Re: [PATCH 12/12] mm: change the contract for free_pgtables(), update docs
From: Kiryl Shutsemau <kas@kernel.org>
Date: 2026-09-01 13:57:38
Also in:
linux-alpha, linux-arch, linux-m68k, linux-mips, linux-mm, linux-riscv, linux-s390, linux-sh, linux-um, lkml, loongarch, sparclinux
On Tue, Sep 01, 2026 at 12:01:32PM +0100, Lorenzo Stoakes (ARM) wrote:
quoted hunk ↗ jump to hunk
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c index b91b1a98029c..ff8ff3706485 100644 --- a/mm/pgtable-generic.c +++ b/mm/pgtable-generic.c@@ -386,9 +386,21 @@ pte_t *pte_offset_map_rw_nolock(struct mm_struct *mm, pmd_t *pmd, * be read-only/read-write protected. * * Note that free_pgtables(), used after unmapping detached vmas, or when - * exiting the whole mm, does not take page table lock before freeing a page - * table, and may not use RCU at all: "outsiders" like khugepaged should avoid - * pte_offset_map() and co once the vma is detached from mm or mm_users is zero. + * exiting the whole mm, does not take the page table lock before freeing a + * table. + * + * However, the PMD entry is cleared first, and the table freed only after + * an RCU grace period, so a walker that mapped the table under + * rcu_read_lock() stays safe, and the pmd_same() recheck in + * pte_offset_map_lock() detects the teardown. + * + * Therefore it is safe for "outsiders" like khugepaged to use + * pte_offset_map() and co. for VMAs that might be undergoing page table + * teardown.
Is it strictly true? free_pte_range() clears the pmd without taking the PTL, so the pmd_same() recheck in pte_offset_map_lock() can pass and the pmd gets cleared right after. Readers are fine -- __pte_offset_map() holds rcu_read_lock() until pte_unmap(), so the table cannot go away. khugepaged is an odd example here. collapse_pte_mapped_thp() and retract_page_tables() don't rely on this recheck -- they take pmd_lock() plus the ptl and do their own pmd_same() under both. Can we say walks are safe and leave the write rule where it is? -- Kiryl Shutsemau / Kirill A. Shutemov