From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794458018; b=Pdfeovl5gT8SKEK3caZRhe1paspm08oymRwlIl4S0n9ovpk63inwKTE6yl709TAd0uoG 3UKYvqiqJ6fgGrZaFLifVS4tLiemChAMKvZLkFDS4E0dAQ95fI/01AkDOARMIhFaLp1fT 2r+UyqbhWeV7QgQqDeDGSbWHEsEx2kmK7e0stIr5wOD/6T49LRxJ4m4SYyB2B46naL1wO //CqW4+cyxtnqnQHYv8lp0OPHABNayht16I9IazMAEETo7zVBjsdw6iEYTb+NGK7MN5U0 VJWk5XwXXBusja3c+cOgGWKWxa/qrK/YizXY62/nj4Hiw08ya65CYt7r9aAviMG72bQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794458018; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=5VUPrV4A9tGNvVlk5qb/TEgkVVbRnZI8k+D93O3fHSc=; b=yFGbsChdgJuaZHvXE6hUIMOaps/zYopepaWm/9xm91orWRKl27rqjCVfEVuwWbDvqVL2 s3EbewBGMMQ/9mPvdjSxJjaY597vAYFMDVHAOwn3P2sElAzSTNUTdrPnS1TEJH3irXO8k cFQCA74vEuijHQlJbX/IxEs3VejQJIjNh/0gpqvg4iyoIYdu6BcKY4HpIs6SHFVt0HIBw tRdY9PMB1NLwLFZYctdtBw3MaBeIPdCqltnzuFnsyg9LbbDqBWdgKkqoEnLuMiz/N9jmE NFseKIxAsw5uK6ZNsiCERqeb1BeoAgZx6BV2KUfA2rIXy201UFqe0LHYcl+XwxcEDyw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=lE3vJMIP; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19406606A31C for ; Thu, 12 Nov 2026 04:33:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=lE3vJMIP Received: by smtp.kernel.org (Postfix) with ESMTPSA id 145BE1F00A05; Thu, 12 Nov 2026 04:33:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794458017; bh=5VUPrV4A9tGNvVlk5qb/TEgkVVbRnZI8k+D93O3fHSc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lE3vJMIP46NCnnLrrXa8kTsKiQumAX/tgM2sNJ040A9+567bvr19ItMZSEndYCsRA itFxb6U8TDWAu0PT1cFlo7N6jMnFs5oS7+puJbiPlIVrS9tUPopM5I4gZqOK8W8f+C 5pfKqp8DUDSRe3WAuswGh5/M+zhhhRYhj77OpcItSjtHADcNk82MAd27vWhcUWZtPj ntk5BlMUF0EXIi/6mQbcE3Z/9J0PM1sLzLbIxhclpNaMICt/NPD6Nx9Xr2RktN7kTb 3CsD8qZi/FXLsLrKMr4Ye3n3xRB2TKL9GG0mCKiKx2OuqwTtENOwir+8GaLm4eTkIZ ZvomlCi3EMN5Q== From: Sasha Levin To: stable@vger.kernel.org Cc: Josef Bacik , "Lorenzo Stoakes (ARM)" , Pedro Falcato , Muhammad Usama Anjum , Lance Yang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.12.y] mm/mremap: fix moving PUD leaves Date: Wed, 11 Nov 2026 23:33:35 -0500 Message-ID: <20261112043317.2067412-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109200915-failed-6.12-440c8779757f@kernel.org> References: <20261109200915-failed-6.12-440c8779757f@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Josef Bacik [ Upstream commit 440c8779757f09f290770b1d361dc1516a9d0b3e ] pud_none_or_clear_bad() only really works on page tables. PUD leaves confuse the check and make us clear the page table entry and print a warning. Since commit aed877c2b4257 ("device/dax: properly refcount device dax pages when mapping"), this also leaks device-DAX folio references, mapcounts and RSS accounting, resulting in "Bad rss-counter state" warnings on exit. Allow PUD leaves in get_old_pud(). If a PUD leaf cannot be moved as a whole or the move fails, split it. This unmaps it with proper accounting instead of treating the leaf entry as a PMD table. Keep using pud_trans_huge() for now, in the future this code should be cleaned up to just check for PUD leaves. Fix generated by an LLM and sent by Josef Bacik in private. Fixes: a00cc7d9dd93 ("mm, x86: add support for PUD-sized transparent hugepages") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik Reviewed-by: Lorenzo Stoakes (ARM) [ david: fallthrough after splitting ] Reviewed-by: Pedro Falcato Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-32-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Signed-off-by: David Hildenbrand (Arm) [ sashal: Adapted pagetable_move_control-based calls to individual arguments while retaining explicit pud_devmap() checks. ] Signed-off-by: Sasha Levin --- mm/mremap.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/mm/mremap.c b/mm/mremap.c index 8b507e228a274..d357d36c1157b 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -47,7 +47,8 @@ static pud_t *get_old_pud(struct mm_struct *mm, unsigned long addr) return NULL; pud = pud_offset(p4d, addr); - if (pud_none_or_clear_bad(pud)) + if (!pud_trans_huge(*pud) && !pud_devmap(*pud) && + pud_none_or_clear_bad(pud)) return NULL; return pud; @@ -624,12 +625,11 @@ unsigned long move_page_tables(struct vm_area_struct *vma, if (!new_pud) break; if (pud_trans_huge(*old_pud) || pud_devmap(*old_pud)) { - if (extent == HPAGE_PUD_SIZE) { - move_pgt_entry(HPAGE_PUD, vma, old_addr, new_addr, - old_pud, new_pud, need_rmap_locks); - /* We ignore and continue on error? */ + if (extent == HPAGE_PUD_SIZE && + move_pgt_entry(HPAGE_PUD, vma, old_addr, new_addr, + old_pud, new_pud, need_rmap_locks)) continue; - } + split_huge_pud(vma, old_pud, old_addr); } else if (IS_ENABLED(CONFIG_HAVE_MOVE_PUD) && extent == PUD_SIZE && uffd_supports_move) { -- 2.53.0