From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DAC043F7886 for ; Wed, 5 Aug 2026 09:34:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785922443; cv=none; b=LJkUL4PPejd9dneYaIw9LKLCWmZOBLk7LnQH8+tyzr0DebAISA6imgMxaD2zAUlYVPMr0vdjoRdq+R3zEC/gfMNq46D6QTimm+OXZQ7V+JDuBmczOM6/WyEyLbLAKh3p0Il/6KqKuz9+kd51VEqunjAeRG9Ag2X4Yl+dkAWOwPc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785922443; c=relaxed/simple; bh=E0JZDYP8BOkns8wsXlg1C44nhz3AvgLK+HdzzXpj+Fw=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=UAu6AHzV9HHJljCcRxGX769Nog8FeN9HDFXyDE4z8CsaKaY9UB4F4DjKuiG9XHzs8I/OOrwP5gBOwSmbD4YSsYYE+QMrctfmZMDIBVU/cGBP5y6PKeb46t0oTxYih7zU5M88fUPWkeLD61zTFXRDhbO9aQtz1L64UKJQkxVS7lo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=v0aRs+OU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="v0aRs+OU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DDA11F000E9; Wed, 5 Aug 2026 09:34:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785922441; bh=VHX5CmjNLanWtv2FsuTdsluZQiJeRZC8fVRq6E2N29g=; h=Subject:To:Cc:From:Date; b=v0aRs+OU6W7sflIpLxp2Tcj8pGUScF84HCUPrrO9YNUFAG4VM+xusDdoYh3JJY+1g PQSTOOBbJxcnpYSbDODxhT9kOuR3hrLrJnlQcXf6H8/ACUx9qyUuO6ViPemA7nXhRC vMgRef9JSZzIknSbSVveerHDUPkN3wSbxEW2ByBE= Subject: FAILED: patch "[PATCH] userfaultfd: wait on source PMD during UFFDIO_MOVE" failed to apply to 6.18-stable tree To: usama.arif@linux.dev,aarcange@redhat.com,akpm@linux-foundation.org,baohua@kernel.org,baolin.wang@linux.alibaba.com,david@kernel.org,dev.jain@arm.com,hannes@cmpxchg.org,lance.yang@linux.dev,liam@infradead.org,ljs@kernel.org,npache@redhat.com,riel@surriel.com,ryan.roberts@arm.com,sashiko-bot@kernel.org,shakeel.butt@linux.dev,stable@vger.kernel.org,ziy@nvidia.com Cc: From: Date: Wed, 05 Aug 2026 11:33:44 +0200 Message-ID: <2026080544-exit-cesarean-7929@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 4165b7d1c45c2da0dfefe528f8d1fb7d79f0d344 # git commit -s git send-email --to '' --in-reply-to '2026080544-exit-cesarean-7929@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 4165b7d1c45c2da0dfefe528f8d1fb7d79f0d344 Mon Sep 17 00:00:00 2001 From: Usama Arif Date: Sun, 5 Jul 2026 06:12:31 -0700 Subject: [PATCH] userfaultfd: wait on source PMD during UFFDIO_MOVE move_pages_huge_pmd() snapshots src_pmdval under src_ptl, drops the lock, and, for migration entries, waits with pmd_migration_entry_wait(). Passing &src_pmdval is wrong. pmd_migration_entry_wait() must lock and re-read the real page-table PMD; on split-PMD-lock kernels, a stack address also resolves to the wrong lock. softleaf_entry_wait_on_locked() then waits without a folio reference, which is safe only while serialized against migration-entry removal by the real PT lock. Pass src_pmd, matching __handle_mm_fault() and hmm_vma_walk_pmd(). Link: https://lore.kernel.org/20260705131231.1499198-1-usama.arif@linux.dev Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") Reported-by: sashiko-bot Link: https://sashiko.dev/#/patchset/20260703173903.3789516-1-usama.arif%40linux.dev?part=8 Signed-off-by: Usama Arif Reviewed-by: Rik van Riel Reviewed-by: Baolin Wang Reviewed-by: Lance Yang Acked-by: David Hildenbrand (Arm) Reviewed-by: Lance Yang Reviewed-by: Lorenzo Stoakes Cc: Andrea Arcangeli Cc: Barry Song Cc: Dev Jain Cc: Johannes Weiner Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Shakeel Butt Cc: Zi Yan Cc: Signed-off-by: Andrew Morton diff --git a/mm/huge_memory.c b/mm/huge_memory.c index b5d1e9d4463d..032702a4637b 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2774,7 +2774,7 @@ int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pm if (!pmd_trans_huge(src_pmdval)) { spin_unlock(src_ptl); if (pmd_is_migration_entry(src_pmdval)) { - pmd_migration_entry_wait(mm, &src_pmdval); + pmd_migration_entry_wait(mm, src_pmd); return -EAGAIN; } return -ENOENT;