Re: [PATCH 1/1] mm/huge_memory: fix pgtable withdrawal for huge zero PMDs

[David Hildenbrand (Arm)]

On 9/14/26 12:59, Kiryl Shutsemau wrote:
> On Sun, Sep 13, 2026 at 03:23:12PM +0800, Lance Yang wrote:
>>
>> On Sat, Sep 12, 2026 at 11:46:35PM -0700, Andrew Morton wrote:
>>>
>>>
>>> That's the sort of thing we'd prefer to avoid.
>>>
>>>
>>> How real is this?  Is there a reported-by:?  Do you have a reproducer? 
>>
>> Yes, I reproduced it on x86 with a small test module. It sets
>> VM_MIXEDMAP | VM_HUGEPAGE and calls vmf_insert_pfn_pmd() with
>> huge_zero_pfn, without touching the page tables directly. A full-PMD
>> munmap() crashes before the split series[1] as well.
> 
> Ah. So there's no real bug upstream, right?

Matches my understanding.

> 
> And I am not sure it is how we want to address this. I don't think we
> should allow randomly map huge zero page (and non-huge too). It can be a
> security risk if it ever gets exposed writable.

Due to some DAX stuff (and others) we have the shared zeropage in VM_MIXEDMAP.
And we have some elaborate checks in vm_mixed_zeropage_allowed() to test for that.

We should do a similar validation, and ideally just forbid it if not used yet.

-- 
Cheers,

David