Go to file
Jinjiang Tu c1dc0524ab mm/hugetlb: fix folio is still mapped when deleted
commit 7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 upstream.

Migration may be raced with fallocating hole.  remove_inode_single_folio
will unmap the folio if the folio is still mapped.  However, it's called
without folio lock.  If the folio is migrated and the mapped pte has been
converted to migration entry, folio_mapped() returns false, and won't
unmap it.  Due to extra refcount held by remove_inode_single_folio,
migration fails, restores migration entry to normal pte, and the folio is
mapped again.  As a result, we triggered BUG in filemap_unaccount_folio.

The log is as follows:
 BUG: Bad page cache in process hugetlb  pfn:156c00
 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00
 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0
 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"
 flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)
 page_type: f4(hugetlb)
 page dumped because: still mapped when deleted
 CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE
 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
 Call Trace:
  <TASK>
  dump_stack_lvl+0x4f/0x70
  filemap_unaccount_folio+0xc4/0x1c0
  __filemap_remove_folio+0x38/0x1c0
  filemap_remove_folio+0x41/0xd0
  remove_inode_hugepages+0x142/0x250
  hugetlbfs_fallocate+0x471/0x5a0
  vfs_fallocate+0x149/0x380

Hold folio lock before checking if the folio is mapped to avold race with
migration.

Link: https://lkml.kernel.org/r/20250912074139.3575005-1-tujinjiang@huawei.com
Fixes: 4aae8d1c05 ("mm/hugetlbfs: unmap pages if page fault raced with hole punch")
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-02 13:40:41 +02:00
arch arm64: dts: imx8mp: Correct thermal sensor index 2025-10-02 13:40:37 +02:00
block block: reject invalid operation in submit_bio_noacct 2025-08-28 16:26:10 +02:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2025-04-25 10:44:04 +02:00
crypto crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg 2025-09-25 10:58:55 +02:00
Documentation docs: networking: can: change bcm_msg_head frames member to support flexible array 2025-09-19 16:29:58 +02:00
drivers i40e: improve VF MAC filters accounting 2025-10-02 13:40:40 +02:00
fs mm/hugetlb: fix folio is still mapped when deleted 2025-10-02 13:40:41 +02:00
include crypto: af_alg - Fix incorrect boolean values in af_alg_ctx 2025-10-02 13:40:40 +02:00
init sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP 2025-05-02 07:47:04 +02:00
io_uring io_uring: include dying ring in task_work "should cancel" state 2025-09-25 10:58:53 +02:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:07:30 +01:00
kernel tracing: dynevent: Add a missing lockdown check on dynevent 2025-10-02 13:40:40 +02:00
lib maple_tree: fix mt_destroy_walk() on root leaf node 2025-07-17 18:32:09 +02:00
LICENSES
mm mm: folio_may_be_lru_cached() unless folio_test_large() 2025-10-02 13:40:37 +02:00
net nexthop: Forbid FDB status change while nexthop is in a group 2025-10-02 13:40:39 +02:00
rust rust: module: place cleanup_module() in .exit.text section 2025-07-06 10:57:54 +02:00
samples ftrace/samples: Fix function size computation 2025-09-19 16:29:56 +02:00
scripts kconfig: lxdialog: fix 'space' to (de)select options 2025-08-28 16:26:02 +02:00
security apparmor: use the condition in AA_BUG_FMT even with debug disabled 2025-08-28 16:26:01 +02:00
sound ALSA: usb-audio: Add mute TLV for playback volumes on more devices 2025-10-02 13:40:36 +02:00
tools selftests: fib_nexthops: Fix creation of non-FDB nexthops 2025-10-02 13:40:39 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:07:25 +01:00
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-06-27 13:46:21 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:21:15 +02:00
.mailmap
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS sign-file,extract-cert: move common SSL helper functions to a header 2025-04-25 10:44:04 +02:00
Makefile Linux 6.1.154 2025-09-25 10:58:55 +02:00
README

Linux kernel

There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first.

In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentation can also be read online at:

https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory, several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the requirements for building and running the kernel, and information about the problems which may result by upgrading your kernel.