From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 822153F787F for ; Tue, 7 Jul 2026 13:53:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783432414; cv=none; b=PAAb8BEhk7YM/cZHrpTxTWbMiwTiNaEQGlxhIrlo0hHQB3kmSMqAoGpeTasMDG3l2qLYVEDjmu+Bde58cvllk7shbGHfXFaWrlPwjkb8PIrPxuTkbkFMZpQlNKYqPuxTQTTHo9jNID+yLGKgRllDQIw3ffbWJOlOC7LmpHBBXxA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783432414; c=relaxed/simple; bh=yCZmfQzEeu3pnbZgAGuifIJvhlCu5yMo8KlyLnRl48I=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RDA0nTkvk7equsCMcuEqyT7qIS65bmIbAIAyJBRpEKscbH1L8DPZMfNFnFybdxKl57n3VeH3i+CPinpPsCBvgMPuhv4cGfg/Uk93ctMPAe+lPHwR6IauXbmacVfX2rlenA0zG/WpLM9pLrs+REk2iDHlDHcewn6oHLJZvSMDE/4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=bOEfrOOd; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="bOEfrOOd" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1783432410; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=quqW7QPkkOmuZBsVPZ6/a3v09/W0iGtXtzNekQUkyPQ=; b=bOEfrOOdGuOrim4uKpsIvxxBxZIz2xNb0Lp6GVAkmYdPwWkfmxFv6q82lsGngNwTn0Uhtp 0PC09+w0Q0nUSEvYgcdT5eDKB6MtOIP+K18zkmp6Oz768mkISYkUXPW/EEug62fjQXhSqm oitahOP5nju9IzBuRypc8sqyu+1TQZg= From: Usama Arif To: Andrew Morton , apopple@nvidia.com, baohua@kernel.org, baolin.wang@linux.alibaba.com, byungchul@sk.com, david@kernel.org, dev.jain@arm.com, gourry@gourry.net, jannh@google.com, joshua.hahnjy@gmail.com, lance.yang@linux.dev, liam@infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, ljs@kernel.org, matthew.brost@intel.com, npache@redhat.com, rakie.kim@sk.com, ryan.roberts@arm.com, usama.arif@linux.dev, vbabka@kernel.org, ying.huang@linux.alibaba.com, ziy@nvidia.com, shakeel.butt@linux.dev, hannes@cmpxchg.org Subject: [PATCH 3/3] mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd Date: Tue, 7 Jul 2026 06:45:09 -0700 Message-ID: <20260707135255.292870-4-usama.arif@linux.dev> In-Reply-To: <20260707135255.292870-1-usama.arif@linux.dev> References: <20260707135255.292870-1-usama.arif@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT madvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then madvise_free_huge_pmd() takes pmd_trans_huge_lock(). pmd_is_huge() returns true for a device-private PMD, so orig_pmd can be device-private and hit the VM_BUG_ON() on the !pmd_present() branch. Potential trigger: an HMM-based GPU driver races with madvise(MADV_FREE): migrate_vma_pages() flips the PMD to a device-private entry between the caller's pmd_trans_huge() check and the callee's pmd_trans_huge_lock(). Skip device-private PMDs after taking the lock, before the !pmd_present() check. Fixes: 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations") Signed-off-by: Usama Arif --- mm/huge_memory.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index c0892cc533a9..cfce9f31b30e 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2296,6 +2296,9 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, if (is_huge_zero_pmd(orig_pmd)) goto out; + if (pmd_is_device_private_entry(orig_pmd)) + goto out; + if (unlikely(!pmd_present(orig_pmd))) { VM_BUG_ON(thp_migration_supported() && !pmd_is_migration_entry(orig_pmd)); -- 2.53.0-Meta