Re: [PATCH 13/46] mm/huge_memory: fix truncate racing with PMD zapping

[Lance Yang]

On Tue, Oct 27, 2026 at 12:17:33AM +0100, David Hildenbrand (Arm) wrote:
>From: Chris Mason <mason@xxxxxxxxxx>
>
>zap_huge_pmd_folio() removes the rmap before calling folio_mark_dirty().
>If this was the last mapping, truncation can skip unmapping the folio
>and proceed without waiting for the PMD lock, racing with dirtying.
>
>ifs_set_range_dirty() can oops if MADV_DONTNEED races with
>ftruncate() on XFS, when we get the folio set dirty after it was found
>to not be mapped anymore.
>
>Move folio_mark_dirty() and folio_mark_accessed() before rmap removal,
>matching the PTE zap path. This keeps the folio mapped while updating
>its state, so truncation must wait for the page table lock.
>
>Fix generated by an LLM and sent by Chris Mason in private.
>
>Fixes: fe6cf984939d ("mm/huge_memory: transfer the pmd dirty bit to the folio on zap")
>Cc: stable@xxxxxxxxxxxxxxx
>Signed-off-by: Chris Mason <mason@xxxxxxxxxx>
>[ david: simplify comment and description ]
>Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>---

Good catch!

Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>