From nobody Fri Jun 12 12:47:03 2026 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24FCC392C52 for ; Fri, 15 May 2026 06:51:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778827864; cv=none; b=oE1BbiMLRLBYvaFNqL+K6sXP/lT0e4/5fGYSmKQRl5DaL86LEpwvbY4Bd8GsCNQ+Pvn2bgFrkCxHtOEATCf7xgFQCkqDgPzQwecZg0+Pm+REgJOR6PjYnRkBPKFd4D3iJTUPekIeHsqOkIuHPnbSlA1urSLE7xfN4kv7kIXMmxc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778827864; c=relaxed/simple; bh=fG46zS+mEuG0ZF5WPcHOg/keWT+xuU43HV4g1r30VJI=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=bDpCMMoamO8HS+Lbv9SyurC2R81TEo0xmWx6ncxfCRTTqpcJGcSQO/gCDdwSbFjsiWOSxpCZDKjZfkk/8UzQl+2COrgAVjtN1WLZpR/0+oNs8MkV4QeNzeFvteVvkRGnxpmNmPl5N/lDJR099RH/YiWS5gtJFD1RAX42rTx0PEs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=TUDRmxeH; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="TUDRmxeH" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3660ab73adbso466311a91.1 for ; Thu, 14 May 2026 23:51:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1778827861; x=1779432661; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=kj9jmbyJw9FvmITdQiF7/TYkM1yUzeyIU1nsfZGgTOo=; b=TUDRmxeH0eSGcj6DuGlfeG/8VADlRnZiU/WFS9ia35zKv1+Me+CwJkxZk5DYGFolit Ksq+NSNqFb2gWA8E93LpYj+abVOmp+Nci19Ol22IJJ2Tap0/zv7d7aoYKcLw/J/agzWL BRTMkLIaAZ+n8MKJCxybunyKn3p1XQviFV8clQgA+n1h6FKLwV93w+q1xsvjmV/Pg2Yt Y2BM3L8ozoPBDdYDxpoXTU2GpN6AXTT/50dQtMsP+EU+qhkBeIuEQ8wfrI/s17omj9MA 41So92641eQ/AIvXPIajyBFR3KFsdVvoShfgE+s+KG8vwCP28AVPxhtYQYVaJ9v+o6fZ hGOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778827861; x=1779432661; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=kj9jmbyJw9FvmITdQiF7/TYkM1yUzeyIU1nsfZGgTOo=; b=IBQjsRn0Jj/LGqS4lUZHpsADjCOk/rQ325GDmPsYCTLZBNGAuGnhBzL+MGzdDbEswY 5iOgmXMUVJr2cwdOWN1hXr35sFa9gI9tWBh+kdQujSVGjnI/h79Ck0ati4EIkMAYH8lH f96jBqVb5+ZZpseQvpQVjoKjVwqslsmGs6xEOgKOHkWnPWRV5q20N3O33Id7yX0Q1xxp 7DVV0wwjq0axEH/pmsKGTz9QVqXjqw+DjJlkr2sZNfTgqzhTHiLVu3YlfAQLyX0AEtKt 91jPcKrhTrxv30ONBDx6i7YBdWuVZiw5y67kd4Vs1j7B+FLFJGbowjOUfAjr+FAg05GB MUlQ== X-Forwarded-Encrypted: i=1; AFNElJ+ip6JS0kfF4+JcOTgBFaz7UQ2cKUzqAjHJ6FtRjeLWOIjBO/eIiFn68yu6Qw7ZlyRivXdsaKMfyb+NIfc=@vger.kernel.org X-Gm-Message-State: AOJu0YwpZNADj12Vz943RN6Ixao6EmGkjJ3ihI1MVhCM7Ek2rmBYoiA4 4TncG/+L1jO2KEYgNTHaZSR0qtpCY/qs6W3uRzXwO/WKH4FI3UPpOYji+OfNfihi1iU= X-Gm-Gg: Acq92OG6yLgroILqU3nyL//EA9org5skmD2x6sSeRV886zLms2RkK8ta/8Jhnpz9KSI hYo0oPCYkyRr4UZtzRiorgQSqBbWJsTzgP9yjoq2rxgzLy5SF49/L1O76Sg8PkuMq3/0PxGBNvc MssnNu1wUO5zviY5bXwBpHRg20+k5mELIurkI+VYTccUZg6ukWDaFllHAU4A3XVISqrgiZFQ3SB DGvSGicaJJtxxjnpK95m+fZcK0XXRYKS1ULOmtmL34ljrhU7/jsAy1LGUQmMLB2Urt45ECidlST Q3Rv/qKxR1OgpsrQ87e7o9kdYaMbEqe4KlAyvcWoc0qm4McxqN0fqWuAE4wVe7aF23G5iwIkOAu Sqr5QZoIl7PtRPj+Q/Y+mHe+oZNz0fAxvGoEym3HllBaUw8rUDA6nURSa5QFVOf5JbDNpCxE7oT fMquern1X2g59TXmU7MklsqvdDcdYRDM3lZeBfxSiP3a6/fs1xx+PgILHvtxWPyqT6 X-Received: by 2002:a17:90b:4b8f:b0:366:5283:cddf with SMTP id 98e67ed59e1d1-3695149a001mr2017973a91.9.1778827861236; Thu, 14 May 2026 23:51:01 -0700 (PDT) Received: from L6YN4KR4K9.bytedance.net ([61.213.176.10]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3695124601asm1734353a91.2.2026.05.14.23.50.57 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 14 May 2026 23:51:00 -0700 (PDT) From: Yunhui Cui To: paul.walmsley@sifive.com, palmer@dabbelt.com, aou@eecs.berkeley.edu, cuiyunhui@bytedance.com, tongtiangen@huawei.com, akpm@linux-foundation.org, pasha.tatashin@soleen.com, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Subject: [PATCH] riscv: mm: exclude invalid THP PMDs from page table check Date: Fri, 15 May 2026 14:50:48 +0800 Message-Id: <20260515065048.94564-1-cuiyunhui@bytedance.com> X-Mailer: git-send-email 2.39.2 (Apple Git-143) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" RISC-V THP splitting uses a temporary invalid PMD state where pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves _PAGE_LEAF set so the MM code can still recognize the PMD as a THP split in-progress entry. That temporary state no longer describes a user-accessible mapping, but page_table_check currently treats it as one because the RISC-V PMD user-accessibility test only checks whether the PMD is a leaf and has user permissions. As a result, when a PMD-sized anonymous THP is split during a COW fault, page_table_check can account the invalid intermediate PMD as a live PMD mapping, and then account the replacement PTE mappings again when the split installs the PTE table. This leaves stale PMD accounting behind and later triggers page_table_check failures such as a non-zero anon_map_count when the folio is freed. Fix this by tightening pmd_user_accessible_page() so PMD page-table-check accounting only considers leaf PMDs that still carry either _PAGE_PRESENT or _PAGE_PROT_NONE. This preserves the THP split semantics required by the MM code while preventing page_table_check from treating invalid split PMDs as live user mappings. With CONFIG_PAGE_TABLE_CHECK=3Dy and CONFIG_PAGE_TABLE_CHECK_ENFORCED=3Dy, tools/testing/selftests/mm/cow completes successfully on RISC-V after this change. Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Cc: stable@vger.kernel.org Signed-off-by: Yunhui Cui --- arch/riscv/include/asm/pgtable.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgta= ble.h index 1725f0861f6c7..88c599fda5779 100644 --- a/arch/riscv/include/asm/pgtable.h +++ b/arch/riscv/include/asm/pgtable.h @@ -1209,7 +1209,14 @@ static inline bool pte_user_accessible_page(pte_t pt= e) =20 static inline bool pmd_user_accessible_page(pmd_t pmd) { - return pmd_leaf(pmd) && pmd_user(pmd); + /* + * page_table_check() must ignore THP split invalidation entries created = by + * pmd_mkinvalid(). These retain _PAGE_LEAF so pmd_present()/pmd_leaf() s= tay + * true during the split, but they no longer describe a user-accessible + * mapping once both _PAGE_PRESENT and _PAGE_PROT_NONE are cleared. + */ + return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)) && + (pmd_val(pmd) & _PAGE_LEAF) && pmd_user(pmd); } =20 static inline bool pud_user_accessible_page(pud_t pud) --=20 2.39.5