On Fri, 27 Jun 2025 14:23:19 +0800 Lance Yang ioworker0@gmail.com wrote:
As pointed out by David[1], the batched unmap logic in try_to_unmap_one() can read past the end of a PTE table if a large folio is mapped starting at the last entry of that table. It would be quite rare in practice, as MADV_FREE typically splits the large folio ;)
So let's fix the potential out-of-bounds read by refactoring the logic into a new helper, folio_unmap_pte_batch().
The new helper now correctly calculates the safe number of pages to scan by limiting the operation to the boundaries of the current VMA and the PTE table.
In addition, the "all-or-nothing" batching restriction is removed to support partial batches. The reference counting is also cleaned up to use folio_put_refs().
I'll queue this for testing while the updated changelog is being prepared.