Re: [PATCH v2] mm/filemap: stop fault-around when the walk steps back

[Pedro Falcato]

On Wed, Nov 04, 2026 at 11:12:41PM +0000, Jose Fernandez (Anthropic) wrote:
> On Tue, Nov 03, 2026 at 12:12:58PM +0000, Pedro Falcato wrote:
> > I'm not sure I understand. xas_find() was fixed. Is there any other case where
> > this loop can step backwards?
> >
> > If not, I don't think this should be Cc: stable, and should probably be a WARN_ON().
> > As it's a hardening patch and not an actual bugfix.
> 
> Yes, there is at least one more case. It triggers when a read fault
> starts a lookup inside a large folio while a hole punch removes that
> folio and a write puts part of it back. A stress test I wrote for the

Thank you. So, if I'm not mistaken, this is the race:
First, you map/see this:
	[folio pgoff 4, length 4]
Then, at some point in time, someone punches the hole:
	[no folios here]
Then, at some point in time, someone faults another folio in the range:
	[folio pgoff 0, length 8]
so you step backwards. Is this correct? Or am I misunderstanding this?

If so, how can this happen while we hold the PTE lock? That itself should
block truncation.

Can you share the reproducer?

-- 
Pedro