FAILED: patch "[PATCH] mm/truncate: unmap large folio on split failure" failed to apply to 6.17-stable tree

PATCH In review [email protected] 2 participants 6 messages Nov 20, 2025 – Nov 27, 2025

Subsystems (3)

Stable branch Memory management Page cache

lore

Share & tools

lore

[email protected]

author maintainer

2025-11-20 16:13 UTC #0 lore raw

The patch below does not apply to the 6.17-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.17.y
git checkout FETCH_HEAD
git cherry-pick -x fa04f5b60fda62c98a53a60de3a1e763f11feb41
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025112037-resurface-backlight-da75@gregkh' --subject-prefix 'PATCH 6.17.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From fa04f5b60fda62c98a53a60de3a1e763f11feb41 Mon Sep 17 00:00:00 2001
From: Kiryl Shutsemau <[email protected]>
Date: Mon, 27 Oct 2025 11:56:36 +0000
Subject: [PATCH] mm/truncate: unmap large folio on split failure

Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS.

This behavior might not be respected on truncation.

During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved.

However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD.

Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics.

Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size.

Link https://lkml.kernel.org/r/[email protected] open here

Fixes b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")

Signed-off-by Kiryl Shutsemau <[email protected]>

Cc Al Viro <[email protected]>

Cc Baolin Wang <[email protected]>

Cc Christian Brauner <[email protected]>

Cc "Darrick J. Wong" <[email protected]>

Cc Dave Chinner <[email protected]>

Cc David Hildenbrand <[email protected]>

Cc Hugh Dickins <[email protected]>

Cc Johannes Weiner <[email protected]>

Cc Liam Howlett <[email protected]>

Cc Lorenzo Stoakes <[email protected]>

Cc Matthew Wilcox (Oracle) <[email protected]>

Cc Michal Hocko <[email protected]>

Cc Mike Rapoport <[email protected]>

Cc Rik van Riel <[email protected]>

Cc Shakeel Butt <[email protected]>

Cc Suren Baghdasaryan <[email protected]>

Cc Vlastimil Babka <[email protected]>

Cc <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

mm/truncate.c +29 -6

index 9210cf808f5c..3c5a50ae3274 100644
@@ -177,6 +177,32 @@ int truncate_inode_folio(struct address_space *mapping, struct folio *folio)
 	return 0;
 }
 
+static int try_folio_split_or_unmap(struct folio *folio, struct page *split_at,
+				    unsigned long min_order)
+{
+	enum ttu_flags ttu_flags =
+		TTU_SYNC |
+		TTU_SPLIT_HUGE_PMD |
+		TTU_IGNORE_MLOCK;
+	int ret;
+
+	ret = try_folio_split_to_order(folio, split_at, min_order);
+
+	/*
+	 * If the split fails, unmap the folio, so it will be refaulted
+	 * with PTEs to respect SIGBUS semantics.
+	 *
+	 * Make an exception for shmem/tmpfs that for long time
+	 * intentionally mapped with PMDs across i_size.
+	 */
+	if (ret && !shmem_mapping(folio->mapping)) {
+		try_to_unmap(folio, ttu_flags);
+		WARN_ON(folio_mapped(folio));
+	}
+
+	return ret;
+}
+
 /*
  * Handle partial folios.  The folio may be entirely within the
  * range if a split has raced with us.  If not, we zero the part of the

@@ -226,7 +252,7 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end)
 
 	min_order = mapping_min_folio_order(folio->mapping);
 	split_at = folio_page(folio, PAGE_ALIGN_DOWN(offset) / PAGE_SIZE);
-	if (!try_folio_split_to_order(folio, split_at, min_order)) {
+	if (!try_folio_split_or_unmap(folio, split_at, min_order)) {
 		/*
 		 * try to split at offset + length to make sure folios within
 		 * the range can be dropped, especially to avoid memory waste

@@ -250,13 +276,10 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end)
 		if (!folio_trylock(folio2))
 			goto out;
 
-		/*
-		 * make sure folio2 is large and does not change its mapping.
-		 * Its split result does not matter here.
-		 */
+		/* make sure folio2 is large and does not change its mapping */
 		if (folio_test_large(folio2) &&
 		    folio2->mapping == folio->mapping)
-			try_folio_split_to_order(folio2, split_at2, min_order);
+			try_folio_split_or_unmap(folio2, split_at2, min_order);
 
 		folio_unlock(folio2);
 out:

Kiryl Shutsemau

2025-11-20 16:52 UTC #1 lore raw

PATCH 1/1 mm/truncate: unmap large folio on split failure

Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS.

This behavior might not be respected on truncation.

However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD.

Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics.

Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size.

Link https://lkml.kernel.org/r/[email protected] open here

Fixes b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")

Signed-off-by Kiryl Shutsemau <[email protected]>

Cc Al Viro <[email protected]>

Cc Baolin Wang <[email protected]>

Cc Christian Brauner <[email protected]>

Cc "Darrick J. Wong" <[email protected]>

Cc Dave Chinner <[email protected]>

Cc David Hildenbrand <[email protected]>

Cc Hugh Dickins <[email protected]>

Cc Johannes Weiner <[email protected]>

Cc Liam Howlett <[email protected]>

Cc Lorenzo Stoakes <[email protected]>

Cc Matthew Wilcox (Oracle) <[email protected]>

Cc Michal Hocko <[email protected]>

Cc Mike Rapoport <[email protected]>

Cc Rik van Riel <[email protected]>

Cc Shakeel Butt <[email protected]>

Cc Suren Baghdasaryan <[email protected]>

Cc Vlastimil Babka <[email protected]>

Cc <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

(cherry picked from commit fa04f5b60fda62c98a53a60de3a1e763f11feb41)

Signed-off-by Kiryl Shutsemau <[email protected]>

---
 mm/truncate.c | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

mm/truncate.c +28 -6

index 91eb92a5ce4f..95fb291526fc 100644
@@ -177,6 +177,31 @@ int truncate_inode_folio(struct address_space *mapping, struct folio *folio)
 	return 0;
 }
 
+static int try_folio_split_or_unmap(struct folio *folio, struct page *split_at)
+{
+	enum ttu_flags ttu_flags =
+		TTU_SYNC |
+		TTU_SPLIT_HUGE_PMD |
+		TTU_IGNORE_MLOCK;
+	int ret;
+
+	ret = try_folio_split(folio, split_at, NULL);
+
+	/*
+	 * If the split fails, unmap the folio, so it will be refaulted
+	 * with PTEs to respect SIGBUS semantics.
+	 *
+	 * Make an exception for shmem/tmpfs that for long time
+	 * intentionally mapped with PMDs across i_size.
+	 */
+	if (ret && !shmem_mapping(folio->mapping)) {
+		try_to_unmap(folio, ttu_flags);
+		WARN_ON(folio_mapped(folio));
+	}
+
+	return ret;
+}
+
 /*
  * Handle partial folios.  The folio may be entirely within the
  * range if a split has raced with us.  If not, we zero the part of the

@@ -224,7 +249,7 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end)
 		return true;
 
 	split_at = folio_page(folio, PAGE_ALIGN_DOWN(offset) / PAGE_SIZE);
-	if (!try_folio_split(folio, split_at, NULL)) {
+	if (!try_folio_split_or_unmap(folio, split_at)) {
 		/*
 		 * try to split at offset + length to make sure folios within
 		 * the range can be dropped, especially to avoid memory waste

@@ -248,13 +273,10 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end)
 		if (!folio_trylock(folio2))
 			goto out;
 
-		/*
-		 * make sure folio2 is large and does not change its mapping.
-		 * Its split result does not matter here.
-		 */
+		/* make sure folio2 is large and does not change its mapping */
 		if (folio_test_large(folio2) &&
 		    folio2->mapping == folio->mapping)
-			try_folio_split(folio2, split_at2, NULL);
+			try_folio_split_or_unmap(folio2, split_at2);
 
 		folio_unlock(folio2);
 out:

Signature · 1 line

2.51.0

Greg KH

author maintainer

2025-11-21 09:46 UTC #2 lore raw

Re: [PATCH 6.17.y] mm/truncate: unmap large folio on split failure

Quoted 43 lines · Kiryl Shutsemau

Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS.
This behavior might not be respected on truncation.
During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved.
However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD.
Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics.
Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size.
Link https://lkml.kernel.org/r/[email protected] open here
Fixes b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")
Signed-off-by Kiryl Shutsemau <[email protected]>
Cc Al Viro <[email protected]>
Cc Baolin Wang <[email protected]>
Cc Christian Brauner <[email protected]>
Cc "Darrick J. Wong" <[email protected]>
Cc Dave Chinner <[email protected]>
Cc David Hildenbrand <[email protected]>
Cc Hugh Dickins <[email protected]>
Cc Johannes Weiner <[email protected]>
Cc Liam Howlett <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Matthew Wilcox (Oracle) <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Mike Rapoport <[email protected]>
Cc Rik van Riel <[email protected]>
Cc Shakeel Butt <[email protected]>
Cc Suren Baghdasaryan <[email protected]>
Cc Vlastimil Babka <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit fa04f5b60fda62c98a53a60de3a1e763f11feb41)
Signed-off-by Kiryl Shutsemau <[email protected]>

Quoted 1 line

---

Does not apply to 6.17.y at all :(

Did you forget to apply this on top of other commits?

thanks,

greg k-h

Kiryl Shutsemau

2025-11-21 13:20 UTC #3 lore raw

Re: [PATCH 6.17.y] mm/truncate: unmap large folio on split failure

Quoted 46 lines · Greg KH

Quoted 43 lines · Kiryl Shutsemau
Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS.
This behavior might not be respected on truncation.
During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved.
However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD.
Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics.
Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size.
Link https://lkml.kernel.org/r/[email protected] open here
Fixes b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")
Signed-off-by Kiryl Shutsemau <[email protected]>
Cc Al Viro <[email protected]>
Cc Baolin Wang <[email protected]>
Cc Christian Brauner <[email protected]>
Cc "Darrick J. Wong" <[email protected]>
Cc Dave Chinner <[email protected]>
Cc David Hildenbrand <[email protected]>
Cc Hugh Dickins <[email protected]>
Cc Johannes Weiner <[email protected]>
Cc Liam Howlett <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Matthew Wilcox (Oracle) <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Mike Rapoport <[email protected]>
Cc Rik van Riel <[email protected]>
Cc Shakeel Butt <[email protected]>
Cc Suren Baghdasaryan <[email protected]>
Cc Vlastimil Babka <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit fa04f5b60fda62c98a53a60de3a1e763f11feb41)
Signed-off-by Kiryl Shutsemau <[email protected]>
Quoted 1 line
---

Quoted 3 lines

Does not apply to 6.17.y at all :(
Did you forget to apply this on top of other commits?

Hm. It applies cleanly on v6.17.8:

❯ git log -1 --oneline @
8ac42a63c561 (HEAD) Linux 6.17.8
❯ b4 shazam [email protected]
Grabbing thread from lore.kernel.org/all/[email protected]/t.mbox.gz Breaking thread to remove parents of [email protected] Checking for newer revisions
Grabbing search results from lore.kernel.org
Analyzing 2 messages in the thread
Analyzing 1 code-review messages
Checking attestation on all messages, may take a moment...
---
✓ [PATCH] mm/truncate: unmap large folio on split failure
---
✓ Signed: DKIM/kernel.org
---
Total patches: 1
---
Applying: mm/truncate: unmap large folio on split failure

Do you have anything on top of v6.17.8 in your 6.17.y queue?

My other backport to 6.17.y doesn't interfere with the patch either.

Signature · 1 line

  Kiryl Shutsemau / Kirill A. Shutemov

Kiryl Shutsemau

2025-11-21 14:17 UTC #4 lore raw

Re: [PATCH 6.17.y] mm/truncate: unmap large folio on split failure

Quoted 72 lines · Kiryl Shutsemau

Quoted 46 lines · Greg KH
Quoted 43 lines · Kiryl Shutsemau
Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS.
This behavior might not be respected on truncation.
During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved.
However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD.
Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics.
Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size.
Link https://lkml.kernel.org/r/[email protected] open here
Fixes b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")
Signed-off-by Kiryl Shutsemau <[email protected]>
Cc Al Viro <[email protected]>
Cc Baolin Wang <[email protected]>
Cc Christian Brauner <[email protected]>
Cc "Darrick J. Wong" <[email protected]>
Cc Dave Chinner <[email protected]>
Cc David Hildenbrand <[email protected]>
Cc Hugh Dickins <[email protected]>
Cc Johannes Weiner <[email protected]>
Cc Liam Howlett <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Matthew Wilcox (Oracle) <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Mike Rapoport <[email protected]>
Cc Rik van Riel <[email protected]>
Cc Shakeel Butt <[email protected]>
Cc Suren Baghdasaryan <[email protected]>
Cc Vlastimil Babka <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit fa04f5b60fda62c98a53a60de3a1e763f11feb41)
Signed-off-by Kiryl Shutsemau <[email protected]>
Quoted 1 line
---
Quoted 3 lines
Does not apply to 6.17.y at all :(
Did you forget to apply this on top of other commits?
Hm. It applies cleanly on v6.17.8:
❯ git log -1 --oneline @
8ac42a63c561 (HEAD) Linux 6.17.8
❯ b4 shazam [email protected]
Grabbing thread from lore.kernel.org/all/[email protected]/t.mbox.gz Breaking thread to remove parents of [email protected] Checking for newer revisions
Grabbing search results from lore.kernel.org
Analyzing 2 messages in the thread
Analyzing 1 code-review messages
Checking attestation on all messages, may take a moment...
---
✓ [PATCH] mm/truncate: unmap large folio on split failure
---
✓ Signed: DKIM/kernel.org
---
Total patches: 1
---
Applying: mm/truncate: unmap large folio on split failure

Quoted 3 lines

Do you have anything on top of v6.17.8 in your 6.17.y queue?
My other backport to 6.17.y doesn't interfere with the patch either.

I see 6.17.9-rc1 includes

53241caf24c7 ("mm/huge_memory: do not change split_huge_page*() target order silently")

With the patch applied, fa04f5b60fda ("mm/truncate: unmap large folio on split failure") can be cherry-picked cleanly.

Signature · 1 line

  Kiryl Shutsemau / Kirill A. Shutemov

Greg KH

author maintainer

2025-11-27 12:44 UTC #5 lore raw

Re: [PATCH 6.17.y] mm/truncate: unmap large folio on split failure

Quoted 75 lines · Kiryl Shutsemau

Quoted 74 lines · Kiryl Shutsemau
Quoted 46 lines · Greg KH
Quoted 43 lines · Kiryl Shutsemau
Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS.
This behavior might not be respected on truncation.
During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved.
However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD.
Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics.
Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size.
Link https://lkml.kernel.org/r/[email protected] open here
Fixes b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")
Signed-off-by Kiryl Shutsemau <[email protected]>
Cc Al Viro <[email protected]>
Cc Baolin Wang <[email protected]>
Cc Christian Brauner <[email protected]>
Cc "Darrick J. Wong" <[email protected]>
Cc Dave Chinner <[email protected]>
Cc David Hildenbrand <[email protected]>
Cc Hugh Dickins <[email protected]>
Cc Johannes Weiner <[email protected]>
Cc Liam Howlett <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Matthew Wilcox (Oracle) <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Mike Rapoport <[email protected]>
Cc Rik van Riel <[email protected]>
Cc Shakeel Butt <[email protected]>
Cc Suren Baghdasaryan <[email protected]>
Cc Vlastimil Babka <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit fa04f5b60fda62c98a53a60de3a1e763f11feb41)
Signed-off-by Kiryl Shutsemau <[email protected]>
Quoted 1 line
---
Quoted 3 lines
Does not apply to 6.17.y at all :(
Did you forget to apply this on top of other commits?
Hm. It applies cleanly on v6.17.8:
❯ git log -1 --oneline @
8ac42a63c561 (HEAD) Linux 6.17.8
❯ b4 shazam [email protected]
Grabbing thread from lore.kernel.org/all/[email protected]/t.mbox.gz Breaking thread to remove parents of [email protected] Checking for newer revisions
Grabbing search results from lore.kernel.org
Analyzing 2 messages in the thread
Analyzing 1 code-review messages
Checking attestation on all messages, may take a moment...
---
✓ [PATCH] mm/truncate: unmap large folio on split failure
---
✓ Signed: DKIM/kernel.org
---
Total patches: 1
---
Applying: mm/truncate: unmap large folio on split failure
Do you have anything on top of v6.17.8 in your 6.17.y queue?

Quoted 8 lines

Quoted 1 line
My other backport to 6.17.y doesn't interfere with the patch either.
I see 6.17.9-rc1 includes
53241caf24c7 ("mm/huge_memory: do not change split_huge_page*() target order silently")
With the patch applied, fa04f5b60fda ("mm/truncate: unmap large folio on split failure") can be cherry-picked cleanly.

Ah, that worked, thanks!

greg k-h