From nobody Mon Sep 28 21:53:24 2026 Received: from out30-113.freemail.mail.aliyun.com (out30-113.freemail.mail.aliyun.com [115.124.30.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB08A30FC1A for ; Mon, 17 Aug 2026 07:16:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.113 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786951017; cv=none; b=EAAvmmOdAAGUpt8rSYdwFs9rTcHn+21K7VJvsg/uC1HPoTR8clnJGCk3J9xgqko+2eW9hg5ldNsDQd0ARewt5+PpYKp9mLJts7q2nBbD8UMIz1OaP4YvlogjF5Lfks2kPMMM+oHFb1aOdB7DeFO2Q6kIgk6K5xG4ffU0JktZgtc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786951017; c=relaxed/simple; bh=+LYw5Vy0cO2wB6j0+BBzYe6ecxVgRmOJd1LGfel6Ae8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Wbe5PuU82lzfwWKP7nqO/2jfY8uHoSBHtbXIIEE+gInspqigVZ9lzP4qW6IfLhsvlOY9949NXRgXmUcnIZ8JQx9OO/3HIG8g6p7F1MtKL/Zwx9vGvU3ruoNvhnpYhOgIubUk5xq80xfFt8IO96gfLpo1DfUtLyWV6npx/B6f/Bc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=bf9QjMjh; arc=none smtp.client-ip=115.124.30.113 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="bf9QjMjh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1786951011; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=NoWPmd2X0OYLbm11P9Q08lQNXkCRPjJwt7qQhihJ0Ks=; b=bf9QjMjhgDLwAhUy/qszx/mmUf0CwgGhhn10hT5BD1p0bllPU/3u7SrvMjFsa+6X5rk6ows2/Y5WDx/esohvxY4xjz3NzcmdBuJLIDOehtkmjhjpE7YdLwuVr/7icVpL837Vq/uKU7qGRDAJM23w6iRT4JbjmzGUtl0XUDkRED8= X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R171e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037009110;MF=baolin.wang@linux.alibaba.com;NM=1;PH=DS;RN=15;SR=0;TI=SMTPD_---0X93Z8A3_1786951010; Received: from localhost(mailfrom:baolin.wang@linux.alibaba.com fp:SMTPD_---0X93Z8A3_1786951010 cluster:ay36) by smtp.aliyun-inc.com; Mon, 17 Aug 2026 15:16:50 +0800 From: Baolin Wang To: akpm@linux-foundation.org, david@kernel.org, ljs@kernel.org, hughd@google.com Cc: ziy@nvidia.com, liam@infradead.org, nico.pache@linux.dev, dev.jain@arm.com, ryan.roberts@arm.com, baohua@kernel.org, lance.yang@linux.dev, usama.arif@linux.dev, baolin.wang@linux.alibaba.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] mm: shmem: fix incorrect vm_flags usage when checking allowable orders Date: Mon, 17 Aug 2026 15:16:43 +0800 Message-ID: X-Mailer: git-send-email 2.43.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Lance reported that when MADV_HUGEPAGE is set on a tmpfs file mounted with huge=3Dadvise option, khugepaged fails the allowable order check and does n= ot scan the tmpfs file for collapse. After commit 6beeab870e70 ("mm: shmem: move shmem_huge_global_enabled() into shmem_allowable_huge_orders()"), the shmem/tmpfs allowable order check reads vma->vm_flags directly. However, when MADV_HUGEPAGE is handled, khugepaged_enter_vma() is called before the VMA's vm_flags have been update= d, so the check uses stale flags and incorrectly rejects the VMA for collapse. As a result, khugepaged does not collapse the tmpfs file into PMD order in = time. Fix this by passing vm_flags as a parameter to shmem_allowable_huge_orders() instead of reading it from the vm_area_struct. Reported-by: Lance Yang Closes: https://lore.kernel.org/all/20260815181632.21453-1-lance.yang@linux= .dev/ Fixes: 6beeab870e70 ("mm: shmem: move shmem_huge_global_enabled() into shme= m_allowable_huge_orders()") Cc: stable@vger.kernel.org Signed-off-by: Baolin Wang Reviewed-by: Lance Yang --- include/linux/shmem_fs.h | 8 ++++---- mm/huge_memory.c | 2 +- mm/shmem.c | 9 +++++---- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h index 5663dff53186..321017e0fd63 100644 --- a/include/linux/shmem_fs.h +++ b/include/linux/shmem_fs.h @@ -127,13 +127,13 @@ int shmem_unuse(unsigned int type); =20 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && defined(CONFIG_SHMEM) unsigned long shmem_allowable_huge_orders(struct inode *inode, - struct vm_area_struct *vma, pgoff_t index, - loff_t write_end, bool shmem_huge_force); + struct vm_area_struct *vma, vm_flags_t vm_flags, + pgoff_t index, loff_t write_end, bool shmem_huge_force); bool shmem_hpage_pmd_enabled(void); #else static inline unsigned long shmem_allowable_huge_orders(struct inode *inod= e, - struct vm_area_struct *vma, pgoff_t index, - loff_t write_end, bool shmem_huge_force) + struct vm_area_struct *vma, vm_flags_t vm_flags, pgoff_t index, + loff_t write_end, bool shmem_huge_force) { return 0; } diff --git a/mm/huge_memory.c b/mm/huge_memory.c index ced400f72d43..70f57d700739 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -187,7 +187,7 @@ unsigned long __thp_vma_allowable_orders(struct vm_area= _struct *vma, */ if (!in_pf && shmem_file(vma->vm_file)) return orders & shmem_allowable_huge_orders(file_inode(vma->vm_file), - vma, vma_start_pgoff(vma), 0, + vma, vm_flags, vma_start_pgoff(vma), 0, forced_collapse); =20 if (!vma_is_anonymous(vma)) { diff --git a/mm/shmem.c b/mm/shmem.c index 599665a3d6e7..6f1ad5456aca 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1834,12 +1834,11 @@ bool shmem_hpage_pmd_enabled(void) } =20 unsigned long shmem_allowable_huge_orders(struct inode *inode, - struct vm_area_struct *vma, pgoff_t index, - loff_t write_end, bool shmem_huge_force) + struct vm_area_struct *vma, vm_flags_t vm_flags, + pgoff_t index, loff_t write_end, bool shmem_huge_force) { unsigned long mask =3D READ_ONCE(huge_shmem_orders_always); unsigned long within_size_orders =3D READ_ONCE(huge_shmem_orders_within_s= ize); - vm_flags_t vm_flags =3D vma ? vma->vm_flags : 0; unsigned int global_orders; =20 if (thp_disabled_by_hw() || (vma && vma_thp_disabled(vma, vm_flags, shmem= _huge_force))) @@ -2430,6 +2429,7 @@ static int shmem_get_folio_gfp(struct inode *inode, p= goff_t index, gfp_t gfp, struct vm_fault *vmf, vm_fault_t *fault_type) { struct vm_area_struct *vma =3D vmf ? vmf->vma : NULL; + vm_flags_t vm_flags =3D vma ? vma->vm_flags : 0; struct mm_struct *fault_mm; struct folio *folio; int error; @@ -2507,7 +2507,8 @@ static int shmem_get_folio_gfp(struct inode *inode, p= goff_t index, } =20 /* Find hugepage orders that are allowed for anonymous shmem and tmpfs. */ - orders =3D shmem_allowable_huge_orders(inode, vma, index, write_end, fals= e); + orders =3D shmem_allowable_huge_orders(inode, vma, vm_flags, index, + write_end, false); if (orders > 0) { gfp_t huge_gfp; =20 --=20 2.47.3