Re: [PATCH v2] mm/rmap: don't discard lazyfree THPs at PMD level

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Mon, Oct 12, 2026 at 10:20:16PM -0400, Zi Yan wrote:
> __discard_anon_folio_pmd_locked() clears a lazyfree THP's PMD before it
> determines whether the folio can be discarded, and restores it if the folio
> is dirty or has extra references. It is done under only the PMD lock and
> the anon_vma read lock inside try_to_unmap_one() and no mmap lock is held.
> The temporarily none PMD causes UAF.
>
> A parallel munmap() or mremap() is supposed to serialize with it on the PMD
> lock, but zap_pmd_range() (called by munmap()) and move_page_tables()
> (called by mremap()) do not take the lock when they see the temporarily
> none PMD and skip the PMD. There is no more page table walk after the none
> PMD is restored:
>
> - munmap(): free_pgtables() waits in unlink_anon_vmas() for the anon_vma
>   lock, then free_pmd_range() drops the restored PMD as bad without
>   removing the rmap, so the folio keeps a stale mapcount.
>
> - whole-VMA MREMAP_DONTUNMAP: dontunmap_complete() unlinks the source VMA
>   from its anon_vma while the restored PMD still maps the folio.
>
> - plain mremap(): the THP is not moved but unmapped, so the THP's data is
>   lost.
>
> In the first two cases, the folio stays mapped, but no VMA that maps it is
> linked to its anon_vma. When the anon_vma is freed, it is still reachable
> when one rmap walks the folio. Racing lazyfree reclaim against
> MREMAP_DONTUNMAP as an unprivileged user reproduces a KASAN use-after-free
> in folio_lock_anon_vma_read() as reported in the Closes link.
>
> One solution is to use an invalidated PMD instead of a cleared one until
> the discard is committed, but it needs arch fixes first.
> 1. GUP-fast still follows an invalidated PMD on riscv, LoongArch and s390.
> 2. sparc64 miscounts thp_pte_count when an invalidated PMD is set again or
>    cleared.
>
> To keep the fix simple for backport, stop discarding lazyfree THPs at PMD
> level instead. try_to_unmap_one() splits the PMD and discards the folio at
> PTE level.
>
> unmap_huge_pmd_locked() and __discard_anon_folio_pmd_locked() are left in
> place, unused, to minimize this fix for backport and the invalidated PMD
> approach is planned as a follow-up series to use them again.
>

Amazing, thanks for that! All LGTM.

> Fixes: 735ecdfaf4e8 ("mm/vmscan: avoid split lazyfree THP during shrink_folio_list()")
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Closes: https://lore.kernel.org/r/20261009165214.40212-2-kylebot@openai.com
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Reviewed-by: Kyle Zeng <kylebot@openai.com>
> Reviewed-by: Lance Yang <lance.yang@linux.dev>
> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> ---
> The proposed fix[1] requires additional arch code fixes[2]. Disable it
> first for stable fix. The function will be re-enabled along with arch code
> fixes.
>
> Link: https://lore.kernel.org/all/20261009165214.40212-2-kylebot@openai.com/ [1]
> Link: https://lore.kernel.org/all/DM0II2QHWWS1.2RXEJXC8S0101@nvidia.com/ [2]
> ---
> Changes in v2:
> 1. added more details on how UAF can happen.
> 2. provides more details on why the invalidated PMD approach is not used.
> 3. explained why unmap_huge_pmd_locked() and
>    __discard_anon_folio_pmd_locked() are left unused.
> - Link to v1: https://patch.msgid.link/20261009-lazyfree-stable-fix-v1-1-70997958ef8d@nvidia.com
> ---
>  mm/rmap.c | 11 -----------
>  1 file changed, 11 deletions(-)
>
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 805db93fe0428..1131b76bbbc28 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -2275,17 +2275,6 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
>  		}
>
>  		if (!pvmw.pte) {
> -			if (folio_test_lazyfree(folio)) {
> -				if (unmap_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, folio))
> -					goto walk_done;
> -				/*
> -				 * unmap_huge_pmd_locked has either already marked
> -				 * the folio as swap-backed or decided to retain it
> -				 * due to GUP or speculative references.
> -				 */
> -				goto walk_abort;
> -			}
> -
>  			if (flags & TTU_SPLIT_HUGE_PMD) {
>  				/*
>  				 * We temporarily have to drop the PTL and
>
> ---
> base-commit: 8b38ed9ab5b09c8ba168cbcc49524e9b380ee5c4
> change-id: 20261009-lazyfree-stable-fix-67712b2049dd
>
> Best regards,
> --
> Yan, Zi
>

--
Cheers, Lorenzo