[REGRESSION] madvise(MADV_REMOVE) corrupts pages in THP-backed MAP_SHARED memfd (bisected to 7460b470a131)

[REGRESSION] madvise(MADV_REMOVE) corrupts pages in THP-backed MAP_SHARED memfd (bisected to 7460b470a131)

[Bas van Dijk]

[-- Attachment #1: Type: text/plain, Size: 783 bytes --]

#regzbot introduced: 7460b470a131f985a70302a322617121efdd7caa

Hey folks,

We discovered madvise(MADV_REMOVE) on a 4KiB range within a
huge-page-backed MAP_SHARED memfd region corrupts nearby pages.

Using the reproducible test in
https://github.com/dfinity/thp-madv-remove-test this was bisected to the
first bad commit:

commit 7460b470a131f985a70302a322617121efdd7caa
Author: Zi Yan <ziy@nvidia.com>
Date:   Fri Mar 7 12:40:00 2025 -0500

    mm/truncate: use folio_split() in truncate operation

v7.0-rc1 still has the regression.

The repo mentioned above explains how to reproduce the regression and
contains the necessary logs of failed runs on 7460b470a131 and v7.0-rc1, as
well as a successful run on its parent 4b94c18d1519.

Best regards,

Bas van Dijk
DFINITY Foundation

[-- Attachment #2: Type: text/html, Size: 1151 bytes --]

Re: [REGRESSION] madvise(MADV_REMOVE) corrupts pages in THP-backed MAP_SHARED memfd (bisected to 7460b470a131)

[Zi Yan]

On 26 Feb 2026, at 15:34, Bas van Dijk wrote:

> #regzbot introduced: 7460b470a131f985a70302a322617121efdd7caa
>
> Hey folks,
>
> We discovered madvise(MADV_REMOVE) on a 4KiB range within a
> huge-page-backed MAP_SHARED memfd region corrupts nearby pages.
>
> Using the reproducible test in
> https://github.com/dfinity/thp-madv-remove-test this was bisected to the
> first bad commit:
>
> commit 7460b470a131f985a70302a322617121efdd7caa
> Author: Zi Yan <ziy@nvidia.com>
> Date:   Fri Mar 7 12:40:00 2025 -0500
>
>     mm/truncate: use folio_split() in truncate operation
>
> v7.0-rc1 still has the regression.
>
> The repo mentioned above explains how to reproduce the regression and
> contains the necessary logs of failed runs on 7460b470a131 and v7.0-rc1, as
> well as a successful run on its parent 4b94c18d1519.

Thanks for the report. I will look into it.

Best Regards,
Yan, Zi

Re: [REGRESSION] madvise(MADV_REMOVE) corrupts pages in THP-backed MAP_SHARED memfd (bisected to 7460b470a131)

[Zi Yan]

On 26 Feb 2026, at 15:49, Zi Yan wrote:

> On 26 Feb 2026, at 15:34, Bas van Dijk wrote:
>
>> #regzbot introduced: 7460b470a131f985a70302a322617121efdd7caa
>>
>> Hey folks,
>>
>> We discovered madvise(MADV_REMOVE) on a 4KiB range within a
>> huge-page-backed MAP_SHARED memfd region corrupts nearby pages.
>>
>> Using the reproducible test in
>> https://github.com/dfinity/thp-madv-remove-test this was bisected to the
>> first bad commit:
>>
>> commit 7460b470a131f985a70302a322617121efdd7caa
>> Author: Zi Yan <ziy@nvidia.com>
>> Date:   Fri Mar 7 12:40:00 2025 -0500
>>
>>     mm/truncate: use folio_split() in truncate operation
>>
>> v7.0-rc1 still has the regression.
>>
>> The repo mentioned above explains how to reproduce the regression and
>> contains the necessary logs of failed runs on 7460b470a131 and v7.0-rc1, as
>> well as a successful run on its parent 4b94c18d1519.
>
> Thanks for the report. I will look into it.

Can you also share your kernel config file? I just ran the reproducer and
could not trigger the corruption.

Thanks.

Best Regards,
Yan, Zi

Re: [External Sender] Re: [REGRESSION] madvise(MADV_REMOVE) corrupts pages in THP-backed MAP_SHARED memfd (bisected to 7460b470a131)

[Bas van Dijk]

On Thu, Feb 26, 2026 at 10:06 PM Zi Yan <ziy@nvidia.com> wrote:
>
> On 26 Feb 2026, at 15:49, Zi Yan wrote:
>
> > On 26 Feb 2026, at 15:34, Bas van Dijk wrote:
> >
> >> #regzbot introduced: 7460b470a131f985a70302a322617121efdd7caa
> >>
> >> Hey folks,
> >>
> >> We discovered madvise(MADV_REMOVE) on a 4KiB range within a
> >> huge-page-backed MAP_SHARED memfd region corrupts nearby pages.
> >>
> >> Using the reproducible test in
> >> https://github.com/dfinity/thp-madv-remove-test this was bisected to the
> >> first bad commit:
> >>
> >> commit 7460b470a131f985a70302a322617121efdd7caa
> >> Author: Zi Yan <ziy@nvidia.com>
> >> Date:   Fri Mar 7 12:40:00 2025 -0500
> >>
> >>     mm/truncate: use folio_split() in truncate operation
> >>
> >> v7.0-rc1 still has the regression.
> >>
> >> The repo mentioned above explains how to reproduce the regression and
> >> contains the necessary logs of failed runs on 7460b470a131 and v7.0-rc1, as
> >> well as a successful run on its parent 4b94c18d1519.
> >
> > Thanks for the report. I will look into it.
>
> Can you also share your kernel config file? I just ran the reproducer and
> could not trigger the corruption.

Sure, I just ran `nix build
.#linux_6_14_first_bad_7460b470a131.configfile -o kernel.config` which
produced:

https://github.com/dfinity/thp-madv-remove-test/blob/master/kernel.config