Linux-mm Archive on
 help / color / Atom feed
From: Hugh Dickins <>
To: Andrew Morton <>
Cc: Ashwin Chaugule <>,
	"Kirill A. Shutemov" <>,
	"Huang, Ying" <>,
	Yang Shi <>,,
Subject: [PATCH] thp: fix data loss when splitting a file pmd
Date: Wed, 11 Jul 2018 17:48:54 -0700 (PDT)
Message-ID: <alpine.LSU.2.11.1807111741430.1106@eggly.anvils> (raw)

__split_huge_pmd_locked() must check if the cleared huge pmd was dirty,
and propagate that to PageDirty: otherwise, data may be lost when a huge
tmpfs page is modified then split then reclaimed.

How has this taken so long to be noticed?  Because there was no problem
when the huge page is written by a write system call (shmem_write_end()
calls set_page_dirty()), nor when the page is allocated for a write fault
(fault_dirty_shared_page() calls set_page_dirty()); but when allocated
for a read fault (which MAP_POPULATE simulates), no set_page_dirty().

Fixes: d21b9e57c74c ("thp: handle file pages in split_huge_pmd()")
Reported-by: Ashwin Chaugule <>
Signed-off-by: Hugh Dickins <>
Cc: "Kirill A. Shutemov" <>
Cc: "Huang, Ying" <>
Cc: Yang Shi <>
Cc: <> # v4.8+

 mm/huge_memory.c |    2 ++
 1 file changed, 2 insertions(+)

--- 4.18-rc4/mm/huge_memory.c	2018-06-16 18:48:22.029173363 -0700
+++ linux/mm/huge_memory.c	2018-07-10 20:11:29.991011603 -0700
@@ -2084,6 +2084,8 @@ static void __split_huge_pmd_locked(stru
 		if (vma_is_dax(vma))
 		page = pmd_page(_pmd);
+		if (!PageDirty(page) && pmd_dirty(_pmd))
+			set_page_dirty(page);
 		if (!PageReferenced(page) && pmd_young(_pmd))
 		page_remove_rmap(page, true);

             reply index

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-12  0:48 Hugh Dickins [this message]
2018-07-12  1:40 ` Yang Shi
2018-07-12 13:42 ` Kirill A. Shutemov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.LSU.2.11.1807111741430.1106@eggly.anvils \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-mm Archive on

Archives are clonable:
	git clone --mirror linux-mm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mm linux-mm/ \
	public-inbox-index linux-mm

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone