* + mm-page_table_check-skip-zero-pages.patch added to mm-new branch
@ 2026-09-01 5:07 Andrew Morton
0 siblings, 0 replies; 2+ messages in thread
From: Andrew Morton @ 2026-09-01 5:07 UTC (permalink / raw)
To: mm-commits, vega, stable, enjou1224z, roxy520tt, akpm
The patch titled
Subject: mm/page_table_check: skip zero pages
has been added to the -mm mm-new branch. Its filename is
mm-page_table_check-skip-zero-pages.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-page_table_check-skip-zero-pages.patch
This patch will later appear in the mm-new branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Note, mm-new is a provisional staging ground for work-in-progress
patches, and acceptance into mm-new is a notification for others take
notice and to finish up reviews. Please do not hesitate to respond to
review feedback and post updated versions to replace or incrementally
fixup patches in mm-new.
The mm-new branch of mm.git is not included in linux-next
If a few days of testing in mm-new is successful, the patch will me moved
into mm.git's mm-unstable branch, which is included in linux-next
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: Zhiling Zou <roxy520tt@gmail.com>
Subject: mm/page_table_check: skip zero pages
Date: Tue, 21 Jul 2026 23:56:38 +0800
page_table_check_set() accounts pages by whether they are PageAnon(). The
shared zero page is a special page, not an ordinary file-backed page.
Read faults on private anonymous mappings can install many read-only PTEs
that point at the zero page, but page_table_check currently accounts them
in file_map_count.
That lets an unprivileged process populate enough zero-page mappings to
overflow file_map_count and trip the BUG_ON() in page_table_check_set().
Skip zero pages in page_table_check accounting. They do not need the
anonymous/file mapping conflict checks that page_table_check performs for
ordinary pages, and this keeps the existing counter size and page_ext
layout unchanged.
Link: https://lore.kernel.org/1f8848512d2e3ded944f8d595c29faee8fdaeab0.1784645969.git.roxy520tt@gmail.com
Fixes: df4e817b7108 ("mm: page table check")
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/page_table_check.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/page_table_check.c~mm-page_table_check-skip-zero-pages
+++ a/mm/page_table_check.c
@@ -67,7 +67,7 @@ static void page_table_check_clear(unsig
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
@@ -102,7 +102,7 @@ static void page_table_check_set(unsigne
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
_
Patches currently in -mm which might be from roxy520tt@gmail.com are
mm-page_table_check-skip-zero-pages.patch
^ permalink raw reply [flat|nested] 2+ messages in thread
* + mm-page_table_check-skip-zero-pages.patch added to mm-new branch
@ 2026-09-01 5:08 Andrew Morton
0 siblings, 0 replies; 2+ messages in thread
From: Andrew Morton @ 2026-09-01 5:08 UTC (permalink / raw)
To: mm-commits, vega, stable, liuye, enjou1224z, roxy520tt, akpm
The patch titled
Subject: mm/page_table_check: skip zero pages
has been added to the -mm mm-new branch. Its filename is
mm-page_table_check-skip-zero-pages.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-page_table_check-skip-zero-pages.patch
This patch will later appear in the mm-new branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Note, mm-new is a provisional staging ground for work-in-progress
patches, and acceptance into mm-new is a notification for others take
notice and to finish up reviews. Please do not hesitate to respond to
review feedback and post updated versions to replace or incrementally
fixup patches in mm-new.
The mm-new branch of mm.git is not included in linux-next
If a few days of testing in mm-new is successful, the patch will me moved
into mm.git's mm-unstable branch, which is included in linux-next
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: Zhiling Zou <roxy520tt@gmail.com>
Subject: mm/page_table_check: skip zero pages
Date: Tue, 21 Jul 2026 23:56:38 +0800
page_table_check_set() accounts pages by whether they are PageAnon(). The
shared zero page is a special page, not an ordinary file-backed page.
Read faults on private anonymous mappings can install many read-only PTEs
that point at the zero page, but page_table_check currently accounts them
in file_map_count.
That lets an unprivileged process populate enough zero-page mappings to
overflow file_map_count and trip the BUG_ON() in page_table_check_set().
Skip zero pages in page_table_check accounting. They do not need the
anonymous/file mapping conflict checks that page_table_check performs for
ordinary pages, and this keeps the existing counter size and page_ext
layout unchanged.
Link: https://lore.kernel.org/1f8848512d2e3ded944f8d595c29faee8fdaeab0.1784645969.git.roxy520tt@gmail.com
Fixes: df4e817b7108 ("mm: page table check")
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Cc: Ye Liu <liuye@kylinos.cn>
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/page_table_check.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/page_table_check.c~mm-page_table_check-skip-zero-pages
+++ a/mm/page_table_check.c
@@ -67,7 +67,7 @@ static void page_table_check_clear(unsig
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
@@ -102,7 +102,7 @@ static void page_table_check_set(unsigne
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
_
Patches currently in -mm which might be from roxy520tt@gmail.com are
mm-page_table_check-skip-zero-pages.patch
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-01 5:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-01 5:08 + mm-page_table_check-skip-zero-pages.patch added to mm-new branch Andrew Morton
-- strict thread matches above, loose matches on Subject: below --
2026-09-01 5:07 Andrew Morton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.