[PATCH 19/46] mm/gup: recheck the PUD under PTL in follow_pud_mask()

[sashiko-bot at kernel.org]

> follow_pud_mask() reads the PUD without a lock. If it is a leaf, it takes
> the lock and calls follow_huge_pud(), which reads the entry again, but
> only tests whether it is present.
> 
> A leaf can be zapped concurrently and a page fault can fill the empty
> entry with a page table.
> 
> This currently only applies when device-dax makes use of PUD entries,
> and the fault after e.g., MADV_DONTNEED would find THPs to be disabled.
> 
> That requires a sequence like
> 
> 1) Fault in the PUD
> 2) Disable THP
> 3) Have GUP race against concurrent MADV_DONTNEED + refault
> [ ... ]
> 
> Fixes: 1b1676180246 ("mm/gup: handle huge pud for follow_pud_mask()")
> Cc: stable at vger.kernel.org
> Reported-by: Josef Bacik <josef at toxicpanda.com>
> Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-fixes_core-v1-0-6f74bec9a5bb@kernel.org?part=19