* [RESEND PATCH] riscv: mm: exclude invalid THP PMDs from page table check
@ 2026-05-23 4:20 ` Yunhui Cui
0 siblings, 0 replies; 6+ messages in thread
From: Yunhui Cui @ 2026-05-23 4:20 UTC (permalink / raw)
To: paul.walmsley, palmer, aou, cuiyunhui, tongtiangen, akpm,
pasha.tatashin, linux-riscv, linux-kernel
Cc: stable
RISC-V THP splitting uses a temporary invalid PMD state where
pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
_PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
in-progress entry.
That temporary state no longer describes a user-accessible mapping, but
page_table_check currently treats it as one because the RISC-V PMD
user-accessibility test only checks whether the PMD is a leaf and has
user permissions.
As a result, when a PMD-sized anonymous THP is split during a COW fault,
page_table_check can account the invalid intermediate PMD as a live PMD
mapping, and then account the replacement PTE mappings again when the
split installs the PTE table. This leaves stale PMD accounting behind and
later triggers page_table_check failures such as a non-zero
anon_map_count when the folio is freed.
Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
accounting only considers leaf PMDs that still carry either
_PAGE_PRESENT or _PAGE_PROT_NONE. This preserves the THP split semantics
required by the MM code while preventing page_table_check from treating
invalid split PMDs as live user mappings.
With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
tools/testing/selftests/mm/cow completes successfully on RISC-V after
this change.
Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
Cc: stable@vger.kernel.org
Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
---
arch/riscv/include/asm/pgtable.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index a1a7c6520a095..ecea48affd7aa 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -976,7 +976,14 @@ static inline bool pte_user_accessible_page(struct mm_struct *mm, unsigned long
static inline bool pmd_user_accessible_page(struct mm_struct *mm, unsigned long addr, pmd_t pmd)
{
- return pmd_leaf(pmd) && pmd_user(pmd);
+ /*
+ * page_table_check() must ignore THP split invalidation entries created by
+ * pmd_mkinvalid(). These retain _PAGE_LEAF so pmd_present()/pmd_leaf() stay
+ * true during the split, but they no longer describe a user-accessible
+ * mapping once both _PAGE_PRESENT and _PAGE_PROT_NONE are cleared.
+ */
+ return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)) &&
+ (pmd_val(pmd) & _PAGE_LEAF) && pmd_user(pmd);
}
static inline bool pud_user_accessible_page(struct mm_struct *mm, unsigned long addr, pud_t pud)
--
2.39.5
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 6+ messages in thread* [RESEND PATCH] riscv: mm: exclude invalid THP PMDs from page table check
@ 2026-05-23 4:20 ` Yunhui Cui
0 siblings, 0 replies; 6+ messages in thread
From: Yunhui Cui @ 2026-05-23 4:20 UTC (permalink / raw)
To: paul.walmsley, palmer, aou, cuiyunhui, tongtiangen, akpm,
pasha.tatashin, linux-riscv, linux-kernel
Cc: stable
RISC-V THP splitting uses a temporary invalid PMD state where
pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
_PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
in-progress entry.
That temporary state no longer describes a user-accessible mapping, but
page_table_check currently treats it as one because the RISC-V PMD
user-accessibility test only checks whether the PMD is a leaf and has
user permissions.
As a result, when a PMD-sized anonymous THP is split during a COW fault,
page_table_check can account the invalid intermediate PMD as a live PMD
mapping, and then account the replacement PTE mappings again when the
split installs the PTE table. This leaves stale PMD accounting behind and
later triggers page_table_check failures such as a non-zero
anon_map_count when the folio is freed.
Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
accounting only considers leaf PMDs that still carry either
_PAGE_PRESENT or _PAGE_PROT_NONE. This preserves the THP split semantics
required by the MM code while preventing page_table_check from treating
invalid split PMDs as live user mappings.
With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
tools/testing/selftests/mm/cow completes successfully on RISC-V after
this change.
Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
Cc: stable@vger.kernel.org
Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
---
arch/riscv/include/asm/pgtable.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index a1a7c6520a095..ecea48affd7aa 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -976,7 +976,14 @@ static inline bool pte_user_accessible_page(struct mm_struct *mm, unsigned long
static inline bool pmd_user_accessible_page(struct mm_struct *mm, unsigned long addr, pmd_t pmd)
{
- return pmd_leaf(pmd) && pmd_user(pmd);
+ /*
+ * page_table_check() must ignore THP split invalidation entries created by
+ * pmd_mkinvalid(). These retain _PAGE_LEAF so pmd_present()/pmd_leaf() stay
+ * true during the split, but they no longer describe a user-accessible
+ * mapping once both _PAGE_PRESENT and _PAGE_PROT_NONE are cleared.
+ */
+ return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)) &&
+ (pmd_val(pmd) & _PAGE_LEAF) && pmd_user(pmd);
}
static inline bool pud_user_accessible_page(struct mm_struct *mm, unsigned long addr, pud_t pud)
--
2.39.5
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [RESEND PATCH] riscv: mm: exclude invalid THP PMDs from page table check
2026-05-23 4:20 ` Yunhui Cui
@ 2026-06-30 4:04 ` Andrew Morton
-1 siblings, 0 replies; 6+ messages in thread
From: Andrew Morton @ 2026-06-30 4:04 UTC (permalink / raw)
To: Yunhui Cui
Cc: paul.walmsley, palmer, aou, tongtiangen, pasha.tatashin,
linux-riscv, linux-kernel, stable
On Sat, 23 May 2026 12:20:52 +0800 Yunhui Cui <cuiyunhui@bytedance.com> wrote:
> RISC-V THP splitting uses a temporary invalid PMD state where
> pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
> _PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
> in-progress entry.
>
> That temporary state no longer describes a user-accessible mapping, but
> page_table_check currently treats it as one because the RISC-V PMD
> user-accessibility test only checks whether the PMD is a leaf and has
> user permissions.
>
> As a result, when a PMD-sized anonymous THP is split during a COW fault,
> page_table_check can account the invalid intermediate PMD as a live PMD
> mapping, and then account the replacement PTE mappings again when the
> split installs the PTE table. This leaves stale PMD accounting behind and
> later triggers page_table_check failures such as a non-zero
> anon_map_count when the folio is freed.
>
> Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
> accounting only considers leaf PMDs that still carry either
> _PAGE_PRESENT or _PAGE_PROT_NONE. This preserves the THP split semantics
> required by the MM code while preventing page_table_check from treating
> invalid split PMDs as live user mappings.
>
> With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
> tools/testing/selftests/mm/cow completes successfully on RISC-V after
> this change.
Thanks. This seems to have slipped through cracks.
AI review appears to have found a couple of related and serious issues
in this code.
https://sashiko.dev/#/patchset/20260523042052.35476-1-cuiyunhui@bytedance.com
perhaps you have time to take a look?
> Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
> ---
> arch/riscv/include/asm/pgtable.h | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
I'm not even slightly a riscv maintainer, but I'll queue this up for
some linux-next testing and so I can keep an eye on the issue, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [RESEND PATCH] riscv: mm: exclude invalid THP PMDs from page table check
@ 2026-06-30 4:04 ` Andrew Morton
0 siblings, 0 replies; 6+ messages in thread
From: Andrew Morton @ 2026-06-30 4:04 UTC (permalink / raw)
To: Yunhui Cui
Cc: paul.walmsley, palmer, aou, tongtiangen, pasha.tatashin,
linux-riscv, linux-kernel, stable
On Sat, 23 May 2026 12:20:52 +0800 Yunhui Cui <cuiyunhui@bytedance.com> wrote:
> RISC-V THP splitting uses a temporary invalid PMD state where
> pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
> _PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
> in-progress entry.
>
> That temporary state no longer describes a user-accessible mapping, but
> page_table_check currently treats it as one because the RISC-V PMD
> user-accessibility test only checks whether the PMD is a leaf and has
> user permissions.
>
> As a result, when a PMD-sized anonymous THP is split during a COW fault,
> page_table_check can account the invalid intermediate PMD as a live PMD
> mapping, and then account the replacement PTE mappings again when the
> split installs the PTE table. This leaves stale PMD accounting behind and
> later triggers page_table_check failures such as a non-zero
> anon_map_count when the folio is freed.
>
> Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
> accounting only considers leaf PMDs that still carry either
> _PAGE_PRESENT or _PAGE_PROT_NONE. This preserves the THP split semantics
> required by the MM code while preventing page_table_check from treating
> invalid split PMDs as live user mappings.
>
> With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
> tools/testing/selftests/mm/cow completes successfully on RISC-V after
> this change.
Thanks. This seems to have slipped through cracks.
AI review appears to have found a couple of related and serious issues
in this code.
https://sashiko.dev/#/patchset/20260523042052.35476-1-cuiyunhui@bytedance.com
perhaps you have time to take a look?
> Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
> ---
> arch/riscv/include/asm/pgtable.h | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
I'm not even slightly a riscv maintainer, but I'll queue this up for
some linux-next testing and so I can keep an eye on the issue, thanks.
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [External] Re: [RESEND PATCH] riscv: mm: exclude invalid THP PMDs from page table check
2026-06-30 4:04 ` Andrew Morton
@ 2026-06-30 4:42 ` yunhui cui
-1 siblings, 0 replies; 6+ messages in thread
From: yunhui cui @ 2026-06-30 4:42 UTC (permalink / raw)
To: Andrew Morton
Cc: paul.walmsley, palmer, aou, tongtiangen, pasha.tatashin,
linux-riscv, linux-kernel, stable
Hi Andrew,
On Tue, Jun 30, 2026 at 12:04 PM Andrew Morton
<akpm@linux-foundation.org> wrote:
>
> On Sat, 23 May 2026 12:20:52 +0800 Yunhui Cui <cuiyunhui@bytedance.com> wrote:
>
> > RISC-V THP splitting uses a temporary invalid PMD state where
> > pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
> > _PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
> > in-progress entry.
> >
> > That temporary state no longer describes a user-accessible mapping, but
> > page_table_check currently treats it as one because the RISC-V PMD
> > user-accessibility test only checks whether the PMD is a leaf and has
> > user permissions.
> >
> > As a result, when a PMD-sized anonymous THP is split during a COW fault,
> > page_table_check can account the invalid intermediate PMD as a live PMD
> > mapping, and then account the replacement PTE mappings again when the
> > split installs the PTE table. This leaves stale PMD accounting behind and
> > later triggers page_table_check failures such as a non-zero
> > anon_map_count when the folio is freed.
> >
> > Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
> > accounting only considers leaf PMDs that still carry either
> > _PAGE_PRESENT or _PAGE_PROT_NONE. This preserves the THP split semantics
> > required by the MM code while preventing page_table_check from treating
> > invalid split PMDs as live user mappings.
> >
> > With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
> > tools/testing/selftests/mm/cow completes successfully on RISC-V after
> > this change.
>
> Thanks. This seems to have slipped through cracks.
>
> AI review appears to have found a couple of related and serious issues
> in this code.
>
> https://sashiko.dev/#/patchset/20260523042052.35476-1-cuiyunhui@bytedance.com
>
> perhaps you have time to take a look?
Thanks Andrew, I looked into the Sashiko findings.
Both findings are pre-existing and do not appear to be regressions
introduced by this patch. This patch only changes
pmd_user_accessible_page() for page_table_check accounting.
The pmd_present() / _PAGE_LEAF / swap soft-dirty interaction looks worth
checking separately, especially with CONFIG_MEM_SOFT_DIRTY enabled. The
pud_present() / _PAGE_PROT_NONE case also looks like a pre-existing helper
inconsistency for PUD-size huge mappings.
I will investigate both separately and send follow-up fixes if they turn
out to be real issues.
>
> > Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
> > ---
> > arch/riscv/include/asm/pgtable.h | 9 ++++++++-
> > 1 file changed, 8 insertions(+), 1 deletion(-)
>
> I'm not even slightly a riscv maintainer, but I'll queue this up for
> some linux-next testing and so I can keep an eye on the issue, thanks.
>
>
>
Thanks,
Yunhui
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [External] Re: [RESEND PATCH] riscv: mm: exclude invalid THP PMDs from page table check
@ 2026-06-30 4:42 ` yunhui cui
0 siblings, 0 replies; 6+ messages in thread
From: yunhui cui @ 2026-06-30 4:42 UTC (permalink / raw)
To: Andrew Morton
Cc: paul.walmsley, palmer, aou, tongtiangen, pasha.tatashin,
linux-riscv, linux-kernel, stable
Hi Andrew,
On Tue, Jun 30, 2026 at 12:04 PM Andrew Morton
<akpm@linux-foundation.org> wrote:
>
> On Sat, 23 May 2026 12:20:52 +0800 Yunhui Cui <cuiyunhui@bytedance.com> wrote:
>
> > RISC-V THP splitting uses a temporary invalid PMD state where
> > pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
> > _PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
> > in-progress entry.
> >
> > That temporary state no longer describes a user-accessible mapping, but
> > page_table_check currently treats it as one because the RISC-V PMD
> > user-accessibility test only checks whether the PMD is a leaf and has
> > user permissions.
> >
> > As a result, when a PMD-sized anonymous THP is split during a COW fault,
> > page_table_check can account the invalid intermediate PMD as a live PMD
> > mapping, and then account the replacement PTE mappings again when the
> > split installs the PTE table. This leaves stale PMD accounting behind and
> > later triggers page_table_check failures such as a non-zero
> > anon_map_count when the folio is freed.
> >
> > Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
> > accounting only considers leaf PMDs that still carry either
> > _PAGE_PRESENT or _PAGE_PROT_NONE. This preserves the THP split semantics
> > required by the MM code while preventing page_table_check from treating
> > invalid split PMDs as live user mappings.
> >
> > With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
> > tools/testing/selftests/mm/cow completes successfully on RISC-V after
> > this change.
>
> Thanks. This seems to have slipped through cracks.
>
> AI review appears to have found a couple of related and serious issues
> in this code.
>
> https://sashiko.dev/#/patchset/20260523042052.35476-1-cuiyunhui@bytedance.com
>
> perhaps you have time to take a look?
Thanks Andrew, I looked into the Sashiko findings.
Both findings are pre-existing and do not appear to be regressions
introduced by this patch. This patch only changes
pmd_user_accessible_page() for page_table_check accounting.
The pmd_present() / _PAGE_LEAF / swap soft-dirty interaction looks worth
checking separately, especially with CONFIG_MEM_SOFT_DIRTY enabled. The
pud_present() / _PAGE_PROT_NONE case also looks like a pre-existing helper
inconsistency for PUD-size huge mappings.
I will investigate both separately and send follow-up fixes if they turn
out to be real issues.
>
> > Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
> > ---
> > arch/riscv/include/asm/pgtable.h | 9 ++++++++-
> > 1 file changed, 8 insertions(+), 1 deletion(-)
>
> I'm not even slightly a riscv maintainer, but I'll queue this up for
> some linux-next testing and so I can keep an eye on the issue, thanks.
>
>
>
Thanks,
Yunhui
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-06-30 4:43 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-23 4:20 [RESEND PATCH] riscv: mm: exclude invalid THP PMDs from page table check Yunhui Cui
2026-05-23 4:20 ` Yunhui Cui
2026-06-30 4:04 ` Andrew Morton
2026-06-30 4:04 ` Andrew Morton
2026-06-30 4:42 ` [External] " yunhui cui
2026-06-30 4:42 ` yunhui cui
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.