Kernel fixes MADV_COLD race that could drop dirty THP data
Non-atomic young-bit clearing on transparent huge pages could lose concurrent writes and let reclaim discard still-dirty anonymous memory.
Pedro Falcato of SUSE has fixed a race in the Linux kernel's MADV_COLD handling for transparent huge pages (THPs) that could cause silent data loss.
The cold path cleared the hardware young (recently accessed) bit on a PMD by invalidating the entry, rewriting a snapshot, and storing it back. That sequence was not atomic against concurrent hardware updates, so a write that set the dirty bit in the same window could be discarded. When the folio had earlier been marked lazyfree with MADV_FREE, later reclaim or MADV_PAGEOUT could then treat the page as clean anonymous memory and drop it, losing the write.
The fix clears the young bit with an atomic PMD operation, so racing dirty updates are preserved. As a side effect it also avoids an unnecessary TLB flush that the old invalidate path performed. Samarth Narang reported the problem. The change is aimed at stable kernels because the flaw dates to the original introduction of MADV_COLD.
Reviewers on the stable list accepted the patch; related cleanup of the same cold/pageout helper is expected separately.