From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585699; b=GA8Ex3fsxXB6cvbA4E52fE1OKdK7oKUN6D89BnfcZYdxLCecu0a35br8hJ5IgBH0t29i f6EYtXqRgG1WjBxPvQIqPuBubMvhPTH1AO+YmZO3P6ub/0uj17sx9ObO/nVxPQZGDbBrp YNusDyZ1w2W5ja6w2+QT1ZyPJwh+KH/PVRlj+OGzCFsB32zFsMGLeiv7IFgk4huZD71Sf ZNUy3p7JgD58bcv/CYbEJoMmZj0ioyFFzCJC7PX/4C8oS8fThAEvpR+ftt5MViUa6fVpx dF9WqRjTwTj8kzA2NfxOUszfMrSuU3zoUPpO9OJpJH0fhQKZJ4Vu7+OuwU4d8JTXhMQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585699; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=ZUw1iK5VosniVKWoKneaCEa2wfcyNmjiSKgi4H5Jins=; b=DEp3jh90UnkGWmIpIkgNRPYDOFssnEqRzca0kGttg0rF6r6Yz3L/pbVTZLyjsg2rWiAw FLxCqW9Fbfxyxr+B4oH85BrMiGpgSKZLcJgs8xMeNHsuNgbTA1maY+8seDyj4r3P1NqTv QjjCLK24fWhXtIaLV8QnIJKGHZ77QnBYscRIas3vG/5grvfCYsWzqW+rr/maWppGxpwkH YYr4SCxgHA2Q7xbiVsRDLpYHZLUFPY9DaEnh/sjSo2U9BzW1RLNByHi/KSXt5dEi/aIlr WG+spvymgnLNrH5zcog+miaJCv+fS0E+36PeMkqU+0UBHDGBfuG9TRF7DAC0FFMjTTA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=hYxHA5BU; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48B17606A8A8; Fri, 13 Nov 2026 16:01:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=hYxHA5BU Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE8711F000C4; Fri, 13 Nov 2026 16:01:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585699; bh=ZUw1iK5VosniVKWoKneaCEa2wfcyNmjiSKgi4H5Jins=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hYxHA5BUjUU2YYBgkv4yZQsKrVa2q6ZF/uYtP3/uTjh5/fzlQpVtGPBYL6bscvMui utacmvW5N2NkOw7vuifs98hnZBw4vlagCajPiDIq+t0BtvwQpN7ujuHF9EzHZG5Gw9 FIFYS+m4xGekad0PdPLU6Ze+oIAVK5dkMUiwHY0k= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Josef Bacik , "Gregory Price (Meta)" , Muhammad Usama Anjum , Lance Yang , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 7.3 305/507] mm/khugepaged: fix PMD table lock leak in try_collapse_pte_mapped_thp() Date: Fri, 13 Nov 2026 10:50:09 -0500 Message-ID: <20261113153805.608162198@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Josef Bacik [ Upstream commit db38b902307e687219ec765ef51a6ef459746c87 ] For a private mapping with userfaultfd, try_collapse_pte_mapped_thp() takes the PMD table lock before it maps the page table for the second time. If that (pte_offset_map_rw_nolock) fails, because the page table vanished in the meantime due to concurrent page table reclaim, it leaves through the abort label, where the PMD table lock is unlocked if it differs from PTE table lock. In case the PMD table lock and the PTE table lock match, which is the case without CONFIG_SPLIT_PTE_PTLOCKS after pte_offset_map_rw_nolock() failed, we miss to unlock the PMD table. To fix it, forget the PTE table lock when we unmap+unlock the PTE table. Fix generated by an LLM and sent by Josef Bacik in private. Fixes: 6375e95f381e ("mm: pgtable: reclaim empty PTE page in madvise(MADV_DONTNEED)") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik [ david: move the ptl = NULL handling; rewrite description, drop wrong comments ] Reviewed-by: Gregory Price (Meta) Tested-by: Gregory Price (Meta) Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-16-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Sasha Levin --- mm/khugepaged.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 9cd468307841f..065030fb3e327 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1928,7 +1928,7 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign result = SCAN_FAIL; start_pte = pte_offset_map_lock(mm, pmd, haddr, &ptl); - if (!start_pte) /* mmap_lock + page lock should prevent this */ + if (!start_pte) goto drop_folio; /* step 1: check all mapped PTEs are to the right huge page */ @@ -1959,6 +1959,7 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign } pte_unmap_unlock(start_pte, ptl); + ptl = NULL; mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, haddr, haddr + HPAGE_PMD_SIZE); mmu_notifier_invalidate_range_start(&range); @@ -1976,7 +1977,7 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign pml = pmd_lock(mm, pmd); start_pte = pte_offset_map_rw_nolock(mm, pmd, haddr, &pgt_pmd, &ptl); - if (!start_pte) /* mmap_lock + page lock should prevent this */ + if (!start_pte) goto abort; if (!pml) spin_lock(ptl); -- 2.53.0