Re: [GIT PULL] x86/urgent for 7.4-rc4

[Linus Torvalds]

On Mon, 14 Sept 2026 at 03:12, Orson Peters <orsonpeters@xxxxxxxxx> wrote:
>
> My minimal reproducer did explicitly call mprotect() to make the
> reproduction deterministic. But on a multi-NUMA-node machine
> pmd_modify can get called entirely transparently in the background
> with memory pressure.

I guess any of the paths that end up calling pmd_modify() will trigger
it, and mprotect() is just the most explicit one.

At the other end of this argument, I tried to find something else that
does what MADV_FREE does. I think the trigger is simply that "clear
dirty bit, but leave it writable".

And a shared mapping writeout will do exactly that - but I don't think
anybody does writeback at the hugepage level.

So it may be that MADV_FREE is indeed the only case that actually can
trigger the bug that otherwise looks pretty much like a generic thp
issue.

                 Linus