From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF3B617A2E8 for ; Sat, 15 Aug 2026 21:13:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786828405; cv=none; b=IIXSD3rv86M4nyohOCx2n6lh6iJit7N/mqV3SROGKVmtYhr3+QXMpcjEhsSTjxbAhyvJKme368rDfw7g6csGO6Armb9q8wnRz86dGwUZbgt6SIbbFVwG0BUMIyOK8ga3hRLJAMyC3wJ+YlHtFAPQV+q9Q9uBRJ6wcjdSPjy2Iy4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786828405; c=relaxed/simple; bh=z9+/u+KZCVsDOraD/TZFbIZX0seZp7sJQ5fpXTpqg4I=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=k4uYMUghEOY2rEwZwNAZD5tTMe6vAJCwqdks9YFICs/qU2zRuFslahv7e937f/pcZOrms+q8+cKgkXMhGbM19mPbp8rqiwBgByRpnPocU5JGaBoab+xwHPRHqio+gCRrXt9iN7GwJvUuF/QWlrVkfDTGgcZ8Y+J1QbMLZqejAM4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BFdhfjvJ; arc=none smtp.client-ip=209.85.221.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BFdhfjvJ" Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-4799b3f7c83so1535246f8f.2 for ; Sat, 15 Aug 2026 14:13:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786828402; x=1787433202; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=9SLTJcm5n+Gs4MvyDRaD5ZUNP0VQqMVi7H7DWoQkAZE=; b=BFdhfjvJyPp4zicsBP1l77R+vJPWr/zs+9mYql2dURXzw9cI9LkyUsRDQkZ6O+Tyiu N5FWUP1p1MO1GpjaeJtcGohuXnhs74Ud3xDn2ztqLKX9HNcQBDUJg+hHKOysx4hqjRVA Fd2hJFQ1+Dx9ig+k/wvRVvwS7ugJfB+Iyir0UouYVJoC4AqUgI1nb1Er/NZecHzf2IGe 2VHYao+qMfzCdxTVVQYz9Yn6AMDBTaz1K/CE/kN/ZRquuBD1DFWCYfWKuig1x2pK++dD hSPm9COt1htoHcA3gWb07yq9fyJPm7yhKGqTqHrrdVOi5mF9tCM7bfNryDumhENfIkHj 2MRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786828402; x=1787433202; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9SLTJcm5n+Gs4MvyDRaD5ZUNP0VQqMVi7H7DWoQkAZE=; b=tYrOA4ixoVlONrsfwrDaWc9jmvOs5Rqy6adT0ktDHGUyinoCj42ITQ54Co+CEx/cFN 1rAWqNuvn6q7Jlkf/RL0XHQVk77DHRx3OeuCpz7oKanlNAmkjDtslfjmCRqqs1xEt6Dz SFkuTHBg6rknHk3Twg+domBUZ1DyKdAe5ZmgDsW2IWoaxzATl2I1cvqqF+KcxFzqm6qg h/QUHeg6HHaD6HKLvCACCRTbkui6HTElylr2y8rXOuy7RbwdC1tOOXKPNKEj331m+8kg JtV/VX8YjkO+4gJ4Ohayt+ufRGwjubeAdsYWjQDd59cE1X/C11dSMsaboAadoDha7OnK VVUg== X-Forwarded-Encrypted: i=1; AHgh+Rq1UHWe6LMHUKpbgrsCIJ/lPSDDX94yl8oWyk5R2aLOZJZLVGXysWZIBuFm5APuJwHq67KWgd4ocLhnb0o=@vger.kernel.org X-Gm-Message-State: AOJu0Ywv8iuz+otI/Y9mZ2z/PD/NOEDXw+neaJuZY76M7ceByA5lbkjU 3d/9F4sB9ZMIztuOyugZEqhWZvWcc0M5jsCViUkvHY02cjVIAcbsKI/4 X-Gm-Gg: AR+sD128c73xRQmXhw6Np4TgJqvLiI6KXdleN0+OjtNeCS7cFGNhVazZ1X7w5PpDfST pCb2N8PWJLhltsyCi3v7ErzlercfaLxGangMHAYUB+X9zQzAYAjno8G7Dcp/sUQ/HncJW83mz0e bpYjzdKaGM7NozxK4cr9l0I7XyvO8yO1xcLWgtNA/taAr0XX+fG3cUxdRORpzOvyjEV0UlNGUfs IrBQD5Kftl6RJi0tm+grkihswjyr8V6AHF12NNdrDkLSzaXVe6JMN4VxtYZEdpAwSD1r2tIsVnf B4JT4qhND27ZbC6PLD64t7OMTo8X2V/+8a/KlNbM0mNKcWAL71eVd1RNUUIXm9V94oh06s7jWPP wQ9YFZTlUiQX977LTnDF08RjKr/a9Q7WZz2bUyE6zH7b0q7e1wPKtSZpYM/CR7l+InXVf8sUodZ v2bMNxTC88A/Yx1728SWEH/2Dpuosyu6uNNH7ii/+StwY8faecgl98ixA1VJgxrJVkRsS74mMHy c9PzJL7MA/se+UceWJDUydRYTSi9GF2KxLuI3SWk49VccJs2MwTBLwdicwGNvByea8sUY8nCXGP Y3uM/eKMWw069hMP7CXZP4T3LCxb9NA4bAS7TX2211zscVYoyvOphUXZmY6i05z9h6+C X-Received: by 2002:a05:6000:2a89:b0:47f:93b4:2def with SMTP id ffacd0b85a97d-481607b5671mr19216866f8f.28.1786828401869; Sat, 15 Aug 2026 14:13:21 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-aecb-d601-fc34-eb31-14a1-3704.310.pool.telefonica.de. [2a02:3100:aecb:d601:fc34:eb31:14a1:3704]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4815f21a068sm19113272f8f.12.2026.08.15.14.13.20 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 15 Aug 2026 14:13:21 -0700 (PDT) From: Karl Mehltretter To: Catalin Marinas , Will Deacon Cc: Karl Mehltretter , Mark Rutland , David Hildenbrand , Ryan Roberts , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] arm64: mm: Walk page tables with interrupts disabled in show_pte() Date: Sat, 15 Aug 2026 23:13:16 +0200 Message-Id: <20260815211316.974-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit show_pte() walks the page tables locklessly and can run with interrupts enabled, so a concurrent teardown (e.g. munmap() in another thread of the faulting mm) can free a table page from under it. Dereferencing the freed page can fault again or print garbage in the oops report. arm64 selects MMU_GATHER_RCU_TABLE_FREE, and the documented protection for lockless walkers is disabling interrupts, as gup_fast() does. That holds off the RCU-deferred table frees and, unlike rcu_read_lock(), also blocks the IPI-based synchronisation (tlb_remove_table_sync_one()) that khugepaged collapse uses before reusing a table. Use guard(irqsave)() around the complete walk. This does not make the diagnostic output a consistent snapshot, but prevents it from dereferencing a released page-table page. Fixes: 1d18c47c735e ("arm64: MMU fault handling and page table management") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Karl Mehltretter --- Testing: QEMU arm64 virt guest, 2 vCPUs, debug_pagealloc=on. A racing page-table unmap triggered a nested fault in the walk without this patch, none with it. arch/arm64/mm/fault.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 0b52557652be6..b173eebd3cd19 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include @@ -151,6 +152,8 @@ static void show_pte(unsigned long addr) return; } + guard(irqsave)(); + pr_alert("%s pgtable: %luk pages, %llu-bit VAs, pgdp=%016lx\n", mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K, vabits_actual, mm_to_pgd_phys(mm)); -- 2.53.0