Re: [PATCH] mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Tue, Aug 11, 2026 at 12:50:17AM +0900, Hyunwoo Kim wrote:
> On Mon, Aug 10, 2026 at 12:19:54PM +0100, Lorenzo Stoakes (ARM) wrote:
> > Since it's 2026 + this is your first patch in mm AFAICT,
>
> Yeah, my home town is netdev :)

Ah I see :) well welcome, this is regardless a useful bug fix so it's
appreciated!

> > So it's only if you're at the end of the PMD range that it's a problem
> > right?
>
> Yes, or more precisely when nothing after it sets walk->action = ACTION_SUBTREE.

Yeah I word this a bit better in my proposed commit message :)

>
> > You should say that.
> >
> > The user-visible problem here is that you can end up calling the callbacks
> > too many times which explicitly breaks mincore.
> >
> > Given I had to decode this it does make me wonder if you fully understand
> > this or if it's just unclear language. This sort of word salad is very
> > LLM-ish :)
>
> The commit message was written with help from the lovely Claude. Not the
> most readable, admittedly :)

Yeah I did wonder :)

I'm totally fine with using an LLM to help with language, especially if English
is not your primary language, but obviously it can go... wrong :)

So will always feedback if the commit message is unclear.

LLMs seem to have a habit of constructing word salads that end up effectively
like 'the code in English' which ends up confusing more than helping.

Key thing is keeping things as short and clear as possible.

> > Is it possible to add a self test that does something like this or is it too
> > racey to be practical?
>
> It looks quite race dependent. Triggering it deterministically would need
> some of the race window widening tricks from exploit work, which I don't
> think belongs in a selftest. I can still write one if you'd like.

Yeah that's what I wondered about. It might still be useful even if it's racey,
as long as obviously the _test itself_ isn't flakey :) and also - it can't take
too long to run, either.

It'd be good to have a regression test for this.

>
> >
> > >
> > > Move the reset to the first statement of the loop body. walk_pud_range()
> > > has the same shape and gets the same change; walk_p4d_range() never looks
> > > at walk->action, so that hunk keeps the two functions in sync rather than
> > > fixing a second bug.
> >
> > Your commit message doesn't mention how you discovered this. If it was AI
> > suggesting it (whether locally or sashiko in reply to some review) you
> > should reference it.
> >
> > If it was simply hardcore code inspection then you should say so too :)
>
> It was found by accident while fuzzing a different subsystem. Either way,
> the fuzzer itself was written by AI, so,
>
> Assisted-by: Claude:claude-opus-5

Ack thanks :)

>
> >
> > >
> > > Fixes: 3b89863c3fa4 ("mm/pagewalk: fix race between concurrent split and refault")
> > > Cc: stable@vger.kernel.org
> >
> > This all seems right.
> >
> > > Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> >
> > The fix itself looks right, but you need to address the other feedback and
> > respin (also please send a respin with at least 1 day's delay).
>
> OK, will do.

Great thanks!

>
>
> Best regards,
> Hyunwoo Kim

--
Cheers, Lorenzo