mm-mprotect-use-huge_ptep_get-for-hugetlb.patch removed from -mm tree

The quilt patch titled
Subject: mm/mprotect: use huge_ptep_get() for hugetlb
has been removed from the -mm tree. Its filename was
mm-mprotect-use-huge_ptep_get-for-hugetlb.patch

This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Dev Jain <[email protected]>
Subject: mm/mprotect: use huge_ptep_get() for hugetlb
Date: Fri, 3 Jul 2026 11:41:59 +0000

prot_none_hugetlb_entry() is the hugetlb callback for the early mprotect(PROT_NONE) PFN permission walk on x86.

The callback passes the decoded PFN to pfn_modify_allowed(). For a hugetlb callback, the pte pointer refers to a hugetlb entry. On architectures where hugetlb entries need huge_ptep_get(), reading that entry with ptep_get() can make the permission check use the wrong PFN.

Use huge_ptep_get() before decoding the hugetlb PFN.

Currently there is no path which can trigger a bug: huge_ptep_get() is a simple ptep_get() for x86, and the prot_none walk occurs only for x86.

So no need to backport - use the correct helper anyways.

---

 mm/mprotect.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

@@ -699,14 +699,20 @@ static int prot_none_pte_entry(pte_t *pt
 		0 : -EACCES;
 }
 
+#ifdef CONFIG_HUGETLB_PAGE
 static int prot_none_hugetlb_entry(pte_t *pte, unsigned long hmask,
 				   unsigned long addr, unsigned long next,
 				   struct mm_walk *walk)
 {
-	return pfn_modify_allowed(pte_pfn(ptep_get(pte)),
-				  *(pgprot_t *)(walk->private)) ?
-		0 : -EACCES;
+	const pte_t entry = huge_ptep_get(walk->mm, addr, pte);
+
+	if (pfn_modify_allowed(pte_pfn(entry), *(pgprot_t *)(walk->private)))
+		return 0;
+	return -EACCES;
 }
+#else
+#define prot_none_hugetlb_entry	NULL
+#endif
 
 static const struct mm_walk_ops prot_none_walk_ops = {
 	.pte_entry		= prot_none_pte_entry,

_

Patches currently in -mm which might be from [email protected] are

mm-rmap-convert-page-folio-for-hwpoison-checks.patch mm-rmap-add-try_to_unmap_poisoned_hugetlb_one.patch mm-rmap-refactor-some-code-around-lazyfree-folio-unmapping.patch mm-rmap-refactor-anon-folio-unmap-in-try_to_unmap_one.patch mm-rmap-add-anon-folio-unmap-dispatcher.patch mm-memory-move-pte_install_uffd_wp_if_needed-into-memoryc.patch mm-memory-batch-set-uffd-wp-markers-during-zapping.patch mm-rmap-batch-unmap-file-folios-belonging-to-uffd-wp-vmas.patch