Re: [BUG] mm/huge_memory: lazyfree THP PMD restore races zap_pmd_range

[Xueyuan Chen]

On Sat, Oct 17, 2026 at 09:15:19AM -0500, 김종혁 wrote:

>Hi,
>
>__discard_anon_folio_pmd_locked() clears the PMD of a lazyfree
>PMD-mapped anon THP with pmdp_huge_clear_flush() and puts it back with
>set_pmd_at() when it turns out the folio cannot be discarded. The only
>lock it shares with a concurrent unmap is the pmd lock. zap_pmd_range()
>tests pmd_none(*pmd) without that lock for every caller except
>unmap_mapping_folio(), so a munmap() or an exiting mm that lands in the
>window skips the whole 2 MB range. The restore then reinstalls the PMD
>into a VMA that is about to go away. Nothing updates the folio's rmap
>or the mm counters, so the folio stays mapped forever, and
>folio->mapping keeps pointing at an anon_vma that unlink_anon_vmas()
>frees a moment later. Reclaim dereferences that pointer on every
>later pass over the folio, for the rest of the boot.
>
>I hit this as an ordinary user (uid 1000, no capabilities, no
>namespaces) on a stock v6.12.112 build. The code is the same in 7.2 and
>in mainline. If this is already known, sorry for the noise.
>

Hi,

This bug should be fixed by:

https://lore.kernel.org/linux-mm/20261012-lazyfree-stable-fix-v2-1-6387d6e30063@xxxxxxxxxx/

It is already in mm-unstable. Your reproducer would be a good test for it.

Thanks,
Xueyuan