v1
2026-10-29
hugetlb多路径修复 · v1
修复 hugetlb 的 MAP_PRIVATE、reservation、UFFD 与 accounting 等多处缺陷，解决长期叠加机制导致的页面状态与账目错误。
原始补丁链接
子 Patch（15）
1/15
hugetlbfs: fix integer overflow in fallocate()
On Oct 29, 2026, at 04:13, David Hildenbrand (Arm) david@kernel.org wrote: > > hugetlbfs_fallocate() rounds the range end up by adding hpage_size - 1 > to offset + len. vfs_fallocate()’s existing
2/15
mm/hugetlb: compare against persistent count when freeing lowmem folios
On Oct 29, 2026, at 04:13, David Hildenbrand (Arm) david@kernel.org wrote: > > try_to_free_low() gets a target number of persistent folios, but > compares it with “nr_huge_pages”, which includes
3/15
mm/hugetlb: preserve reservations when shrinking on HIGHMEM
On Oct 29, 2026, at 04:13, David Hildenbrand (Arm) david@kernel.org wrote: > > try_to_free_low() drops the hugetlb_lock while freeing lowmem folios. > set_max_huge_pages() then resumes freeing fo
4/15
mm/hugetlb: account temporary folios separately
为 hugetlb 迁移临时 folio 增加 temporary 计数，persistent_huge_pages()/node 版本计算时扣除，修复其被误算为 persistent 导致缩池时 surplus 计数错乱甚至超过实际分配。
5/15
mm/hugetlb: keep surplus folios when the pool shrinks
[Re: [PATCH 05/15] mm/hugetlb: keep surplus folios when the pool shrinks] > On Oct 29, 2026, at 04:13, David Hildenbrand (Arm) david@kernel.org wrote: > > From: Josef Bacik josef@toxicpanda.com >
6/15
mm/hugetlb: fix mremap() racing with page migration
move_hugetlb_page_tables() 在移动 anon hugetlb 和最终 TLB flush 间持 anon_vma 写锁，防止迁移与 mremap 竞争复用旧 folio/rmap 漏项；需分配页表时先刷 TLB 再重取锁。
7/15
hugetlbfs: fix unmapping folios from private VMAs
hugetlb_unmap_file_folio() 误把 private VMA 的 vm_private_data（resv_map）当 hugetlb_vma_lock；改为仅存在 shareable vma lock 时才取锁，private VMA 依赖 fault mutex 和 i_mmap_rwsem 保护。
8/15
mm/hugetlb: serialize page-cache allocations with truncation
hugetlb 缺页在尺寸检查、folio 分配、page cache 插入/预留回滚期间持 mapping->invalidate_lock 共享锁，truncation 在 i_size_write() 周边独占，防止删预留导致 resv_huge_pages 下溢和 EOF 外 folio。
9/15
mm/memfd: recheck the page cache before allocating a hugetlb folio
memfd_alloc_folio() 取 fault mutex 后重查 page cache；并发 fault/PIN 可能已填充 folio，若存在则返回 -EEXIST 让 memfd_pin_folios() 重试，避免无全局预留时误报 -ENOMEM。
10/15
mm/hugetlb: count again if the reserve map shrank
hugetlb_reserve_pages() 比较 region_add() 实际增加量与已 charge 数；若 restore_reserve_on_error 删除条目使 region_add() 少加，则回退 cgroup/subpool/pool 计数，避免预留图缩减导致漏记账。
11/15
hugetlbfs: do not grow a sealed file in mmap()
hugetlbfs_file_mmap() 在可写映射超出 EOF 时检查 F_SEAL_GROW，置位则拒绝增长但 mmap 仍成功；避免 sealed 文件被 mmap 绕过 setattr()/fallocate() 的 seal 检查。
12/15
mm/hugetlb: keep surplus folios that are reserved
free_huge_folio() 恢复预留后若节点有 surplus 仍会归还 folio，可能丢失覆盖预留的 hugetlb 页并使 available_huge_pages() 下溢；改为只要 folio 仍被预留（含刚恢复）就留在 pool。
13/15
mm/hugetlb: fix reservation leak on min_size= mounts
min_size= 且无 size= 的 hugetlbfs 上 CoW 分配失败时，HPG_restore_reserve 只恢复全局预留未归还 subpool；因 CoW 无 reserve map 或同 index 已记账，修正 free_huge_folio() 避免预留泄漏。
14/15
RFC: mm/hugetlb: account restored reservations before freeing folios
anon hugetlb 取消映射恢复预留时立即增加 resv_huge_pages 并脱离 subpool、清除 restore 标志，避免 folio 释放延迟导致计数下溢；将 available 夹到 0 并限制 surplus 释放。
15/15
RFC: mm/hugetlb: delay anon folio rmap removal until after the TLB flush
扩展 mmu_gather 延迟 rmap 机制处理 hugetlb，在 TLB flush 后再移除匿名 hugetlb 的 rmap，避免 munmap/MADV_DONTNEED 先降 mapcount、另一线程经 stale TLB 读时写 fault 使 hugetlb_wp() 误复用 folio。