From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E998C341660 for ; Sun, 5 Jul 2026 19:24:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783279453; cv=none; b=TN9cC8CJ1BDCDm3k39DVClzR+cc9CuGOPnCMLgmXVccyGso3xF5E/FRqGhN8Beg67wXRZh4Pi42kmvr17CotiRMScoZCh/5K62l0MwTXv9z3pEGjFAzO4dScik1veN6PDhr1giqz78TJsrbDDV2eRWXLkcvskh6QJj59dNQd5aU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783279453; c=relaxed/simple; bh=Jd4ymHukGOctmKgFKrC+Fa1a03gmBZi6gn2VJBDpBLU=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=K3T0VwNI3xwZxHj3tcuXO89vSjs+BuKU4A8C2mIqubvwVNi+ITzBd9mQmqNaKQLf0WtuC59jzwW2wTRn8TftOt4/KK/ILEC1wFVyE9mQXV9eMkcTugVia8jsSdM2XpGrNmWPpEEyZofjdqEo+1u5LbAmrN9WXGK3xwAEDbyOtNI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=Hpi4V1cH; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="Hpi4V1cH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EB38A1F000E9; Sun, 5 Jul 2026 19:24:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1783279451; bh=WdAOV4jTXETI55ttjbV9xV8cB+fGX14AaRjD6nCElhQ=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=Hpi4V1cHkY4R+5QDU5ssT+41lUT4m3MyuD8IbW9Ls2gqqqajSE3hQsRvQ7zeJmP4s CKklW6srKTS+v7kD7iJ9XkHk+h69LOHo+XWHUPixjSL8CwnV+La1XMQSjxnH/qb8pb mDjmpZaFT6fwGWZAY2obmF/rxn+gXRK7xVWEEz6Q= Date: Sun, 5 Jul 2026 12:24:10 -0700 From: Andrew Morton To: Usama Arif Cc: baohua@kernel.org, baolin.wang@linux.alibaba.com, david@kernel.org, dev.jain@arm.com, lance.yang@linux.dev, liam@infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, ljs@kernel.org, npache@redhat.com, ryan.roberts@arm.com, ziy@nvidia.com, aarcange@redhat.com, shakeel.butt@linux.dev, hannes@cmpxchg.org, riel@surriel.com, kernel-team@meta.com, sashiko-bot Subject: Re: [PATCH] userfaultfd: wait on source PMD during UFFDIO_MOVE Message-Id: <20260705122410.d44328f443b63b96bc6280fc@linux-foundation.org> In-Reply-To: <20260705131231.1499198-1-usama.arif@linux.dev> References: <20260705131231.1499198-1-usama.arif@linux.dev> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Sun, 5 Jul 2026 06:12:31 -0700 Usama Arif wrote: > move_pages_huge_pmd() snapshots src_pmdval under src_ptl, drops the lock, > and, for migration entries, waits with pmd_migration_entry_wait(). > > Passing &src_pmdval is wrong. pmd_migration_entry_wait() must lock and > re-read the real page-table PMD; on split-PMD-lock kernels, a stack > address also resolves to the wrong lock. softleaf_entry_wait_on_locked() > then waits without a folio reference, which is safe only while serialized > against migration-entry removal by the real PT lock. > > Pass src_pmd, matching __handle_mm_fault() and hmm_vma_walk_pmd(). Thanks. > Reported-by: sashiko-bot > Link: https://sashiko.dev/#/patchset/20260703173903.3789516-1-usama.arif%40linux.dev?part=8 Sashiko says "wild spinlock acquisition and memory corruption", so I'll add a cc:stable to this. > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -2775,7 +2775,7 @@ int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pm > if (!pmd_trans_huge(src_pmdval)) { > spin_unlock(src_ptl); > if (pmd_is_migration_entry(src_pmdval)) { > - pmd_migration_entry_wait(mm, &src_pmdval); > + pmd_migration_entry_wait(mm, src_pmd); > return -EAGAIN; > } > return -ENOENT;