From nobody Fri Oct 23 03:31:41 2026 Received: from PH8PR06CU001.outbound.protection.outlook.com (mail-westus3azon11012039.outbound.protection.outlook.com [40.107.209.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E9CC56853B; Thu, 15 Oct 2026 18:13:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.209.39 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088012; cv=fail; b=ow/T/TUa+FkHLFn4cdlQMGvLeOPLH0aZkkXdhBTWAXPkKvFm+6mNytrxbBcjZdVbuRslAbcxM+iED1sXnZXww/4D5aHo+zed7B6QUFrpOXUNlNKScMNc1P/Ck3YfX8LhGYb03pwXn9/rEEDG4K17EphkNiOkFUqSBBglRPf+NkU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088012; c=relaxed/simple; bh=v1fImGEKGzE3nGK9ANJDd5Vs3iN0fItPFzkZy0ddAgM=; h=From:Date:Subject:Content-Type:Message-Id:References:In-Reply-To: To:Cc:MIME-Version; b=ZFx/8Z5gdxpUq3fzrvMU5nUJ6qjOYMj0K7JDpNomAsZl20yZZ/Oz4zG2JwJwY0JVKqiRnqpldjPMvS+KPRPiIJPON+pe170pMQg++aeKU9z2ryPBfAENhOPqTkov6Wq+/LG/7bEOXOm+XC5YE+IlPU1oU2Jd57EWaF0SCmXspFU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=JIa9G1Lj; arc=fail smtp.client-ip=40.107.209.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="JIa9G1Lj" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=VWhxSSXdnn4AQ0FlAFUr+9WsaB2YbLysjBOTEeahA2/wQcGh2PW0FjY1IHKmf32VnmD1Z8Y4iJ1zWkoiAajhSv3SUG6ge3SFllU+xi0aeFhKHiN1XahRPODIIGZR4rHOg3RRrQf/6GQjwOUEvVk1fHs6pwtkQwHUykYqKgR9f9R/j+Mklw2Y1jO+6HKOCQ2nJLt52vU/DclRHPOfTSdqYo9n8mm6UjSF8y1Y9aCwFN77KiuK3s5uSI+4SatCIf450y15g1tEkn9F0uQzfGs0+b7x+SZrCyj0OmYDfYnTO2zWXXhDRYDsDh+Luo4OdTej2QVA/qIznT7Z7ukgZyAVpA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=4nQRG+P0Cb5YJVXcWEOM09eq9a7157aYbKeMOoFYutM=; b=VykgrT3j4CUprB0Ipc5Tby5Nn9xSecrFk6B3zYOcq0Y1kd/XHXmfXWfjCw0qQ7TYUOndKd4MijhWPqx2HoLhqSK39QmsJbeSz0wPbhnE0q0l4clmycO+aK4Bkx+ZWnFVJ7pd4dcymr/TDJmClcLr2fQC9wiyzsIlz5Qnlfsv6aadfQ6MJlbfeFk1PmWttKA9A915Ho2N7gnOYWxi71T6q3D3mgE1Ljl1DyvNhfdzHoC2jnS889wC7hHpm7pn2ADZ2lK04qqDezio5kkFyU8qKrGK3FQe5ZuBdhV6WuwB5NeifkLIa/lGkKXyscWl0S2j2qW6rxGBLYrIL2cmfyupmw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4nQRG+P0Cb5YJVXcWEOM09eq9a7157aYbKeMOoFYutM=; b=JIa9G1LjQTyoJzxSkf0UfcfJVMr41d5nJMSdM1dezYNK7It3QSCInlx207MuTj8WMOz4bTHcuNgunzH2Okvktm3XnlEBon/s8tG7C7FjuqRokBYb0wvdJHtfGmUyWPrBmu/J1J2QOOg7lPL+QM9xGFhuAcU1m/lox4LT/In7M0FKZJWWHB1tK3S7l7o83GXZACS5EZkJFo0gsKHy2DCYOwfTUOHBHGTPy6Peka5itSGuBrSYhA+xqcNlOZhd+/v1bI/VCiAXyE0xuB17Y22iipqUbOtWxl2refIBagyzox9Vjf+h2P36S9kporlE7eL1/ruIGGhd5qB8Y6/7lHyUtA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS0PR12MB9058.namprd12.prod.outlook.com (2603:10b6:8:c6::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Thu, 15 Oct 2026 18:13:12 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%6]) with mapi id 15.21.0472.016; Thu, 15 Oct 2026 18:13:12 +0000 From: Zi Yan Date: Thu, 15 Oct 2026 14:13:01 -0400 Subject: [PATCH for 7.4-rc2+ 1/7] powerpc/book3s64/mm: don't count invalidated PMDs in page table check Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261015-anon_vma_uaf_fix-v1-1-7b977303b42b@nvidia.com> References: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> In-Reply-To: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> To: David Hildenbrand , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Lorenzo Stoakes , Rik van Riel , Vlastimil Babka , Harry Yoo , Jann Horn , Kyle Zeng , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Zi Yan , stable@vger.kernel.org, Madhavan Srinivasan , Andrew Donnellan , Rohan McLure , Pasha Tatashin , Michael Ellerman , Nicholas Piggin , "Christophe Leroy (CS GROUP)" , "Ritesh Harjani (IBM)" , Shrikanth Hegde , linuxppc-dev@lists.ozlabs.org X-Mailer: b4 0.16.0 X-ClientProxiedBy: YQBPR0101CA0096.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:4::29) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS0PR12MB9058:EE_ X-MS-Office365-Filtering-Correlation-Id: 62527d50-ff55-48b6-2f3f-08df2ae7f955 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|7416014|366016|23010399003|921020|56012099006|11063799006|261009223027099003|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: w0d5tzQhOwY6iSSgqyhAYg2J78Xhv/ZrYHuiGIHwgQEkJtui6nJCmb3F/fIE6Oa7uCju/elLcwT4w7Zk1mt26g+ZiWEt4Frj8br+VMEPc9CBvhWojMErB8YPvy2fyp5akm32+eV29grTRJynhnoDDrTDRl7uUZxYhu6PrGnWvS6YFZUFBGEF2CVLOiumDfms1NyS6HSe6RaCM4dnEIQRN6AW4Zmc3xZzgIOMesrPUrguZnWdj/QrkAa96YEuS2qGeFETJS2HHxZ9uIphPgeIXsYOJIWVS0IorID4LkO8K1LGbst6W9/pBNhSpGx6DldBmt0BZ5fAeKnBqVxeSrHa/+Dzz3acG65FTJkEUrptMJKG3Jut8KPS3e0NTbuV/Igc8mipRQS4+aWvSkbWQzXI0HN7x9qUstoUdF51U2TRRnYizSBfUqAJMIS3d07awditqJEWCOtS8273GywcBwkjo/lK34xFK8x3uTy5E9CG3L+yNsNDeZzm3UWEdMWqqyrLMgaWuN7m96iI9TFoP7BVcOScC+oDeAU484Jrsb6rz/0ETucL2Z1KNXCDYj8m/v1znfnyCJVOGnzvzjdHhntvlJ3luE0Xy24wYk07oQ+mL6iM/vRRGcz5la1GYzfvfKLp1Dqq6K+S+zMcdK/WH9IzlFeCU14t/DOCAalop/pikw5UkNAb2FtV5K4vgeRKbuOw/ODc7cn8874fUNM0K1XYoA== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(7416014)(366016)(23010399003)(921020)(56012099006)(11063799006)(261009223027099003)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WHhsb3ZiM2lJYXlqMndULzBIK2tiQTk4Rlh3MmZtRTlUU1NjT1RVUWhKa3Iz?= =?utf-8?B?RStuTWVSTFBtN0txY1c1WWowdklLcUpmZ3dPM0hkanF0Sk5oM1ByWHh1S0Rv?= =?utf-8?B?MlJQa25HeHlzMGxKV2hJMDc1QS9iZDdZaVhoV3NUN25MQUpoT0RHdlJxZXda?= =?utf-8?B?bGhuVnArODFSdHVhczE5ODI2bU1wc2Evb3hxYzR5V2lweTVoMi9LaFZEY1VL?= =?utf-8?B?b2UrL3IwNWM3Mk1BdWRwbDVIbENtOVRRUXdDWkR6MFVjRkNXRHB0bnorUTRy?= =?utf-8?B?VUw5c1hKM3lQU1hVMmFzSjgvQjBjVFQ4WFRlT3FVVVlxVGwwSzNsTmc2TmI0?= =?utf-8?B?bUhSQTcrODdyczd0NHh5a0NCMExKa1RHc3NMMkw5VXFVbG9CZGRkamwzckxs?= =?utf-8?B?TDdMbFZoVVliWC92d2RyRXRlTnAwOWdHN3VGVHdXbmVnV3VsTXNwdGFBTms4?= =?utf-8?B?M3l3M1hWVDR2RjcwakNxM1dGRThPK0cyUS84OU8xdGxyQUVGc3VQWTYwVDVB?= =?utf-8?B?SlpqMk9KUDRkMFVrUHZLbDZTbVJvS1k1a0JMRHlVVE5NT29BVjk3QlE3T0t3?= =?utf-8?B?aUJKM2QwOWFqWTFjVHUwZktPL0hzaE1CdGFFU1kvRTgxeFN6Q0V3R2JoMDhD?= =?utf-8?B?R0VkaXNPT09EZTNteU9XdEtQYTRYZDZSenAxQzdDbUtDczFJOE9sbElpNHdx?= =?utf-8?B?bWx3MDVhMkIwYXd3ZXMvL1U0MzR2Vms4OTFsZnJuZ1VXVEx2RFMwd25FTTVU?= =?utf-8?B?STQyV3NVMHd5RDE0MGxSazFPdDdqUERnclpsekZVTkY2K3l5eGR6T3hicVla?= =?utf-8?B?MXV0YzlZN0NQK1ZNVmV5M3VDNDRDNjhDREQvRHE2K0xxS3Bzek82bEhCcDVq?= =?utf-8?B?VnhZSmx4N3N3YmlBaFZ2THVoT0FGSnN5QnpMcnNWa3dJS3puWFRGanZ2SGpt?= =?utf-8?B?VXgyRXlyZ1RQRG5kNE1BeTloOTlPenY0aUt1Q0tWQllYTWkzUnIzZHhDdWxL?= =?utf-8?B?WXZJZHRBS0duTUNBRW1TMVJjMFg2U2hPV3pDR2V2dWZUcE5aL0RXZnNqRnNl?= =?utf-8?B?YnAwa2VVVGVabFU2cmVEY0lvRllpbFVIaEZOREtoZXhJdkRJTm5EUnJYUURn?= =?utf-8?B?WkV0VVE2SWt5Q2ttK2RqWm1CZjY3WlVRcURUc1oxRkw1cmJrNEJ2ME9Pek02?= =?utf-8?B?U1JETHNIdlZkYlZodzdFamwwMHB3dHp4RFBzMDQ1Vm5xaU4wOGwvUmtleDNo?= =?utf-8?B?TWRSV2VROUN2ck5wUC9nemd0VGlvSzFQWnBNT01XNTZzUmQraXdZcDJ2NWtW?= =?utf-8?B?YU01LzR2ekRsSFpkNklxYVZRTFdDSitWTlI1Ukp5clhuUnF6RzRFaTVDSXdv?= =?utf-8?B?R1JsN0tjS0ZyUk1KVUF2QUZyd2M1ckNHam9IS1JjSGN0OEZublovOElGbWYy?= =?utf-8?B?RldKWE0zZjdPMk5oenZGUUpJV3QwdzhQRDU4Y3R2WW1ROEx6dFpHTkJqNUNG?= =?utf-8?B?TTVxUFZXWUlIWEFreU5UZFlvRk1rdkZBTUJoQW4xRVd3b3A4YlJZYmtWWDh2?= =?utf-8?B?cnVIN1haMStNVDcvVTN3YTFieXU2K3dDSlJpY3RGcXRHVm51Z1MvTzlHSnJS?= =?utf-8?B?dnpvdlM0MlNuQlBVTUUxRk0zZWZBK2wrN3NsNVJheTlvOHQvdFc0MnZTaFlY?= =?utf-8?B?V0tINzA2V2h1UlZVUkMrWUhtZlJ1dTBwWDNMSGNHYWhPMlR4dW9rclNIMTBL?= =?utf-8?B?VjFKcUZSZjRxd2pOOTAyeGJwWHd3ZjJZRUVtNENiV2RvM3o1eHRsK3d5UVM1?= =?utf-8?B?dEhCMjNRa0EzR0tFYmZQOXc1OXFhNlNuL2s3aGY3dzQ3ZCtKTUZXKzdJSHlO?= =?utf-8?B?WUEvU0FRMEtUaUt0M3JzWjJpYzVJbFg1anVBL1lKWGVCSkhiZVFQK0xlaXhL?= =?utf-8?B?ZWI2OElyWEpxUzBtdFM3T1JnSjVBNnpjYTJjekxITkJ1emN3WE56R1pTZ21T?= =?utf-8?B?NDlRbkpWOXpIYlloNDJDTDBGWE9VYUFPRE83OWdTVk9yS0o2MWlkdWdFY1VL?= =?utf-8?B?OG1rOHZSRjBPd1ZIQ2FOeER1V1k0V2d4dHpqU0xuYXRWZW5kSUNFUG83R3F1?= =?utf-8?B?Yjh5elVrdGZIOFlyZXpJOFFFTjJHMXZSWkRQV012TldtVVgzQmxIL1B6QXN4?= =?utf-8?B?UkJoOGw1aW1Yem40ckVFMGh4bDI2TTYyaHk1dUNnM3doUVg4bStqZGVMd3F1?= =?utf-8?B?ZWNVelJiT21XZVFDdHU0bkZGWStSdWY4K0VQWFRWUnRIYUNxbGs3SnV6czJl?= =?utf-8?Q?WJvJ1aVdlfz39BlY3S?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 62527d50-ff55-48b6-2f3f-08df2ae7f955 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Oct 2026 18:13:11.9775 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: QAJSY4HiRsI0JFy7QfG+HifWNUwMHC2SsmYWPk7Tizs6E/5LlT4U/uF6uJV1HP7b X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB9058 pmdp_invalidate() replaces a huge PMD with an invalidated one (_PAGE_PRESENT cleared and _PAGE_INVALID set) and calls page_table_check_pmd_clear() on the old entry. This decreases the page table check map count. When the invalidated entry is later replaced with set_pmd_at(), as MADV_COLD, page_mkclean_one() and change_huge_pmd() do, page_table_check_pmds_set() in set_pmd_at() clears it a second time and decreases the map count because pmd_user_accessible_page() still counts it as a live user mapping. The same happens when it is cleared with pmdp_huge_get_and_clear(). Then the map count underflows and hits BUG_ON() in page_table_check_clear(). Found by code inspection and confirmed in QEMU (pseries, POWER9, 64K pages, CONFIG_PAGE_TABLE_CHECK_ENFORCED=3Dy): MADV_COLD or mprotect() on an anonymous THP hits the BUG_ON() with both the radix and the hash MMU. Fix it by only counting entries that are hardware valid, so an invalidated entry is skipped, as the patch "riscv: mm: exclude invalid THP PMDs from page table check" did for riscv. Fixes: 641d47d4c963 ("powerpc/mm: support page table check") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Zi Yan To: Madhavan Srinivasan To: Andrew Donnellan To: Rohan McLure To: Pasha Tatashin To: Andrew Morton Cc: Michael Ellerman Cc: Nicholas Piggin Cc: "Christophe Leroy (CS GROUP)" Cc: "Ritesh Harjani (IBM)" Cc: Shrikanth Hegde Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-kernel@vger.kernel.org --- arch/powerpc/include/asm/book3s/64/pgtable.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/in= clude/asm/book3s/64/pgtable.h index dff8790a047db..392474972777c 100644 --- a/arch/powerpc/include/asm/book3s/64/pgtable.h +++ b/arch/powerpc/include/asm/book3s/64/pgtable.h @@ -1091,7 +1091,8 @@ static inline bool pmd_access_permitted(pmd_t pmd, bo= ol write) #define pmd_user_accessible_page pmd_user_accessible_page static inline bool pmd_user_accessible_page(struct mm_struct *mm, unsigned= long addr, pmd_t pmd) { - return pmd_leaf(pmd) && pte_user_accessible_page(mm, addr, pmd_pte(pmd)); + return pmd_leaf(pmd) && pte_hw_valid(pmd_pte(pmd)) && + pte_user_accessible_page(mm, addr, pmd_pte(pmd)); } =20 #ifdef CONFIG_TRANSPARENT_HUGEPAGE --=20 2.53.0 From nobody Fri Oct 23 03:31:41 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013038.outbound.protection.outlook.com [40.93.196.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46870466B58 for ; Thu, 15 Oct 2026 18:13:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.38 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088017; cv=fail; b=SG92pBVHpBoftHHiZ552rlnz0zJVsmUTA2j4EaXnho8qt3r73ltoCKOKtQkTHwd5MjLaQH9YH+sTUCMz64nzjDMQOX7JAVNELG21W6jWRvU6Drj7anRJoYYM0BJMtpbejpytq21ft1J8dyBkyqm0BooD1e0F6o1qPxgkszAD0Mg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088017; c=relaxed/simple; bh=J64OeNEPZdPwgIZjg9eA25aSML8dF/ogNpCYFBLwW2Q=; h=From:Date:Subject:Content-Type:Message-Id:References:In-Reply-To: To:Cc:MIME-Version; b=t05GwKJiiXiApNNAEt15Nb2KX8W0lrUxcPA3JkQb3uuplkd+WbEhvcUiH7Ivj6V20agPeDPKYkA/5ozUh3d8V4Sld3oIrN1a4vUUAYShJIQFIhwm7YuvmeNx/YpENYgTzPzLUHjLNBEUT0H+/Wdz9kwSixsFL5Tqvftc08s4iaE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=drS4tK+9; arc=fail smtp.client-ip=40.93.196.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="drS4tK+9" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SvkyZmt+L99PQrUG4jGW2fLc+MpbuTV1qNP94GA3XtCFXplpwDZMvfm9Y3LTQ1Lq+okf3ySdOyCecMmW145pKVUSGdJY7jcLAZVNh1kDO8191/u1/VxhL6yRUySAtprOwc/3aUh7KNShDs3p8im/5pSZUPXH0QplKInTCWMYs8+VyGaOW6T2itCxWkyHzEwusHJuvDeK6DtB3fZ8A+Vop0JudS6AKxt1BurCBDNVEAi7Y/+d18lFdOv9lwOY9k09KWVxDFhDBFpgonRtkCQps0FqnsBx9x9Sn3k+S/YEz9xYWSMRnS8iqU7tjCTj/SeOzLzalTjY9kvu0DNPIJKKCQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NjQRMzjmWhwFyO/EkneVh0xWt8+hcaTn26d1Fi2mBg0=; b=d0iocx6XYG2bzL/DVkYjqxDxv0tcLAxuA+P7nC0+39HNCH2h0NJIiGiKCfejTAJ2cAL68aMJcLE3KEvKnvYfG073gSEVpozmltUtyuJgWBkD9xMxdX11nP9z2xoQb+1+d0S/guLM9dyyHxw6VPmFEEcQs1uWa6xHAl+qOAzhDqW6w0BQhHtO5IOfWxzZUaNThiEq+dKET2iauhsi+SH6QC3tNrjCZhk9j14hOnOMKc9TEf8m4sFF3GX/QMlvBH5dTH/rfVcG1NFZtC4oOkZ/dPYlqx0LVdtbrmfzzGrjPQvREcvB6sbLnk8dxkA3Grt95PWEVlq8m+3PkTAslrSm1A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NjQRMzjmWhwFyO/EkneVh0xWt8+hcaTn26d1Fi2mBg0=; b=drS4tK+9p3m+gi8D9YHgQWdPPSralJyV4hZSarYYmOJFpHpyidHYZvHXglkI8+dRO+jsSTszf9xaGhvREny54zs4mG03Ln81OGo0NRSRh0eKKrHGtRYOfYAggPrm3CUME/Dk6eCJcBlt5jCBi68VYvGa86EK6KxcnrUJjQ8Ykexbbz6+xFEDHbPnKiH+OXXsEOYEqr/XNQhOoxf+Bx+47fBnxONEkc72dWG5c7eM32ILoZI5Jan5ul4nbe7XgfWm1qEg2jfAEQ5sK6jszE2Qea2n5bzxrnHJi2qPeTVd0U4ngbRZcrKCMpSBQjyszf5eVKnHZEUy5A170xpxHIuMZg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS0PR12MB9058.namprd12.prod.outlook.com (2603:10b6:8:c6::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Thu, 15 Oct 2026 18:13:14 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%6]) with mapi id 15.21.0472.016; Thu, 15 Oct 2026 18:13:13 +0000 From: Zi Yan Date: Thu, 15 Oct 2026 14:13:02 -0400 Subject: [PATCH for 7.4-rc2+ 2/7] riscv: mm: don't let GUP-fast follow invalidated THP PMDs Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261015-anon_vma_uaf_fix-v1-2-7b977303b42b@nvidia.com> References: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> In-Reply-To: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> To: David Hildenbrand , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Lorenzo Stoakes , Rik van Riel , Vlastimil Babka , Harry Yoo , Jann Horn , Kyle Zeng , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Zi Yan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , John Hubbard , Peter Xu , linux-riscv@lists.infradead.org, Jason Gunthorpe X-Mailer: b4 0.16.0 X-ClientProxiedBy: YQBPR0101CA0101.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:4::34) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS0PR12MB9058:EE_ X-MS-Office365-Filtering-Correlation-Id: 8d3ccb48-1394-452c-9e57-08df2ae7fa30 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|7416014|366016|23010399003|921020|56012099006|11063799006|261009223027099003|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: EyxtQlTXCxPQI0x7pBb5R3ujKfkedl3RDfsHOHGoGPFPeC4JVh+qeb//+q+6AxaTk5JK27tmbkvyKnZMTrG+qHzgvq47zCbrVIRTmLXYKnNAKIntW4+TG4kWjjC0l+GAW0Pc2/4S+QU5dnT568RioItUuUvSn/GJMqPilNiEWPez08/3Q5hZRp0z2oqUEMfDf2R+K7oNbTQvqqH/E94bs+ZTUuNN+z6jxlM+vejZ46xXWqzrDYPK0J+grf7KjBBKUF9GUj2P+HI3vXdJK9klXyDvX0vcP6I/6qrhPAvHd6b4h70hul3duA41AOcpmm+usCPq3AUb7LJt5JIHHXVBu3Cmo53nCfMNQNw5qbWarFKYepCbH4AttWHSnwWkVM76Alvky0knA7AbZlu5uvviet1mpJeF0qJXe9kNucRml77+iKOCOlVjb84EQ5QoUathLlP7yHmQz+fBIl4rYBkmNU2vR05MHZfKdYgA0loVigSq5woiE7nsL/WVnXS6kP7g4xEg+SPyAe/tPoGFp0lk2oCusJqKVR9EdwBoavh1/GH84n4r33q/tzVxnkzYGA9MTzhfogWbF/rck4ja8mI9QFO4gfeus+VlcljRxVCkyI/iYX+ErtoDLc8F1PAXaTVbc19pb16AaB/onXieVwbnNf8Fxc1+ckGWTFSzWUnwf2zbhbRKft5g2lQiNWiHomFPFHvqjUGUM/v5YKHogdsytQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(7416014)(366016)(23010399003)(921020)(56012099006)(11063799006)(261009223027099003)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?b1JYdm42UzE5bFd0L2o3WTBnVlRHNjhZUEpLM2dTQlZyK1hOaGVudERzeVVv?= =?utf-8?B?ZjltRTh5ZnlIbUlRWTB1b202K3YreG9IVG9aQ01CcnBEbUU0emR6Tjcwamhu?= =?utf-8?B?L2t0SzlPTjl6Q0dZaXk0OXhqRE9ZdWtEeXRGeE5nS1BuSEMwaCtjSFBjLzZG?= =?utf-8?B?ZHMzNjdPTFZwbGtnWnpwQzRDMlVlZkhzL1V2TjBPanNoZTk4eE9ham9VOGwv?= =?utf-8?B?a3FFWDZrbVJ0S2c2Q3hXb0lUbTVab0NRK1NNdzZrTytHL01meVgwUkYwRjU1?= =?utf-8?B?UVlDOUNJcTZrQk5VdElTRGJRdEhVb0oxeDV4N2ZRR2pXUnp6Y3hEZDZVTmR6?= =?utf-8?B?c1diNENBOHFVbndvZHkzT0JudmlPOEYrMWNHOXFtMi9lcFc0SFZ3T0ZyZVMw?= =?utf-8?B?QmVRVWFBdHVmQno3SWFkbkh2clcvU0QrYzhXZEQ2dFg5UkFJQ2lTUmlMSjJt?= =?utf-8?B?Yk1mbC9NQnZDMmFhRXA5d3ZrNVpNekMzUDhwekNTNVFMT2lmUjBKdlVEVllM?= =?utf-8?B?VHlUQnlPem9pUWFMTUVtakFFaDJQR21vbEp4VnZxajFyVHlqNWlDMC9wcFI4?= =?utf-8?B?S21xN0l6bVR6MzlnenVhVThINWJXbUZqVVIrd1Z3dVk1ZXV3SzZid3daNDFV?= =?utf-8?B?Wnp1c3U2Nm1VejdXelpPUXB1MVJYK1VHZVpST2dqamNFQzg2UktnUmxscTF0?= =?utf-8?B?NDN3ZVhCKzVUc1h0WFhsMWg4K3N5S3dmS3llbVZtcFBBOHFKMXF4QkdLbi9u?= =?utf-8?B?YUViT2dtZEdIUE1uSzhDZC81NkFMVlE1SGY1ZTdKNkZQMVVkTlZMdkZ1TUlF?= =?utf-8?B?OTE1T1J5a0FDNStPbWs2ZlVZOW1RUXhEVzdIbHdhMHZreW9QaEY4Y2NSNHc0?= =?utf-8?B?ZWRDcWdjSWNEZjRWZTdpQzVzQVlzb1JWRW8xMHd0MGg3dm9ZZ1JkK2wxak1K?= =?utf-8?B?bnNOUzI3UkFKKzJtVFErVXcrSllEVnlCZnp1ZVVjVkRySGE3ZjFhdDExbWhG?= =?utf-8?B?L3R1QkJGSitTdGVGaEYwSVRTYU11RUVWNTR5NTBpL3QrbmFjTnBBTVRUQzJi?= =?utf-8?B?QkdEM2l1U0hGakRuWnRtM3ArWmRwMU5QYVRaM1YxcmFDNnZCdEtMbktjTk44?= =?utf-8?B?eUFiczh6Mm9tbUpoQUplWTE2OVFUSndiVk81NitBRE1tTi9YRTgzZXgyd0tz?= =?utf-8?B?Qlg5ODNMeE93STdyMVRqamJKYVMvbUlyY0JyRzNKNnUyWm1wbmVNblFvM1pE?= =?utf-8?B?ODMxdzRFYlowT25jZi80bjRLem1TMTdWOURCVnE3Vml4RENqZVhHbWsxclFN?= =?utf-8?B?Q3FFL0hEdGdiYVJ3ZkdLT2h5dkU3LzliRTlIa2F3VzFuYWppR2puaUllRFRv?= =?utf-8?B?WDB6Y0pMMGQ4ZHdWN3hQU3NxQWdKQ1A1dVcvTGFIc3ljRHNxMlQwZ0dHRDJp?= =?utf-8?B?YnMxbmt3WWZtYUpudG1wbkpqazFoVkxyR0hRb3J0bkdLR2VSR3k2bzRDS3hP?= =?utf-8?B?VlhMZmM5VkJkelNSRXk2ZEpJSE5xQjVocWQ2bDRTSU95QXpna21mSDR5d3JC?= =?utf-8?B?UHc4VFI4b0V6ditJRmFEaTUzNGpGYmxkUlF3cXJ5SDVtME1CS0xvRlBNYzNT?= =?utf-8?B?YmhHVm5kcXdJR056NTJ3WSs0MWo2YW1zb1lac0hObHBQNWNqVWdLMFhjV2RZ?= =?utf-8?B?VFM2azA2Q3dwK0NmWlVMVnZ3TEJqaXNCaVdzWUxLaTVMZEoxNlUxKzJQSCtB?= =?utf-8?B?TzVzWkpMRFZCNU5tMHZ4My9XNkN3c0Q4YnJCWWY4MDlZWkZQZTUwdUpmNmdY?= =?utf-8?B?VWVqTG5XZmwvc0E0dEl5TXFzeDZySmltTU1sMGZydVFXZzREcWxOVERGdjZE?= =?utf-8?B?SEZ2aGU3WldVemhRNG1vMDNPYWQwRGoxWVl5cnNZVkZCVVNjYjFGM0NWSWc3?= =?utf-8?B?djMxTVpuWTFXd3ZiT2MyL3ZaamVZY0VIVXh5OWFpUHFQQ201ZXdKVXVsQTla?= =?utf-8?B?UTl1TFFURTF5VFlSdHdtUEVxeDliNWpDMVZQMThxa1FoVGRvWkR1WnNrQVZl?= =?utf-8?B?V2hCK1BDc2wxMVRiQ2c4T2ZrNHdhRldaMTh0NW1Odkh6UlpEdEJxUlJpekd2?= =?utf-8?B?eWpqTXZLZm9zTjRVanlOaDNYVDlmazRmM0VwMXVtTTRXN2hSUVZWdTdrR1Fy?= =?utf-8?B?S3NkTHAydHU2SWJmRW1jVnd5dmF4NTQrb2FPS3lnK1JqZG1IY2dyNlNhbnpp?= =?utf-8?B?WVo2U1dsclR1Z2NyeDRRZS8rRDFGVkdDVDUwaU1QcDY3SFA4OU9YTkhoaE1j?= =?utf-8?Q?Pd6u0z9PNkEwyjP9La?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8d3ccb48-1394-452c-9e57-08df2ae7fa30 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Oct 2026 18:13:13.4147 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: hpB20jfPFlr7SWLkuY4nhllwaeLxXuUtulVbiGMCTr5qTA+vm5uPvcvMagWh0gKd X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB9058 pmdp_invalidate() leaves a PMD whose pmd_present() is still true, so the generic pmd_access_permitted() returns true for an invalidated PMD. Then GUP-fast can grab a reference on the folio and, as the PMD value doesn't change until the caller finishes, the recheck after taking the reference passes too. Code that invalidates a PMD and then decides, from the folio refcount, whether it may drop the mapping relies on GUP-fast backing off from an invalidated PMD, like it does from a cleared one. x86, arm64 and powerpc already reject invalidated PMDs in pmd_access_permitted(). Provide a riscv pmd_access_permitted() that requires _PAGE_PRESENT, so invalidated (and PROT_NONE) PMDs are not followed by GUP-fast. Assisted-by: LLM Signed-off-by: Zi Yan To: Paul Walmsley To: Palmer Dabbelt To: Albert Ou Cc: Alexandre Ghiti Cc: Jason Gunthorpe Cc: John Hubbard Cc: Peter Xu Cc: linux-riscv@lists.infradead.org Cc: linux-kernel@vger.kernel.org --- arch/riscv/include/asm/pgtable.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgta= ble.h index d48f90140841e..66aac56631f0c 100644 --- a/arch/riscv/include/asm/pgtable.h +++ b/arch/riscv/include/asm/pgtable.h @@ -816,6 +816,12 @@ static inline int pmd_write(pmd_t pmd) return pte_write(pmd_pte(pmd)); } =20 +#define pmd_access_permitted pmd_access_permitted +static inline bool pmd_access_permitted(pmd_t pmd, bool write) +{ + return (pmd_val(pmd) & _PAGE_PRESENT) && (!write || pmd_write(pmd)); +} + #define pud_write pud_write static inline int pud_write(pud_t pud) { --=20 2.53.0 From nobody Fri Oct 23 03:31:41 2026 Received: from PH8PR06CU001.outbound.protection.outlook.com (mail-westus3azon11012039.outbound.protection.outlook.com [40.107.209.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC30256E071 for ; Thu, 15 Oct 2026 18:13:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.209.39 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088019; cv=fail; b=l/m9toG8KQr+pk9iXduzkWSXeSSk8WPZqS5bKXDUDKCZnxIEfIphBILn9sykZnutdtGFvncb+/EtzkDDwaQAv+wuXLHa3iPPD9krgTiqRIOFG+GtSOVbBpqbfMR/AMaVwjnR7W3D24zWvBn1r0eDcIeyrNozWGjAJMYUrE6Unyc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088019; c=relaxed/simple; bh=VQG8ezIU3tx1H/n8rjNrc91L9uApRUgue41l0PYMF7I=; h=From:Date:Subject:Content-Type:Message-Id:References:In-Reply-To: To:Cc:MIME-Version; b=XCBMWZ5oXiZ2RbkAQif1VCO3CpBD4ngYVkDNA0vht7X2aYO/3yQInARhpEy4AZTLr1xJLAUfanzg/7mRgNHIDTQpYpT4B0F4S1XrtdK/I5MasY7xh8dpvLKzmclSgs9BE4FH5gtLve3vCHRQiUavMEAX0sy/9Au2I1np9pJ6Exg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=mhRsDrj7; arc=fail smtp.client-ip=40.107.209.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="mhRsDrj7" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=kVmy2M/6hnj7d5UXE7Qq0jOJUqaHS6qNcvlhd0C9pyiJ2yvq0voq8lx8HmdPF+H08dkEMLW/FgXCfqm7TXGCFfsZGRWDMRcrxiTxpZHBOK53BM/DDyW0xCMK57Q3xJKj5AmomOuSTKtosWaRkaGju3LqXgXRM1QnA5z3+MzTrF54fAZ3OX7CIKbMvdSpGtSiOlYv21qz/DT00FuJfZSjr+PMxzi0uDMVgAao8a0qAe8i4br3pSS+ESXrGr5OIzi+uuCf79UQKxvLi7QUi1xAjVE4eQJrikFwPCCYivoY01lSqMJxiV7C+CcteXvO9aPdhpAGGFbz2vQX5RVJ922eow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=eZFgU1NGLzyuw4BLUMIZLOxrCViKnSXqfb/cgj1xOus=; b=g2HoV/yopYq7sGCGJfvv5Py9PxCRVbONmhSJeQ87oACHPuxzN4wjDv2LNvMIvlnajDudepoLWJbc2angAexRaKRpxEYj8tSyhMowRQQHwlSMe1c40aA27A1iNxbY8vPP39NFJLqe78jDCqwTcOOOttbTFU9WZz7xLzhHOZDqnI+C6EVxamSU/wjL7Bb5XgryW1y+RMCTvF8uiOhZuMXE56JQyQ5qAVqHC6x0U43UrXLQYg5OSNvHdptA6s2SOv8ksZ6a2fmwamuxenmjpM+Bji1xweyGv8350JZ2EX0VNlq6XKSkFqvynGEu40XUb/eaCdsp4VPkYPvYRbcbmaQGoQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eZFgU1NGLzyuw4BLUMIZLOxrCViKnSXqfb/cgj1xOus=; b=mhRsDrj7WM1EJyokVY0otnw/xcexMoI1eKB4j8FBtTnGwlsR1KgDoIF9ots8Nw9ijetjYnaWFSGyRdaW/c7HSL27NoXqUnTat3AHYDqBGpfdUdavAOeiZhau2XsO/Sv+C+Qm3+D7piPYj9TGPEfBdSKzcd+AiW0V2LwxskoABPZ5cypfZzCFcEE9yVsNs2G2FfXbyUHP1PX9IAna0xTx8UBD08avDBvKE5RfyXk3EWmt9SA+gczHEaPC6dlCwnCgTSLESeQkI/IVx/mpaBmoAXFWbWWOAcwmCxjX799h7TOMPHg4fPTNr+SsX5z8T1IOwPZAo6UsWss5iOZ5zThYdA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS0PR12MB9058.namprd12.prod.outlook.com (2603:10b6:8:c6::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Thu, 15 Oct 2026 18:13:18 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%6]) with mapi id 15.21.0472.016; Thu, 15 Oct 2026 18:13:18 +0000 From: Zi Yan Date: Thu, 15 Oct 2026 14:13:03 -0400 Subject: [PATCH for 7.4-rc2+ 3/7] LoongArch: mm: don't let GUP-fast follow invalidated THP PMDs Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261015-anon_vma_uaf_fix-v1-3-7b977303b42b@nvidia.com> References: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> In-Reply-To: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> To: David Hildenbrand , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Lorenzo Stoakes , Rik van Riel , Vlastimil Babka , Harry Yoo , Jann Horn , Kyle Zeng , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Zi Yan , Huacai Chen , WANG Xuerui , John Hubbard , Peter Xu , loongarch@lists.linux.dev, Jason Gunthorpe X-Mailer: b4 0.16.0 X-ClientProxiedBy: YQBP288CA0034.CANP288.PROD.OUTLOOK.COM (2603:10b6:c01:9d::21) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS0PR12MB9058:EE_ X-MS-Office365-Filtering-Correlation-Id: 799f1d9a-3aab-4a10-c611-08df2ae7fbc0 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|7416014|366016|23010399003|921020|56012099006|11063799006|261009223027099003|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: woEBebSdLBw65qjB4TriUWNIKxidzrOI6/D3T0e6NGzoDHjJnnQKhKQn4oMIaEOmuae7K7tJ6N41vqBWw48UWDhDcipDSpqa/vml/PV1Rd/laiHzCe7Io9mPH/30M/hgECVaGDQkh2kd3NJLoocp5OPKP5znLRHy/6/8V5TCE8VpP3+E1d44/0l+bw7LxZG9bU3Rg2PhKKBSetun3j7rt6QQeLkuvuC2RKLgUcm8Vka9Mkb3DLBHcdpQRLFuvnNWK1vjaxV7f4Ro6+cRju8Hr2IMlNQ1ZwGz6VR4tssQTE3xoTDSGDsqkv2aMUZF0ZgjaO4sUrNY/IOe4sZZ8aNbPKVFKBmlO/eN62B0SQiIIoDVl4M8ai46+C6gG1AHdSoPXJp1fbXxM0REQC49QEETXDWxjX7mlrm6AIXwSQyNHNoRTquOTXbQkxQdeno2EA5fp2i5yWDvUqGdCC8wZX+FiFKnTByhJ/9ITbsFlYFRnKj1bhkPagrjdS+wPHx8O4sVbW0bJIG9g5ypJYAx6fsXS1w2lzRbKwu2Gr+ynZE8ilkEvrchvXfygKmxbNvs1E2ifTc3ovVAoFpbK6mkQqkT6gVOjGFetBEfNuqmzI8svcYGEFw007xaul/wJC4RxSYQHnUXRw98ZHEpHcWyGGfc14DZzpfoTo02Gr6/xRPyWQGksuKPSdKiry5kv149RkXmgsxg2L2NKyYj2+c6rqTy+Q== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(7416014)(366016)(23010399003)(921020)(56012099006)(11063799006)(261009223027099003)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Q2ZReGVmUkVpaXp3Nzc4YzBEdGdyYlRvM0ZvdzdyRkFMdjZRUWNEcVlTRWJZ?= =?utf-8?B?QVc5eDBwTUNVdklMaktSRzF3REdGNU90RUNaTEFSZkVqTUdQMHRBdUpUdzBY?= =?utf-8?B?VmdFNWNtVi8vVFhlbjNXUmFsbkZObjFwL1ZaSGt3THl1L2IwVnp5TDlrdHF3?= =?utf-8?B?dGpiOUpHTGN0TFhjbGh3RnJWTzFjOC9IZEZnYjRLaUFGQVNjMTlsaFVmNDNI?= =?utf-8?B?bVQyRDBicW1YOTRkakhmMVA1UFhoQVVkaWRyUDFEM3RMcFE1anBpSWRPUVMz?= =?utf-8?B?cHlvdWhDdzh5Qm85akdNU0s2T3phZW5lbUk4UnZpN2FzWk9jUVB0bXFIdzIx?= =?utf-8?B?aUVwU0tLMzRjaGhUSkRjR3RSQ0ZTVTNEcDVCc3ZUN3JvN0lSd2NkUkdFZ2sy?= =?utf-8?B?bGhKYktBU084ekpQUWJYNnNkeG9DdDFsY09ncVJoTEpLbWUxZUlOcGJhYU1O?= =?utf-8?B?dXdEZnFrcHNVbGU4SzUwakxMb2RkNHVFREsvUDZlUHA2UXMxR1BKV0swNjZa?= =?utf-8?B?eHZuWmFSM0JnNUd6WG9zMHM5RDFvcFFOUmxQYlZtT1lkT0RMbnZibEN3Z0wv?= =?utf-8?B?YTBFcHh3VDFKenBzaTI3S2piRzJnTFBUaytoazR5WlJLaHlOajBYMVdpZWRG?= =?utf-8?B?dXJNTlJLOXhja1Jtanhwc1I0czFDMVBIMkJ6enkraW5XS2dCK0JuaW5yeFdz?= =?utf-8?B?TlBXV05XNnlzZEJseHIwRW5ZVmlOU0YyMFZ1TjIwT05EZmVkMjFxaUJGSzRC?= =?utf-8?B?ZW4rTGE4WFFWVHZER2k4RzlPSWFocnVKSWJrUWZyckx5eGppV0lPVDFlY0lw?= =?utf-8?B?cUNEb1BZcFQxcXhsSzhOcW1sTFhoL0plYW44bHQ5eHlzaWxKVk83K3NCRjNY?= =?utf-8?B?ZFREZWVkV2JrTmlFejhYQitDVnpMRTVQS1NaUU1YYkVMV1NNV3JyVzNjU05J?= =?utf-8?B?aUZFRDhEQ1RUS3BQdldtdDVadHA2YWtxUE9ydWZrRW83NXZHc3puZmh6N1VC?= =?utf-8?B?S2JScTRNTzZTekRHcmgyUEJSVU52dU9hMnJodHNhdHRjSEsyMERXK1JiWVVs?= =?utf-8?B?aGVUazFEaWt4M3pHSXpTYkhzaEpFTlNtdmdreDdMVURYYmRIM1pxdXBaWjMz?= =?utf-8?B?NjA3M3IwcnZvem0rdk1hQktyVE1jRjBqaDJUSXRJNGxqYTRUNmltVGJ5ZjZ4?= =?utf-8?B?WEF4bWlVNUxTc1oyTndzeWRxM1pRNkgyQVNlcm5WbXNDZjN6QUpwblVMaW5k?= =?utf-8?B?V3owVHlUSS92MjBwTlNUUWxRNVFCTGlyVGJsVUs2SWZ6TWNkdU8waWdlUnlB?= =?utf-8?B?bHl4RzZ3c0xoNm9sb05EZVNrRHJpdjZ4SUF3L2hsWXpzdDh1dFExYlJBYkQ1?= =?utf-8?B?UTNCVkRGb0xPTzBIWGVLQ3FUdHlBQm9sdVpjMFkxYjVYSHJPOVh5MEpUa1hr?= =?utf-8?B?ekViVDJEY3FGbmdjYlo4Y0FZSHV6Vzc4SE9BanNmanFZSEJaU3Zkc2ppVThu?= =?utf-8?B?YmV6djl6SGFZSFlmRE8yZ21WYWlQVzBjN2l1dzgzSkNoRmVCUjdlcDIvOWo4?= =?utf-8?B?cklwK1BqakxwWWZHOU9Zb2QvUGZqMUZKeXFJTVdaWGZ1dnBOUHdjOXNuQk1t?= =?utf-8?B?S1oxbVB5cmRHenZSSjV4UzRScTFteU1VUFZjOFJSeWc0azhQS0hjUU52RVlm?= =?utf-8?B?OFZETVBLY2dCOGszamVNQXBCVTNCSlhqMTNHTlBpdTJCd0svRTNucHJXRzB2?= =?utf-8?B?b2JSQjVqWG9kNjlmaE5GS0lZZVE3VG1Wa1hHdVpjT2tiaTVDZVdYK2Z0a1F6?= =?utf-8?B?TzJZOElpWm5VY1VRM09FMmhuTHk5cWpyalNNejJrSlBONFl6Z3VKOFFTZkdQ?= =?utf-8?B?cXJjZ1lIZ1BjMXRMc0hqUGRjZEpCM2I0Z0l2STExaVBVV3Jlbko5OGlhNlE0?= =?utf-8?B?ZGJyUy8yVzdjb2dId1BRWE5RT0gwZHFGd2UwTFhHeDdhRERKMmR5YlRReEp5?= =?utf-8?B?VXpERzVDMmRZVFZwQ0cyV0twNjZqTmVoeDNndVc0a0RCMUtMUWk2MkpBV0Rs?= =?utf-8?B?WkV0V1VoT2dIMXM3RUxNRXRTWlhyUzAyZ1BzSGY4YlZyUWZ1VVl0UEtEUUJx?= =?utf-8?B?d2p4TmROd2FnMkthdDRkN2h0clZ3RUtYUGtpSGdjQzVIWFRhdjdDeEhMdVZD?= =?utf-8?B?YnF5M0kvcDNOVGpmRndyQ2diSlR0TGVKVUxTd2xmZzUrRG1JSFBrb0lPQWJq?= =?utf-8?B?cGVkMlVWK2tSWnhGbENvQW5LZmpmeFZtSTV4QlArT0xiYjRlazMzbkZ4YzhE?= =?utf-8?Q?t2HkhziURxtwr0WsYP?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 799f1d9a-3aab-4a10-c611-08df2ae7fbc0 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Oct 2026 18:13:18.3950 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: c1pZ4CuRSCN1yG+V1keT3T3GbRcS2KVuSvP+W06oCIK+N5ZpLia3W8V/QRgAonNB X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB9058 pmdp_invalidate() leaves a PMD whose pmd_present() is still true, so the generic pmd_access_permitted() returns true for an invalidated PMD. Then GUP-fast can grab a reference on the folio and, as the PMD value doesn't change until the caller finishes, the recheck after taking the reference passes too. Code that invalidates a PMD and then decides, from the folio refcount, whether it may drop the mapping relies on GUP-fast backing off from an invalidated PMD, like it does from a cleared one. x86, arm64 and powerpc already reject invalidated PMDs in pmd_access_permitted(). Provide a LoongArch pmd_access_permitted() that requires _PAGE_PRESENT, so invalidated (and PROT_NONE) PMDs are not followed by GUP-fast. Assisted-by: LLM Signed-off-by: Zi Yan To: Huacai Chen Cc: WANG Xuerui Cc: Jason Gunthorpe Cc: John Hubbard Cc: Peter Xu Cc: loongarch@lists.linux.dev Cc: linux-kernel@vger.kernel.org --- arch/loongarch/include/asm/pgtable.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/loongarch/include/asm/pgtable.h b/arch/loongarch/include/= asm/pgtable.h index f876031351319..bcba7bce71d5d 100644 --- a/arch/loongarch/include/asm/pgtable.h +++ b/arch/loongarch/include/asm/pgtable.h @@ -522,6 +522,12 @@ static inline int pmd_write(pmd_t pmd) return !!(pmd_val(pmd) & _PAGE_WRITE); } =20 +#define pmd_access_permitted pmd_access_permitted +static inline bool pmd_access_permitted(pmd_t pmd, bool write) +{ + return (pmd_val(pmd) & _PAGE_PRESENT) && (!write || pmd_write(pmd)); +} + static inline pmd_t pmd_mkwrite_novma(pmd_t pmd) { pmd_val(pmd) |=3D _PAGE_WRITE; --=20 2.53.0 From nobody Fri Oct 23 03:31:41 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013038.outbound.protection.outlook.com [40.93.196.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E168A563FDB; Thu, 15 Oct 2026 18:13:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.38 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088029; cv=fail; b=f5GdlPVDkjWn3zQrxYLqI0V6VwD+wpB5ww0pLdDoyM+KGzca3nSWXIaLqskkJ7H4PZqCyc16NcJvxscLdG5k2buQexPiFEsgadqL7U6Oq1GZ4zRBXyutgApDzaJs8GukLHrrUsBv1xGWLuRRwq4dxIX5gWs2AM/2NHq2YiBhYbU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088029; c=relaxed/simple; bh=haQXwOd7zdSrHNgq/1iy+JAxCpsYQL00njrEgTmLPHE=; h=From:Date:Subject:Content-Type:Message-Id:References:In-Reply-To: To:Cc:MIME-Version; b=D5WzCUxqG1CdN45q4s7MPmF9PusfZa5pNjcaRW9IbWh4mqDtmJGocjBZ731XRgDG+FepPh9tJGRvCkLu9My3apNZMtppBoIPwy0LQA0Qt+cYbdipoIyoGZbz88XSA3yngYSoFz/INZD536Aawhlr4BBsbnPRTPRkn9JoMr6DQtA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=UTDH38sz; arc=fail smtp.client-ip=40.93.196.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="UTDH38sz" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ANNLSsak0rGMHr7LK/HNh03H/TrD2iAzZAqbrsyNrntyqUWOs29LXHVpdqN9Q71zvnrmJ0/T690TMxSl2Nizr8Cd1TiAnO5L533JH5nD+snCY5uGhq93YrTjC/F9IEQTEkYtv48HIxnEt1/BkgCrzeSRqLmNWgk+wgpENlootrEFl0fea0kPBkliELy6eB9bFpdMdNz3dwSOv2Xpa9rY1yRRzZxSNcy9D+bqlcVv/W9xSC8muwbZGqVkwjkCOXfP448w40xKnd6dk+oaaETOFDGljtrROoSzqriucMStKIiNyacfEmXpTrprfJDQbPtpCO29Kg+azQ+fbP59NXerpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3RPmnAaQPjZe+jzEtzDeDLZQt7rc6Dj+85hXtD5gVDo=; b=Zq1fYgSpbOoR6agCQSf5HlyhOGtjlZkjV1EYY0DqRtobNsxlvVNDEna7JpPclV/rOiouUsEgM8TGb3tRSGeBFgc0QFqDLwPB0JAs0r/KRaEvBeSiOl/p3cOfMj7Dnfqq3JL3LJoI/SQOloGi5wjK+kTFxNNQ5mYkHnQdKD3ZIQmcTZ1g75/aMu+i0KYr0nbzphcj9tqcI1dTvqNow5gvUxKUSTXN0ketIPHrlu2KjI8koTsK87/X3B7tzOWETy6Cpuv2lWkDHdt40N20o32zsgcxWS5CXolRTgRizQTO3zA80WqdzlWXJQ9SUeRdkdhdcSPR4EtQuYNsDsPsSNzDyg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3RPmnAaQPjZe+jzEtzDeDLZQt7rc6Dj+85hXtD5gVDo=; b=UTDH38szc/WAFXA6AriE4OqJA1GEqJBcFVufB+A81EBvCt4drfBMip0ZYxBuHlHqi27968PRd3NmHR/sIhhYfHi2e8HNtZGYGh61uL1FNg0Mw9bQ2QEjKaCedY7gWzpcsMWaX8Q54KKfDjn/hOw0esLTzaEOM+wSEUsOJ6p6fCLQ5ki3VsfQAEXDKGTN93r/Y4mjxCqeAtP220LmoSS8afNQXTQ40MLY/X5SOUdIJKXIRmIRIsC2y1YQyM2zOzvogX2fJgwUsxBa1vkDoIv4jUyRu7rDzQejPJRV6bTjQd32Rc1+E2l6444XTiMm7HMUZShRlFpdjlharjJYYCmfwQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS0PR12MB9058.namprd12.prod.outlook.com (2603:10b6:8:c6::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Thu, 15 Oct 2026 18:13:19 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%6]) with mapi id 15.21.0472.016; Thu, 15 Oct 2026 18:13:19 +0000 From: Zi Yan Date: Thu, 15 Oct 2026 14:13:04 -0400 Subject: [PATCH for 7.4-rc2+ 4/7] s390/mm: always clear _SEGMENT_ENTRY_READ in pmdp_invalidate() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261015-anon_vma_uaf_fix-v1-4-7b977303b42b@nvidia.com> References: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> In-Reply-To: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> To: David Hildenbrand , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Lorenzo Stoakes , Rik van Riel , Vlastimil Babka , Harry Yoo , Jann Horn , Kyle Zeng , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Zi Yan , Alexander Gordeev , Gerald Schaefer , Heiko Carstens , Vasily Gorbik , Christian Borntraeger , Sven Schnelle , John Hubbard , Peter Xu , linux-s390@vger.kernel.org, Jason Gunthorpe X-Mailer: b4 0.16.0 X-ClientProxiedBy: YQBPR0101CA0188.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:f::31) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS0PR12MB9058:EE_ X-MS-Office365-Filtering-Correlation-Id: 9092811e-ae93-42e0-7098-08df2ae7fdf3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|7416014|366016|23010399003|921020|56012099006|11063799006|261009223027099003|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: MDPTr7kna1Bf0y9OCBJ1usa5u4YO/bnVRDGpvKvZEMJN02uNNonYOf7kAdHwU4GSiGyJumitbEfLawNhIfB+1pS0Jc7Mh3toLqfK1G/6SUKJlJFL7IrmT0DNrNQMrYDEI8FD2jXtM4U8PmYnJCExpzaWDCajMALlXnKbTZH9FDhOsllCZt4fveFjKGy8uAgahATel/rja1viRYA2zLGJqIMftmv91g4RCSK9eyiY/m/LvwF88TJQXDzhYEBNrd8VHzOO+yajalmwldAYmzO+vlbas1LSeBo2OZLYCIpsPLQzgk6gbvUs1TcW97jwhF3F+i/1P2jgGO2ndulr1S1aXm/9XB9QSwsMqZeKxUp/+OgV9EhP9YR7rahJiWp5+Un7dNM5n3FiJmWFAMI0LQHY6P8gpO5byQHtDyS4WrwVKAA0HIMZC/JBW0l4dS246Y1W0JMdf4IbHfAx1BUBrGbKO517NW0fAOnq8pGSJtxwZsyzUwt989Fyrwy2xMoYUxLRkywzIoSRrFBYPfyunuIJ7SNt9D7U9IeUr87CXu+WGqHoS/61e8TfyNl4DLitAcRDBR6RY7mvbGMKtUUafgj+rsNvER/h3iBGt9QOzCsh6qKs0jRZkMD8PlPh1WVCKvt6HLAQOyQQwRXt+VJCDA3BaQBGWxwF1QNCvaeoCi4snUOb41zxGBcYMME1Ao1xdO1j4JjwgdlYcljM2yADePYYWg== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(7416014)(366016)(23010399003)(921020)(56012099006)(11063799006)(261009223027099003)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZXdDbUJXQnh2UzRRT0haYi9XN3NlQ3FtbjJxTnZSYStQOEZxbTJjZ2MwYzZX?= =?utf-8?B?RHdEdFd2STMxNUt0aHk3V0dmZjRNQzVIM3B1ZjZ0S1lXazJuODV3cHE3UFBY?= =?utf-8?B?TFJYUEw3L29GOGg1eTFkbVVFc2NkSjk5RnJWL3NPZ21XRWIzMDluaEpveVlY?= =?utf-8?B?eTNzelFMTGJRSHhqLzEvd0diRE9YS01Fc3lESjNuTWoyTmV4clR0Y1RCODN0?= =?utf-8?B?TlhJSzczaDQvSE1iUXVsTWE1TXhSK3ZkeDZ4d0NVa0hGZkY2LzhIUUx1UU1O?= =?utf-8?B?K0grYVF2N1hoZ3VqUUp2ZmJTUnMxTXVrdlFtWDBVa3hSNWxMNFZEdGlVdDF2?= =?utf-8?B?dzRjcndqS0lDVUk5QjlsYzdUUzVvM21ZU2hubUtBL0dTUFUvWTdqenM1cnRH?= =?utf-8?B?b0E3L1ptR3dodE5qQ2dNZzJyMmhkaGQ0U3FqZ2N5ZXRqZktacll0MnNQTWhF?= =?utf-8?B?cnlESXNtMmVaMnVEWGVFd3Ezd2phYUpVYUxrdGo3NnEzei9VcTQyZHJwK21D?= =?utf-8?B?ZGJUL3pxWGhqbUtlV2VERWpyWjJRM3VmcjFIb0l1cGZvbVI4bUczci9lUFRm?= =?utf-8?B?NjNFSTBxTlF6YUdYTXlmaFZxR1NwQXJqbXUwbkVtRVlkYURMcmR6djVBemR4?= =?utf-8?B?Rm1ZZDZ0bzYraFBXNWRHSlJxbVk5c1c1OEoxWms2SkdvN21QN2t6UFZQM3Uv?= =?utf-8?B?VjZqaFJYSTAvWFBWSXNxUTlFalpOVzRiNFFIYmFLTEJhUHdZVjNGYThYZjFl?= =?utf-8?B?QkY5YVpDdXJmd2lXM3ZGZG14bHNrckJLVGtZVUxzZlcwMVA1NVk2cUNrNUhq?= =?utf-8?B?bldJOWdaRFdNUUUySngrU3dxVzhUeG0vV2U3RDNrNU5MVHFKaXplUWhzM09S?= =?utf-8?B?VzFxQW5xY3FVZGNRdDFWMUpmeFJjVnM4UXZCNzhRZHVoV1JNYVZQNkhUbnB1?= =?utf-8?B?aVNBTnA2SGxMeWx2cjRycGhodmtKM2U1RnVwa0xSRnJtaGdpUndvdUc4SDhK?= =?utf-8?B?WGlLQzJRSVJPTy9YZktYYlVIMnhrblR3c0FpYkxNeG5VcjQ4UjhTQjJEV0s1?= =?utf-8?B?bzRoczBRYkRVRkRLMklPbXp4RDA3alRRcGJjUG5BbTM2a0wyWURISXBVZitQ?= =?utf-8?B?MnZGMlhsdjBOTkJEamRxZjBXYTIxYU1HMVFYUVVjK0gyNVY0YTNmU2FZTEVy?= =?utf-8?B?WTdPbnZxN2l4UFUxZndtQ2prRjZzSjhCOHB0REtmRjVOTTZBNng1TDlSTlFt?= =?utf-8?B?SXNYUmk3bTBFdzJSeUlqVXJUTXc4UlZTZDFRUzRMNjR5ejc0K3lKdjlNTGpB?= =?utf-8?B?RUVBQnlrTExzd3ZxM3Z0cmptZmdPUVcwVVRTRklVekpRa3A4Q0JQaXNsVXEy?= =?utf-8?B?WThjTXM4cXhSNEgrdzNBRXlnSFlSWTBCUmQva2pFU2pMamtES3BNQWcxK0o1?= =?utf-8?B?K2Z0SzVQekR2SnVhdEJGZk5yYjAwT0V4a2hwRzkzQUF2bUdmdWx5K2gvOVlr?= =?utf-8?B?N01DMGlGWGpyUmlCMVQxTzIyd3hZUGNQaW5ER09jMkhPR1FzUFJhT1J5d2Ir?= =?utf-8?B?aTJjTEFCQTZRQVZRaFN3WWdQeDc4OGo1eFlRY1IxRUNzcWJSOU50RkhQUEMz?= =?utf-8?B?Ykh5RDlhWWZSNTZjSHRtamlUNFQ4U2pEbGhNS0lwWk9Rb2ROS2RRWDEyRFZx?= =?utf-8?B?UzJVbDB3Z2x1TTVnRnFGWTRRTWJkdlF5UkRJdFMxYVc0c3drTUJrdHRqT0pp?= =?utf-8?B?aHVwUkh2bnQ0Y1hDdTBobW8wTkdnSmovaERWMXdNNnc3QnZETi84M0tmT3hF?= =?utf-8?B?RzNlK1l6TytFcmJUTWVITEN4TUNpQURTcDE4WW5NRDY3VUlMWWZFbTE4dHVW?= =?utf-8?B?N1E3eGttekhHQXVwc1pJS1hjTzBCcnQ2K3BKWG5ZS1NyWjZxblQrRjdoa2FX?= =?utf-8?B?V1N4ek1uRXE4UlpnOHRUTnU0UDluMXl5Nk5PTWtzc2JpYWcyRDBWMEEvWVl2?= =?utf-8?B?ejFoSk8zcDNhSzU5aDFWVkM2cFpjWitzc3FDeWdFejFIMlRpb1k1d0F6Y0JR?= =?utf-8?B?VWFZcmRZTWNvek9JN09KMlBJWG45MklTV2pSTGxTeXlCU0VLaGJyalRreTdN?= =?utf-8?B?NWMxbVFMOVZoNmZrSW1xZHZHWWVpYndSeEhHQXJrbkF1WlRuMm4vVFJ3NW5m?= =?utf-8?B?N2xaOEFQNEJUdElxNCtpL3p5UXBsZzNMbFhuY1UyTGFobitCYkhacm0rRFV6?= =?utf-8?B?anZpV3JIMFh1b3ZYVk4wOFRRNW00cGRXaVpWdFc2RUlQelB6cEZ6aEUrVjhU?= =?utf-8?Q?4NUdpe5aEVRBTULelY?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9092811e-ae93-42e0-7098-08df2ae7fdf3 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Oct 2026 18:13:19.7572 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Q4n/1BODQBbj7zM2cb4D6kT+oERxJ2h5S6nCpPRli4nPzS03VJ7r1xMZXpEs3b8k X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB9058 pmdp_invalidate() sets _SEGMENT_ENTRY_INVALID, but on s390 that bit alone also marks an old (not young) PMD, which is still a valid mapping that GUP-fast follows. Without CONFIG_PAGE_TABLE_CHECK, an invalidated PMD is therefore not pmd_protnone(), so GUP-fast can grab a reference on the folio and, as the PMD value doesn't change until the caller finishes, the recheck after taking the reference passes too. Code that invalidates a PMD and then decides, from the folio refcount, whether it may drop the mapping relies on GUP-fast backing off from an invalidated PMD, like it does from a cleared one. x86, arm64 and powerpc already make GUP-fast reject invalidated PMDs. With CONFIG_PAGE_TABLE_CHECK, pmdp_invalidate() already clears _SEGMENT_ENTRY_READ, which makes the entry pmd_protnone(), so GUP-fast does not follow it. Do that unconditionally. As noted in commit 7b4dde5e40ad6 ("s390/pgtable: Add s390 support for page table check"), an invalidated PMD that is pmd_protnone() is fine for the remaining pmd_protnone() users, which run under the page table lock or are lockless walkers that should not follow it anyway. Assisted-by: LLM Signed-off-by: Zi Yan To: Alexander Gordeev To: Gerald Schaefer To: Heiko Carstens To: Vasily Gorbik Cc: Christian Borntraeger Cc: Sven Schnelle Cc: Jason Gunthorpe Cc: John Hubbard Cc: Peter Xu Cc: linux-s390@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- arch/s390/include/asm/pgtable.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtabl= e.h index 2d5c2ab06de98..fe1ba746203ab 100644 --- a/arch/s390/include/asm/pgtable.h +++ b/arch/s390/include/asm/pgtable.h @@ -1781,10 +1781,14 @@ static inline pmd_t pmdp_invalidate(struct vm_area_= struct *vma, pmd_t pmd =3D *pmdp; =20 VM_WARN_ON_ONCE(!pmd_present(pmd)); + /* + * _SEGMENT_ENTRY_INVALID alone also marks an old (not young) entry, + * which lockless walkers like GUP-fast may follow. Clear + * _SEGMENT_ENTRY_READ too, so the invalidated entry is pmd_protnone() + * and is not followed, and page table check does not count it. + */ pmd =3D set_pmd_bit(pmd, __pgprot(_SEGMENT_ENTRY_INVALID)); -#ifdef CONFIG_PAGE_TABLE_CHECK pmd =3D clear_pmd_bit(pmd, __pgprot(_SEGMENT_ENTRY_READ)); -#endif page_table_check_pmd_set(vma->vm_mm, addr, pmdp, pmd); pmd =3D pmdp_xchg_direct(vma->vm_mm, addr, pmdp, pmd); return pmd; --=20 2.53.0 From nobody Fri Oct 23 03:31:41 2026 Received: from PH8PR06CU001.outbound.protection.outlook.com (mail-westus3azon11012039.outbound.protection.outlook.com [40.107.209.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 29F3456E050; Thu, 15 Oct 2026 18:13:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.209.39 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088030; cv=fail; b=SW1Zel3Wjl+yIpS0cvwlMn1N1LLxzst45Ldw8aeF+5WjDJpxeAxzL2Jw+1DvfPGTKI/2deD6hzoXvQgIGwFxIKVPawLsEFteeSxwA6mVG1D3mqixiK/l8crNaZqfTraRJVynhznbiOQCgygb7Ivveq1EotnZsec0wJvUhKxWQD4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088030; c=relaxed/simple; bh=cRHZfm38e1FXRxwaKGpP68FC9V86lj33kabO4waesio=; h=From:Date:Subject:Content-Type:Message-Id:References:In-Reply-To: To:Cc:MIME-Version; b=g2VS7U9F+cd/NBbL7Vf9qHJLm/VTKuVhUHjfrAnVAghpn9mSXFQ7ftpEqp7HhogeXRuE5GZ1Ulh141VN8+klQRj9AJPENDu3rkjCMkaLWvi59dDUf5f5NgLe85CzcTKmlkd6E7ssphI0XmhgmJPXMj/GAHseUTM/0BJA3hXL2F0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=cLbRcLk+; arc=fail smtp.client-ip=40.107.209.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="cLbRcLk+" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=gJ3AVOdbIhaPa4Mu/qQ6RazH5YcMCqYoVx7ocs/5Hzio4aIOvnPaM8UES7fDeSC60lePtWuJAECuQAwk9Iu/v1o1oUH+LbtfTn+chLCyHji7rTEQWlxZl9FclUXEwkf6hmEKwlvaR5A+FtP4ZGlZfVdFUjjQhqW5/Iggd154k4SsbaCAxHoQlc9bo3DXJ5JOd5uj0L8XuT+H4rX7IgBOHSt+8VzJshIH9z9aD36meqhalkhAura3mOEWlMGtkA4LjVmF/K2eCyRHPpYrrLLgww3arAihSiWElYa0xrBNywbzr0eBJjl4VRuklJ07sY0cMiLVcBBGvTCL13YYYt9erg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xZTOf7UknMsFhJcYOQ/NNvWNPA2o9+Ua9mz4xTnadag=; b=mpmd/GTrSABIhfVWoOFK8bbtJrMs9dGKZzLiOgAcaobVle8K/ea2KHRpMhUcDzCSYrxnMTGLiv9DK0MORImyRBZATNuJ430rO2EcelbzoHut7JtXgkQ9E5MGE2LCxeVXn/G3h9k8sbBxFWolL05K1hqFnbw+GVt6lex4e3zC4LMXRYO7uzoeHcnLXNzjDKQOSr0yilKxc/Wk0zTqq1Dg51eIbdjygRK0KgSrDcpyGCciVMccOt7irJcd3UOIPP5r36HSAodY1q5AmFf6K2x0ucZZYVUZpWgHtCifYqvPnQTWCFSE6eqFpFOxukWdFerp3k24QuAP4up1/fhnx7EWXQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xZTOf7UknMsFhJcYOQ/NNvWNPA2o9+Ua9mz4xTnadag=; b=cLbRcLk+pIeROwWjQItS0Ko7caKisJNWWx5yLuon0j87xYo7Pa6GK5GU6J7d6em+erI3IqLYxVrf4LcMo9NatPMsqkQ/QwCfR+l2uL8BhTNEcmtKAictk0H0Xipe98idT4s3QRuMe36358m4aEShjp4aQBFInI0cub8p11raDZMkEG36oyZbmVgnJFG4YUyLXNqt8qR8YLYARDgkSbwGImssIoQsE3Rj3nLZk3n2+1AsHF9RswSsDJcswd2V4dxqG+i8tIWK0bnpOgymzNfAcmBPfFCkB3vmKHrZNxeImwKGgsgcvxkfm7O6ORiWKOFJmZHTSwck4LBslgI6BRvhfg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS0PR12MB9058.namprd12.prod.outlook.com (2603:10b6:8:c6::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Thu, 15 Oct 2026 18:13:21 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%6]) with mapi id 15.21.0472.016; Thu, 15 Oct 2026 18:13:21 +0000 From: Zi Yan Date: Thu, 15 Oct 2026 14:13:05 -0400 Subject: [PATCH for 7.4-rc2+ 5/7] sparc64: mm: fix thp_pte_count accounting around pmdp_invalidate() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261015-anon_vma_uaf_fix-v1-5-7b977303b42b@nvidia.com> References: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> In-Reply-To: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> To: David Hildenbrand , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Lorenzo Stoakes , Rik van Riel , Vlastimil Babka , Harry Yoo , Jann Horn , Kyle Zeng , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Zi Yan , "David S. Miller" , Andreas Larsson , sparclinux@vger.kernel.org X-Mailer: b4 0.16.0 X-ClientProxiedBy: YQBPR0101CA0234.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:66::10) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS0PR12MB9058:EE_ X-MS-Office365-Filtering-Correlation-Id: e728704b-ae2f-465c-fbcd-08df2ae7feb5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|7416014|366016|23010399003|921020|56012099006|11063799006|261009223027099003|10067099003|18002099003|22082099003|10063799003; X-Microsoft-Antispam-Message-Info: h0f+0Md24YiOX4kmptFIlTrrfoSiWWnj46v9F/69e08RozeN3DMUFuio24TCtFQF/MBAdaU3bn7kjbAOXvbn/Tu8vv6rcWG6pdt8jl7E07tUb/Z0p4u126QMhUmovmTUjjGyew+D9bZ8BjqisshOi3+fwAYqhGTS8SSRwOqofqof4csqeZw8EjcZE7IAVUD0J1yWFCJH+t9ggMUc0DkI1Q3iQrNQj3HswSZaV5XIUlNDv73fHCrz46oveyHrh7o2RV/LBZZsb8szN9j0Ye7U2HRseFItX+jKQ7cq2R8uljNuLTye2BlNQ4HZrnkdcuV2mtkY3KqlCOPcOVanoKChlj1TfU53sWov2/MfmWkapzQrVqWjlKE2JxiI/Mk7bgg5Mm8SYN3j32K0otvmk6h7bSnpJd6Fm8O6W4FL33huLYpZr3jdoIPq8VD87ua5uUNRNQBMcJf+kHLRQbYm+6L+oPa+sGL6JODJsclK1TMwqOVyGsb9hZloNuuQ6S7vYhnnGz+6BYPlPgsEYkcuVTKb1jPDokIvw4OmzuD+UUUhyE5ORopxVZNw6YbMkPgKjJ7xCymlEOYpLLpGqpiNN/gIW1hrCodDN1NkjvgPC9kYadoePGkEOk1B9crzkqVEn5mnzmK+c/wmCDEWBZkddtyyYfZaKpubVNUAXMvmiezMm7G7k654uEAsgTLr5TYkSXrgXXsJZ4C/+TTVXI9LMvxFJQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(7416014)(366016)(23010399003)(921020)(56012099006)(11063799006)(261009223027099003)(10067099003)(18002099003)(22082099003)(10063799003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZEhaOVJ4dTRoajVxSnhSMm5YYlhiL0lZMzZDSFB0SExySjNsQ1VjMkcwYUky?= =?utf-8?B?dGtZRTlrR2w3NEMvWFg2UTNTd3lpWEJUUlZ4ZFFRN1Vsbkt0K1JNbEZudy96?= =?utf-8?B?b2F1Nlh4K0tSeW1pMWd4WkdMTjljQVVPd0dBcVFOYVVvcjFzdjloYWJxdUxk?= =?utf-8?B?bFA4ZkxPb2M2Zy9rQnAzNENwbWNHRm4walgxdXF5eVc2VENscU9TQnA4OU5Q?= =?utf-8?B?SVBoNzBDdEFSUFp1QTFDMzZ6aERNWUNDcVl4T2lCblB5aEpEdGZ1NG01WkpF?= =?utf-8?B?SmZMVkl3R0M3ek5UVzkwMzhuL1dTRDYydzgrMkgzUEwwbTVCYzliZVhIcllm?= =?utf-8?B?NXluT1NoSzlBY2RGRHdnUmFWOEI0Qm9aRU9sOWdjV2hYcEJDREJhcC9DQWt5?= =?utf-8?B?dTdJSk1OZWtMMVBQSDluamQ2M3lnaDVWakRqTHJxQ1h4TXBHR2hsaGVFbDd1?= =?utf-8?B?c2ZmUFRrc0psNjVLTFV2WUVoYmZCWk1UMit0UmFLdUI5cE9MZVR2SFFlWmd6?= =?utf-8?B?b09oWEJiejNDbXdFb1FycVkvYk5NaythQlQ4MkUrWTI0MkZLcDJubmc4enJo?= =?utf-8?B?Y051U3NGUHUyMklUdlZ2NFBMU3NkR244enMrdXByc3ZLTmFPZHhSU3A1Zjdp?= =?utf-8?B?OHY4ME9vOFk0YTZtVjVPWU1rYU5NaU1sTkhya1JwZDNRUUZiK1NBVVduNDhu?= =?utf-8?B?MVk4RUpWTUFXM2hiTGpJTFN5K1RCdFpvU2laV1ZyNzZtRjI4M21xTkxReU80?= =?utf-8?B?WlZQa2lWNmtHN0psc3VId1NYUmw2NUliNWRzdDJXR1B3SERqblJCTUtIUjI5?= =?utf-8?B?dHR2a3M1cEYzRmJkL2hvR1hCNmQzTUVCb3ROekM1UDMvaDNTaTdJdlVCRTd6?= =?utf-8?B?bHFPN2NyMDdGYlNyRDZIYWEzV0tVcGxaSncxS1kybUJmMWRPQTU5RTBpWmM1?= =?utf-8?B?ZkRMcTZMNlNMMGtxcXRNT3h0WVhHNlB0MFBEaXhVYmRZOGlOeVFVbEJabzJJ?= =?utf-8?B?WHNoOG4wRy84YXZjdktaUWo4RlVtWkZzOUpkekNxY3d4eU00UmcxQlJycDFF?= =?utf-8?B?UkxHcGh6R2VycTRNeDc3bTNSYjJaUDMrcSt5eVhwT1E0cW0vVzZHMXBBb25H?= =?utf-8?B?L1RQR0VMRnI4cWF0R25mcXd2T2RZT2tnY3I0WDRTL3NOUkpESXNiUVJSeWRo?= =?utf-8?B?R2NLbUVjOXlPMDN4UTlHVEJWRDllQnFaMVM5U2RKTWNVODVpbEphdTBhdWZr?= =?utf-8?B?d2s1b2xQTngvenBqV3pOcitYM0xEQlFOWCswMWRRek9aRG5iVDgzVGxBM3pB?= =?utf-8?B?ejVUcTYyVTV5cXRCYTZGaXNLM0QvaVorVTFCakdmWTRnY2luZHZXN1RFdkFr?= =?utf-8?B?NUxxSk4rNmhBQlhocDl6VEdtVHdlQStuTDRWbTFXRmxrS1M1RjJ5OThPZVlH?= =?utf-8?B?bjZ4V3YrVWhVMll2QkJNbEZ1WGkrZ3owSlFTZHl0bHNlclFpWnVzazlPN0FQ?= =?utf-8?B?RndCelRVMys1VDJVRml4b1U5KzNPOHlmUlRTUU12OTV1amcwbFJYd2Vzd0Yy?= =?utf-8?B?dEZ2S2hjenVYWXlWeUJNRjZXTi9icjBuRVhNRWpHSk9DQjlUelZkcmlNcy9Q?= =?utf-8?B?aG1TUFBBQUYwTTdhZVBTc3ZDc1hwTUVLbzBTTzdDd3dDZVluaENiRlBoUEx3?= =?utf-8?B?bk9kQmxJQWNZa3BRMExKbUNTNWFvNjhmbUM1QU80Vjg5V2w4ZWFxRExzL0kz?= =?utf-8?B?VEJPRTFUVDhENjFjdVk1L1h3ekpDZFhRS2RaOGZXWnBoZDBDYzRqMTVnQ092?= =?utf-8?B?cXA3amNLa3JxbXl0aXpQKzNibTZld0hUUlkxNVNoTUw1OURDNHNPWXpUL20r?= =?utf-8?B?dmhHOHFzc3FybUhINjJpWGVQZE5jdWpPdjk2SWV1MHhPL2JGU2h3T3d5Z2xT?= =?utf-8?B?ZEJUYUw4cUZKSVg0Zzd0ZGJqWG15STliUm9GK1VBeFpqNHJBZjJ6QnlWME4r?= =?utf-8?B?RGlYMkRSTjJSS1B5YkNnSktDdVQwYktONEcweURVakNZcHBPSnpCM1RDdWJC?= =?utf-8?B?QllBa210c2p5aUxmcktQWGY2RTlqMFRSSnpPaUZiek1VZzcvYmVOb0M5dGtt?= =?utf-8?B?MldUR3RYSXJQU0FzS3pyUDlaZ0k3U1NKWDJndjl0NXRFdFUxaDFoSlBSUklp?= =?utf-8?B?b1dMU0FKWHFpN2xtV2E4SWR1TDZaNTdOVnA2a3NTT3IrQXhVWDJ1Um5mYkM5?= =?utf-8?B?NEVqOVRPVjRKaG9EVVJhd3A4eWZ0MlNBa3A0eFJtZ25mcmNaTUV0a2o2L3dK?= =?utf-8?Q?H8vBfkd5ah0Y/OMkEH?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: e728704b-ae2f-465c-fbcd-08df2ae7feb5 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Oct 2026 18:13:21.0018 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: d/YX9NaDDRtRrjdo2Dih0xTQoJBK+6NQhjt8s/85XQRqcomDtvnZzRDVyzE7cssV X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB9058 thp_pte_count is maintained in __set_pmd_acct() whenever _PAGE_PMD_HUGE flips. pmdp_invalidate() only clears _PAGE_VALID, so it does not flip that bit, but it also decrements thp_pte_count on its own, because THP split replaces the invalidated PMD with a page table via pmd_populate(), which does no accounting. That is only right if the invalidated PMD is never set back. Several callers invalidate a PMD and then install a valid huge PMD again with set_pmd_at(): MADV_FREE, MADV_COLD clearing the young bit, page_mkclean_one() and change_huge_pmd(). The valid PMD is not counted again, as _PAGE_PMD_HUGE did not flip, so each such call loses one count. Count only valid huge PMDs instead: in __set_pmd_acct(), adjust the count when an entry starts or stops being both _PAGE_PMD_HUGE and _PAGE_VALID, and drop the separate decrement from pmdp_invalidate(), whose pmdp_establish() now accounts for the invalidation itself. An invalidated PMD that is set again, cleared or replaced by a page table then stays balanced. A PROT_NONE THP is no longer counted either, which suits the TSB sizing the count is used for, as only valid entries are inserted into the TSB. Fixes: 1e953d846ac0 ("sparc64 mm: Fix more TSB sizing issues") Assisted-by: LLM Signed-off-by: Zi Yan To: "David S. Miller" To: Andreas Larsson Cc: sparclinux@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- arch/sparc/mm/tlb.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c index 6d9dd5eb13287..0a941d497525f 100644 --- a/arch/sparc/mm/tlb.c +++ b/arch/sparc/mm/tlb.c @@ -176,13 +176,23 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, = unsigned long vaddr, } =20 =20 +/* + * Only valid huge PMDs are counted: an invalidated or PROT_NONE PMD gives= no + * access and never goes into the TSB. + */ +static bool pmd_huge_valid(pmd_t pmd) +{ + return (pmd_val(pmd) & (_PAGE_PMD_HUGE | _PAGE_VALID)) =3D=3D + (_PAGE_PMD_HUGE | _PAGE_VALID); +} + static void __set_pmd_acct(struct mm_struct *mm, unsigned long addr, pmd_t orig, pmd_t pmd) { if (mm =3D=3D &init_mm) return; =20 - if ((pmd_val(pmd) ^ pmd_val(orig)) & _PAGE_PMD_HUGE) { + if (pmd_huge_valid(pmd) !=3D pmd_huge_valid(orig)) { /* * Note that this routine only sets pmds for THP pages. * Hugetlb pages are handled elsewhere. We need to check @@ -191,7 +201,7 @@ static void __set_pmd_acct(struct mm_struct *mm, unsign= ed long addr, * for TSB entries. So, huge zero page counts go into * hugetlb_pte_count. */ - if (pmd_val(pmd) & _PAGE_PMD_HUGE) { + if (pmd_huge_valid(pmd)) { if (is_huge_zero_pmd(pmd)) mm->context.hugetlb_pte_count++; else @@ -250,9 +260,6 @@ static inline pmd_t pmdp_establish(struct vm_area_struc= t *vma, return old; } =20 -/* - * This routine is only called when splitting a THP - */ pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp) { @@ -263,15 +270,6 @@ pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsi= gned long address, old =3D pmdp_establish(vma, address, pmdp, entry); flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE); =20 - /* - * set_pmd_at() will not be called in a way to decrement - * thp_pte_count when splitting a THP, so do it now. - * Sanity check pmd before doing the actual decrement. - */ - if ((pmd_val(entry) & _PAGE_PMD_HUGE) && - !is_huge_zero_pmd(entry)) - (vma->vm_mm)->context.thp_pte_count--; - return old; } =20 --=20 2.53.0 From nobody Fri Oct 23 03:31:41 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013038.outbound.protection.outlook.com [40.93.196.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B9C7421A447 for ; Thu, 15 Oct 2026 18:13:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.38 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088039; cv=fail; b=fg7KpM5WZsMVHYhSqaM8NwpsKvj2d6deyGvZSRLLr9xgbfPcy55aa33ixe0/wHj3cyLpTS+FYTJ2/1jkbba04YTJDsAL/cMrQNzu5KwIuB3OVKZGVYBv5ClNCnHw2Oy+PTOdjt964bTsqyzRrGSA2/+lSWFjiULDFsUU8NSKIqc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088039; c=relaxed/simple; bh=Z+ThZhCNcXFxIwbVkyApafF9W3kgO3ioPhvnwAXKrso=; h=From:Date:Subject:Content-Type:Message-Id:References:In-Reply-To: To:Cc:MIME-Version; b=Y8SG4YBk3a13Shjc+yU/CxalMNrWyZ83FKPPx49G1hyi4RTt+/5dIJaueNiEQooY2I1ryj1egqRSRq1LErqbBWyCMbZ5pHE1JrtXQLDyuNkx/Aysy2Y5TwvyAN/C0sukMux+qvWNYbKlYeS+LhtMB5ydO+FtQthkdeIxdsFy/x0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=robDDbxn; arc=fail smtp.client-ip=40.93.196.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="robDDbxn" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=M5k9iDyxIK9/WiVvy6MbxeCN0W4Qafr6NmT7fBUQs4WIFOqj/8SMa6XyE1yqjERGTKl4u7jvRySoNHaRdnfm9MQ1QCZxs4MLDupIW2RqApDs6ObjSIUoSiXqq8r/r/FRzY6Q5zEC8PoNe3l6Yn0G050AsH9a2M3mulfZ21spNJcXeZUtry2Znu+VSbyMAija2SxyOX2XvZPUHNzxsbj1lhZ7TGx/T9t2l94FmRwU/H6ySlcOPzjJYD6kTO1SaoiXUz6izWxOrOkgA/TAX+93NhB27kXK8cTj4KGPifLv61qmF78Uozh5bTxtdQRfnwTjeAwg7cEbErJv7XEQteVvmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rDB1f0sKguTk1eQsF/NF4vlSac3s0gHTk2MkMD0FZK4=; b=C07iYw7MbjMgKG5NozJHzKpuZTQUIKgIIACqyaIVLQAJELVLfmQ+5Na+nxPvdwUlXr+KWTg8kab0BAIAjgJSGpE1K6avRTCbdEuByE4D1iv5ekkDm8zOFH5Oe5BaeGfU+wfFWReYclg4YwTenvAm3kwJXq84s9NF3tExCfjaq15JNCcy8uGSFsLn7RM8de+MMZCPjkf9LlJuikCtiKju+ulOvAj+1n3Qfi1/1WJtUydmhj3XhMlT0abWIDT9jgAUrL5Xmtj81r03G/Fhn0iMC2EbMMcR+uj9muS9fkrzfon8WR+XJwN1wfzJetIQYJ6oIzyR45QaI6ZAqx74wzEjKg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rDB1f0sKguTk1eQsF/NF4vlSac3s0gHTk2MkMD0FZK4=; b=robDDbxnD28fd2HFmzk+q3UrBA9XFOlLOKlOZAxOYUBhL317sP05i0MtBt5mnOkUSIapWhFs49BzQRb9CqtMKQD9dZ2AwG4j54uyGpJl+cVFubEJON7sCzKtKbI6clHmXq0rBDl3Kudv2VacHnofQrSe0tCb1u4hxD8W+Q3SW+0x45AghWFNxPnB0RKNOqWtpwadQLGih/PBG8E/hDOe3KK8IBqJZAwCxhSG3wIYzCd3i2c1BgCaxS5MXCgUdLxRj4fOA29YNn/FKai9jtOC3/HkL+npHTLDPF+kMrB051+8QitAzbuJKjY/KuldNnWizu1SxM/6gIClR3ot+7erCA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS0PR12MB9058.namprd12.prod.outlook.com (2603:10b6:8:c6::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Thu, 15 Oct 2026 18:13:22 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%6]) with mapi id 15.21.0472.016; Thu, 15 Oct 2026 18:13:22 +0000 From: Zi Yan Date: Thu, 15 Oct 2026 14:13:06 -0400 Subject: [PATCH for 7.4-rc2+ 6/7] mm/huge_memory: avoid transient none PMDs during lazyfree reclaim Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261015-anon_vma_uaf_fix-v1-6-7b977303b42b@nvidia.com> References: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> In-Reply-To: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> To: David Hildenbrand , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Lorenzo Stoakes , Rik van Riel , Vlastimil Babka , Harry Yoo , Jann Horn , Kyle Zeng , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Zi Yan , John Hubbard , Peter Xu , Jason Gunthorpe X-Mailer: b4 0.16.0 X-ClientProxiedBy: YQZPR01CA0064.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:88::16) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS0PR12MB9058:EE_ X-MS-Office365-Filtering-Correlation-Id: fdc981f6-6bdc-4ac2-39de-08df2ae7ff7d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|7416014|366016|23010399003|921020|56012099006|11063799006|261009223027099003|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: iTjAqxk6I7XGTN7FXCB/Ek6u0LuSVhwTdHMfjwdnysjnIlOEQnUsWGKsifkkgQHGVIF4oBDWmq6+DNSDItvS6RPMn8deLvLA8H9fHKMbO5fqEu41UhlZO2vrMMMkAWa7QbhwZ/RW5UuYXs8hoSpmekIO6+ieS9HeA4kI9dMdYqlS5m9XmDo3dNovoFMqhXaCUZu9P0aGXfYQpFRpmfxq97XYyXkfX46PsWmJps/4m8WgnCAI48fSHNVSWVmd6jItBP6PrPvT1RJiVCAXSNGUFjyYhGj5YIUJo0dTcnRAmH4B+dpQDJias4Gs9ayzpKgJyijwUkqxUMzb1tTqSr3EkIU3PnDX11klAbKeaeHxI1tY8Xyov2aBx0F+PfdoLgoe2WirUBLHy2gsHNkBfFZIOmZepBaOhI1p7fsY/NnHf0e6WcyP3LAlPCjfdsbZvvdY1lIz8hsVs4HNQ4KYQgiql0HoM3IDqOMoGfXGlOmLJWQUs7Xb9OomhlhyEFGGDmZ1YRQfw2dJteE7ESvepMM1W95kxJkv/RBg9Kf9KHveL4+KWqG3ocRqYfI2CMKmGEh44EVHUP3ouk9JCgtN2SjAQksrt2HkehEfg1I2mWZgeYkpsIK5siXui2yCQWEgg2MNwsfw7vZ7hNXoWaMHap+bcXhQCPXvpUauy8R7+NCddpug7CQeh6xQWjFnFGggXoBDg8oAMMfGrKS9Z3GD/ZDC8g== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(7416014)(366016)(23010399003)(921020)(56012099006)(11063799006)(261009223027099003)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TTR2VWFvdXBhd1dUelE1ZVRONklzVk95SkkyQ1pReCtQRXJML1VWWVJ3RkdW?= =?utf-8?B?NUdHakdpOGdUOEkzV3ZCNmQ4WGhtR2FGTUkzNFB5cjJXclE5Z1dlSi9xeGNp?= =?utf-8?B?UjVwM1Jwc0w5dWxaMkJXYjZZeXMxNUExWWdueWxCR0g1amR4SW5iSkY0UStk?= =?utf-8?B?d05uNGtJbDg0c1lZeitSYzlPOEM4M3V0TkNxT0NsWGNUblNkZ1lqbTR2bjg5?= =?utf-8?B?WDlpNEZiS3dmaDlqVGM4SXIrVnNzTGFsR1dsQ3FrSG5rV1hUOXdROGVGeUFM?= =?utf-8?B?VDJIWlRaV0Fzb3VMbEdDdmp1L3V0REpabzBsWDdYdHltZ2oxWVVrQko5Qkls?= =?utf-8?B?RkpwdDVPWEJMYW5waFBqaHROZ1FqY3NkUExGc0VWN3BWcHNqS1hYdWlMQ1d6?= =?utf-8?B?WForVmc4MitkZnhFU3lwNUUvRFVaL1F0NWZHT0lrQlZUMDZTbFE2ZmhITEZW?= =?utf-8?B?MmNZcEpkLzVvV0U0VVpnd1VZbGgrYWVnVUZlOVFORXcvV0tmUzUwR1B0a0lm?= =?utf-8?B?cUxDMHBob1FKdW1wbFBxcjlVdTB1QVVINmVZelpzWTJEM2U1cjE0ajRCVzdY?= =?utf-8?B?c3hJTkR6YVVPWHJmbVF5ZTZNN3NXUVlDVTFBZHJyVkRuTlVyQWVnczV6cHhC?= =?utf-8?B?L3lYd2xRWmtqMk9oZTBRR0d2akNFTVFoN1BOU0hwRnpnam81SFBuZmk2TWZx?= =?utf-8?B?S0ZWQThPT2M0azhqSHlBeFRva1RIeVVQN0J0MXN5YU9iRENlZ0V4MXZvT2Fu?= =?utf-8?B?dEdhWXZmeGI0OUVEVm1TSGNTanFuRUZlNUFVYm1seWpxNVk5eTNOdStjaEZL?= =?utf-8?B?VHhGMmFtVnZZd3l1QXJkTVA3aG12dDdkZi81RUYzdnhwa0k5YlF1aHRobUVS?= =?utf-8?B?bVBoTlg3YUZPRWxaZVVqcEZmUEhVQ2JhalpFa0crNGQvVGRxUUtuYTZlYTFO?= =?utf-8?B?LzhKMSsvcktQVE1BdGZZeHhQdSsxdnlPK0xkRG1FeFkrZU4zTUpudXBNZjBM?= =?utf-8?B?eXhHb01tT3pFRWE0Qjk3Z0crMi9LdWtEVWlsYVByYXlpM1U2cUZaUnJUWVVR?= =?utf-8?B?UmNEUTE3WDlEZnpBcnJiSFJqaE5Bc3d1bk1QMUdKYVljaTE3bWV3UE9rNFQ2?= =?utf-8?B?OTl0RzVIUnpjUEwyYlRFcGFaTFhaclFCeVRheUpSRUQ0U0FwSG9obFkwRmpz?= =?utf-8?B?UGMyNS9SMU0wQituS1MyalZFc2VlM0RzdWpBbFZPam91VVJVODdoSFBraTd0?= =?utf-8?B?bUs0b2x2dThqZ2VWZlB5R3Job2tZNTE1b1JTWXh1SFI2SVNEc2VaSTJGTmps?= =?utf-8?B?T1BGdkFBaitMZ09nakZQazNxS0g4ek9DbU9DWEdla1pnSU5DSHN0Wm9nZ29P?= =?utf-8?B?bnRrbCtMVkd1WTcxbEZqRUtXb09RRHpYQWwxR0Q4Zi95ZGw2UGlBSG9rWlpC?= =?utf-8?B?ZWhpeDU5R0F1T3EyTkMwWDZTWUxKd3lCTXovVWxNdDUva1BZUzZrMktSbjFQ?= =?utf-8?B?RU44T3NqYW5kY0dZUjUwU3l3cXJwNUNCbVIycC9taFFUakZQRGdWSm5YbU1J?= =?utf-8?B?MDhxYkF5ZFo4dnkzZHJsbDZsZVFvVTdGS0V5dXd5VTBHeWVORzhSaHpRVWFv?= =?utf-8?B?N2dDcEJ6WkliK0ZNbUNiKzhVWFpEZTViRmFhTkI3bXdCL1FxR2NPZlZRRTdw?= =?utf-8?B?ZnIrdWFHVE5pcDU2cTJBUG5tVWV1bmgzZ0dma2dwNXVmblJYVXBYK1FhbjlP?= =?utf-8?B?YVdzQkZZQ1Zpb0R0ZTlCMXFrQURpSjlLK0pMZy9wQmt6eng2c016OTZHbUxI?= =?utf-8?B?QXRNRDJLS0hkMGRVTkxUZFB4elR0OG8yMVRKeko3UTR4dkFvYXh5RGJ4V2ZX?= =?utf-8?B?elc0UWdIRUhWWGdPV3hKTHNsN2RQRnh6eS81c1FGSmtPK3FJVmVqemNMbFFW?= =?utf-8?B?V3I0cXBYdTdKbGFlUFdKc2V6a2pIc0hBVTZkNjYwU0hMdUVNZS91Z3YzUkQ5?= =?utf-8?B?U1kvcmNJcjhuak05MHdCbHRSbnBwcVhBRTB0OG5RRHBiMEorWFo2QXFQTXJ0?= =?utf-8?B?Um5IUkcxdEd3ZkZmQ1BMZ2dXTDRBTHB3RXc0aFo1dkNmNEFIK3Z2ZDRIcER0?= =?utf-8?B?eVVYTDJGei9wWlc1Ykx5QURLY1FYRGhEV1d1UDJZOFFpY1MxR0NaaUJrRi9W?= =?utf-8?B?b1R6TTZsbGhnN3NrM1I0dXRSc1h2Q3B3TEhjNkp6K1Mxd3d0bzZkWWhjOGZ4?= =?utf-8?B?RW1yVGVUYXp1Y1ZBWjQzOWFkWlVKQlZlU0NWUjFxaW1zTkdUTWVDbzFNckhW?= =?utf-8?Q?JLPW5SGP7T6Z9dGh5e?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: fdc981f6-6bdc-4ac2-39de-08df2ae7ff7d X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Oct 2026 18:13:22.3047 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 51Ek/mKtXJlbA4zkEm15rbLKyw3DkwXqHuxLIhhXbwpQLelEp9/VhHknUrhHMUU7 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB9058 From: Kyle Zeng __discard_anon_folio_pmd_locked() clears and flushes a huge PMD before checking whether the folio can be discarded. If the folio was redirtied or has unexpected references, it restores the original PMD. Reclaim holds the PMD lock and the anon_vma read lock, but not the owning mmap_lock. Both zap_pmd_range() and mremap's get_old_pmd() can skip a none PMD without taking its lock. A concurrent munmap() or whole-VMA MREMAP_DONTUNMAP can therefore miss the PMD and later unlink the source VMA from its anon_vma, leaving a restored mapping behind. The anon_vma write lock taken by unlink_anon_vmas() waits for reclaim to finish, but does not repeat the skipped page-table walk. Once the remaining VMA links are removed, the folio's positive mapcount no longer guarantees a live anon_vma. Racing lazyfree reclaim against MREMAP_DONTUNMAP as an unprivileged user reproduces a KASAN use-after-free in folio_lock_anon_vma_read(). Use pmdp_invalidate() to keep a recognizable, non-none huge PMD while the discard can still fail. Concurrent unmap and move operations then have to synchronize on the PMD lock instead of skipping the mapping. Clear the invalidated PMD only after the dirty and reference checks have succeeded, before removing the rmap and withdrawing the deposited page table. The full invalidation retains the TLB flush required for the dirty and GUP-fast checks. Note: this patch relies on the following patches to work correctly: 1. powerpc/book3s64/mm: don't count invalidated PMDs in page table check 2. riscv: mm: don't let GUP-fast follow invalidated THP PMDs 3. LoongArch: mm: don't let GUP-fast follow invalidated THP PMDs 4. s390/mm: always clear _SEGMENT_ENTRY_READ in pmdp_invalidate() 5. sparc64: mm: fix thp_pte_count accounting around pmdp_invalidate() Assisted-by: LLM Signed-off-by: Kyle Zeng Signed-off-by: Zi Yan To: Andrew Morton To: David Hildenbrand To: Lance Yang Cc: Zi Yan Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Usama Arif Cc: Kiryl Shutsemau Cc: Jason Gunthorpe Cc: John Hubbard Cc: Peter Xu Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org --- mm/huge_memory.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index bd44d58e86845..39d56b5032d59 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3571,11 +3571,11 @@ static bool __discard_anon_folio_pmd_locked(struct = vm_area_struct *vma, return false; } =20 - orig_pmd =3D pmdp_huge_clear_flush(vma, addr, pmdp); + orig_pmd =3D pmdp_invalidate(vma, addr, pmdp); =20 /* * Syncing against concurrent GUP-fast: - * - clear PMD; barrier; read refcount + * - invalidate PMD; barrier; read refcount * - inc refcount; barrier; read PMD */ smp_mb(); @@ -3609,6 +3609,7 @@ static bool __discard_anon_folio_pmd_locked(struct vm= _area_struct *vma, return false; } =20 + pmdp_huge_get_and_clear(mm, addr, pmdp); folio_remove_rmap_pmd(folio, pmd_page(orig_pmd), vma); zap_deposited_table(mm, pmdp); add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR); --=20 2.53.0 From nobody Fri Oct 23 03:31:41 2026 Received: from PH8PR06CU001.outbound.protection.outlook.com (mail-westus3azon11012039.outbound.protection.outlook.com [40.107.209.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6204F392811 for ; Thu, 15 Oct 2026 18:13:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.209.39 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088036; cv=fail; b=ZRqYX4DyykyFqClf3MZr2cMn0rpTJ7AkoLun34lyqF04e0wsJkmT0jiiR2yiBKlBgJyMdGc/TTgxRs0BEEmhP+CG6apz0M3ZbynWxc7mj3szdBFZ1aanJF7VqZwG9hobj9EyudAiyVEDzwMh+rwTu1H/6EEKne2FddgPtwhM/vk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792088036; c=relaxed/simple; bh=YT8Z8lGL8hgshpnA/RFDKIvOgpc82FciVQfWXf2YioI=; h=From:Date:Subject:Content-Type:Message-Id:References:In-Reply-To: To:Cc:MIME-Version; b=EQgk2A3MMsAAm8NSnb6WL9LQNqFe3AvXKRQgyGsDZ1envSAYNuCDj1SA164diFEMUSdcC+4sx3s6a3ySOg1g7oU4czlZYhHby9h/sA+isLSfOso9QL6jAAeozQSz0n9VjgokCxkU/faTV+LNFOf5e0SPOUm5AdWtB1nN4+Vq/r4= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=NkKxiZuX; arc=fail smtp.client-ip=40.107.209.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="NkKxiZuX" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Z0Ku00z3j1C2W5o74dW7UKyZNGsbooQw2p63HM35hLWQhzHIdPR29NUTQ8AcNXxAcspbK5g2fVOKkyduJgGTJ4zH7s1rGu8lYCEd3QRnjz45vLu+6LhE/0JbstaVPmJNgfSZFWsFipqtdOlBKlH0INFC7CdGEadpAKsQtFH36gQV4rQxSeXlPaphhltyvTASOnrxvJT6S7rhhP/AxWDagdvB0YLnFxgibQEDpykZFjA6xSmQ6JByZt5pscSAhgZLrCOLevoXjvua+I9rNIjJNOb0FSgcaLgZb1ouSL05ijnH7xIDW1VW2z5BpC2vkThNuS3sdzEYkG6WCr9CQaLZvg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IEqsCkqaYkWu5OZuS9wQQNLA6Vv19xX/x+/7IITAQPk=; b=Auv2l6XUhAbejkks/u7Z4Vd5USVqhZ4tCWl+WjBCa/69Lg+iJPsSNE0AELEUEvJIB9piwEYqKdtchQLHhkmh3O0LTojs289NGxPqXG9MOi7rsv00zZkWYJK9V8RGm5k8QC3zeYS7c2IbU1TmIqlm7cBDJS0eF+OqiMMm4WR1hbzPEx9Hg6pAmQjpNYtD2UlhDL4mSar8CKpsgTNfOwKpchbQtFUI04FOnw3+cx3nSqmCjbplfSqNex1Hkzk1199ZCqwkWoNZx9n1v6Pqx9Z/sEv9S17XA231Tf/9QpelsUMn/Q3x6Ge8BLdsGYJG1x9smuyOlU9FGkOi1C9nPKHInA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IEqsCkqaYkWu5OZuS9wQQNLA6Vv19xX/x+/7IITAQPk=; b=NkKxiZuXAjfNGOS/tupvhltvFizyBgB6HDuA42mRN85ZjEJLulWMGbvGIfoRa9lFMLGPK/Ige3WvhrDWG8dxiwqRu76BPheHChpIDyudUfwjwLyMFmkSkC9THJZoCUHGClgh4zTdDw0zl0Zl8/8PZghFGzXE+iDwWJ6Y3SqUQdzlwyBhx+5ZlsjQccrAhGikOGe6JVrs0XJurOmvWdJlzfaiKWSPs1ZGZJ7T7DuMB8uRzF6pow3TkZW4nwYUxv1Zdo7KMq/ne/qjjxWlM/fM582vUf1/NLQ2MXUtb1d5rhz19LkdJnDDbnh18BcmGMJiPDTNUTT50+pwB6GmKYAf5w== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS0PR12MB9058.namprd12.prod.outlook.com (2603:10b6:8:c6::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Thu, 15 Oct 2026 18:13:23 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%6]) with mapi id 15.21.0472.016; Thu, 15 Oct 2026 18:13:23 +0000 From: Zi Yan Date: Thu, 15 Oct 2026 14:13:07 -0400 Subject: [PATCH for 7.4-rc2+ 7/7] mm/rmap: re-enable discarding lazyfree THPs at PMD level Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261015-anon_vma_uaf_fix-v1-7-7b977303b42b@nvidia.com> References: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> In-Reply-To: <20261015-anon_vma_uaf_fix-v1-0-7b977303b42b@nvidia.com> To: David Hildenbrand , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Lorenzo Stoakes , Rik van Riel , Vlastimil Babka , Harry Yoo , Jann Horn , Kyle Zeng , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Zi Yan X-Mailer: b4 0.16.0 X-ClientProxiedBy: YQBPR0101CA0244.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:66::16) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS0PR12MB9058:EE_ X-MS-Office365-Filtering-Correlation-Id: e6512b67-dcdc-4f82-a816-08df2ae80042 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|7416014|366016|23010399003|921020|56012099006|11063799006|261009223027099003|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: RJtm44WJdxe/1BraaYiooPrEjOMo/25ZNYPw3+/7bgDu6YiOe25xXWoOPi9KrtZ9PH1J0EZpVGHwHd2+qbJy4LOLXKICyxjBTS6Te6QhrW4zRzROr0SYhSWDWBKYOclEHbV8SaxKRWt1FVawJQez7XIM21AZOQ2Gh9eby6y5/FKYXHPdgrEQutFaNIPMprwJRioY98BwGN83jkH2GtFd06JTgmw0BSQwP2dQuHisgErNSBa9SDRVCLynkEz8Xp0RCXN2A1qdaQCtcHD00zZ8JXVlNVCas2SBjz284Em+TMojcI9LbcChpnJzVPWu1Nuo1Ura6mkIobQp18KZuwpLf9o6awm4ZhzXvE46Kt0e9l66mS6Y1zwxr3autxnRZpamOeCk4sPhp5/dVbMNA9n62tZIqZd6qFhvWaBQ1OeomJ2NXaQu5BnD9Nq23Fo+Sv8u/Vxrw45wToBowZOqYtXz7C/HUMvWm3789e1k/P5UwXryrqxiPPeZGpESgmZ2JPuUhCrv2xssi9gYBRiQOU08WNi/9L3rUEEHnSN+CLX/CmD96iBjDb1931m04pgGTbJqmHtaAKQodJQS/6+qophpuEYzyau75mk+zz4X1ytqSvyd0DYc38vcX/gx3xaSUAIno8p47Y3u4IEEzNCP4XWg024R0epSNipVuQH0scZJpR2qpgyoTLRu6E93feUPXmauMdGND8dwzh7B9zcyG6Qnfw== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(7416014)(366016)(23010399003)(921020)(56012099006)(11063799006)(261009223027099003)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?KzNTeEVYYUR6ODdlcmdVanErZnZHRG4wWFlLb1lUNkphMkRaZlFYemsyTkVZ?= =?utf-8?B?Z1NhNWlCdXJPM1ZzZ2t3RUlyd3BxQWQ5a0V0MzZrUjBPRWNsU0x6VDRJTzF3?= =?utf-8?B?QmxPK29MK0wzdUZOWDlaTFZlMFlrNDl4TXF3cXh1bU5TR3lwa3JlbFhVV0NE?= =?utf-8?B?WndrTTNWYVA4NURnbFNPUy9udVhTRkM2Y2VUWG5MaDlDdTFlWlI5SCtaRVNz?= =?utf-8?B?d0oyU2tjeE5pVUkrSWVkZGllS2FXTlJQVHMzanV3UEpJUUtkOFpWVmRTY05t?= =?utf-8?B?ZDdRODhjRVZpdm1vdm9Bd3IwaDVQbVI4MUtmSHBSUDFCZkNLZk5GeitnZlRw?= =?utf-8?B?Z0JOMW45SjUwZ0hJWEJHL0dnYjJrckdQajhVL0w0M09XSVRGdnlWSGlrd3gx?= =?utf-8?B?TEF2Z2srNWhaRDJTcnI1WmtqYmkyUHZjdzlBd0xTeWlLTGVMUWlEUWNjMXhW?= =?utf-8?B?aDduVzdleFBSVVF6cXFlQXFqemREaGM3WGRoek9iNTI4cXRDZGY0dXFLN3hz?= =?utf-8?B?TWt5WTJpQ3U5a2RLNDZFSjhUQlFLSWdQNHpkOUs4NGVwbjkzdi82aUVFMnRm?= =?utf-8?B?aldFZFZTT3R5VGRncWZTUFZjbXZhYUlubUN0L2oxdk5RdWtRV2Z2RGF3NlFJ?= =?utf-8?B?YUNZY2tUNUpEY2pNcTZYYXdkMVJJeFNiZWFsT1dNTjZCSjM3TmFDSW5UR3ll?= =?utf-8?B?RDBaV21PSHI4cFB0RUVNOGZZMHJKVzRpTXlKM0U2Y2tIWGZqd1pTWVgrZG95?= =?utf-8?B?akRMY1ppMnlyLzF5c0wxMVhkNXVINU9lWHlFZ2RXQ0FBWXZwMzZiRGl1UUVG?= =?utf-8?B?MEIrQVI4NzhMNUo5TkFCRTBDem1rOEJjR01wYnFFdlhBc2Z6VitxbjM1bXc1?= =?utf-8?B?a0dvamtheFU1Qmo1Vk9Cd2pXbjRlUnowQmJYSFQzUUI5UzRZeCs5eGpzS00w?= =?utf-8?B?U2NUMzZlajJEVEUrdGpIZTk3TDNnNTJBOXVlZkNxaHNEUE5Yd0dyY1RQKzdL?= =?utf-8?B?U0lpSGRUY0N3RVM2UmZpd0Z1YUJPSTlBZ2VYaXM5Zk1FVkxjelgxRmduem00?= =?utf-8?B?cUxQWWlDb2xtQlM5OVRwMjZFdGNMMXd0VEhBN3UzOEM1clRoeU16OVkvdWd4?= =?utf-8?B?dGNIMlJ3Q0Y1M2h3d3FsVjhZQ290YVo0T2RZQkdodG9uc0d6RmQydzRzbnR6?= =?utf-8?B?eUc3MlMvUXY3bG0rL2RBaFZyYjdjaFZiVDFRMS9FaExDek5CVzNCM3hOeERO?= =?utf-8?B?a2pRTkkxc3dxK2x3blV1ZmtqMDNWTS9mYkZLcTMrb1BBWDFqZjZ1b1N3Y0ND?= =?utf-8?B?bWJjc1BlK0J6Rncvdi9ibHZnSWE1Ky84d1ZpQXRrbFkvRHlSa2VjVXh3dDR1?= =?utf-8?B?TXFlNjNmL3M4ZjIxZldyYml0akFPRm00cldnQWJRWkVDMTJ1ODVZMFh5Y3lZ?= =?utf-8?B?eXpmZHh5b3FKeG0rZzEvVXhkZmxBSlR3QzlCeSszc015Zm1kcGRjSno3YjJP?= =?utf-8?B?VnJmVkMwT0pRSmhKVFhvaGJyZEpKOUlWcUVsU3JtQlNuR2J1cFEvMmtLVDdV?= =?utf-8?B?ZDh2VWNNM241dnFjU1lpTlkrYVprV3Z3Q1B3TFNrV2NoZmRJSFh6aFE3Vyta?= =?utf-8?B?TUdUcnFuMG96QnJtOXEvajUraFlsU2wydWtvRjdKbXF4WExlZmtOZlRIY1Fz?= =?utf-8?B?UmhDVFlFUkRtR3pHejJ2WlJHQVFmR2NxWUxRUitWQ2RrZnFDb2JQL09XbU5J?= =?utf-8?B?RUhKWHZMbFVta2g0bkgzemprc3prRWUraEFhZ1E4S1NsNTdTTU41c1lKOElv?= =?utf-8?B?cFJ3OXFnNU9PZXU4L25sdllueEE4dVBpRngxOUZ1bDF3bE9vUUk3bDlOTFp1?= =?utf-8?B?dFA3anEvM01oMXQxcXBOU3Vpck5xQjVVclR5Y203NFlPR3lGMk10TWZZYnFH?= =?utf-8?B?akxPRHB1MlMwOGxUaDh0NThKTE4zbmpFdVlad0dkSmFLekdaU2hsanNBYnE0?= =?utf-8?B?R21IaGpVb1FmczFPVlV4L2tBN3YyU3k4alJ1dWhZZDc3L0lUbXBMN3RWaFZM?= =?utf-8?B?T2Y0bThKYWgwc2pZcytYTitldFQ5U0tUMUc5UzNEYkxud3AyQ05VMU5HRE5j?= =?utf-8?B?Z05hK0dLejF6aWNhbkluem84d3V5cG0zbVRqNTB2UEJtak5NNHlONkJGTHFX?= =?utf-8?B?SENkV1NJUGtpMFh6K0JVSS9QZXgvRVBZZGppVHZGUnV0TElXTDNaY2t0UWZI?= =?utf-8?B?MWV1QytVQXY4SnVvdDcxRDBhZjNUQ0VWZ2ZrOTRTMjk0RDF4ZkdhOEJjTkpS?= =?utf-8?Q?mwF6vHv/d6KV61kqLa?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: e6512b67-dcdc-4f82-a816-08df2ae80042 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Oct 2026 18:13:23.5769 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: USHBwXWftIUg4ADgyi1wV7ktmQza4PVGmp83ibFY2qJJ219mERAtil4XemalrZHU X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB9058 The patch "mm/rmap: don't discard lazyfree THPs at PMD level" disabled the PMD-level discard, because it cleared the PMD before checking whether the folio could be discarded, and munmap() or mremap() could skip that transiently none PMD. __discard_anon_folio_pmd_locked() now keeps the PMD invalidated, not cleared, until the discard is committed, GUP-fast no longer follows an invalidated PMD on any architecture, powerpc page table check no longer counts an invalidated PMD as mapped, and sparc64 keeps thp_pte_count balanced when an invalidated PMD is set again or cleared. Discard lazyfree THPs at PMD level again. Assisted-by: LLM Signed-off-by: Zi Yan To: Andrew Morton To: David Hildenbrand To: Lorenzo Stoakes Cc: Rik van Riel Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Harry Yoo Cc: Jann Horn Cc: Lance Yang Cc: Kyle Zeng Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org --- mm/rmap.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/rmap.c b/mm/rmap.c index 1131b76bbbc28..805db93fe0428 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -2275,6 +2275,17 @@ static bool try_to_unmap_one(struct folio *folio, st= ruct vm_area_struct *vma, } =20 if (!pvmw.pte) { + if (folio_test_lazyfree(folio)) { + if (unmap_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, folio)) + goto walk_done; + /* + * unmap_huge_pmd_locked has either already marked + * the folio as swap-backed or decided to retain it + * due to GUP or speculative references. + */ + goto walk_abort; + } + if (flags & TTU_SPLIT_HUGE_PMD) { /* * We temporarily have to drop the PTL and --=20 2.53.0