[PATCH v2 0/2] mm: free unused page table allocated by do_set_pmd()

[PATCH v2 0/2] mm: free unused page table allocated by do_set_pmd()

[David Hildenbrand (Arm)]

This isn't super urgent, so it can wait for 7.5.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
Changes in v2:
- Free the table in do_set_pmd() instead.
- Add "mm: don't allocate a page table under RCU in do_set_pmd()"
- Link to v1: https://patch.msgid.link/20261105-khugepaged_set_pmd-v1-1-cb79ab117199@kernel.org

---

David Hildenbrand (Arm) (2):
      mm: free unused page table allocated by do_set_pmd()
      mm: don't allocate a page table under RCU in do_set_pmd()

 include/linux/mm.h |  3 ++-
 mm/filemap.c       |  2 +-
 mm/khugepaged.c    |  2 +-
 mm/memory.c        | 16 +++++++++++++---
 4 files changed, 17 insertions(+), 6 deletions(-)

---

base-commit: f44fd601f72e09e44c667b9234c9cd469856679c

change-id: 20261105-khugepaged_set_pmd-60a02f718e64

--

Cheers,

David

[PATCH v2 1/2] mm: free unused page table allocated by do_set_pmd()

[David Hildenbrand (Arm)]

do_set_pmd() can allocate vmf->prealloc_pte on architectures that need a
deposited page table, such as PowerPC with the hash MMU. If the PMD is
no longer empty when it takes the PMD lock, it returns VM_FAULT_FALLBACK
without consuming that table.

Since collapse_pte_mapped_thp() uses mmap_read_lock(), a concurrent
userfaultfd operation can install a PTE table before taking the folio
lock. If that races with set_huge_pmd(), the unused preallocated table
is lost when its local vm_fault goes out of scope.

Track whether do_set_pmd() allocated the table and free it after dropping
the PMD lock if it was not consumed. Preserve any preallocated table
supplied by the caller for PTE fallback. Successful PMD installation
consumes the table and clears the pointer.

Returning without a preallocated table matches the existing behavior on
architectures that do not need a deposited table. All callers
already handle that case.

Fixes: 1043173eb5eb ("mm/khugepaged: collapse_pte_mapped_thp() with mmap_read_lock()")
Cc: stable@vger.kernel.org
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 mm/memory.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mm/memory.c b/mm/memory.c
index becf53a2a0944..421064aef3cf0 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -5687,6 +5687,7 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
 	struct vm_area_struct *vma = vmf->vma;
 	bool write = vmf->flags & FAULT_FLAG_WRITE;
 	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
+	bool pgtable_allocated = false;
 	pmd_t entry;
 	vm_fault_t ret = VM_FAULT_FALLBACK;
 
@@ -5725,6 +5726,7 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
 		vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
 		if (!vmf->prealloc_pte)
 			return VM_FAULT_OOM;
+		pgtable_allocated = true;
 	}
 
 	vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
@@ -5755,6 +5757,10 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
 	count_vm_event(THP_FILE_MAPPED);
 out:
 	spin_unlock(vmf->ptl);
+	if (pgtable_allocated && vmf->prealloc_pte) {
+		pte_free(vma->vm_mm, vmf->prealloc_pte);
+		vmf->prealloc_pte = NULL;
+	}
 	return ret;
 }
 #else

-- 
2.43.0

[PATCH v2 2/2] mm: don't allocate a page table under RCU in do_set_pmd()

[David Hildenbrand (Arm)]

do_fault_around() skips PTE table preallocation when the PMD already points
to a PTE table. A concurrent collapse can then retract that table and
clear the PMD before filemap_map_pages() locks the new PMD-sized folio.

filemap_map_pmd() can then call do_set_pmd() with an empty PMD and no
preallocated table. On PowerPC hash MMU, do_set_pmd() then tries
allocating a PTE table to deposit. But filemap_map_pmd() calls
do_set_pmd() under RCU, so allocating from that context is not good.

This race became possible when retract_page_tables() stopped taking the
mmap and VMA locks. Previously, those locks excluded retraction while
the fault was in progress.

Add a may_alloc argument to do_set_pmd() and pass false from
filemap_map_pmd(), so we can fail with VM_FAULT_FALLBACK instead of
trying to allocate.

This issue should be fairly hard to hit in practice.

Fixes: 1d65b771bc08 ("mm/khugepaged: retract_page_tables() without mmap or vma lock")
Cc: stable@vger.kernel.org
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 include/linux/mm.h |  3 ++-
 mm/filemap.c       |  2 +-
 mm/khugepaged.c    |  2 +-
 mm/memory.c        | 10 +++++++---
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index a2dd76cc5bbfe..bd144fec5f5da 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2156,7 +2156,8 @@ static inline pte_t maybe_mkwrite(pte_t pte, struct vm_area_struct *vma)
 	return pte;
 }
 
-vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page);
+vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
+		bool may_alloc);
 void set_pte_range(struct vm_fault *vmf, struct folio *folio,
 		struct page *page, unsigned int nr, unsigned long addr);
 
diff --git a/mm/filemap.c b/mm/filemap.c
index 86297841f9955..9871b4f32a916 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3745,7 +3745,7 @@ static bool filemap_map_pmd(struct vm_fault *vmf, struct folio *folio,
 
 	if (pmd_none(*vmf->pmd) && folio_test_pmd_mappable(folio)) {
 		struct page *page = folio_file_page(folio, start);
-		vm_fault_t ret = do_set_pmd(vmf, folio, page);
+		vm_fault_t ret = do_set_pmd(vmf, folio, page, /* may_alloc= */ false);
 		if (!ret) {
 			/* The page is mapped successfully, reference consumed. */
 			folio_unlock(folio);
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 8d9f05a39afb3..5836e08abc984 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1826,7 +1826,7 @@ static enum scan_result set_huge_pmd(struct vm_area_struct *vma, unsigned long a
 	}
 
 	vmf.pmd = pmdp;
-	if (do_set_pmd(&vmf, folio, page))
+	if (do_set_pmd(&vmf, folio, page, /* may_alloc= */ true))
 		return SCAN_FAIL;
 
 	folio_get(folio);
diff --git a/mm/memory.c b/mm/memory.c
index 421064aef3cf0..6eeed43b05a19 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -5682,7 +5682,8 @@ static void deposit_prealloc_pte(struct vm_fault *vmf)
 	vmf->prealloc_pte = NULL;
 }
 
-vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page)
+vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
+		bool may_alloc)
 {
 	struct vm_area_struct *vma = vmf->vma;
 	bool write = vmf->flags & FAULT_FLAG_WRITE;
@@ -5723,6 +5724,8 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
 	 * related to pte entry. Use the preallocated table for that.
 	 */
 	if (arch_needs_pgtable_deposit() && !vmf->prealloc_pte) {
+		if (!may_alloc)
+			return VM_FAULT_FALLBACK;
 		vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
 		if (!vmf->prealloc_pte)
 			return VM_FAULT_OOM;
@@ -5764,7 +5767,8 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
 	return ret;
 }
 #else
-vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page)
+vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
+		bool may_alloc)
 {
 	return VM_FAULT_FALLBACK;
 }
@@ -5888,7 +5892,7 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
 
 	if (pmd_none(*vmf->pmd)) {
 		if (!needs_fallback && folio_test_pmd_mappable(folio)) {
-			ret = do_set_pmd(vmf, folio, page);
+			ret = do_set_pmd(vmf, folio, page, /* may_alloc= */ true);
 			if (ret != VM_FAULT_FALLBACK)
 				return ret;
 		}

-- 
2.43.0

Re: [PATCH v2 1/2] mm: free unused page table allocated by do_set_pmd()

[Usama Arif]

On Fri, 06 Nov 2026 13:36:12 +0100 "David Hildenbrand (Arm)" <david@kernel.org> wrote:

> do_set_pmd() can allocate vmf->prealloc_pte on architectures that need a
> deposited page table, such as PowerPC with the hash MMU. If the PMD is
> no longer empty when it takes the PMD lock, it returns VM_FAULT_FALLBACK
> without consuming that table.
> 
> Since collapse_pte_mapped_thp() uses mmap_read_lock(), a concurrent
> userfaultfd operation can install a PTE table before taking the folio
> lock. If that races with set_huge_pmd(), the unused preallocated table
> is lost when its local vm_fault goes out of scope.
> 
> Track whether do_set_pmd() allocated the table and free it after dropping
> the PMD lock if it was not consumed. Preserve any preallocated table
> supplied by the caller for PTE fallback. Successful PMD installation
> consumes the table and clears the pointer.
> 
> Returning without a preallocated table matches the existing behavior on
> architectures that do not need a deposited table. All callers
> already handle that case.
> 
> Fixes: 1043173eb5eb ("mm/khugepaged: collapse_pte_mapped_thp() with mmap_read_lock()")
> Cc: stable@vger.kernel.org
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---
>  mm/memory.c | 6 ++++++
>  1 file changed, 6 insertions(+)

Acked-by: Usama Arif <usama.arif@linux.dev>

Reminded me of lazy pagetable deposit series :)

> 
> diff --git a/mm/memory.c b/mm/memory.c
> index becf53a2a0944..421064aef3cf0 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -5687,6 +5687,7 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  	struct vm_area_struct *vma = vmf->vma;
>  	bool write = vmf->flags & FAULT_FLAG_WRITE;
>  	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
> +	bool pgtable_allocated = false;
>  	pmd_t entry;
>  	vm_fault_t ret = VM_FAULT_FALLBACK;
>  
> @@ -5725,6 +5726,7 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  		vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
>  		if (!vmf->prealloc_pte)
>  			return VM_FAULT_OOM;
> +		pgtable_allocated = true;
>  	}
>  
>  	vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
> @@ -5755,6 +5757,10 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  	count_vm_event(THP_FILE_MAPPED);
>  out:
>  	spin_unlock(vmf->ptl);
> +	if (pgtable_allocated && vmf->prealloc_pte) {
> +		pte_free(vma->vm_mm, vmf->prealloc_pte);
> +		vmf->prealloc_pte = NULL;
> +	}
>  	return ret;
>  }
>  #else
> 
> -- 
> 2.43.0
> 
> 

Re: [PATCH v2 2/2] mm: don't allocate a page table under RCU in do_set_pmd()

[Usama Arif]

On Fri, 06 Nov 2026 13:36:13 +0100 "David Hildenbrand (Arm)" <david@kernel.org> wrote:

> do_fault_around() skips PTE table preallocation when the PMD already points
> to a PTE table. A concurrent collapse can then retract that table and
> clear the PMD before filemap_map_pages() locks the new PMD-sized folio.
> 
> filemap_map_pmd() can then call do_set_pmd() with an empty PMD and no
> preallocated table. On PowerPC hash MMU, do_set_pmd() then tries
> allocating a PTE table to deposit. But filemap_map_pmd() calls
> do_set_pmd() under RCU, so allocating from that context is not good.
> 
> This race became possible when retract_page_tables() stopped taking the
> mmap and VMA locks. Previously, those locks excluded retraction while
> the fault was in progress.
> 
> Add a may_alloc argument to do_set_pmd() and pass false from
> filemap_map_pmd(), so we can fail with VM_FAULT_FALLBACK instead of
> trying to allocate.
> 
> This issue should be fairly hard to hit in practice.
>

Yes, I imagine it was very difficult to reproduce, doing a sleeping
pte_alloc_one() inside filemap_map_pmd()'s RCU read-side section
when a concurrent retract_page_tables() empties the PMD. Only
possible on PowerPC.

> Fixes: 1d65b771bc08 ("mm/khugepaged: retract_page_tables() without mmap or vma lock")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---

Acked-by: Usama Arif <usama.arif@linux.dev>

>  include/linux/mm.h |  3 ++-
>  mm/filemap.c       |  2 +-
>  mm/khugepaged.c    |  2 +-
>  mm/memory.c        | 10 +++++++---
>  4 files changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index a2dd76cc5bbfe..bd144fec5f5da 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -2156,7 +2156,8 @@ static inline pte_t maybe_mkwrite(pte_t pte, struct vm_area_struct *vma)
>  	return pte;
>  }
>  
> -vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page);
> +vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
> +		bool may_alloc);
>  void set_pte_range(struct vm_fault *vmf, struct folio *folio,
>  		struct page *page, unsigned int nr, unsigned long addr);
>  
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 86297841f9955..9871b4f32a916 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -3745,7 +3745,7 @@ static bool filemap_map_pmd(struct vm_fault *vmf, struct folio *folio,
>  
>  	if (pmd_none(*vmf->pmd) && folio_test_pmd_mappable(folio)) {
>  		struct page *page = folio_file_page(folio, start);
> -		vm_fault_t ret = do_set_pmd(vmf, folio, page);
> +		vm_fault_t ret = do_set_pmd(vmf, folio, page, /* may_alloc= */ false);
>  		if (!ret) {
>  			/* The page is mapped successfully, reference consumed. */
>  			folio_unlock(folio);
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 8d9f05a39afb3..5836e08abc984 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -1826,7 +1826,7 @@ static enum scan_result set_huge_pmd(struct vm_area_struct *vma, unsigned long a
>  	}
>  
>  	vmf.pmd = pmdp;
> -	if (do_set_pmd(&vmf, folio, page))
> +	if (do_set_pmd(&vmf, folio, page, /* may_alloc= */ true))
>  		return SCAN_FAIL;
>  
>  	folio_get(folio);
> diff --git a/mm/memory.c b/mm/memory.c
> index 421064aef3cf0..6eeed43b05a19 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -5682,7 +5682,8 @@ static void deposit_prealloc_pte(struct vm_fault *vmf)
>  	vmf->prealloc_pte = NULL;
>  }
>  
> -vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page)
> +vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
> +		bool may_alloc)
>  {
>  	struct vm_area_struct *vma = vmf->vma;
>  	bool write = vmf->flags & FAULT_FLAG_WRITE;
> @@ -5723,6 +5724,8 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  	 * related to pte entry. Use the preallocated table for that.
>  	 */
>  	if (arch_needs_pgtable_deposit() && !vmf->prealloc_pte) {
> +		if (!may_alloc)
> +			return VM_FAULT_FALLBACK;
>  		vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
>  		if (!vmf->prealloc_pte)
>  			return VM_FAULT_OOM;
> @@ -5764,7 +5767,8 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  	return ret;
>  }
>  #else
> -vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page)
> +vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
> +		bool may_alloc)
>  {
>  	return VM_FAULT_FALLBACK;
>  }
> @@ -5888,7 +5892,7 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
>  
>  	if (pmd_none(*vmf->pmd)) {
>  		if (!needs_fallback && folio_test_pmd_mappable(folio)) {
> -			ret = do_set_pmd(vmf, folio, page);
> +			ret = do_set_pmd(vmf, folio, page, /* may_alloc= */ true);
>  			if (ret != VM_FAULT_FALLBACK)
>  				return ret;
>  		}
> 
> -- 
> 2.43.0
> 
>