Re: [PATCH RFC v2 08/20] mm: vmscan: remove stack copy address of pud pass in wallk_pud_range()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `pmd_same` concurrency check in `walk_pte_range` is bypassed because it receives a pointer to a stack variable (`&val`) instead of the actual PMD entry.
--

--- Patch [8]: [PATCH RFC v2 08/20] mm: vmscan: remove stack copy address of pud pass in wallk_pud_range() ---
commit 509a7a22f2cecb4a110a42ba30c39b2954f718fe
Author: Yeoreum Yun <yeoreum.yun@arm.com>

mm: vmscan: remove stack copy address of pud pass in wallk_pud_range()

This commit replaces passing the address of a stack copy of a pXd to
walk_pmd_range() with passing the pud pointer directly. This change prepares
the codebase for generic compile-time folded page tables.

> diff --git a/mm/vmscan.c b/mm/vmscan.c
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -3727,7 +3727,7 @@ static int walk_pud_range(p4d_t *p4d, unsigned long start, unsigned long end,
>  		if (!pud_present(val) || WARN_ON_ONCE(pud_leaf(val)))
>  			continue;
>  
> -		walk_pmd_range(&val, addr, next, args);
> +		walk_pmd_range(pud + i, addr, next, args);

[Severity: High]
This is a pre-existing issue, but should walk_pmd_range() in mm/vmscan.c
also be updated to avoid passing a stack copy to walk_pte_range()?

In walk_pmd_range(), a stack copy of the PMD entry is created and its
address is passed to walk_pte_range():

    if (!walk_pte_range(&val, addr, next, args))

Inside walk_pte_range(), this pointer is used for a concurrency check:

    if (unlikely(!pmd_same(pmdval, pmdp_get_lockless(pmd)))) {

Because pmd points to the unchanging stack variable, pmdp_get_lockless(pmd)
reads the frozen value, causing the pmd_same() check to always succeed.

Could this bypass allow the MGLRU walker to iterate over a detached or freed
PTE page table if a concurrent operation like MADV_DONTNEED clears the PMD,
potentially resulting in use-after-free or data corruption when
walk_update_folio() modifies flags on reallocated folios?

>  
>  		if (need_resched() || walk->batched >= MAX_LRU_BATCH) {
>  			end = (addr | ~PUD_MASK) + 1;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-dummy_ptxp3-v2-0-d9e4bad31e0a@arm.com?part=8