Re: [PATCH RFC v2 07/20] mm/pgtable: define (pgd|p4d|pud)_offset_lockless() for folded page tables

[Yeoreum Yun <yeoreum.yun@arm.com>]

On Wed, Jul 22, 2026 at 03:58:49PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Critical] Use-After-Free in GUP-fast on dynamically folded architectures (RISC-V SV39) due to flawed generic lockless page table offset macros.
> --
> 
> --- Patch [7]: [PATCH RFC v2 07/20] mm/pgtable: define (pgd|p4d|pud)_offset_lockless() for folded page tables ---
> commit 235a6b06e94a41ff4c56118e36e869516151cea9
> Author: David Hildenbrand (Arm) <david@kernel.org>
> 
> mm/pgtable: define (pgd|p4d|pud)_offset_lockless() for folded page tables
> 
> The patch provides p4d_offset_lockless(), pmd_offset_lockless(), and
> pud_offset_lockless() for static folded page tables to ignore the passed
> value and return the pointer. This avoids returning a pointer to the stack
> value like the default handlers do.
> 
> > diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
> > index 6c9bca78047c4..5a2b0a81ae197 100644
> > --- a/include/asm-generic/pgtable-nopud.h
> > +++ b/include/asm-generic/pgtable-nopud.h
> [ ... ]
> > @@ -47,6 +47,13 @@ static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
> >  }
> >  #define pud_offset pud_offset
> >  
> > +static inline pud_t *pud_offset_lockless(p4d_t *p4dp, p4d_t p4d,
> > +		unsigned long address)
> > +{
> > +	return (pud_t *)p4dp;
> > +}
> > +#define pud_offset_lockless pud_offset_lockless
> 
> [Severity: Critical]
> This is a pre-existing issue, but does this fix leave dynamically folded
> architectures like RISC-V SV39 vulnerable to a use-after-free?
> 
> The generic fallback macro in include/linux/pgtable.h still passes the address
> of a local stack variable:
> 
> #define pud_offset_lockless(p4dp, p4d, address) pud_offset(&(p4d), address)
> 
> On RISC-V SV39, PUD is folded dynamically in arch/riscv/mm/pgtable.c:
> 
> pud_t *pud_offset(p4d_t *p4d, unsigned long address)
> {
> 	if (pgtable_l4_enabled)
> 		return p4d_pgtable(p4dp_get(p4d)) + pud_index(address);
> 
> 	return (pud_t *)p4d;
> }
> 
> Since pgtable_l4_enabled is false on SV39, pud_offset() returns the pointer it
> was passed, which is the stack pointer from the generic pud_offset_lockless()
> macro.
> 
> When gup_fast_pud_leaf() in mm/gup.c executes its concurrent modification
> check, it reads the stale stack variable instead of the actual page table:
> 
> 	if (unlikely(pud_val(orig) != pud_val(pudp_get(pudp)))) {
> 		gup_put_folio(folio, refs, flags);
> 		return 0;
> 	}
> 
> Because it reads the isolated stack variable, the check trivially passes,
> allowing GUP-fast to pin and return a concurrently freed 1GB huge page.
> 
> Could a similar lockless override be applied for dynamically folded
> architectures to prevent this?

concurrent modification check doesn't lose the meaning since pudp is read
again and compare with orig and isolated stack variable doesn't connect
to trivially passes. So, this is ignorable.

-- 
Sincerely,
Yeoreum Yun