From nobody Fri Jul 24 21:52:35 2026 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B0A7284B2F for ; Fri, 24 Jul 2026 10:06:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784887562; cv=none; b=g1kBTvoOs5JKjIWrQurRWn59FpjNWXs3OJNtVHImmYGTN9MCcmj6qwMjovz2Xf4SuUqg3RCSAPVycxU/QlcGXVy3J807xQrmcE4oO3xjSxdMtq8g9JvUmKoFntZLC2xJFVWCWoWK04kDYpK2XjuiWGGj/UODp2yBk+k4ufU7Hnw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784887562; c=relaxed/simple; bh=+RQX6Z5CJi4damuHXNSpYQzNvUipT39Ak+qcC0d86LQ=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=SNoOZ1byqTHFZrcXUyXi3/ARCRFsmk4oCb+mvfzHoDwXbAm7Sv26JFYFw/mih5iVQfdRhkmKwlLxC90uRTLhawSzcx3Mwv+SNFiJzjaIRFMD3uSXslbsfX0NtNuBUIPmndpkNUwTffyK77l79iThLjUTScM7+ZbwYGucDOyaUYg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XysQhOaW; arc=none smtp.client-ip=209.85.214.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XysQhOaW" Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2cfbbdfa60bso2788835ad.3 for ; Fri, 24 Jul 2026 03:06:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784887561; x=1785492361; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=o0x9J44qVBxsbkEywzSNqZdp3EOTpYHRk69RjXAekuw=; b=XysQhOaWnEJUUAUXeFXtcE1DuFMTfstzHcS3XoSfqh0Fa7J3im9xSU1f4AyseVdwwg 3s9iufnd+S+d2hFBaG79bwmMgDZEdFKfjFGVfoTW1bD6qMP81/bYWpvNKpb1ikMkq50p wS88yzgDJR14TgYnzy6Fgx6WvRhjUqgbrQyz/O/VL3hvz6+tQgMJrdF+xavmczUjo6sl ytCVkZLMOo5IgHAsuziGKidH4XO1F+uIVxpYCLWShrXySn7WLNUK9BpO6ubrUGZI4pl+ 3j5eT+bEDsI033QPj+n+sJXaJauV6K8yfVSOnb+eZrRdsQIF0voOK0TGvEVFC+LhONVf Goxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784887561; x=1785492361; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=o0x9J44qVBxsbkEywzSNqZdp3EOTpYHRk69RjXAekuw=; b=Ll74Iyg66eaU63OCYc3q/iiDsH0OKSQMUZBotHL1TJUh/VcqlVxrE3FMPMDaSOCI4f o1qOT5zKgdT5f+cnMEuDVTNhKv3LviaoQv9xvWrp7cfCG7vdjoZexSGCaw7NDybxEKC1 JasIg+8/33kx7JEd3H5mJaLSBb86CqE+nWlhR+sF2RoHt+0+1RwEEhPewagp1yrzWYIQ hWCxkPPO1rwIN0sjcz9P0LyYWuP6TAUzZQzXY+kUJzUyfE/jy+KC7PC9FN1fQlrscXhB kRK++BG8nLEhaFSoC+D/xNSHggQMv432nAl4A+nEk9gEmkZu4Li6xo/qnBQy3teqb4ax QsEQ== X-Forwarded-Encrypted: i=1; AHgh+Ro7r+f21HeHYZ8tJfE/WgnHAxMOvGHmoFMfr/xh3zo3rkxzoRxDc8gzk7jhRQFTsX9ztGPJajde84gMEeQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yz8nYMetXbivpvng7Dk4/1nqQWSfwCNh5iehcmmtzh/opJDlu5/ FpQHkxAUmStIIm2XDeOrXU36Y3awA7Gt4HEW2Krti0HcYZPGOPhdeRN7 X-Gm-Gg: AR+sD122ZAsehoBarUVGk3ftOsX/WkcP61MS/cHbidL9izCOgE6hXFx7xnYqztFSGcc YF6PcKoC7kuBu19qFhdQ93AvOSsI/rOJptylM9b2smIk5YwlDZ6jvFsyHMFzFe9FhvqgYyddKT0 Hv65uss2ZiyvjgIMaGXKesGcomu6PCt2XVf1f7EjOTjOiEct4hz/hHWjvsS/+b6kcsD/NkYXBYx B2FcxHgjvS8mbJmbnA7VHTAuq2RFbTy4seniy25Tyq+3iH9FeDGYOptNhl43853cv4ov6JBnlLv Q+9FQ3BT7rS/xGsiDhC6fhj9pf/weU1qgaWerbOG4uvLuIe8xzXpWjvMP/gJ8ZiTUXMBCfiTFoj H364tgFd0odBGDcPW5jFGriCm1yAluyYBgDzxhPDPGRb8+EVACkvgv70XZiMbWdL6a6X8o4hyF/ cr57XVxpYO6yUbaP0F9lYb X-Received: by 2002:a17:903:22c7:b0:2c9:ed16:8d8d with SMTP id d9443c01a7336-2cfa6d8797bmr76515745ad.38.1784887560837; Fri, 24 Jul 2026 03:06:00 -0700 (PDT) Received: from spr1.ipads-lab.se.sjtu.edu.cn ([202.120.40.82]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf8efa2cd0sm48600405ad.4.2026.07.24.03.05.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 03:06:00 -0700 (PDT) From: Hengbin Zhang To: linux-mm@kvack.org, akpm@linux-foundation.org, david@kernel.org, ljs@kernel.org Cc: ziy@nvidia.com, linux-kernel@vger.kernel.org, Hengbin Zhang Subject: [RFC PATCH] mm/thp: order huge zero folio PFN invalidation before removal Date: Fri, 24 Jul 2026 10:05:09 +0000 Message-Id: <20260724100509.2300200-1-uqbarz@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The nonpersistent huge-zero shrinker removes huge_zero_folio with xchg() and then invalidates huge_zero_pfn. A concurrent fault can publish a new folio and its PFN between these operations, after which the old shrinker invalidates the new generation's PFN identity. A later partial mprotect() can misclassify the live special PMD and enter the ordinary anonymous THP split path. Invalidate huge_zero_pfn before making huge_zero_folio NULL. A getter which observes a zero refcount while the old pointer is still present cannot publish a new folio: its cmpxchg() fails and it retries. A getter which succeeds does so after the invalidation and publishes the new PFN afterwards. Fixes: 3b77e8c8cde5 ("mm/thp: make is_huge_zero_pmd() safe and quicker") Signed-off-by: Hengbin Zhang --- mm/huge_memory.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index b5d1e9d4463d..fcc492368160 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -298,9 +298,11 @@ static unsigned long shrink_huge_zero_folio_scan(struc= t shrinker *shrink, struct shrink_control *sc) { if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) =3D=3D 1) { - struct folio *zero_folio =3D xchg(&huge_zero_folio, NULL); - BUG_ON(zero_folio =3D=3D NULL); + struct folio *zero_folio; + WRITE_ONCE(huge_zero_pfn, ~0UL); + zero_folio =3D xchg(&huge_zero_folio, NULL); + BUG_ON(zero_folio =3D=3D NULL); folio_put(zero_folio); return HPAGE_PMD_NR; } --=20 2.34.1