Re: [PATCH 17/22] mm: pagewalk: drop redundant address check for kernel mm walks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Removing the `addr >= TASK_SIZE` check in `walk_pte_range()` causes `ptdump` to clear valid kernel PMDs, leading to memory corruption and a kernel panic.
--

--- Patch [17]: [PATCH 17/22] mm: pagewalk: drop redundant address check for kernel mm walks ---
commit 85b512e55cb35ec57a18d00b67fbf62a68320627
Author: Kevin Brodsky <kevin.brodsky@arm.com>

mm: pagewalk: drop redundant address check for kernel mm walks

This commit removes the addr >= TASK_SIZE check from walk_pte_range() for
no-VMA walks. It relies entirely on mm_is_kernel() to determine whether
to use pte_offset_kernel() or pte_offset_map().

> diff --git a/mm/pagewalk.c b/mm/pagewalk.c
> index a3f47d1de3c5a..0dd9d4ad9b689 100644
> --- a/mm/pagewalk.c
> +++ b/mm/pagewalk.c
> @@ -68,17 +68,14 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
>  	if (walk->no_vma) {
>  		/*
>  		 * pte_offset_map() might apply user-specific validation.
> -		 * Indeed, on x86_64 the pmd entries set up by init_espfix_ap()
> -		 * fit its pmd_bad() check (_PAGE_NX set and _PAGE_RW clear),
> -		 * and CONFIG_EFI_PGT_DUMP efi_mm goes so far as to walk them.
>  		 */
> -		if (mm_is_kernel(walk->mm) || addr >= TASK_SIZE)
> +		if (mm_is_kernel(walk->mm))
>  			pte = pte_offset_kernel(pmd, addr);
>  		else
>  			pte = pte_offset_map(pmd, addr);

[Severity: High]
Does removing the addr >= TASK_SIZE check here cause ptdump to clear valid
kernel PMDs?

When tools like ptdump walk the address space (e.g. via
/sys/kernel/debug/page_tables/current_kernel), they may walk kernel addresses
using current->mm, which is a user mm. In this case, mm_is_kernel() returns
false, causing walk_pte_range() to use pte_offset_map() for kernel addresses.

On x86, pte_offset_map() eventually calls __pte_offset_map(), which validates
the PMD using pmd_bad(). If a kernel PMD (such as the espfix mapping) fails
this check because it intentionally lacks _PAGE_RW and sets _PAGE_NX,
__pte_offset_map() unconditionally clears it via pmd_clear_bad().

Since kernel page tables are shared via init_mm, clearing the PMD permanently
destroys the global espfix mapping. The next IRET to a 16-bit userspace
segment would then encounter a missing page table, triggering a Double Fault
kernel panic.

Should we keep the addr >= TASK_SIZE check to ensure kernel addresses always
use pte_offset_kernel(), even when walked via a user mm?

>  		if (pte) {
>  			err = walk_pte_range_inner(pte, addr, end, walk);
> -			if (!mm_is_kernel(walk->mm) && addr < TASK_SIZE)
> +			if (!mm_is_kernel(walk->mm))
>  				pte_unmap(pte);
>  		}
>  	} else {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-remove_pgtable_cdtor-v1-0-44be8a7685d7@arm.com?part=17