Re: [PATCH v2] x86/mm/pat: take cpa_lock around large-page collapse

[Mike Rapoport <rppt@kernel.org>]

On Wed, Jul 15, 2026 at 08:34:52PM +0200, Denis V. Lunev wrote:
> Loading and unloading modules concurrently on several CPUs on a KASAN
> build, with a short delay injected at the CPA page-table lookup to
> widen the window, faults within minutes:
> 
>   BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0
>   Write of size 8 at addr ffff888181139718 by task modprobe
>   ...
>   The buggy address belongs to the physical page:
>    pfn:0x181139 ... page_type: f2(table)

...

> Serialize the collapse - the PMD rebuild, TLB flush and PTE-table
> free - under cpa_lock, the same lock __change_page_attr() now takes
> unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on
> debug_pagealloc_enabled()"), so a concurrent walker can no longer
> hold a pointer into a table the collapse is about to free.
> 
> Fixes: 41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation")
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> Acked-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

I though I acked v1, but apparently I didn't :/

Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

-- 
Sincerely yours,
Mike.