Re: [PATCH RFC v2 07/20] mm/pgtable: define (pgd|p4d|pud)_offset_lockless() for folded page tables

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Use-After-Free in GUP-fast on dynamically folded architectures (RISC-V SV39) due to flawed generic lockless page table offset macros.
--

--- Patch [7]: [PATCH RFC v2 07/20] mm/pgtable: define (pgd|p4d|pud)_offset_lockless() for folded page tables ---
commit 235a6b06e94a41ff4c56118e36e869516151cea9
Author: David Hildenbrand (Arm) <david@kernel.org>

mm/pgtable: define (pgd|p4d|pud)_offset_lockless() for folded page tables

The patch provides p4d_offset_lockless(), pmd_offset_lockless(), and
pud_offset_lockless() for static folded page tables to ignore the passed
value and return the pointer. This avoids returning a pointer to the stack
value like the default handlers do.

> diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
> index 6c9bca78047c4..5a2b0a81ae197 100644
> --- a/include/asm-generic/pgtable-nopud.h
> +++ b/include/asm-generic/pgtable-nopud.h
[ ... ]
> @@ -47,6 +47,13 @@ static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
>  }
>  #define pud_offset pud_offset
>  
> +static inline pud_t *pud_offset_lockless(p4d_t *p4dp, p4d_t p4d,
> +		unsigned long address)
> +{
> +	return (pud_t *)p4dp;
> +}
> +#define pud_offset_lockless pud_offset_lockless

[Severity: Critical]
This is a pre-existing issue, but does this fix leave dynamically folded
architectures like RISC-V SV39 vulnerable to a use-after-free?

The generic fallback macro in include/linux/pgtable.h still passes the address
of a local stack variable:

#define pud_offset_lockless(p4dp, p4d, address) pud_offset(&(p4d), address)

On RISC-V SV39, PUD is folded dynamically in arch/riscv/mm/pgtable.c:

pud_t *pud_offset(p4d_t *p4d, unsigned long address)
{
	if (pgtable_l4_enabled)
		return p4d_pgtable(p4dp_get(p4d)) + pud_index(address);

	return (pud_t *)p4d;
}

Since pgtable_l4_enabled is false on SV39, pud_offset() returns the pointer it
was passed, which is the stack pointer from the generic pud_offset_lockless()
macro.

When gup_fast_pud_leaf() in mm/gup.c executes its concurrent modification
check, it reads the stale stack variable instead of the actual page table:

	if (unlikely(pud_val(orig) != pud_val(pudp_get(pudp)))) {
		gup_put_folio(folio, refs, flags);
		return 0;
	}

Because it reads the isolated stack variable, the check trivially passes,
allowing GUP-fast to pin and return a concurrently freed 1GB huge page.

Could a similar lockless override be applied for dynamically folded
architectures to prevent this?

> +
>  #define pud_val(x)				(p4d_val((x).p4d))
>  #define __pud(x)				((pud_t) { __p4d(x) })

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-dummy_ptxp3-v2-0-d9e4bad31e0a@arm.com?part=7