From: "Zi Yan" <ziy@nvidia.com>
To: "David Hildenbrand" <david@kernel.org>,
"Baolin Wang" <baolin.wang@linux.alibaba.com>,
"Liam R. Howlett" <liam@infradead.org>,
"Nico Pache" <nico.pache@linux.dev>,
"Ryan Roberts" <ryan.roberts@arm.com>,
"Dev Jain" <dev.jain@arm.com>, "Barry Song" <baohua@kernel.org>,
"Lance Yang" <lance.yang@linux.dev>,
"Usama Arif" <usama.arif@linux.dev>,
"Kiryl Shutsemau" <kas@kernel.org>,
"Lorenzo Stoakes" <ljs@kernel.org>,
"Rik van Riel" <riel@surriel.com>,
"Vlastimil Babka" <vbabka@kernel.org>,
"Harry Yoo" <harry@kernel.org>, "Jann Horn" <jannh@google.com>,
"Kyle Zeng" <kylebot@openai.com>,
"Andrew Morton" <akpm@linux-foundation.org>
Cc: <linux-mm@kvack.org>, <linux-kernel@vger.kernel.org>,
"Zi Yan" <ziy@nvidia.com>
Subject: Re: [PATCH for 7.4-rc2+ 7/7] mm/rmap: re-enable discarding lazyfree THPs at PMD level
Date: Thu, 15 Oct 2026 22:47:09 -0400 [thread overview]
Message-ID: <DM5X3STSH0MA.334PCP2CJFVG3@nvidia.com> (raw)
In-Reply-To: <20261015-anon_vma_uaf_fix-v1-7-7b977303b42b@nvidia.com>
On Thu Oct 15, 2026 at 2:13 PM EDT, Zi Yan wrote:
> The patch "mm/rmap: don't discard lazyfree THPs at PMD level" disabled
> the PMD-level discard, because it cleared the PMD before checking whether
> the folio could be discarded, and munmap() or mremap() could skip that
> transiently none PMD.
>
> __discard_anon_folio_pmd_locked() now keeps the PMD invalidated, not
> cleared, until the discard is committed, GUP-fast no longer follows an
> invalidated PMD on any architecture, powerpc page table check no longer
> counts an invalidated PMD as mapped, and sparc64 keeps thp_pte_count
> balanced when an invalidated PMD is set again or cleared. Discard lazyfree
> THPs at PMD level again.
>
> Assisted-by: LLM
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> To: Andrew Morton <akpm@linux-foundation.org>
> To: David Hildenbrand <david@kernel.org>
> To: Lorenzo Stoakes <ljs@kernel.org>
> Cc: Rik van Riel <riel@surriel.com>
> Cc: "Liam R. Howlett" <liam@infradead.org>
> Cc: Vlastimil Babka <vbabka@kernel.org>
> Cc: Harry Yoo <harry@kernel.org>
> Cc: Jann Horn <jannh@google.com>
> Cc: Lance Yang <lance.yang@linux.dev>
> Cc: Kyle Zeng <kylebot@openai.com>
> Cc: linux-mm@kvack.org
> Cc: linux-kernel@vger.kernel.org
> ---
> mm/rmap.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 1131b76bbbc28..805db93fe0428 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -2275,6 +2275,17 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
> }
>
> if (!pvmw.pte) {
> + if (folio_test_lazyfree(folio)) {
> + if (unmap_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, folio))
Sashiko mentioned that unmap_huge_pmd_locked() does add_mm_counter()
without calling update_hiwater_rss() first so that peak RSS can be
under-reported.
Answer:
yes, I fixed it locally by calling update_hiwater_rss() before
unmap_huge_pmd_locked().
> + goto walk_done;
> + /*
> + * unmap_huge_pmd_locked has either already marked
> + * the folio as swap-backed or decided to retain it
> + * due to GUP or speculative references.
> + */
> + goto walk_abort;
> + }
> +
> if (flags & TTU_SPLIT_HUGE_PMD) {
> /*
> * We temporarily have to drop the PTL and
--
Best Regards,
Yan, Zi
prev parent reply other threads:[~2026-10-16 2:47 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 18:13 [PATCH for 7.4-rc2+ 0/7] Re-enable " Zi Yan
2026-10-15 18:13 ` [PATCH for 7.4-rc2+ 1/7] powerpc/book3s64/mm: don't count invalidated PMDs in page table check Zi Yan
2026-10-15 18:13 ` [PATCH for 7.4-rc2+ 2/7] riscv: mm: don't let GUP-fast follow invalidated THP PMDs Zi Yan
2026-10-16 2:41 ` Zi Yan
2026-10-15 18:13 ` [PATCH for 7.4-rc2+ 3/7] LoongArch: " Zi Yan
2026-10-15 18:13 ` [PATCH for 7.4-rc2+ 4/7] s390/mm: always clear _SEGMENT_ENTRY_READ in pmdp_invalidate() Zi Yan
2026-10-15 18:13 ` [PATCH for 7.4-rc2+ 5/7] sparc64: mm: fix thp_pte_count accounting around pmdp_invalidate() Zi Yan
2026-10-15 18:13 ` [PATCH for 7.4-rc2+ 6/7] mm/huge_memory: avoid transient none PMDs during lazyfree reclaim Zi Yan
2026-10-15 18:13 ` [PATCH for 7.4-rc2+ 7/7] mm/rmap: re-enable discarding lazyfree THPs at PMD level Zi Yan
2026-10-16 2:47 ` Zi Yan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM5X3STSH0MA.334PCP2CJFVG3@nvidia.com \
--to=ziy@nvidia.com \
--cc=akpm@linux-foundation.org \
--cc=baohua@kernel.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=david@kernel.org \
--cc=dev.jain@arm.com \
--cc=harry@kernel.org \
--cc=jannh@google.com \
--cc=kas@kernel.org \
--cc=kylebot@openai.com \
--cc=lance.yang@linux.dev \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=nico.pache@linux.dev \
--cc=riel@surriel.com \
--cc=ryan.roberts@arm.com \
--cc=usama.arif@linux.dev \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®