Re: [PATCH 5.10 419/491] mm/hugetlb: make detecting shared pte more reliable

Ben Hutchings
2026-04-13T20:36:50Z

[-- Attachment #1: Type: text/plain, Size: 3697 bytes --]

On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Miaohe Lin <linmiaohe@huawei.com>

Missing "commit 3aa4ed8040e1535d95c03cef8b52cf11bf0d8546 upstream."

Ben.

> If the pagetables are shared, we shouldn't copy or take references. Since
> src could have unshared and dst shares with another vma, huge_pte_none()
> is thus used to determine whether dst_pte is shared. But this check isn't
> reliable. A shared pte could have pte none in pagetable in fact. The
> page count of ptep page should be checked here in order to reliably
> determine whether pte is shared.
>
> [lukas.bulwahn@gmail.com: remove unused local variable dst_entry in copy_hugetlb_page_range()]
> Link: https://lkml.kernel.org/r/20220822082525.26071-1-lukas.bulwahn@gmail.com
> Link: https://lkml.kernel.org/r/20220816130553.31406-7-linmiaohe@huawei.com
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
> Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
> Cc: Muchun Song <songmuchun@bytedance.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit 3aa4ed8040e1535d95c03cef8b52cf11bf0d8546)
> [ David: We don't have 4eae4efa2c29 ("hugetlb: do early cow when page
> pinned on src mm", so there are some contextual conflicts. ]
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> mm/hugetlb.c | 19 +++++++------------
> 1 file changed, 7 insertions(+), 12 deletions(-)
>
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 99a71943c1f69..a2cab8f2190f8 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -3827,7 +3827,7 @@ static bool is_hugetlb_entry_hwpoisoned(pte_t pte)
> int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
> struct vm_area_struct *vma)
> {
> - pte_t *src_pte, *dst_pte, entry, dst_entry;
> + pte_t *src_pte, *dst_pte, entry;
> struct page *ptepage;
> unsigned long addr;
> int cow;
> @@ -3867,27 +3867,22 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
>
> /*
> * If the pagetables are shared don't copy or take references.
> - * dst_pte == src_pte is the common case of src/dest sharing.
> *
> + * dst_pte == src_pte is the common case of src/dest sharing.
> * However, src could have 'unshared' and dst shares with
> - * another vma. If dst_pte !none, this implies sharing.
> - * Check here before taking page table lock, and once again
> - * after taking the lock below.
> + * another vma. So page_count of ptep page is checked instead
> + * to reliably determine whether pte is shared.
> */
> - dst_entry = huge_ptep_get(dst_pte);
> - if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
> + if (page_count(virt_to_page(dst_pte)) > 1)
> continue;
>
> dst_ptl = huge_pte_lock(h, dst, dst_pte);
> src_ptl = huge_pte_lockptr(h, src, src_pte);
> spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
> entry = huge_ptep_get(src_pte);
> - dst_entry = huge_ptep_get(dst_pte);
> - if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) {
> + if (huge_pte_none(entry)) {
> /*
> - * Skip if src entry none. Also, skip in the
> - * unlikely case dst entry !none as this implies
> - * sharing with another vma.
> + * Skip if src entry none.
> */
> ;
> } else if (unlikely(is_hugetlb_entry_migration(entry) ||

--
Ben Hutchings
When in doubt, use brute force. - Ken Thompson

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]