From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42E452874F8 for ; Wed, 29 Jul 2026 01:21:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785288106; cv=none; b=U3a7F8KaXrPJFt5AJlwZRdFv4csiUawQtZ1rYNo/aM0SdnYghOhSdEZ54rU+PBykRXlNKjUym75BhG+zfLLWdS0fIH357AxH7AlUHhLDrtL52IEEErp1r73zlBPYaljBzbMzm53TMdFFS1ctkUmCwpx1d0PZtXdhRPbw/ecuqU0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785288106; c=relaxed/simple; bh=n/qVBJM1nmz/9ofzwmMzzjTfo+bSl1LG/ixWGp6Olw0=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=EtskPITBZsMIWvQAujJFrPvbB9q/ptP0nHWdgKSXh73Pgx/lrwFt7wU7qMcUknhFDv5e9uK/IiP6EZpPVcESQ2qw3CqIrd/hTd+9QODwx6DkhyGnaLBvoKhlgdSGeFKt9vgKr1IGLL/8pr/1l6HxRKMoR56Ya0RiLxWEJHi2krE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bCUwdlq1; arc=none smtp.client-ip=209.85.221.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bCUwdlq1" Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-47c6e9a694bso295223f8f.1 for ; Tue, 28 Jul 2026 18:21:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785288103; x=1785892903; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=X/yNUmJXbEn4d1QfM+/JRPejjSzhIBZ/Fs+rqUcpp98=; b=bCUwdlq16ptr0XaASs8CWB1vTPWyNuseeaXIElFjsU+KJQ6u+5P58/dvTzbKPKK80l N0HpEf5Sj7k2byCWV3cvrPOI3zgLO7oCw8+9X15lzJIXOzmk9OToDd8UYpqDnX9tqoKM aJEkDUcOnWsbwcInaNg2APKmPrtxjRg/ujasFK2uAbfl487R1Cq8XCmxqUq1gdJIwC0N P04/eBTFZOb7FIyaZXhvecEg9LRF2n90OXcS/294lM6WykTtWMLP0HfTFXLS49kIDfJz ZO9mwaScRivn6nX04+YAgd9IuvDXpFTcHKyBy2mTKDgh1IqBGJXlT4op4SSAzqTQntCL LvAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785288103; x=1785892903; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=X/yNUmJXbEn4d1QfM+/JRPejjSzhIBZ/Fs+rqUcpp98=; b=XMn0KBJ6hwgvqbVhT6hTPK6bVBn7FFiEJV95yobF6h7kGgQ4QXhwOaVrIpqLqd6el8 q12+CojaJ8SUIMQnB/VPLNHj8s61ufHxGSODNcRQGwzCjljwcLjzzANEc/WxBXD/E9qH sMZ0fPgeBHeX9SzaFyUbCwqN6QJAE08PT69rOH0pRMl/NkbR2OluG9ROPjlLW11GaN/1 eocPBH4E/JNU3/AVhQTkBnkEL2Jf88RevITs0NxOHNwAnTPGoi5HFjUjaT6DuhcvZRvK 5cpy45ju/0S7Z1ntXuJvMfNVj5F+2FcBw1zfIEqZvjAjXOiBcfv7rH+Ujr+N4x8oeDB6 38jQ== X-Forwarded-Encrypted: i=1; AHgh+RqbibGlqsP3HEOXY2LRhfCt9B1Eyvf9vFzcXdDcvl00NZXSF4weIDIr28tgJhMdRI+SLjEo+czBmNnE5cI=@vger.kernel.org X-Gm-Message-State: AOJu0YxI8RH0kUJZyUb7DPppoADlXvlxzDtvZAJEgZegvbxWDMU5fka0 vxhSN9Z5cm2mQLi/+GmAoW6YNg6o2IUDJQ3KQNLrkVDSexLAoqzRoXGi X-Gm-Gg: AR+sD110qXHaIJ5dLaWGIA4GcblSTx7lNlRemKEumiFafuaDPHIGEZbjF/B+aCUgPxz VFS26eTBNS8uDIL9kgHFbXuoXmGiw5VzzrP08Cl5QhSbj1enelERx9f0kt0dp+sOptq+2GXui5J zLkRwihaxABL5MLA+KQdTDUdr6HbiDbfyoYU5JwudQRmPlEslURiYmlzMDNtuGbCeTelSk3ilwR OaLaCMO50uqKZtrfkqm+d02LShWjAFl1mRJbexGZ5ASuUV5MtCUbPqD+ZE8URSpjz7MkZCOEgro QkwtzBy1GdE6GSioS0j8oBmVcQBR7wZf/nVCoil66DekzxqlweBVUOGhYgEZDClXxSEj7d4hYnq 2VmwNgslf/15hBoXsD1VeoqO/xaWx7smn5vdx5JMKgFGTXiNHkdtMAf21QfQPU85LvS22lTlN55 zHFkCU/AGOK5jUa+Gj50bGEM8sFwcSyUgImvRKsdRsSr6F/eijZ6odvfu0qdcqcRMatdFELlyMx Vrrg8aq6/JH8bQMSNQ976f3AC4h2WNTNKePpKXaBiO43+kssVML/TQjlP/o+V7jBzqFw9Ixm/5s pxBKmR1bBOPaqAMtgSEa2NxgfbgXlHygbnk2sD0Lzgdm0UNI7CybtBaLieDA7kukRfE1 X-Received: by 2002:a5d:5f42:0:b0:47f:aead:f81b with SMTP id ffacd0b85a97d-47fb1e9381amr4471613f8f.21.1785288103396; Tue, 28 Jul 2026 18:21:43 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-b323-2b01-0d98-9fe8-a4cd-78ab.310.pool.telefonica.de. [2a02:3100:b323:2b01:d98:9fe8:a4cd:78ab]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fb6b0f039sm3507389f8f.18.2026.07.28.18.21.41 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 28 Jul 2026 18:21:42 -0700 (PDT) From: Karl Mehltretter To: Paul Walmsley , Palmer Dabbelt , Albert Ou Cc: Karl Mehltretter , Alexandre Ghiti , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Date: Wed, 29 Jul 2026 03:21:32 +0200 Message-Id: <20260729012132.24882-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit remove_pud_mapping() and remove_p4d_mapping() obtain a child table base with pud_offset(p4dp, 0) and p4d_offset(pgd, 0), then add the index for addr. RISC-V folds page-table levels at runtime. When a level is folded, its offset helper returns the parent entry itself, but the index can still be nonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39 folds both P4D and PUD, so memory hot-remove can descend into unrelated memory and pass an invalid page to __free_pages(). This can trigger: kernel BUG at include/linux/mm.h:1810! VM_BUG_ON_PAGE(page_ref_count(page) == 0) arch_remove_memory+0x1e/0x5c try_remove_memory+0x15e/0x200 remove_memory+0x24/0x3c Only add the index when the corresponding page-table level is enabled, matching p4d_offset() and pud_offset(). Fixes: c75a74f4ba19 ("riscv: mm: Add memory hotplugging support") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter --- arch/riscv/mm/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c index 3e450890be07..338a8cbf4b80 100644 --- a/arch/riscv/mm/init.c +++ b/arch/riscv/mm/init.c @@ -1618,7 +1618,7 @@ static void __meminit remove_pud_mapping(pud_t *pud_base, unsigned long addr, un for (; addr < end; addr = next) { next = pud_addr_end(addr, end); - pudp = pud_base + pud_index(addr); + pudp = pgtable_l4_enabled ? pud_base + pud_index(addr) : pud_base; pud = pudp_get(pudp); if (!pud_present(pud)) continue; @@ -1649,7 +1649,7 @@ static void __meminit remove_p4d_mapping(p4d_t *p4d_base, unsigned long addr, un for (; addr < end; addr = next) { next = p4d_addr_end(addr, end); - p4dp = p4d_base + p4d_index(addr); + p4dp = pgtable_l5_enabled ? p4d_base + p4d_index(addr) : p4d_base; p4d = p4dp_get(p4dp); if (!p4d_present(p4d)) continue; -- 2.53.0