]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Revert "mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()"
authorHarry Yoo <harry.yoo@oracle.com>
Fri, 16 Jan 2026 03:38:38 +0000 (12:38 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 6 Feb 2026 15:44:22 +0000 (16:44 +0100)
commitd729fa456af2ae7734b1930ff280b108204cc14c
treee6f2a100116f40240274e770f110c3f6b81fd4a1
parent92d26ce07ac3b7a850dc68c8d73d487b39c39b33
Revert "mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()"

This reverts commit 91750c8a4be42d73b6810a1c35d73c8a3cd0b481 which is
commit 670ddd8cdcbd1d07a4571266ae3517f821728c3a upstream.

While the commit fixes a race condition between NUMA balancing and THP
migration, it causes a NULL-pointer-deref when the pmd temporarily
transitions from pmd_trans_huge() to pmd_none(). Verifying whether the
pmd value has changed under page table lock does not prevent the crash,
as it occurs when acquiring the lock.

Since the original issue addressed by the commit is quite rare and
non-fatal, revert the commit. A better backport solution that more
closely matches the upstream semantics will be provided as a follow-up.

Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mm/mprotect.c