From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794637470; b=CtiIdP/xMk0BYrspB7yjcrsNmBJOnRyQYlxoifmOd4NH9/kMfsiIEaeh1sCjix3rMlVs hHvFHXz6CLMyA3ikhISUHLDXcLkxP98MBZwlBv7z2CFZf5yqgTUOAWJsYaN9WGcuxpkLG G8JnntZ8nepLTIW7b1gDQY/IzkHRcJyz9p0T/Hr3B9UEMRcicNTjBn0PH8dJULV34PBO3 2Gw9dqtVuBG+UqwEYM43P303qwHp05Bqt7+kjXK4EttMa+xE0RUFDk8d5PzWHeVL0vYSr ryskdlc4NZvwFh073euYCye/X+tY/tPSTVODi88m4nmE9VzUdUI9zqf0Ui4nMsVOR6A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794637470; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=id9pSCUAYUiiyS6PO7EUsTpelNmH+hat2rQzMn4ER1k=; b=e2LmdQVkNcxgCVcn7l589rpWTqKCLm9bNA/21SVUnPr++3U4SRfLo+1I3rDQ3foiUrMz WczQwfS3xPwFN23GrUstXIIfB+ZAxyzaZKBPjYw1DhapikjK0KF/wPhsNibvmjJEkVbjP JZbxoStZEyA5mN75pe1prlzDjX62tz0YLbmm+dhcAETg3KjUgNVYUXRYXbol2fZX7c/bN Du0ttX70cOeZ7EeGuvyhdcGBvT2Ld/VpdDTnQwzsLbfd2i2JYeNJnZcLNfNTyF6afX4d1 TBEmeZI3m4Jq0yrId1y80z2UrJZk1opA4wx0PrY/zEzOmXVed72f/Fzwl61REoQha4Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=iijg1Wma; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B832F606A327 for ; Sat, 14 Nov 2026 06:24:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=iijg1Wma Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE2A81F000C4; Sat, 14 Nov 2026 06:24:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794637470; bh=id9pSCUAYUiiyS6PO7EUsTpelNmH+hat2rQzMn4ER1k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=iijg1WmaHhKBupzwz782VrjKGoCYQXLJr8ewh8zojumYbwsZ2QG0hDasVaJndovPj KIWMzZAaNcyU1q2cVAVXqLdM5nKb57IjUVKZ7TOjgal/mSCDdtOsp5J4wcBGSLsRu3 QJvzJ7dunXaO7F2ofsR9o+K/gdwvNUuIreoXXyWXnH+YORCW3v3ep9hI6ZdRRG8WD/ UajUseL97pA+jYuP210mFcm5U9KgBJnzwhY5JIPVqueeNNY19gKH0wJw9/cLi78vJU NGaV26EvvI3SBAoPG6x626VUn6ngT1HchW9fGfiA0UAbmzhfWG/eYup2shM9sFIIbS SuTDgFOBoCZ7w== From: Sasha Levin To: stable@vger.kernel.org Cc: Chris Mason , "Gregory Price (Meta)" , Muhammad Usama Anjum , Zi Yan , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 5.10.y] mm/huge_memory: fix truncate racing with PMD zapping Date: Sat, 14 Nov 2026 01:24:28 -0500 Message-ID: <20261114062414.3210344-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109202756-failed-5.10-e6a07d29b0a6@kernel.org> References: <20261109202756-failed-5.10-e6a07d29b0a6@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chris Mason [ Upstream commit e6a07d29b0a60f3a4cfe77fe34eeb4b3fb38d6c4 ] zap_huge_pmd_folio() removes the rmap before calling folio_mark_dirty(). If this was the last mapping, truncation can skip unmapping the folio and proceed without waiting for the PMD lock, racing with dirtying. ifs_set_range_dirty() can oops if MADV_DONTNEED races with ftruncate() on XFS, when we get the folio set dirty after it was found to not be mapped anymore. Move folio_mark_dirty() and folio_mark_accessed() before rmap removal, matching the PTE zap path. This keeps the folio mapped while updating its state, so truncation must wait for the page table lock. Fix generated by an LLM and sent by Chris Mason in private. Fixes: fe6cf984939d ("mm/huge_memory: transfer the pmd dirty bit to the folio on zap") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify comment and description ] Reviewed-by: Gregory Price (Meta) Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-13-d6437171ecc3@kernel.org Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) [ sashal: adapted folio-based rmap removal to page_remove_rmap() in zap_huge_pmd() ] Signed-off-by: Sasha Levin --- mm/huge_memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index f6fd1d3527b68..54c097bacd5d5 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1699,8 +1699,6 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, if (pmd_present(orig_pmd)) { page = pmd_page(orig_pmd); - page_remove_rmap(page, true); - VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); VM_BUG_ON_PAGE(!PageHead(page), page); } else if (thp_migration_supported()) { swp_entry_t entry; @@ -1724,6 +1722,12 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, set_page_dirty(page); } + /* Remove the rmap after transferring the dirty bit to the page. */ + if (pmd_present(orig_pmd)) { + page_remove_rmap(page, true); + VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); + } + spin_unlock(ptl); if (flush_needed) tlb_remove_page_size(tlb, page, HPAGE_PMD_SIZE); -- 2.53.0