From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91AAF330656 for ; Mon, 10 Aug 2026 15:55:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786377344; cv=none; b=WJD62hopy7YLDOpMTQasBlPat9ihit/em2Ewa8GAlkIm7WMImncBFnitp9THkj0DYNYWQMKKGA+/FYJyI3EFwXOA0bXrZUpEa+neC9Q8Xjpqke+l7u/xXVxOtu6ouXp61ycazZOGrXVe5L/gjySPYfYRx29bTUC9+xhAzUbDJ+w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786377344; c=relaxed/simple; bh=nOFrt6pX2UwikI+9wqoJfAtsdR0PpzzASBSsjIMcp6c=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=j69wcV05AA1wXRwcGWg4DiGd4xoHa+b+UFzuP/DQFm75w+OwTE+iMgDtoPANsKZb/5GspqXQFx/kiwUcbGW25qbkUnliituMcUw3dBl/mJmujCihrU+y+Y3udthqKDaZhlIhWhPDB/dFtyOlJaNBx/wMBVRJ/z/NFj7CvTQbFQQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=B8FFCC3Z; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="B8FFCC3Z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D77F51F000E9; Mon, 10 Aug 2026 15:55:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786377343; bh=nOFrt6pX2UwikI+9wqoJfAtsdR0PpzzASBSsjIMcp6c=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=B8FFCC3ZMPednQD/1EUdyJySPIXs0HvY1XWzQ4usA7MCJQlumC+jb89mgmpXeAl0s ZO4x5YlmLZZVzg2bN5KOkxlHcA7Jt7+hRPovbsgiLTDTo8wRVyCynkuygTFNlt6esq 5vgJ8Ks975Isr3s1pmRN5cpLA+NxUOwFX1jgWSjeHIdBV1LkQVymawVsxmCGuGIX3S 1YtUXGJ/679syTX6H3pJ4h10c9Llt4bGunQaS/hgtziB1tE/d+VndITjYxkwU3QMcG e21rR4KlfMHeDRitxt8Ia2PDJee/1gTKWsceLs8gerPZbvcfRhuXCJgk9uYABYnrTF m3axSva1t19Jg== Date: Mon, 10 Aug 2026 16:55:25 +0100 From: "Lorenzo Stoakes (ARM)" To: Hyunwoo Kim Cc: akpm@linux-foundation.org, david@kernel.org, liam@infradead.org, vbabka@kernel.org, rppt@kernel.org, surenb@google.com, mhocko@suse.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Aug 11, 2026 at 12:50:17AM +0900, Hyunwoo Kim wrote: > On Mon, Aug 10, 2026 at 12:19:54PM +0100, Lorenzo Stoakes (ARM) wrote: > > Since it's 2026 + this is your first patch in mm AFAICT, > > Yeah, my home town is netdev :) Ah I see :) well welcome, this is regardless a useful bug fix so it's appreciated! > > So it's only if you're at the end of the PMD range that it's a problem > > right? > > Yes, or more precisely when nothing after it sets walk->action = ACTION_SUBTREE. Yeah I word this a bit better in my proposed commit message :) > > > You should say that. > > > > The user-visible problem here is that you can end up calling the callbacks > > too many times which explicitly breaks mincore. > > > > Given I had to decode this it does make me wonder if you fully understand > > this or if it's just unclear language. This sort of word salad is very > > LLM-ish :) > > The commit message was written with help from the lovely Claude. Not the > most readable, admittedly :) Yeah I did wonder :) I'm totally fine with using an LLM to help with language, especially if English is not your primary language, but obviously it can go... wrong :) So will always feedback if the commit message is unclear. LLMs seem to have a habit of constructing word salads that end up effectively like 'the code in English' which ends up confusing more than helping. Key thing is keeping things as short and clear as possible. > > Is it possible to add a self test that does something like this or is it too > > racey to be practical? > > It looks quite race dependent. Triggering it deterministically would need > some of the race window widening tricks from exploit work, which I don't > think belongs in a selftest. I can still write one if you'd like. Yeah that's what I wondered about. It might still be useful even if it's racey, as long as obviously the _test itself_ isn't flakey :) and also - it can't take too long to run, either. It'd be good to have a regression test for this. > > > > > > > > > Move the reset to the first statement of the loop body. walk_pud_range() > > > has the same shape and gets the same change; walk_p4d_range() never looks > > > at walk->action, so that hunk keeps the two functions in sync rather than > > > fixing a second bug. > > > > Your commit message doesn't mention how you discovered this. If it was AI > > suggesting it (whether locally or sashiko in reply to some review) you > > should reference it. > > > > If it was simply hardcore code inspection then you should say so too :) > > It was found by accident while fuzzing a different subsystem. Either way, > the fuzzer itself was written by AI, so, > > Assisted-by: Claude:claude-opus-5 Ack thanks :) > > > > > > > > > Fixes: 3b89863c3fa4 ("mm/pagewalk: fix race between concurrent split and refault") > > > Cc: stable@vger.kernel.org > > > > This all seems right. > > > > > Signed-off-by: Hyunwoo Kim > > > > The fix itself looks right, but you need to address the other feedback and > > respin (also please send a respin with at least 1 day's delay). > > OK, will do. Great thanks! > > > Best regards, > Hyunwoo Kim -- Cheers, Lorenzo