Re: [PATCH v9 06/10] arm64: Implement can_set_direct_map_range()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Lockless page table walk uses standard offset macros causing naked dereferences and unsafe multiple reads on folded levels.
- [High] The lockless walk loop fails to advance correctly when page-table levels are folded, silently skipping range checks.
--

commit de12d2156510af8d2a1f0b0adad3f96ba3b75cda
Author: Vincent Donnefort <vdonnefort@google.com>
Subject: arm64: Implement can_set_direct_map_range()

This commit adds an implementation for can_set_direct_map_range() on ARM64.
For systems where can_set_direct_map() is false, it verifies if a subregion
of the direct map is mapped at the last level by performing a lockless page
table walk.

> diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
> index 58898ae53f5d1..c59ef17eb0d06 100644
> --- a/arch/arm64/mm/pageattr.c
> +++ b/arch/arm64/mm/pageattr.c
[ ... ]
> +bool can_set_direct_map_range(struct page *page, unsigned long nr_pages)
> +{
[ ... ]
> +	/*
> +	 * If !can_set_direct_map() then no one can split blocks and it is safe
> +	 * to walk the page-table lockless.
> +	 */
> +	while (addr < end) {
> +		pud_t *pudp, pud;
> +		pmd_t *pmdp, pmd;
> +		pgd_t *pgdp;
> +		p4d_t *p4dp;
> +
> +		pgdp = pgd_offset_k(addr);
> +		if (pgd_none(READ_ONCE(*pgdp)))
> +			return false;
> +
> +		p4dp = p4d_offset(pgdp, addr);
[Severity: High]
Does this standard offset macro perform multiple reads of the same entry when
page-table levels are folded?

When lockless walk logic assumes all levels are live without checking for
folded levels, blindly applying multi-level READ_ONCE() causes the same
memory location to be read multiple times, risking stale or torn reads.

> +		if (p4d_none(READ_ONCE(*p4dp)))
> +			return false;
> +
> +		pudp = pud_offset(p4dp, addr);
> +		pud = READ_ONCE(*pudp);
> +		if (pud_none(pud) || pud_leaf(pud))
> +			return false;
> +
> +		pmdp = pmd_offset(pudp, addr);
[Severity: High]
Does this generic offset macro dereference the shared page table pointer
without using READ_ONCE()?

The generic pmd_offset() dereferences *pudp internally. This introduces a
naked dereference and data race during a lockless walk.

> +		pmd = READ_ONCE(*pmdp);
> +		if (pmd_none(pmd) || pmd_leaf(pmd))
> +			return false;
> +
> +		addr = pmd_addr_end(addr, end);
[Severity: High]
Can this fail to advance the loop correctly when page-table levels are
folded?

On a system with 2-level paging (like 64KB pages with 42-bit VA) where PMD
is folded, pmd_addr_end() unconditionally evaluates to the provided end
address.

If this occurs, the loop would only check the first entry and immediately skip
the remainder of the range, falsely returning true. This could allow modifying
direct map regions containing block mappings, subsequently triggering a
WARN_ON_ONCE and -EINVAL failure in pageattr_pmd_entry() because the
modification size won't align with the block size.

> +	}
> +
> +	return true;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902104712.2399797-1-vdonnefort@google.com?part=6