From: Dev Jain <dev.jain@arm.com>
To: catalin.marinas@arm.com, will@kernel.org
Cc: david@redhat.com, ryan.roberts@arm.com,
anshuman.khandual@arm.com, mark.rutland@arm.com,
yang@os.amperecomputing.com, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, Dev Jain <dev.jain@arm.com>,
stable@vger.kernel.org
Subject: [PATCH] arm64: Check pxd_leaf() instead of !pxd_table() while tearing down page tables
Date: Thu, 15 May 2025 12:04:50 +0530 [thread overview]
Message-ID: <20250515063450.86629-1-dev.jain@arm.com> (raw)
Commit 9c006972c3fe removes the pxd_present() checks because the caller
checks pxd_present(). But, in case of vmap_try_huge_pud(), the caller only
checks pud_present(); pud_free_pmd_page() recurses on each pmd through
pmd_free_pte_page(), wherein the pmd may be none. Thus it is possible to
hit a warning in the latter, since pmd_none => !pmd_table(). Thus, enforce
these checks again through pxd_leaf().
This problem was found by code inspection.
The patch is based on 6.15-rc6.
Fixes: 9c006972c3fe (arm64: mmu: drop pXd_present() checks from pXd_free_pYd_table())
Cc: <stable@vger.kernel.org>
Reported-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Dev Jain <dev.jain@arm.com>
---
arch/arm64/mm/mmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index ea6695d53fb9..3d6789413a9b 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -1255,7 +1255,7 @@ int pmd_free_pte_page(pmd_t *pmdp, unsigned long addr)
pmd = READ_ONCE(*pmdp);
- if (!pmd_table(pmd)) {
+ if (pmd_leaf(pmd)) {
VM_WARN_ON(1);
return 1;
}
@@ -1276,7 +1276,7 @@ int pud_free_pmd_page(pud_t *pudp, unsigned long addr)
pud = READ_ONCE(*pudp);
- if (!pud_table(pud)) {
+ if (pud_leaf(pud)) {
VM_WARN_ON(1);
return 1;
}
--
2.30.2
next reply other threads:[~2025-05-15 6:53 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-15 6:34 Dev Jain [this message]
2025-05-15 8:13 ` [PATCH] arm64: Check pxd_leaf() instead of !pxd_table() while tearing down page tables David Hildenbrand
2025-05-15 8:22 ` Dev Jain
2025-05-15 8:36 ` David Hildenbrand
2025-05-15 8:40 ` Dev Jain
2025-05-15 8:49 ` David Hildenbrand
2025-05-15 8:47 ` Dev Jain
2025-05-15 8:53 ` David Hildenbrand
2025-05-15 9:27 ` Dev Jain
2025-05-15 9:32 ` David Hildenbrand
2025-05-15 12:56 ` Will Deacon
2025-05-15 13:04 ` David Hildenbrand
2025-05-15 13:21 ` Will Deacon
2025-05-15 10:07 ` Ryan Roberts
2025-05-15 13:01 ` David Hildenbrand
2025-05-15 13:14 ` Ryan Roberts
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250515063450.86629-1-dev.jain@arm.com \
--to=dev.jain@arm.com \
--cc=anshuman.khandual@arm.com \
--cc=catalin.marinas@arm.com \
--cc=david@redhat.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=ryan.roberts@arm.com \
--cc=stable@vger.kernel.org \
--cc=will@kernel.org \
--cc=yang@os.amperecomputing.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.