From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794637325; b=Zhu46zFFyWcPT18FiIrF1TWDVSXc/qco0tXuniX4x+v4r9+ANUHwXy9eG9GlyGqaENgg X74yiJ+DgE19lrnSKySyhcyw38jV+t7klueCvvv0BMF2AD1uKTWi7Dg6fXN/mu+Yg5oXB mmcTo8ieQ2kHdlW3wOyE+Xjl3nSzZcRbWZJqxMUbYGj/Rr0h8knzCSXgKW/1EAg/Ys2EH KNpzKIFkzOrs7EyALQhmGFQaRogN+/fhNVxdaWk9cTupRE1pVTHBXEr0I6pc85oFv1jDz IudTQN20PWw/ddan1nYLlP/L0SqmSwzQQ7Mx/FQaE/coCGBB45Y/pCw5utFgRMGHrYg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794637325; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=pOl/DMbxWM8YQTALW/RvygzQhTAwZx6KO1FSv5xB4AY=; b=eyCnTSUOkIzDK4y4xOqadJyvJI9Ps081TV8fW53PlFZ5VGD9JHIHQQ6WHU1nD9F1mHd0 i23SdaFIw8x2qh9N5nDvvinMw0lM7+z8ZLoEdFWW+03Dk9XVOvSflCMcaTls2wRTj+FPV d5jNspNhEPP4A9CKekacNOF5ssFzAici0gDe8e+6wzGCJLW+CqjD1NKREQ6ZrIRBiSNpi NLKZLsxmTAj17r3doUD1SQdWt0UExN1k6mMjjdc3i77EUyDz7kQuhR3i6S3PSQujGAEtd ElbiHwI6qRAiE1QgobsJToUChnVOgFSAwBvCg7vA/2MNnJT7SnscVhpwnyw4is3Wo0w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Sqv+2XJ0; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20DB4606A327 for ; Sat, 14 Nov 2026 06:22:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Sqv+2XJ0 Received: by smtp.kernel.org (Postfix) with ESMTPSA id D19EC1F000C4; Sat, 14 Nov 2026 06:22:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794637324; bh=pOl/DMbxWM8YQTALW/RvygzQhTAwZx6KO1FSv5xB4AY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Sqv+2XJ0D4aVF0ZyAzO26SJNbwH2PRxoRGnSpxEG+/iFLKMvTiqUc/tg85g+x7fyd 0ajyXf/4fGSa6y56g1//rUjm1uDPENfWcyNxRpIlyajF0oHbf9rkwzbSXuSkv91uEL AWST+IKqebuJXwrkD/04uBBaH+ur34xYxSexiZ2phWv2mWblygg6xelIFXV4K81jLA y5Mbvgp1Ymzh5k6bHpMxPHcq9uSwFeKENayJPwip66tNAd3DGp5xdEgwFd8l9xARiE q2cNwLlK6fWwOzmtMSKxLWcqDzpoTLzvZfHzsSPqTW1teCkECUoe7HsSlFAkmU9nqp 1NGze+sMcNggQ== From: Sasha Levin To: stable@vger.kernel.org Cc: Chris Mason , "Gregory Price (Meta)" , Muhammad Usama Anjum , Zi Yan , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 5.15.y] mm/huge_memory: fix truncate racing with PMD zapping Date: Sat, 14 Nov 2026 01:22:02 -0500 Message-ID: <20261114062146.3203998-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109202320-failed-5.15-e6a07d29b0a6@kernel.org> References: <20261109202320-failed-5.15-e6a07d29b0a6@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chris Mason [ Upstream commit e6a07d29b0a60f3a4cfe77fe34eeb4b3fb38d6c4 ] zap_huge_pmd_folio() removes the rmap before calling folio_mark_dirty(). If this was the last mapping, truncation can skip unmapping the folio and proceed without waiting for the PMD lock, racing with dirtying. ifs_set_range_dirty() can oops if MADV_DONTNEED races with ftruncate() on XFS, when we get the folio set dirty after it was found to not be mapped anymore. Move folio_mark_dirty() and folio_mark_accessed() before rmap removal, matching the PTE zap path. This keeps the folio mapped while updating its state, so truncation must wait for the page table lock. Fix generated by an LLM and sent by Chris Mason in private. Fixes: fe6cf984939d ("mm/huge_memory: transfer the pmd dirty bit to the folio on zap") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify comment and description ] Reviewed-by: Gregory Price (Meta) Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-13-d6437171ecc3@kernel.org Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) [ sashal: adapted zap_huge_pmd_folio() changes to the page-based implementation in zap_huge_pmd() ] Signed-off-by: Sasha Levin --- mm/huge_memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index cd44744724d0a..1cfc6c8156e18 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1622,8 +1622,6 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, if (pmd_present(orig_pmd)) { page = pmd_page(orig_pmd); - page_remove_rmap(page, true); - VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); VM_BUG_ON_PAGE(!PageHead(page), page); } else if (thp_migration_supported()) { swp_entry_t entry; @@ -1647,6 +1645,12 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, set_page_dirty(page); } + /* Remove the rmap after transferring the dirty bit to the page. */ + if (pmd_present(orig_pmd)) { + page_remove_rmap(page, true); + VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); + } + spin_unlock(ptl); if (flush_needed) tlb_remove_page_size(tlb, page, HPAGE_PMD_SIZE); -- 2.53.0