Please backport aedf2efd1897 ("mm/pagewalk: fix stale walk->action escaping walk_pmd_range()") to 6.12.y

Please backport aedf2efd1897 ("mm/pagewalk: fix stale walk->action escaping walk_pmd_range()") to 6.12.y

[JongHyuk Kim(MalHyuk)]

Please consider aedf2efd1897 ("mm/pagewalk: fix stale walk->action escaping
walk_pmd_range()") for 6.12.y.

It fixes 3b89863c3fa4 ("mm/pagewalk: fix race between concurrent split and
refault"), which is in 6.12.y, but the fix has no Cc: stable so it was never
picked up. 6.12.112 and 6.12.113 still have the pre-fix layout: in
walk_pmd_range() the "walk->action = ACTION_SUBTREE" assignment sits below
the pmd_none() block, so the continue in that block skips it and a stale
ACTION_AGAIN survives into walk_pud_range(), which then re-walks the whole
PUD with walk->private never reset. Same thing in walk_pud_range().

I hit it on the stock 6.12.112 KASAN build:

  BUG: KASAN: use-after-free in __mincore_unmapped_range+0x1ca/0x240
  Write of size 1 at addr ffff888105ae2000 by task exp_root/191
  CPU: 0 UID: 1000 PID: 191 Comm: exp_root Not tainted 6.12.112-dirty #1
   __mincore_unmapped_range+0x1ca/0x240
   mincore_unmapped_range+0x5d/0xd0
   walk_pgd_range+0x8b0/0x1b10
   __walk_page_range+0x418/0x600
   walk_page_range+0x2b1/0x620
   do_mincore+0x1a1/0x350
   __x64_sys_mincore+0x1aa/0x390

The -dirty suffix comes from the kernelCTF build, the tree itself is
unmodified 6.12.112.

Reproducer shape, everything unprivileged (uid 1000): map a memfd so that a
mincore() range of 4096 pages straddles a 1G boundary with exactly one PMD
past the boundary, have a second process call MADV_COLLAPSE on that PMD so
collapse_file() -> retract_page_tables() clears the PMD without holding
mmap_lock, and spin on mincore() in the first process. The raced PMD has to
be the last one in the range, otherwise the next non-none PMD resets
walk->action and the leak is lost. It takes about a minute on a 2 vCPU
guest. I can send the .c off-list if that is useful.

Note that 6.12.y has no CONFIG_PT_RECLAIM, so the MADV_DONTNEED path used by
CVE-2026-89754 does not reach this on 6.12, but MADV_COLLAPSE does.

I only checked 6.12.y. Any stable tree that carries 3b89863c3fa4 without
aedf2efd1897 should be in the same state.

Thanks,
JongHyuk Kim(MalHyuk)

Re: Please backport aedf2efd1897 ("mm/pagewalk: fix stale walk->action escaping walk_pmd_range()") to 6.12.y

[Sasha Levin]

> Please consider aedf2efd1897 ("mm/pagewalk: fix stale walk->action escaping
> walk_pmd_range()") for 6.12.y.

Queued for 6.12, thanks.

-- 
Thanks,
Sasha