Re: [PATCH 3/3] mm/rmap: fix PTE table overruns during batched reference checks

[Baolin Wang <baolin.wang@linux.alibaba.com>]

On 11/12/26 4:29 PM, David Hildenbrand (Arm) wrote:
> On 11/12/26 08:25, Baolin Wang wrote:
>>
>>
>> On 11/12/26 6:00 AM, David Hildenbrand (Arm) wrote:
>>> With a folded PMD, pmd_addr_end() simply returns the supplied end.
>>> folio_referenced_one() can therefore walk past the PTE table when
>>> checking references to a large folio.
>>>
>>> Folded PMDs are uncommon, but can occur even on arm64, for example
>>> with 64K pages and a 42-bit virtual address space.
>>>
>>> Use pte_table_clamped_end() to clamp the range to the PTE table and
>>> VMA boundaries.
>>>
>>> Fixes: 52e054f71840 ("mm: rmap: support batched checks of the references for
>>> large folios")
>>> Cc: stable@vger.kernel.org
>>> Reported-by: Chris Mason <mason@kernel.org>
>>> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
>>> ---
>>
>> LGTM.
>> Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
>>
>> BTW, the 'end' calculation for the batch operation in lru_gen_look_around()
>> could also use the pte_table_clamped_end() helper. But this can be a follow-up.
>>
>> end = min(addr | ~PMD_MASK, vma->vm_end - 1) + 1;
> 
> Cool, can you send a cleanup patch? I'd pick it up once these patches are upstream.
> 
> I'll move these into core.git today, so you can send against that for-next later
> today.

Sure.