From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oa1-f52.google.com (mail-oa1-f52.google.com [209.85.160.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 157692FDC20 for ; Fri, 16 Oct 2026 02:56:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792119405; cv=none; b=M6qOn0F205Ic05s+cXsumm0Jtwhkdi7lVy5rmVI3pPwNlX4oKb7ne0aDbcsMOp2TrcFO6OMWUX+6jMIHF9l2HiD1LWcay7U3f4sz4d7kD2El0ll818GaISYjXzHJzU1QVzVqFX4L8QlZ1nmzFGO9dQfM1Jtz69m50o+0wU4gRBg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792119405; c=relaxed/simple; bh=mtxB1OwQH2CyH4ORbA6Epab3sPneNPWVVjItMLtc0ps=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=BX+MRtjXAZfWST54pT2Uc1pgoKejAzw21ftFMrnGOy9mFDygKsxis5uR2FSXAEmgyOc/f0DTJV29o6C+oNmc+9POk3rUcoVLFHx3IfCKv14asb+1n7XW8ZWP7NsoPhAUmAdurSODv8Ex/nw2fBFi6n3592fP7/f7+fJW0M0F2+8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com; spf=pass smtp.mailfrom=openai.com; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b=LU4rTv8f; arc=none smtp.client-ip=209.85.160.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openai.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b="LU4rTv8f" Received: by mail-oa1-f52.google.com with SMTP id 586e51a60fabf-49e1251674cso880327fac.2 for ; Thu, 15 Oct 2026 19:56:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openai.com; s=google; t=1792119403; x=1792724203; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=KoU7NlRc2WHo1VRPn8/Lg64nT3xPfPjPfg5kvwFTx1I=; b=LU4rTv8fYJHDgSUUXQfyb9ZSq742mZu40njPSSAk5QJ2dhCOVui20sLPixqnc8IKUu 4MxYX4UIILmKWvpk9pJjEdEyiX5it9nFlhMmYBzGmzzquj7Cxd45y0yec0jGgjwycsbU ukVksPfsUx710HybB2vjUp2VIcXMlt2FJkNF8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792119403; x=1792724203; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KoU7NlRc2WHo1VRPn8/Lg64nT3xPfPjPfg5kvwFTx1I=; b=tyjAbE/qRR8x0qqztEsjZCpLV3zEC6Dp6LP5y2m6PhBvLWq05V/5oQumFGr5vOxwER rKTgTG8OkCytFyC/htGiJnP5vDQVivheURn58eZpIQ0CBrgsc2sJfg5VwtDIozwJVVUl dwhYLzbCOqT3VEfbRXFjTpndn+x1VbCx5b7LUwQToxVyXUPt+zaeAnTQ2TsZASY8J4x6 szm4/uLfxHBkLRW7gMlayBY1n1aIX26eyG7mb9z+NvpKgyTGSs/QfDL0HajrgjMTIOFa xqwrfvfJ1byWnFkREl6O8N+WWRqBh/WOFiVO6zeDeZ/NYJcjhVX0DhOsbjnK5ph627AI IW4g== X-Forwarded-Encrypted: i=1; AKwUvByA6V2/WOaJK/ATx6TmGOo8CL41k3CQw64SJt66ug+Vdz9Hpy1ysNX2f0DED1CksRc0+znTQUhn9iWDV1o=@vger.kernel.org X-Gm-Message-State: AFq9FYJbZrBVa0hHIL0Yfapn65xCu9K3rNzsrUbjKmMELEvXxOG+vGo5 FEPtgYSOBP2Hy5kqa3oBlCZXPX1f9OcP11JkAQ5MaLnRAvH/me9qJJTUqlv9bRs4lMo= X-Gm-Gg: AYBFou3Kh7YHBlEa+yhNaC5Eosv0Z1vgdggxLUIJiniEzkn+ku1rVR/imsW4/Ai9LoP xWWNYcSM1BbTX5rvn0wHnF0k8q5gud4F6L/h49N9iGpBJyZfBx1JR/2HfjNhdzmTRznoVW92NFJ EqRQM1GXRjlYYfkhD0H0FOytG6JdyRYtKT6IyN7cNDYXr5UejdhcED75azN2DzzY4OUs6V5aknS oo92yQ4DhigqMzMjxCWYtx+PrDGVmio3c0gX7mbErtYZLfCTSmJ8NvJyjNeCnfprdGoNWrk1ev4 kqhiYtt5IiB4Q8/9fb3wieRXIMzOEaktS+lHjOgMXCSBvGmQgtyCYm8b3RE3vEtWAshmBUXvNAJ 1MSKCXbJIXdMTPYUM5+X6OO1pLBQDmSlmBSYOXdmGRCR50PkzDFaWl4SVPekAwkJCEyN4q7BziE i7scdrVC0fFvCF/4gLUxYihe+Ooob7XCgCw1Ec3g2EiZuOpqfHqupllxKFaiy1whKS7GaWD4Gjt b4x3Y0+y04FcDVOVP56Lsfz4uUvgssRQjQ9fBY2jTTebodHjC2v+P3mcrTHh27tRQGJeWQxi7WS ipktJQVOSBtLWARIY4L8yIsTS/I56YClQd07cl7HLK7iiSqlx/VUe81J X-Received: by 2002:a05:6808:4f24:b0:4bc:be93:3506 with SMTP id 5614622812f47-50c415e0b76mr18984605b6e.3.1792119402912; Thu, 15 Oct 2026 19:56:42 -0700 (PDT) Received: from com-75606 ([199.47.143.7]) by smtp.gmail.com with ESMTPSA id 5614622812f47-5388c16d862sm537575b6e.9.2026.10.15.19.56.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Oct 2026 19:56:42 -0700 (PDT) Date: Thu, 15 Oct 2026 19:56:38 -0700 From: Kyle Zeng To: Andrew Morton Cc: linux-mm@kvack.org, David Hildenbrand , Lorenzo Stoakes , Rik van Riel , "Liam R. Howlett" , Vlastimil Babka , Harry Yoo , Jann Horn , Lance Yang , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] mm/page_vma_mapped: continue past nonmatching huge PMDs Message-ID: References: <20261016011549.61146-1-kylebot@openai.com> <20261015192020.5336a49bc516219e8254dfdf@linux-foundation.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20261015192020.5336a49bc516219e8254dfdf@linux-foundation.org> On Thu, Oct 15, 2026 at 07:20:20PM -0700, Andrew Morton wrote: > On Thu, 15 Oct 2026 18:15:49 -0700 Kyle Zeng wrote: > > > A PTE-mapped large folio can straddle PMD boundaries after an unaligned > > mremap(). If the first part is discarded and replaced with an unrelated > > huge PMD, page_vma_mapped_walk() stops instead of looking for the rest > > of the folio in subsequent PMDs. > > > > This also affects migration entries. A walk that stops at an unrelated > > huge PMD can leave migration PTEs behind when migration or an anonymous > > folio split restores the mappings. Those entries do not hold mapping > > references and can outlive the source folio. > > > > Skip the current PMD rather than ending the walk on a flag or PFN > > mismatch. Do the same if the PMD became nonpresent before the locked > > recheck. Release the PMD lock, clear the per-PMD state and advance with > > step_forward(), so the existing range limit controls termination. > > This covers present, migration and device-private huge PMDs while > > preserving the matching-PMD and split-to-PTE paths. > > As always, when fixing a bug please describe the worst-case > userspace-visible effects of the bug. > > I asked $LLM and was told > > : The worst credible effects are permanent application hangs, kernel > : crashes, and potentially system-wide denial of service. Stale > : migration entries can refer to freed and reused physical pages, causing > : page faults to access unrelated folio metadata. Memory corruption is > : possible but unproven; cross-process information disclosure has not > : been established. > > But you have an LLM too! So please never again send a bugfix without > this info. > > Also please explain whether there's a reproducer and if so, at least > describe it and confirm the before-and-after results. > > Thanks. > Hi Andrew, This issue can lead to memory corruption and I have a reproducer for it. I can update the description and send in a v2 if you think it is proper. Best, Kyle