Re: [PATCH v2 2/2] mm: don't allocate a page table under RCU in do_set_pmd()

[Usama Arif]

On Fri, 06 Nov 2026 13:36:13 +0100 "David Hildenbrand (Arm)" <david@xxxxxxxxxx> wrote:

> do_fault_around() skips PTE table preallocation when the PMD already points
> to a PTE table. A concurrent collapse can then retract that table and
> clear the PMD before filemap_map_pages() locks the new PMD-sized folio.
> 
> filemap_map_pmd() can then call do_set_pmd() with an empty PMD and no
> preallocated table. On PowerPC hash MMU, do_set_pmd() then tries
> allocating a PTE table to deposit. But filemap_map_pmd() calls
> do_set_pmd() under RCU, so allocating from that context is not good.
> 
> This race became possible when retract_page_tables() stopped taking the
> mmap and VMA locks. Previously, those locks excluded retraction while
> the fault was in progress.
> 
> Add a may_alloc argument to do_set_pmd() and pass false from
> filemap_map_pmd(), so we can fail with VM_FAULT_FALLBACK instead of
> trying to allocate.
> 
> This issue should be fairly hard to hit in practice.
>

Yes, I imagine it was very difficult to reproduce, doing a sleeping
pte_alloc_one() inside filemap_map_pmd()'s RCU read-side section
when a concurrent retract_page_tables() empties the PMD. Only
possible on PowerPC.

> Fixes: 1d65b771bc08 ("mm/khugepaged: retract_page_tables() without mmap or vma lock")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> ---

Acked-by: Usama Arif <usama.arif@xxxxxxxxx>

>  include/linux/mm.h |  3 ++-
>  mm/filemap.c       |  2 +-
>  mm/khugepaged.c    |  2 +-
>  mm/memory.c        | 10 +++++++---
>  4 files changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index a2dd76cc5bbfe..bd144fec5f5da 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -2156,7 +2156,8 @@ static inline pte_t maybe_mkwrite(pte_t pte, struct vm_area_struct *vma)
>  	return pte;
>  }
>  
> -vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page);
> +vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
> +		bool may_alloc);
>  void set_pte_range(struct vm_fault *vmf, struct folio *folio,
>  		struct page *page, unsigned int nr, unsigned long addr);
>  
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 86297841f9955..9871b4f32a916 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -3745,7 +3745,7 @@ static bool filemap_map_pmd(struct vm_fault *vmf, struct folio *folio,
>  
>  	if (pmd_none(*vmf->pmd) && folio_test_pmd_mappable(folio)) {
>  		struct page *page = folio_file_page(folio, start);
> -		vm_fault_t ret = do_set_pmd(vmf, folio, page);
> +		vm_fault_t ret = do_set_pmd(vmf, folio, page, /* may_alloc= */ false);
>  		if (!ret) {
>  			/* The page is mapped successfully, reference consumed. */
>  			folio_unlock(folio);
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 8d9f05a39afb3..5836e08abc984 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -1826,7 +1826,7 @@ static enum scan_result set_huge_pmd(struct vm_area_struct *vma, unsigned long a
>  	}
>  
>  	vmf.pmd = pmdp;
> -	if (do_set_pmd(&vmf, folio, page))
> +	if (do_set_pmd(&vmf, folio, page, /* may_alloc= */ true))
>  		return SCAN_FAIL;
>  
>  	folio_get(folio);
> diff --git a/mm/memory.c b/mm/memory.c
> index 421064aef3cf0..6eeed43b05a19 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -5682,7 +5682,8 @@ static void deposit_prealloc_pte(struct vm_fault *vmf)
>  	vmf->prealloc_pte = NULL;
>  }
>  
> -vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page)
> +vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
> +		bool may_alloc)
>  {
>  	struct vm_area_struct *vma = vmf->vma;
>  	bool write = vmf->flags & FAULT_FLAG_WRITE;
> @@ -5723,6 +5724,8 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  	 * related to pte entry. Use the preallocated table for that.
>  	 */
>  	if (arch_needs_pgtable_deposit() && !vmf->prealloc_pte) {
> +		if (!may_alloc)
> +			return VM_FAULT_FALLBACK;
>  		vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
>  		if (!vmf->prealloc_pte)
>  			return VM_FAULT_OOM;
> @@ -5764,7 +5767,8 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  	return ret;
>  }
>  #else
> -vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page)
> +vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *page,
> +		bool may_alloc)
>  {
>  	return VM_FAULT_FALLBACK;
>  }
> @@ -5888,7 +5892,7 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
>  
>  	if (pmd_none(*vmf->pmd)) {
>  		if (!needs_fallback && folio_test_pmd_mappable(folio)) {
> -			ret = do_set_pmd(vmf, folio, page);
> +			ret = do_set_pmd(vmf, folio, page, /* may_alloc= */ true);
>  			if (ret != VM_FAULT_FALLBACK)
>  				return ret;
>  		}
> 
> -- 
> 2.43.0
> 
>