Linux s390 Architecture development
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Kevin Brodsky" <kevin.brodsky@arm.com>
Cc: linux-s390@vger.kernel.org, "Vasily Gorbik" <gor@linux.ibm.com>,
	"Alexander Gordeev" <agordeev@linux.ibm.com>,
	"Heiko Carstens" <hca@linux.ibm.com>
Subject: Re: [PATCH 04/22] mm: use mm_is_kernel() in generic page table code
Date: Tue, 14 Jul 2026 14:28:14 +0000	[thread overview]
Message-ID: <20260714142815.743D41F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260714-remove_pgtable_cdtor-v1-4-44be8a7685d7@arm.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] apply_to_pte_range() routes all kernel MMs to pte_alloc_kernel_track(), which explicitly hardcodes &init_mm, leading to incorrect locking and mm attribution.
--

--- Patch [4]: [PATCH 04/22] mm: use mm_is_kernel() in generic page table code ---
commit 94fec0def7956a4362140e84c87769a3c5a046b2
Author: Kevin Brodsky <kevin.brodsky@arm.com>

mm: use mm_is_kernel() in generic page table code

Generic page-table allocation, constructor and walker code uses
init_mm comparisons to select kernel page table handling. Use
mm_is_kernel() instead so kernel-owned mm's can share that handling
once they are marked with MMF_KERNEL.

> diff --git a/mm/memory.c b/mm/memory.c
> index d5e87624f6920..c0244c0b07567 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
[ ... ]
> @@ -3394,13 +3394,13 @@ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
>  	spinlock_t *ptl;
>  
>  	if (create) {
> -		mapped_pte = pte = (mm == &init_mm) ?
> +		mapped_pte = pte = mm_is_kernel(mm) ?
>  			pte_alloc_kernel_track(pmd, addr, mask) :

[Severity: Medium]
If a non-init_mm kernel MM (like efi_mm) has MMF_KERNEL set in the future,
will this route it to pte_alloc_kernel_track() which hardcodes init_mm?

Looking at __pte_alloc_kernel() in mm/memory.c, which 
pte_alloc_kernel_track() calls:

int __pte_alloc_kernel(pmd_t *pmd)
{
        pte_t *new = pte_alloc_one_kernel(&init_mm);
        if (!new)
                return -ENOMEM;

        spin_lock(&init_mm.page_table_lock);
...

Since __pte_alloc_kernel() drops the mm context and explicitly locks
init_mm.page_table_lock instead of the target MM's lock, would this
lead to data races during concurrent page table modifications for other
kernel MMs?

>  			pte_alloc_map_lock(mm, pmd, addr, &ptl);
>  		if (!pte)
>  			return -ENOMEM;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-remove_pgtable_cdtor-v1-0-44be8a7685d7@arm.com?part=4

  reply	other threads:[~2026-07-14 14:28 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-14 14:03 [PATCH 00/22] Simplify special kernel page table handling Kevin Brodsky
2026-07-14 14:03 ` [PATCH 01/22] mm: drop unused __mm_flags_set_mask_bits_word() Kevin Brodsky
2026-07-14 14:03 ` [PATCH 02/22] mm: move mm_flags helpers to mm_types.h Kevin Brodsky
2026-07-14 14:03 ` [PATCH 03/22] mm: introduce MMF_KERNEL flag and set it for init_mm Kevin Brodsky
2026-07-14 14:47   ` Dave Hansen
2026-07-14 15:04     ` Lorenzo Stoakes (ARM)
2026-07-14 14:03 ` [PATCH 04/22] mm: use mm_is_kernel() in generic page table code Kevin Brodsky
2026-07-14 14:28   ` sashiko-bot [this message]
2026-07-14 14:03 ` [PATCH 05/22] arm64: mm: use mm_is_kernel() for kernel mm checks Kevin Brodsky
2026-07-14 14:03 ` [PATCH 06/22] loongarch: mm: use mm_is_kernel() in switch_mm_irqs_off() Kevin Brodsky
2026-07-14 14:03 ` [PATCH 07/22] parisc: mm: use mm_is_kernel() for kernel mm checks Kevin Brodsky
2026-07-14 14:03 ` [PATCH 08/22] powerpc: " Kevin Brodsky
2026-07-14 14:03 ` [PATCH 09/22] s390: " Kevin Brodsky
2026-07-14 14:03 ` [PATCH 10/22] sparc: " Kevin Brodsky
2026-07-14 14:04 ` [PATCH 11/22] um: mm: use mm_is_kernel() in TLB sync Kevin Brodsky
2026-07-14 14:04 ` [PATCH 12/22] x86/mm: use mm_is_kernel() for kernel mm checks Kevin Brodsky
2026-07-14 15:09   ` Dave Hansen
2026-07-14 14:04 ` [PATCH 13/22] mm: account page table pages when allocated Kevin Brodsky
2026-07-14 14:54   ` sashiko-bot
2026-07-14 14:04 ` [PATCH 14/22] mm: set page table page type " Kevin Brodsky
2026-07-14 14:54   ` sashiko-bot
2026-07-14 15:16   ` Vishal Moola
2026-07-14 14:04 ` [PATCH 15/22] mm: only initialise pt_share_count for user pgtables Kevin Brodsky
2026-07-14 14:04 ` [PATCH 16/22] efi: mark efi_mm as a kernel mm Kevin Brodsky
2026-07-14 15:16   ` sashiko-bot
2026-07-14 14:04 ` [PATCH 17/22] mm: pagewalk: drop redundant address check for kernel mm walks Kevin Brodsky
2026-07-14 14:42   ` sashiko-bot
2026-07-14 14:04 ` [PATCH 18/22] arm64: mm: drop explicit mm_is_efi() check in contpte Kevin Brodsky
2026-07-14 14:04 ` [PATCH 19/22] x86/tboot: mark tboot_mm as a kernel mm Kevin Brodsky
2026-07-14 15:19   ` Dave Hansen
2026-07-14 14:04 ` [PATCH 20/22] arm64: mm: drop ctor/dtor calls for kernel page tables Kevin Brodsky
2026-07-14 14:56   ` sashiko-bot
2026-07-14 14:04 ` [PATCH 21/22] arm: mm: drop ctor call " Kevin Brodsky
2026-07-14 14:04 ` [PATCH 22/22] riscv: mm: drop ctor/dtor calls " Kevin Brodsky

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260714142815.743D41F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=agordeev@linux.ibm.com \
    --cc=gor@linux.ibm.com \
    --cc=hca@linux.ibm.com \
    --cc=kevin.brodsky@arm.com \
    --cc=linux-s390@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox