[PATCH] mm/khugepaged: free unused page table when setting a huge PMD fails

[David Hildenbrand (Arm)]

do_set_pmd() can allocate vmf.prealloc_pte on architectures that need a
deposited page table, such as PowerPC with the hash MMU. If the PMD is
no longer empty when it takes the PMD lock, it returns VM_FAULT_FALLBACK
without consuming that table.

Since collapse_pte_mapped_thp() uses mmap_read_lock(), a concurrent
userfaultfd operation can install a PTE table before taking the folio
lock. If that races with set_huge_pmd(), the unused preallocated table
is lost when its local vm_fault goes out of scope.

Free vmf.prealloc_pte on failure, as do_fault() already does. Successful
PMD installation consumes the table and clears the pointer.

Having to do this cleanup outside of do_set_pmd() is rather nasty, but
other callers depend on it already having been allocated. This needs a
cleanup at some point.

Fixes: 1043173eb5eb ("mm/khugepaged: collapse_pte_mapped_thp() with mmap_read_lock()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
---
This isn't super urgent, so it can wait for 7.5.
---
 mm/khugepaged.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 8d9f05a39afb3..213c005fa8575 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1826,8 +1826,11 @@ static enum scan_result set_huge_pmd(struct vm_area_struct *vma, unsigned long a
 	}
 
 	vmf.pmd = pmdp;
-	if (do_set_pmd(&vmf, folio, page))
+	if (do_set_pmd(&vmf, folio, page)) {
+		if (vmf.prealloc_pte)
+			pte_free(mm, vmf.prealloc_pte);
 		return SCAN_FAIL;
+	}
 
 	folio_get(folio);
 	return SCAN_SUCCEED;

---

base-commit: 02f72aa35c5e7dff443c62cd9964686396c8b201

change-id: 20261105-khugepaged_set_pmd-60a02f718e64

--

Cheers,

David