From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-124.freemail.mail.aliyun.com (out30-124.freemail.mail.aliyun.com [115.124.30.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 798EC3E8331 for ; Mon, 17 Aug 2026 09:34:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786959289; cv=none; b=OmOk/jjL5bhnUA+BsfZoanJFZYxZk8+2HDG24DyU8SJDfE72J+J7rXuUHyk681USz+MqIywWBRh1HgesSOq2rivCzt/yGd7B9JS/3IgoWoapf+FDuozEvVAcAM3+MEZ0v1V4qUTsSmlPXUUn65mhUSug+GzBinjmPURYP74667Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786959289; c=relaxed/simple; bh=hue3SIjr0zEByteXx9LandmDy/a/n5GYMtY7HpqYCo8=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=UiJSLf+kRgHiTLSwY4XMs83+PmbwQrYRU7EL5RIAuxdseaJ8C2FaJPrkYY3mc0nw1qjHbzjIXCBIyHmR88MK991noAfPspd7VaMZBfekpnPmt4L7GIlLEz0gYS5sXf4m8+sCpDk0eZQ3kXpRqPMw1sATgm/lENN/DaHeJD8jBJs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=vJGwPUh1; arc=none smtp.client-ip=115.124.30.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="vJGwPUh1" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1786959271; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=4Dpf8rNnkAaaE60/W1M/0ZbnWHpXRdwLly7Psg5rJcI=; b=vJGwPUh1A2MKFgCapzLJL0FGpvfg28Yn+mvfTFJ1JUF2xPextN2nY1H1dhumz1UDYdgonSRYvepSGJg/GhSXUlFHIlBnkwyM63QhINB+5PKcgQK+FuEVrrsvquou9/rl6qQjS97475MmD8GB5x0q+SYU0ob57HEzatAuGCPHgGw= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R111e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037033178;MF=baolin.wang@linux.alibaba.com;NM=1;PH=DS;RN=14;SR=0;TI=SMTPD_---0X95hlMe_1786959269; Received: from 30.74.144.121(mailfrom:baolin.wang@linux.alibaba.com fp:SMTPD_---0X95hlMe_1786959269 cluster:ay36) by smtp.aliyun-inc.com; Mon, 17 Aug 2026 17:34:30 +0800 Message-ID: <3246987a-7f99-4dcd-b3f9-50d9a8c112ff@linux.alibaba.com> Date: Mon, 17 Aug 2026 17:34:29 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm: shmem: fix incorrect vm_flags usage when checking allowable orders To: "Lorenzo Stoakes (ARM)" Cc: akpm@linux-foundation.org, david@kernel.org, hughd@google.com, ziy@nvidia.com, liam@infradead.org, nico.pache@linux.dev, dev.jain@arm.com, ryan.roberts@arm.com, baohua@kernel.org, lance.yang@linux.dev, usama.arif@linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org References: From: Baolin Wang In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 8/17/26 3:40 PM, Lorenzo Stoakes (ARM) wrote: > On Mon, Aug 17, 2026 at 03:16:43PM +0800, Baolin Wang wrote: >> Lance reported that when MADV_HUGEPAGE is set on a tmpfs file mounted with >> huge=advise option, khugepaged fails the allowable order check and does not >> scan the tmpfs file for collapse. > > Ugh. > > But really I think this isn't quite accurate - what you mean to say I think is > that when _nothing else_ causes the mm to be considered for khugepaged collapse, > an MADV_HUGEPAGE-advised tmpfs VMA alone does not cause scanning to commence. Yes. >> After commit 6beeab870e70 ("mm: shmem: move shmem_huge_global_enabled() into >> shmem_allowable_huge_orders()"), the shmem/tmpfs allowable order check reads >> vma->vm_flags directly. However, when MADV_HUGEPAGE is handled, >> khugepaged_enter_vma() is called before the VMA's vm_flags have been updated, >> so the check uses stale flags and incorrectly rejects the VMA for collapse. >> As a result, khugepaged does not collapse the tmpfs file into PMD order in time. > > Could we at least refer to the non-deprecated field in the commit message? > i.e. vma->flags. > > Probably worth mentioning VMA_HUGEPAGE_BIT also. Sure. >> Fix this by passing vm_flags as a parameter to shmem_allowable_huge_orders() >> instead of reading it from the vm_area_struct. > > Ugh this is so disgusting. > > I understand this is a fix for a bug to be backported but couldn't we just > achieve the same without having to add a deprecated field to be passed around? > > As you say the khugepaged_enter_vma() isn't really so helpful in > hugepage_madvise(). > > But you could add this to the bottom of madvise_update_vma(): > > if (vma_flags_test(&new_vma_flags, VMA_HUGEPAGE_BIT)) > khugepaged_enter_vma(vma, new_flags); > > I don't think this is really egregious on this code path and could go some way > towards us eliminating the silly thing of passing around flags-to-be-set. This is not the point (maybe I didn't describe it clearly). The point is that the allowable orders check for tmpfs in shmem_huge_global_enabled() (called by shmem_allowable_huge_orders()) uses a stale vma flag. static unsigned int shmem_huge_global_enabled(struct inode *inode, pgoff_t index, loff_t write_end, bool shmem_huge_force, struct vm_area_struct *vma, vm_flags_t vm_flags) { ...... switch (SHMEM_SB(inode->i_sb)->huge) { ...... case SHMEM_HUGE_ADVISE: if (vm_flags & VM_HUGEPAGE) return THP_ORDERS_ALL_FILE_DEFAULT; fallthrough; default: return 0; } } So we should pass the new vma flags for shmem_allowable_huge_orders() to check the allowable orders for tmpfs. Changing madvise_update_vma() doesn't help with the allowable orders check for tmpfs. > And yeah you'd endure a little backport pain on switching that new_vma_flags > vma_flags_t test to a new_flags vm_flags_t test but it's not so bad :) > > I will be doing a series soon that improves the allowable orders vomit-a-thon > somewhat in tip :) Great. Look forward to seeing these cleanups. >> Reported-by: Lance Yang >> Closes: https://lore.kernel.org/all/20260815181632.21453-1-lance.yang@linux.dev/ >> Fixes: 6beeab870e70 ("mm: shmem: move shmem_huge_global_enabled() into shmem_allowable_huge_orders()") >> Cc: stable@vger.kernel.org >> Signed-off-by: Baolin Wang >> --- >> include/linux/shmem_fs.h | 8 ++++---- >> mm/huge_memory.c | 2 +- >> mm/shmem.c | 9 +++++---- >> 3 files changed, 10 insertions(+), 9 deletions(-) >> >> diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h >> index 5663dff53186..321017e0fd63 100644 >> --- a/include/linux/shmem_fs.h >> +++ b/include/linux/shmem_fs.h >> @@ -127,13 +127,13 @@ int shmem_unuse(unsigned int type); >> >> #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && defined(CONFIG_SHMEM) >> unsigned long shmem_allowable_huge_orders(struct inode *inode, >> - struct vm_area_struct *vma, pgoff_t index, >> - loff_t write_end, bool shmem_huge_force); >> + struct vm_area_struct *vma, vm_flags_t vm_flags, >> + pgoff_t index, loff_t write_end, bool shmem_huge_force); >> bool shmem_hpage_pmd_enabled(void); >> #else >> static inline unsigned long shmem_allowable_huge_orders(struct inode *inode, >> - struct vm_area_struct *vma, pgoff_t index, >> - loff_t write_end, bool shmem_huge_force) >> + struct vm_area_struct *vma, vm_flags_t vm_flags, pgoff_t index, >> + loff_t write_end, bool shmem_huge_force) >> { >> return 0; >> } >> diff --git a/mm/huge_memory.c b/mm/huge_memory.c >> index ced400f72d43..70f57d700739 100644 >> --- a/mm/huge_memory.c >> +++ b/mm/huge_memory.c >> @@ -187,7 +187,7 @@ unsigned long __thp_vma_allowable_orders(struct vm_area_struct *vma, >> */ >> if (!in_pf && shmem_file(vma->vm_file)) >> return orders & shmem_allowable_huge_orders(file_inode(vma->vm_file), >> - vma, vma_start_pgoff(vma), 0, >> + vma, vm_flags, vma_start_pgoff(vma), 0, >> forced_collapse); >> >> if (!vma_is_anonymous(vma)) { >> diff --git a/mm/shmem.c b/mm/shmem.c >> index 599665a3d6e7..6f1ad5456aca 100644 >> --- a/mm/shmem.c >> +++ b/mm/shmem.c >> @@ -1834,12 +1834,11 @@ bool shmem_hpage_pmd_enabled(void) >> } >> >> unsigned long shmem_allowable_huge_orders(struct inode *inode, >> - struct vm_area_struct *vma, pgoff_t index, >> - loff_t write_end, bool shmem_huge_force) >> + struct vm_area_struct *vma, vm_flags_t vm_flags, >> + pgoff_t index, loff_t write_end, bool shmem_huge_force) >> { >> unsigned long mask = READ_ONCE(huge_shmem_orders_always); >> unsigned long within_size_orders = READ_ONCE(huge_shmem_orders_within_size); >> - vm_flags_t vm_flags = vma ? vma->vm_flags : 0; >> unsigned int global_orders; >> >> if (thp_disabled_by_hw() || (vma && vma_thp_disabled(vma, vm_flags, shmem_huge_force))) >> @@ -2430,6 +2429,7 @@ static int shmem_get_folio_gfp(struct inode *inode, pgoff_t index, >> gfp_t gfp, struct vm_fault *vmf, vm_fault_t *fault_type) >> { >> struct vm_area_struct *vma = vmf ? vmf->vma : NULL; >> + vm_flags_t vm_flags = vma ? vma->vm_flags : 0; >> struct mm_struct *fault_mm; >> struct folio *folio; >> int error; >> @@ -2507,7 +2507,8 @@ static int shmem_get_folio_gfp(struct inode *inode, pgoff_t index, >> } >> >> /* Find hugepage orders that are allowed for anonymous shmem and tmpfs. */ >> - orders = shmem_allowable_huge_orders(inode, vma, index, write_end, false); >> + orders = shmem_allowable_huge_orders(inode, vma, vm_flags, index, >> + write_end, false); >> if (orders > 0) { >> gfp_t huge_gfp; >> >> -- >> 2.47.3 >> > > -- > Cheers, Lorenzo