Re: [PATCH v3 30/47] mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs

[Lance Yang]

On Sat, Oct 31, 2026 at 10:39:59AM +0100, David Hildenbrand (Arm) wrote:
>move_huge_pud() reads the old PUD and clears it in separate operations.
>Hardware accessed or dirty updates between those operations can be lost
>when the saved entry is installed at the new address.

Yep. HW can still update the A/D bits while the PUD lock is held :)

>The raw pud_clear() also bypasses page_table_check_pud_clear(), while
>set_pud_at() accounts for the destination mapping. This leaves the
>checker counts unbalanced for mappings tracked by page table checking.
>
>To fix it, simply use pudp_huge_get_and_clear().
>
>Fixes: 7d846db7d0e2 ("mm/mremap: convert huge PUD move to separate helper")
>Cc: stable@xxxxxxxxxxxxxxx
>Reviewed-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
>Reviewed-by: Pedro Falcato <pfalcato@xxxxxxx>
>Reviewed-by: Dev Jain <dev.jain@xxxxxxx>
>Tested-by: Muhammad Usama Anjum <usama.anjum@xxxxxxx>
>Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>---
> mm/mremap.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
>diff --git a/mm/mremap.c b/mm/mremap.c
>index 0d06d7f37f19a..16e736c72d9cb 100644
>--- a/mm/mremap.c
>+++ b/mm/mremap.c
>@@ -509,8 +509,7 @@ static bool move_huge_pud(struct pagetable_move_control *pmc,
> 		spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
> 
> 	/* Clear the pud */
>-	pud = *old_pud;
>-	pud_clear(old_pud);
>+	pud = pudp_huge_get_and_clear(mm, pmc->old_addr, old_pud);

Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>

> 
> 	VM_BUG_ON(!pud_none(*new_pud));
> 
>
>-- 
>2.43.0
>
>