Re: [PATCH 1/2] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area()

[Thomas Bogendoerfer]

On Tue, Sep 15, 2026 at 07:13:24AM +0000, Orgad Shaneh wrote:
> Since hugetlb mappings were made to go through the architecture's
> arch_get_unmapped_area{,_topdown}(), every architecture that implements
> those has to align hugetlb files itself. The generic implementation and
> loongarch do it with huge_page_mask_align(); MIPS was left out.
> 
> A non-MAP_FIXED mmap() of a hugetlbfs file therefore returns an address
> that is only SHMLBA aligned, and the kernel then installs 2 MB PMDs for
> a VMA that starts in the middle of a PMD. The consequences on an
> Octeon (CN63XX) board running a process that links libhugetlbfs with
> HUGETLB_ELFMAP=R and HUGETLB_MORECORE=yes, all within a minute of
> start: the neighbouring 4 KB page table is clobbered, the TLB ends up
> with overlapping entries ("Caught Machine Check exception - caused by
> multiple matching entries in the TLB"), process exit trips
> BUG_ON(start & ~huge_page_mask(h)) in __unmap_hugepage_range(), and
> freed pages leak into unrelated kernel structures (oopses in the irq
> maple tree, in pte_offset_map, ...).
> 
> Do what loongarch does in commit 3109d5ff484b ("LoongArch: Set hugetlb
> mmap base address aligned with pmd size"): when the file is a hugetlb
> file, use its page mask as the search alignment instead of the cache
> colour mask.
> 
> Fixes: 7bd3f1e1a9ae ("mm: make hugetlb mappings go through mm_get_unmapped_area_vmflags")
> Cc: stable@xxxxxxxxxxxxxxx # 6.13+
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Orgad Shaneh <orgads@xxxxxxxxx>
> ---
> diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
> --- a/arch/mips/mm/mmap.c
> +++ b/arch/mips/mm/mmap.c
> @@ -9,6 +9,7 @@
>  #include <linux/compiler.h>
>  #include <linux/elf-randomize.h>
>  #include <linux/errno.h>
> +#include <linux/hugetlb.h>
>  #include <linux/mm.h>
>  #include <linux/mman.h>
>  #include <linux/export.h>
> @@ -72,8 +73,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
>  	}
>  
>  	info.length = len;
> -	info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
>  	info.align_offset = pgoff << PAGE_SHIFT;
> +	if (filp && is_file_hugepages(filp))
> +		info.align_mask = huge_page_mask_align(filp);
> +	else
> +		info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
>  
>  	if (dir == DOWN) {
>  		info.flags = VM_UNMAPPED_AREA_TOPDOWN;
> -- 
> 2.47.0

applied to mips-next

Thomas.

-- 
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea.                                                [ RFC1925, 2.3 ]