A ripgrep segfault investigation localizes a Linux kernel TLB-shootdown race between the per-VMA-lock anonymous fault path and concurrent munmap

Sources: analysis repository, ripgrep issue 3494, HN discussion
Summary: dfoxfranke published a separate analysis repository for ripgrep issue 3494 that reattributes the crash from the allocator to the kernel. The write-up reports that a thread's own store to a freshly faulted anonymous page is visible to an immediate reload and gone about ten instructions later, with pagemap showing the address backed by the kernel zero page. The analysis is a source-level review of Linux 7.0.12 that names a v7.0 munmap-teardown change, and it rules out use-after-free and buffer overrun on four grounds after pinning suppression of the fault to prefaulting one specific page.
Comments: HN commenters ask whether kernel maintainers have confirmed the diagnosis.
Why it matters: If the analysis holds, any multithreaded process on the affected kernels can have a store to a freshly faulted anonymous page silently lost, so the failure surfaces as unexplained heap corruption in unrelated software rather than as a kernel error.
Follow-up: Track whether a kernel maintainer confirms or refutes the race and whether a fix lands.