[PATCH V2 0/3] mm/hugetlb: fix mremap bugs

[Li Zhe]

This series fixes a few hugetlb mremap bugs.

Patch 1 fixes the return type of move_hugetlb_page_tables(), so large
hugetlb moves cannot be truncated when reported back to the generic
mremap code.

Patch 2 disables hugetlb PMD sharing for UFFD missing mode, because
UFFDIO_POISON can install PTE markers that must not become shared PMD
page-table state.

Patch 3 fixes the recursive i_mmap_rwsem deadlock in the hugetlb mremap
path by avoiding the destination PMD sharing allocation path while the
mapping lock is already held for write.

David Hildenbrand (Arm) (1):
  mm/hugetlb: disable PMD sharing for UFFD missing mode

Li Zhe (2):
  mm/hugetlb: fix mremap move length truncation
  mm/hugetlb: fix mremap deadlock when PMD sharing is possible

 include/linux/hugetlb.h       | 18 +++++------
 include/linux/userfaultfd_k.h | 13 +++++---
 mm/hugetlb.c                  | 56 ++++++++++++++++++++++++++---------
 3 files changed, 60 insertions(+), 27 deletions(-)

---
v1: https://lore.kernel.org/all/20260930064308.58159-1-lizhe.67@xxxxxxxxxxxxx/

ChangeLogs:

v1->v2:
- Add a fix for the newly discovered move_hugetlb_page_tables()
  return type issue.
- Disable hugetlb PMD sharing for UFFD missing mode.
- Rework the mremap deadlock fix to zap the source range and let the
  destination fault path populate or share the PMD lazily, as suggested
  by David.
    	
-- 
2.20.1