Re: [PATCH] mm/pagewalk: fix race between concurrent split and refault

[Boone, Max]

> On Mar 18, 2026, at 1:55 PM, Lorenzo Stoakes (Oracle) <ljs@xxxxxxxxxx> wrote:
> 
>> […]
> 
> So IOW, the PUD entry is split, then refaulted back to a PUD leaf entry
> again?

As far as I understand indeed, although the usage and faulting of huge
pfnmaps does not feel intuitive to me yet. Empirically, yes, observing this
when follow_fault_pfn() in drivers/vfio/vfio_iommu_type1.c is running 
concurrently with walk_pud_range(). I have another patch sent up to
that list because this fix causes follow_fault_pfn() to return -EINVAL [1].

>> […] 
> 
> I think it mirrors the retry logic in walk_pte_range() more closely right?
> Because there it's:
> 
> if (!pte)
> walk->action = ACTION_AGAIN;
> return err;
> 
> I.e. let the parent handle the PTE not being got by pte_offset_map_lock(),
> and you draw a comparison to this in the comment in walk_pmd_range().

I’d personally say that the main logic introduced is walk_pud_range() retrying when
walk_pmd_range() fails. We’re also splitting the PUD in walk_pud_range() and 
descending. But yeah, retry logic mirrors walk_pmd_range(), deciding that we need
to retry mirrors walk_pte_range().

> 
>> 
>> Fixes: a00cc7d9dd93 ("mm, x86: add support for PUD-sized transparent hugepages")
> 
> Yikes, really? :) This is from 2017, I'm a little surprised we didn't hit
> this bug until now.
> 
> Has something changed more recently that made it more likely to hit? Or is
> it one of those 'needed people to have more RAM first' or bigger PCI BAR's?

Yeah, frankly, this is the first patch where I could find the splitting being introduced. It might
be more correct to refer to the introduction of 1G huge_pfnmaps?

> 
>> Cc: stable@xxxxxxxxxxxxxxx
>> Co-developed-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>> Signed-off-by: Max Boone <mboone@xxxxxxxxxx>
> 
> Only nits here, the logic LGTM, so:

I’ll write up a PATCH v2 later today.

> 
> […]

Attachment: smime.p7s
Description: S/MIME cryptographic signature