From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 00227C3DA49 for ; Thu, 25 Jul 2024 12:43:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=dsWWhrs54tGgnQnWrJt4Z6K105Z5G75WuVw7li7Bl7s=; b=QExat4uenn3ypw3yGtqEClKBCd L8mDOIosDLfnGb9g0oyel+GGnSQKWo3Etn6z01rRLHYXEBMjiqNELYOL6ulBfnew2iaapNpKvFmoS tf5aoyoXvGREAiUqVHqHozVWmGAjv0DleJ4fWWoPI6Ul0+xEz3sL/YvNYdmgTO84SWhq8jIT229I1 JixK74RkM98enKkhQs/QLDMujNXNCVc+aE/rutYMQueDDkKZYt4LG9W7jiCx2qqXQ86z1FAiY5ugH ZqrzJKSwbYbqtwh6kOHlLMzB5IQOp5xROLHp9PS0adIH9oqQf6e5sD/OgImQg9U6rcPthJUEDwgZG L2xQpiEg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sWxom-00000000xiB-1hEv; Thu, 25 Jul 2024 12:43:36 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sWxoM-00000000xcQ-3Ecc for linux-arm-kernel@lists.infradead.org; Thu, 25 Jul 2024 12:43:12 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 10B586140C; Thu, 25 Jul 2024 12:43:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A0C9C4AF0B; Thu, 25 Jul 2024 12:43:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1721911389; bh=JeI4DQ9YoM8V7YYCXQrDN8/023QOt7/fH91jyaS5oak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vQyG8H8krsHT94wY1Pt8D7oDACLmhwz3JziX3v5NaJYPzUWelLfBvCeP9PtPuu6aD N2t34TmBvnHqjeoXTzlpf335SpeuUNFB39GuTEUbwFCCdotA5zr9NHfQoKTqHTDnPR Qtnok9XaMxBGCGXjy9+hQeX7nw6jiZ/C8V5dVkDnCBmDWlbx7CkYmhALF0nXn1bO+I CKWc+qL3NqgkgJ7oIJrLoyErPeDHBnrLFx3xIPAoQ12FAUj5aHGUwrmLT3DL0wpDS6 WE/U+DFTinfN0TmbMhYrgwgChpZrFn7FWSvaop3Vj3Rm5TUy20jRiI//DFODhsAbMy Zhsg6Bv1RZ+zQ== From: Will Deacon To: linux-arm-kernel@lists.infradead.org, Will Deacon Cc: catalin.marinas@arm.com, kernel-team@android.com, Ard Biesheuvel , stable@vger.kernel.org, Asahi Lina Subject: Re: [PATCH] arm64: mm: Fix lockless walks with static and dynamic page-table folding Date: Thu, 25 Jul 2024 13:43:00 +0100 Message-Id: <172191005619.4039653.10092210051964314188.b4-ty@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20240725090345.28461-1-will@kernel.org> References: <20240725090345.28461-1-will@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240725_054310_880343_75552E6D X-CRM114-Status: GOOD ( 11.82 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, 25 Jul 2024 10:03:45 +0100, Will Deacon wrote: > Lina reports random oopsen originating from the fast GUP code when > 16K pages are used with 4-level page-tables, the fourth level being > folded at runtime due to lack of LPA2. > > In this configuration, the generic implementation of > p4d_offset_lockless() will return a 'p4d_t *' corresponding to the > 'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range(). > This is normally fine, but when the fourth level of page-table is folded > at runtime, pud_offset_lockless() will offset from the address of the > 'p4d_t' to calculate the address of the PUD in the same page-table page. > This results in a stray stack read when the 'p4d_t' has been allocated > on the stack and can send the walker into the weeds. > > [...] Applied to arm64 (for-next/core), thanks! [1/1] arm64: mm: Fix lockless walks with static and dynamic page-table folding https://git.kernel.org/arm64/c/36639013b346 Cheers, -- Will https://fixes.arm64.dev https://next.arm64.dev https://will.arm64.dev