On 11/02/23 19:24, Mike Kravetz wrote: > > In the specific case causing the null-ptr-deref, the resv_map pointer > (vm_private_data) is NULL. Hi Rik, In commit bf4916922c60 hugetlbfs: extend hugetlb_vma_lock to private VMAs, it correctly says: Extend the locking scheme used to protect shared hugetlb mappings from truncate vs page fault races, in order to protect private hugetlb mappings (with resv_map) against MADV_DONTNEED. That qualification '(with resv_map)' caught my attention originally, and I thought about it again while looking into this. We now cover the common cases, but there are still quite a few cases where resv_map is NULL for private mappings. In such cases, the race between MADV_DONTNEED and page fault still exists. Is that a concern? With a bit more work we 'could' make sure every hugetlb vma has a lock to participate in this scheme. Any thhoughts? -- Mike Kravetz