From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794636048; b=l+LN/9NT4uPbjieqH0OxEpCU/dvONFxh4JpU5RGBSvfdGYvMR07ODcyEEXPoYQcJyexG wBU3z6UNukbHLBhVHxTtvna5GrzW+mDY2SSbVH3IzwLIEiLqamjyIPvzp2uydFZImaU6F FOs0ySbytXtm3lssdkwDkjq1OwWSrlGo2CGGZvohf1BuV3GG76ezNcOgqFxymGnezyXQB umfLf4yUyRIJk8T8ypE2Be122kNs9hQbgfLmHQidaHG7Gn7xTzyw11SYJCjT+vL6X7eFa gobf++tIczhbSlSOeIeo7qOdZTG7mfTyFcH8fGwacafCH+LrX6aH8S4qVVjBvlg8oIA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794636048; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=8tbvdHlJ5oYB0VgvsfjmGVGYKtd+kxpfRtJCKzPpzds=; b=v+NiZUe0R6uYdtStiwS1IlFKSPVdctV5kdpOY8RxwfMQh3sSc4G6Isfrm/BWXIAADqIG M7xpTC/7CZIypELOJ4mDg13iBC0cv9yOquo2kUsJd3SlbjUmGkue3ixXHa12EJ45WK+XM c95DJ8CN1Wdfnflvu36Wf5pgIUFNiZOQdIB+Jmt7IQVKZABR4bIeP+drAMe36jfSxVm9F JBrh9u4Ci/uyeWipX/1zS4o2l2Tb9Y9Fw6f4yYHrNgNF6UMLEZrbzwVX6QcAqoKeafT4x mdJk7YhqJBE8mCx3hZvJy6i7QWw43p15kgpCBVzmXjPjsEPZsgdu6SU8o418c90R7gQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=gEq3qXfx; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0286A606A329 for ; Sat, 14 Nov 2026 06:00:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=gEq3qXfx Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FFC61F000C4; Sat, 14 Nov 2026 06:00:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794636047; bh=8tbvdHlJ5oYB0VgvsfjmGVGYKtd+kxpfRtJCKzPpzds=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gEq3qXfx31+KZFAtu3/yWbH01cUO/JvgYMxC7oOm7GfVSLItCnfNpTArc/ouNE9Kk H5S51Jk/p70y0TbQGsyn4ai84EpVXsVzgdBP3C9jd/2zGsqFBpTZ65bGQu1LL7fXQN SeeRk++VwM/G9Z3dTQGgmKrHHgtd5CcKUH2HQIlIK5yj1GGsz5Dl5vviLicDXNykxa j+dNvNBb91uw/Ertu2pTs71XQjp7OyRg/mklUrVN/kcifhpvK/1m6ddWQU3m846MV8 eTSk4TPLiroY9rUgNNziHFeB4+94Bex2+Vgep8UVn027LPRLsp4NrW3pHODOAk7Hqx x1Z1Ofh+7Do1Q== From: Sasha Levin To: stable@vger.kernel.org Cc: Chris Mason , "Gregory Price (Meta)" , Muhammad Usama Anjum , Zi Yan , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.18.y] mm/huge_memory: fix truncate racing with PMD zapping Date: Sat, 14 Nov 2026 01:00:45 -0500 Message-ID: <20261114060030.3191180-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109200457-failed-6.18-e6a07d29b0a6@kernel.org> References: <20261109200457-failed-6.18-e6a07d29b0a6@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chris Mason [ Upstream commit e6a07d29b0a60f3a4cfe77fe34eeb4b3fb38d6c4 ] zap_huge_pmd_folio() removes the rmap before calling folio_mark_dirty(). If this was the last mapping, truncation can skip unmapping the folio and proceed without waiting for the PMD lock, racing with dirtying. ifs_set_range_dirty() can oops if MADV_DONTNEED races with ftruncate() on XFS, when we get the folio set dirty after it was found to not be mapped anymore. Move folio_mark_dirty() and folio_mark_accessed() before rmap removal, matching the PTE zap path. This keeps the folio mapped while updating its state, so truncation must wait for the page table lock. Fix generated by an LLM and sent by Chris Mason in private. Fixes: fe6cf984939d ("mm/huge_memory: transfer the pmd dirty bit to the folio on zap") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify comment and description ] Reviewed-by: Gregory Price (Meta) Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-13-d6437171ecc3@kernel.org Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) [ sashal: adapted zap_huge_pmd_folio() changes to the existing inline logic in zap_huge_pmd() ] Signed-off-by: Sasha Levin --- mm/huge_memory.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 24f5887eb48ee..eba9280ddb594 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2327,8 +2327,6 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, struct page *page = pmd_page(orig_pmd); folio = page_folio(page); - folio_remove_rmap_pmd(folio, page, vma); - WARN_ON_ONCE(folio_mapcount(folio) < 0); VM_BUG_ON_PAGE(!PageHead(page), page); } else if (thp_migration_supported()) { swp_entry_t entry; @@ -2360,6 +2358,15 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, folio_mark_accessed(folio); } + /* + * Only present folios are rmappable. Remove the rmap after + * transferring young+dirty to the folio. + */ + if (flush_needed) { + folio_remove_rmap_pmd(folio, &folio->page, vma); + WARN_ON_ONCE(folio_mapcount(folio) < 0); + } + spin_unlock(ptl); if (flush_needed) tlb_remove_page_size(tlb, &folio->page, HPAGE_PMD_SIZE); -- 2.53.0