7j4OqvUXUCOE/5kBaONxDopKM2A3xqCUc7Xc8rkk7q0xfqhBOGDIQPlwTji0JJnW9Hw2Co1mI7Js4MEbW1ekjPt8YvknrRtQzksYU3hqgUVxsaC/fgGlrVwKXpAgino6mfw+SSIDCw+GBc38QLaUJ4nUkEERPURmzAo91H63r99hDdjjS58iG/xhilu1BcbGeQPhrxFjsQ4eTl4cT7Fbb5EWjQEF51uS3acLWgEjDLIMJpG/jOaIDLE0zNy4TyeOyqlp8kXlBkcexU3V3WDung/E1RqXwikkCT8RlyVuz4B5ScRtgLZ9+rUIg/GdFDUx4tgDrOBj0MlhU= Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 From: Chris Mason zap_huge_pmd_folio() removes the rmap before calling folio_mark_dirty(). If this was the last mapping, truncation can skip unmapping the folio and proceed without waiting for the PMD lock, racing with dirtying. ifs_set_range_dirty() can oops if MADV_DONTNEED races with ftruncate() on XFS, when we get the folio set dirty after it was found to not be mapped anymore. Move folio_mark_dirty() and folio_mark_accessed() before rmap removal, matching the PTE zap path. This keeps the folio mapped while updating its state, so truncation must wait for the page table lock. Fix generated by an LLM and sent by Chris Mason in private. Fixes: fe6cf984939d ("mm/huge_memory: transfer the pmd dirty bit to the folio on zap") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify comment and description ] Signed-off-by: David Hildenbrand (Arm) --- mm/huge_memory.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2b31a425c7a3..1d65c4f576f9 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2495,10 +2495,6 @@ static void zap_huge_pmd_folio(struct mm_struct *mm, struct vm_area_struct *vma, { const bool is_device_private = folio_is_device_private(folio); - /* Present and device private folios are rmappable. */ - if (is_present || is_device_private) - folio_remove_rmap_pmd(folio, &folio->page, vma); - if (folio_test_anon(folio)) { add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR); } else { @@ -2512,6 +2508,13 @@ static void zap_huge_pmd_folio(struct mm_struct *mm, struct vm_area_struct *vma, folio_mark_accessed(folio); } + /* + * Present and device private folios are rmappable. Remove the + * rmap after transferring young+dirty to the folio. + */ + if (is_present || is_device_private) + folio_remove_rmap_pmd(folio, &folio->page, vma); + /* Device private folios are pinned. */ if (is_device_private) folio_put(folio); -- 2.43.0