Re: [GIT PULL] x86/urgent for 7.4-rc4

[Orson Peters]

> Yeah, so it looks to me like the *fix* is correct, and it's just that
> blaming MADV_FREE is the wrong thing.

One thing I'd like to point out is that from userspace THP + MADV_FREE
is all you need to hit the bug, if you are on a multi-NUMA-node
machine.

My minimal reproducer did explicitly call mprotect() to make the
reproduction deterministic. But on a multi-NUMA-node machine
pmd_modify can get called entirely transparently in the background
with memory pressure.

So from the perspective of the user it really is just MADV_FREE
misbehaving (write-after-free getting lost) when THP is being used.
I'm not sure if that should actually be reflected in the commit
message, but wanted to point it out anyway.