Documentation/mm/hugetlbfs_reserv.rst | 12 +-- fs/hugetlbfs/inode.c | 60 +++++++------- include/linux/hugetlb.h | 31 +------ mm/hugetlb.c | 112 ++++++++++++++------------ mm/memfd.c | 18 +++-- mm/userfaultfd.c | 6 +- 6 files changed, 109 insertions(+), 130 deletions(-)
This series stems from a discussion with David. [1] The series makes a small cleanup to a few hugetlb interfaces used outside the subsystem by standardizing them on base-page indices. Hopefully this makes the interface semantics a bit more coherent with the rest of mm, while the internal hugetlb code continue to use hugepage indices where that remains the more natural fit. It is based off mm-stable, 3/30/2026, b2c31180b9d6. [1] https://lore.kernel.org/linux-mm/9ec9edd1-0f4c-4da2-ae78-0e7b251a9e25@kernel.org/ Jane Chu (6): hugetlb: open-code hugetlb folio lookup index conversion hugetlb: remove the hugetlb_linear_page_index() helper hugetlb: make hugetlb_fault_mutex_hash() take PAGE_SIZE index hugetlb: drop vma_hugecache_offset() in favor of linear_page_index() hugetlb: make hugetlb_add_to_page_cache() use PAGE_SIZE-based index hugetlb: pass hugetlb reservation ranges in base-page indices Documentation/mm/hugetlbfs_reserv.rst | 12 +-- fs/hugetlbfs/inode.c | 60 +++++++------- include/linux/hugetlb.h | 31 +------ mm/hugetlb.c | 112 ++++++++++++++------------ mm/memfd.c | 18 +++-- mm/userfaultfd.c | 6 +- 6 files changed, 109 insertions(+), 130 deletions(-) -- 2.43.5
On Thu, Apr 09, 2026 at 05:41:51PM -0600, Jane Chu wrote: > This series stems from a discussion with David. [1] > The series makes a small cleanup to a few hugetlb interfaces used > outside the subsystem by standardizing them on base-page indices. > Hopefully this makes the interface semantics a bit more coherent with > the rest of mm, while the internal hugetlb code continue to use hugepage > indices where that remains the more natural fit. > > It is based off mm-stable, 3/30/2026, b2c31180b9d6. > > [1] https://lore.kernel.org/linux-mm/9ec9edd1-0f4c-4da2-ae78-0e7b251a9e25@kernel.org/ It seems you got some trailing spaces issues: Applying: hugetlb: open-code hugetlb folio lookup index conversion .git/rebase-apply/patch:64: trailing whitespace. pgoff_t index = start >> PAGE_SHIFT; Applying: hugetlb: make hugetlb_fault_mutex_hash() take PAGE_SIZE index .git/rebase-apply/patch:161: trailing whitespace. key[1] = index >> huge_page_order(hstate_inode(mapping->host)); Applying: hugetlb: drop vma_hugecache_offset() in favor of linear_page_index() .git/rebase-apply/patch:44: trailing whitespace. start = linear_page_index(vma, vma->vm_start); .git/rebase-apply/patch:46: trailing whitespace. end = linear_page_index(vma, vma->vm_end); Applying: hugetlb: pass hugetlb reservation ranges in base-page indices .git/rebase-apply/patch:237: trailing whitespace. next_index = index + pages_per_huge_page(h) -- Oscar Salvador SUSE Labs
On 4/15/2026 1:03 AM, Oscar Salvador wrote: > On Thu, Apr 09, 2026 at 05:41:51PM -0600, Jane Chu wrote: >> This series stems from a discussion with David. [1] >> The series makes a small cleanup to a few hugetlb interfaces used >> outside the subsystem by standardizing them on base-page indices. >> Hopefully this makes the interface semantics a bit more coherent with >> the rest of mm, while the internal hugetlb code continue to use hugepage >> indices where that remains the more natural fit. >> >> It is based off mm-stable, 3/30/2026, b2c31180b9d6. >> >> [1] https://lore.kernel.org/linux-mm/9ec9edd1-0f4c-4da2-ae78-0e7b251a9e25@kernel.org/ > > It seems you got some trailing spaces issues: > > Applying: hugetlb: open-code hugetlb folio lookup index conversion > .git/rebase-apply/patch:64: trailing whitespace. > pgoff_t index = start >> PAGE_SHIFT; > > Applying: hugetlb: make hugetlb_fault_mutex_hash() take PAGE_SIZE index > .git/rebase-apply/patch:161: trailing whitespace. > key[1] = index >> huge_page_order(hstate_inode(mapping->host)); > > Applying: hugetlb: drop vma_hugecache_offset() in favor of linear_page_index() > .git/rebase-apply/patch:44: trailing whitespace. > start = linear_page_index(vma, vma->vm_start); > .git/rebase-apply/patch:46: trailing whitespace. > end = linear_page_index(vma, vma->vm_end); > > Applying: hugetlb: pass hugetlb reservation ranges in base-page indices > .git/rebase-apply/patch:237: trailing whitespace. > next_index = index + pages_per_huge_page(h) > > Sorry, will remove them in v2. thanks! -jane >
syzbot ci has tested the following series
[v1] hugetlb: normalize exported interfaces to use base-page indices
https://lore.kernel.org/all/20260409234158.837786-1-jane.chu@oracle.com
* [PATCH 1/6] hugetlb: open-code hugetlb folio lookup index conversion
* [PATCH 2/6] hugetlb: remove the hugetlb_linear_page_index() helper
* [PATCH 3/6] hugetlb: make hugetlb_fault_mutex_hash() take PAGE_SIZE index
* [PATCH 4/6] hugetlb: drop vma_hugecache_offset() in favor of linear_page_index()
* [PATCH 5/6] hugetlb: make hugetlb_add_to_page_cache() use PAGE_SIZE-based index
* [PATCH 6/6] hugetlb: pass hugetlb reservation ranges in base-page indices
and found the following issue:
WARNING: bad unlock balance in hugetlb_no_page
Full report is available here:
https://ci.syzbot.org/series/95c5ba82-0135-4026-b7c7-b0819e1ca4d6
***
WARNING: bad unlock balance in hugetlb_no_page
tree: mm-new
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/mm.git
base: 06a6cfb92448a97ef429a7fbd395a20a9d388acc
arch: amd64
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
config: https://ci.syzbot.org/builds/cefe8576-3c99-42d3-9b51-1e70d62a64a7/config
syz repro: https://ci.syzbot.org/findings/3a14cc12-14a8-4fac-9614-ae7ae2555e58/syz_repro
=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Not tainted
-------------------------------------
syz.0.17/5971 is trying to release lock (&hugetlb_fault_mutex_table[i]) at:
[<ffffffff8229b876>] hugetlb_handle_userfault mm/hugetlb.c:5686 [inline]
[<ffffffff8229b876>] hugetlb_no_page+0x1986/0x1da0 mm/hugetlb.c:5770
but there are no more locks to release!
other info that might help us debug this:
2 locks held by syz.0.17/5971:
#0: ffff88816b85fb88 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:310
#1: ffff88816079e338 (&hugetlb_fault_mutex_table[i]){+.+.}-{4:4}, at: hugetlb_fault+0x317/0x1440 mm/hugetlb.c:5991
stack backtrace:
CPU: 0 UID: 0 PID: 5971 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5298
__lock_release kernel/locking/lockdep.c:5537 [inline]
lock_release+0x248/0x3d0 kernel/locking/lockdep.c:5889
__mutex_unlock_slowpath+0xd3/0x7d0 kernel/locking/mutex.c:938
hugetlb_handle_userfault mm/hugetlb.c:5686 [inline]
hugetlb_no_page+0x1986/0x1da0 mm/hugetlb.c:5770
hugetlb_fault+0x67f/0x1440 mm/hugetlb.c:-1
handle_mm_fault+0x2007/0x3170 mm/memory.c:6716
do_user_addr_fault+0xa73/0x1340 arch/x86/mm/fault.c:1334
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fa742251964
Code: 41 89 00 31 c0 c3 b9 40 00 00 00 bf 40 00 00 00 eb bc 0f 1f 40 00 48 89 7c 24 f8 48 89 74 24 f0 48 8b 7c 24 f8 4c 8b 44 24 f0 <8b> 4f 50 8b 47 58 4c 01 c1 41 8b 34 00 8b 11 21 d6 89 f0 8d 72 01
RSP: 002b:00007fa7431fd018 EFLAGS: 00010212
RAX: 00007fa742251950 RBX: 00007fa742615fa0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000400000
RBP: 00007fa742432c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000200000400000 R11: 0000000000000000 R12: 0000000000000000
R13: 00007fa742616038 R14: 00007fa742615fa0 R15: 00007ffe952c6908
</TASK>
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
To test a patch for this bug, please reply with `#syz test`
(should be on a separate line).
The patch should be attached to the email.
Note: arguments like custom git repos and branches are not supported.
On 4/9/2026 11:45 PM, syzbot ci wrote:
> syzbot ci has tested the following series
>
> [v1] hugetlb: normalize exported interfaces to use base-page indices
> https://lore.kernel.org/all/20260409234158.837786-1-jane.chu@oracle.com
> * [PATCH 1/6] hugetlb: open-code hugetlb folio lookup index conversion
> * [PATCH 2/6] hugetlb: remove the hugetlb_linear_page_index() helper
> * [PATCH 3/6] hugetlb: make hugetlb_fault_mutex_hash() take PAGE_SIZE index
> * [PATCH 4/6] hugetlb: drop vma_hugecache_offset() in favor of linear_page_index()
> * [PATCH 5/6] hugetlb: make hugetlb_add_to_page_cache() use PAGE_SIZE-based index
> * [PATCH 6/6] hugetlb: pass hugetlb reservation ranges in base-page indices
>
> and found the following issue:
> WARNING: bad unlock balance in hugetlb_no_page
Thanks for catching the bug. I was able to reproduce by turning on a few
configs. It appears below change fixed the issue, please confirm.
$ diff -c mm/hugetlb.c-BAD mm/hugetlb.c
*** mm/hugetlb.c-BAD 2026-04-10 13:36:52.417044993 -0600
--- mm/hugetlb.c 2026-04-10 14:33:31.637033381 -0600
***************
*** 5659,5665 ****
u32 hash;
pgoff_t index;
! index = linear_page_index((const struct vm_area_struct *)vmf,
vmf->address);
hash = hugetlb_fault_mutex_hash(mapping, index);
/*
--- 5659,5665 ----
u32 hash;
pgoff_t index;
! index = linear_page_index(vmf->vma, vmf->address);
hash = hugetlb_fault_mutex_hash(mapping, index);
thanks,
-jane
>
> Full report is available here:
> https://ci.syzbot.org/series/95c5ba82-0135-4026-b7c7-b0819e1ca4d6
>
> ***
>
> WARNING: bad unlock balance in hugetlb_no_page
>
> tree: mm-new
> URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/mm.git
> base: 06a6cfb92448a97ef429a7fbd395a20a9d388acc
> arch: amd64
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> config: https://ci.syzbot.org/builds/cefe8576-3c99-42d3-9b51-1e70d62a64a7/config
> syz repro: https://ci.syzbot.org/findings/3a14cc12-14a8-4fac-9614-ae7ae2555e58/syz_repro
>
> =====================================
> WARNING: bad unlock balance detected!
> syzkaller #0 Not tainted
> -------------------------------------
> syz.0.17/5971 is trying to release lock (&hugetlb_fault_mutex_table[i]) at:
> [<ffffffff8229b876>] hugetlb_handle_userfault mm/hugetlb.c:5686 [inline]
> [<ffffffff8229b876>] hugetlb_no_page+0x1986/0x1da0 mm/hugetlb.c:5770
> but there are no more locks to release!
>
> other info that might help us debug this:
> 2 locks held by syz.0.17/5971:
> #0: ffff88816b85fb88 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:310
> #1: ffff88816079e338 (&hugetlb_fault_mutex_table[i]){+.+.}-{4:4}, at: hugetlb_fault+0x317/0x1440 mm/hugetlb.c:5991
>
> stack backtrace:
> CPU: 0 UID: 0 PID: 5971 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5298
> __lock_release kernel/locking/lockdep.c:5537 [inline]
> lock_release+0x248/0x3d0 kernel/locking/lockdep.c:5889
> __mutex_unlock_slowpath+0xd3/0x7d0 kernel/locking/mutex.c:938
> hugetlb_handle_userfault mm/hugetlb.c:5686 [inline]
> hugetlb_no_page+0x1986/0x1da0 mm/hugetlb.c:5770
> hugetlb_fault+0x67f/0x1440 mm/hugetlb.c:-1
> handle_mm_fault+0x2007/0x3170 mm/memory.c:6716
> do_user_addr_fault+0xa73/0x1340 arch/x86/mm/fault.c:1334
> handle_page_fault arch/x86/mm/fault.c:1474 [inline]
> exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
> asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
> RIP: 0033:0x7fa742251964
> Code: 41 89 00 31 c0 c3 b9 40 00 00 00 bf 40 00 00 00 eb bc 0f 1f 40 00 48 89 7c 24 f8 48 89 74 24 f0 48 8b 7c 24 f8 4c 8b 44 24 f0 <8b> 4f 50 8b 47 58 4c 01 c1 41 8b 34 00 8b 11 21 d6 89 f0 8d 72 01
> RSP: 002b:00007fa7431fd018 EFLAGS: 00010212
> RAX: 00007fa742251950 RBX: 00007fa742615fa0 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000400000
> RBP: 00007fa742432c91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000200000400000 R11: 0000000000000000 R12: 0000000000000000
> R13: 00007fa742616038 R14: 00007fa742615fa0 R15: 00007ffe952c6908
> </TASK>
>
>
> ***
>
> If these findings have caused you to resend the series or submit a
> separate fix, please add the following tag to your commit message:
> Tested-by: syzbot@syzkaller.appspotmail.com
>
> ---
> This report is generated by a bot. It may contain errors.
> syzbot ci engineers can be reached at syzkaller@googlegroups.com.
>
> To test a patch for this bug, please reply with `#syz test`
> (should be on a separate line).
>
> The patch should be attached to the email.
> Note: arguments like custom git repos and branches are not supported.
© 2016 - 2026 Red Hat, Inc.