On 2025/6/24 23:34, David Hildenbrand wrote:

On 24.06.25 17:26, Lance Yang wrote:

quoted

On 2025/6/24 20:55, David Hildenbrand wrote:

quoted

On 14.02.25 10:30, Barry Song wrote:

quoted

From: Barry Song <redacted>

[...]

quoted

quoted

diff --git a/mm/rmap.c b/mm/rmap.c
index 89e51a7a9509..8786704bd466 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c

@@ -1781,6 +1781,25 @@ void folio_remove_rmap_pud(struct folio *folio,

struct page *page,
   #endif
   }
+/* We support batch unmapping of PTEs for lazyfree large folios */
+static inline bool can_batch_unmap_folio_ptes(unsigned long addr,
+            struct folio *folio, pte_t *ptep)
+{
+    const fpb_t fpb_flags = FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRTY;
+    int max_nr = folio_nr_pages(folio);

Let's assume we have the first page of a folio mapped at the last page
table entry in our page table.

Good point. I'm curious if it is something we've seen in practice ;)

I challenge you to write a reproducer :P I assume it might be doable 
through simple mremap().

quoted

quoted

What prevents folio_pte_batch() from reading outside the page table?

Assuming such a scenario is possible, to prevent any chance of an
out-of-bounds read, how about this change:

diff --git a/mm/rmap.c b/mm/rmap.c
index fb63d9256f09..9aeae811a38b 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c

@@ -1852,6 +1852,25 @@ static inline bool 

can_batch_unmap_folio_ptes(unsigned long addr,
      const fpb_t fpb_flags = FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRTY;
      int max_nr = folio_nr_pages(folio);
      pte_t pte = ptep_get(ptep);
+    unsigned long end_addr;
+
+    /*
+     * To batch unmap, the entire folio's PTEs must be contiguous
+     * and mapped within the same PTE page table, which corresponds to
+     * a single PMD entry. Before calling folio_pte_batch(), which does
+     * not perform boundary checks itself, we must verify that the
+     * address range covered by the folio does not cross a PMD boundary.
+     */
+    end_addr = addr + (max_nr * PAGE_SIZE) - 1;
+
+    /*
+     * A fast way to check for a PMD boundary cross is to align both
+     * the start and end addresses to the PMD boundary and see if they
+     * are different. If they are, the range spans across at least two
+     * different PMD-managed regions.
+     */
+    if ((addr & PMD_MASK) != (end_addr & PMD_MASK))
+        return false;

You should not be messing with max_nr = folio_nr_pages(folio) here at 
all. folio_pte_batch() takes care of that.

Also, way too many comments ;)

You may only batch within a single VMA and within a single page table.

So simply align the addr up to the next PMD, and make sure it does not 
exceed the vma end.

ALIGN and friends can help avoiding excessive comments.

Thanks! How about this updated version based on your suggestion:

diff --git a/mm/rmap.c b/mm/rmap.c
index fb63d9256f09..241d55a92a47 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c

@@ -1847,12 +1847,25 @@ void folio_remove_rmap_pud(struct folio *folio, struct page *page,
 
 /* We support batch unmapping of PTEs for lazyfree large folios */
 static inline bool can_batch_unmap_folio_ptes(unsigned long addr,
-			struct folio *folio, pte_t *ptep)
+					      struct folio *folio, pte_t *ptep,
+					      struct vm_area_struct *vma)
 {
 	const fpb_t fpb_flags = FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRTY;
+	unsigned long next_pmd, vma_end, end_addr;
 	int max_nr = folio_nr_pages(folio);
 	pte_t pte = ptep_get(ptep);
 
+	/*
+	 * Limit the batch scan within a single VMA and within a single
+	 * page table.
+	 */
+	vma_end = vma->vm_end;
+	next_pmd = ALIGN(addr + 1, PMD_SIZE);
+	end_addr = addr + (unsigned long)max_nr * PAGE_SIZE;
+
+	if (end_addr > min(next_pmd, vma_end))
+		return false;
+
 	if (!folio_test_anon(folio) || folio_test_swapbacked(folio))
 		return false;
 	if (pte_unused(pte))

@@ -2025,7 +2038,7 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
 				folio_mark_dirty(folio);
 		} else if (likely(pte_present(pteval))) {
 			if (folio_test_large(folio) && !(flags & TTU_HWPOISON) &&
-			    can_batch_unmap_folio_ptes(address, folio, pvmw.pte))
+			    can_batch_unmap_folio_ptes(address, folio, pvmw.pte, pvmw.vma))
 				nr_pages = folio_nr_pages(folio);
 			end_addr = address + nr_pages * PAGE_SIZE;
 			flush_cache_range(vma, address, end_addr);
--

Thanks,
Lance