From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-183.mta1.migadu.com (out-183.mta1.migadu.com [95.215.58.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1EF93356762 for ; Thu, 21 May 2026 06:26:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.183 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779344809; cv=none; b=i5Y/754IMPbmtdN6fXfmq+CfAAbXbW1Ii0847csMoNR7Bn2IL/VFAMX3RZLjv3+hTnLsjz6u0k9Ku1dY1YHVQrp3N+g0QJE3kntvnyJqYotZ2w+J6PEm7CMwMtCmqn4PJMuuccqwtL7m0A9kOKvm7pe7K2bKcl1+c13/wrokctk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779344809; c=relaxed/simple; bh=qnmCWKueNJ4pi9u9Jt7UIlH3wMEegvOEUzVJnKCErbQ=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=f3tuR3x2QTe51ZSe8kXHJ0CoipwIVk0CPmqyeIiZLixNOVlW43zPqTn5JKBxagOVU0C//gEnaUqn1qDW2FfuzsZwDkpHGV0teWGGqH1wK/RTKrccKfD08NIT9CHPvUkTREVB+2awv4hAMhFl+2k/2oIpCQpg1n6y3YFCdRR+NO0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=s8NtqF0P; arc=none smtp.client-ip=95.215.58.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="s8NtqF0P" Content-Type: text/plain; charset=us-ascii DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779344802; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oS6qoV4jANTDW9AOUtNU1MNWiMdTldRllFEpVOk7i9s=; b=s8NtqF0PBL7b51MNkeA1wcD4sJCODzQ9ri+YnQwMb3IUepcKApYFxi+kXigmDQNhmkunsB UpcKoRu9PiOW80veNLIy+L2F0A1VAofpPpvcnHkk804eReywvx71aHZQ9udbmUWgT6g49p rEYa+pLddcRpL9sZnhRjGu1wAGD5WE8= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: [PATCH v3] mm: do not install PMD mappings when handling a COW fault X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: William Kucharski In-Reply-To: <20260520151624.78370-1-yizhang089@gmail.com> Date: Thu, 21 May 2026 00:26:27 -0600 Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, david@redhat.com, karol.wachowski@linux.intel.com, yi.zhang@huawei.com, yi.zhang@huaweicloud.com, liuyongqiang13@huawei.com, wangkefeng.wang@huawei.com, yangerkun@huawei.com Content-Transfer-Encoding: quoted-printable Message-Id: <17356DF5-A72E-46B8-BD54-4CCFB6775BB1@linux.dev> References: <20260520151624.78370-1-yizhang089@gmail.com> To: yizhang089@gmail.com X-Migadu-Flow: FLOW_OUT Thank you, that's what I was hoping to see. Reviewed-by: William Kucharski > On May 20, 2026, at 09:16, yizhang089@gmail.com wrote: >=20 > From: Zhang Yi >=20 > When pinning a page with FOLL_LONGTERM in a CoW VMA and a PMD-aligned > (2MB on x86) large folio follow_page_mask() failed to obtain a valid > anonymous page, resulting in an infinite loop issue. The specific > triggering process is as follows: >=20 > 1. User call mmap with a 2MB size in MAP_PRIVATE mode for a file that > has a 2MB large folio installed in the page cache. >=20 > addr =3D mmap(NULL, 2*1024*1024, PROT_READ, MAP_PRIVATE, file_fd, = 0); >=20 > 2. The kernel driver pass this mapped address to pin_user_pages_fast() > in FOLL_LONGTERM mode. >=20 > pin_user_pages_fast(addr, 512, FOLL_LONGTERM, pages); >=20 > -> pin_user_pages_fast() > | gup_fast_fallback() > | __gup_longterm_locked() > | __get_user_pages_locked() > | __get_user_pages() > | follow_page_mask() > | follow_p4d_mask() > | follow_pud_mask() > | follow_pmd_mask() //pmd_leaf(pmdval) is true because the > | //huge PMD is installed. This is normal > | //in the first round, but it shouldn't > | //happen in the second round. > | follow_huge_pmd() //require an anonymous page > | return -EMLINK; > | faultin_page() > | handle_mm_fault() > | wp_huge_pmd() //remove PMD and fall back to PTE > | handle_pte_fault() > | do_pte_missing() > | do_fault() > | do_read_fault() //FAULT_FLAG_WRITE is not set > | finish_fault() > | do_set_pmd() //install a huge PMD again, this is wrong!!! > | do_wp_page() //create private anonymous pages > <- goto retry; >=20 > Due to an incorrectly large PMD set in do_read_fault(), > follow_pmd_mask() always returns -EMLINK, causing an infinite loop. >=20 > David pointed out that we can preallocate a page table and remap the = PMD > to be mapped by a PTE table in wp_huge_pmd() in the future. But now we > can avoid this issue by not installing PMD mappings when handling a = COW > and unshare fault in do_set_pmd(). >=20 > Fixes: a7f226604170 ("mm/gup: trigger FAULT_FLAG_UNSHARE when = R/O-pinning a possibly shared anonymous page") > Reported-by: Karol Wachowski > Closes: = https://lore.kernel.org/linux-ext4/844e5cd4-462e-4b88-b3b5-816465a3b7e3@li= nux.intel.com/ > Suggested-by: David Hildenbrand > Signed-off-by: Zhang Yi > Acked-by: David Hildenbrand > --- > v2->v3: > - Update comments to clarify why we shouldn't install PMD mappings > while doing CoW. >=20 > mm/memory.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) >=20 > diff --git a/mm/memory.c b/mm/memory.c > index ea6568571131..b1aed4f08224 100644 > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -5520,6 +5520,17 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, = struct folio *folio, struct page *pa > if (!thp_vma_suitable_order(vma, haddr, PMD_ORDER)) > return ret; >=20 > + /* > + * We're about to trigger a write or unshare fault on a CoW > + * mapping, breaking the shared folio into private anonymous > + * copies at PTE granularity. A PMD mapping would bind an > + * entire PMD-sized range to the shared folio, defeating CoW. > + * Fall back to direct PTE mapping. > + */ > + if (is_cow_mapping(vma->vm_flags) && > + (vmf->flags & (FAULT_FLAG_WRITE | FAULT_FLAG_UNSHARE))) > + return ret; > + > if (!is_pmd_order(folio_order(folio))) > return ret; > page =3D &folio->page; > --=20 > 2.52.0 >=20