From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021086.outbound.protection.outlook.com [52.101.65.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D53B4418DC for ; Wed, 15 Jul 2026 12:21:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.65.86 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784118068; cv=fail; b=QkAkWVNGl/Yg/Q1MU2RmZ7dFo+UJvAE8+goDiWcr2XSL+ulPyf4QU2O8gx7C5aLRd6cWIe64A1WuinLJzfXz9rDWePEUv2s/qk1Snfjud/JH8hcfZy1DXJIxkdYLCE+gwDnIllGY4lbCwGBxx+KLd4CA8b+OzBK5a2XLjJRkm1o= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784118068; c=relaxed/simple; bh=wfW+IuqfoX4etWRMO2HdRtVc0GGqY6xW7FhBRaVA730=; h=Message-ID:Date:Subject:To:Cc:References:From:In-Reply-To: Content-Type:MIME-Version; b=Nc9BKcZb9MYhtKr1q2Oir7boUzCLGiz0lO+eXbM/gpIuKxrOhJvh9aQL8eIJw6OKZD1Dm3oR23hvzHcoyN6GU5zg2jYds8woDotucDCtVkUB3dlNH4jgIMYHU41HH/y8ap3UEheNnQTOYeZ5W85diR2VIAwXLsXKC2saKmAJdN8= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=virtuozzo.com; spf=pass smtp.mailfrom=virtuozzo.com; dkim=pass (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b=d6ggQtqO; arc=fail smtp.client-ip=52.101.65.86 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=virtuozzo.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=virtuozzo.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="d6ggQtqO" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=R8VN8uzwZBUWZ7sng5FgF271Grj8mcvACboQE9MBtYCYzswvtxVMCgI954uXHqW3/aTW20k/FuQXnB1w/3Y5Dqv2I0bJk4bO3x/0DfmWyEONmKuglFarhEBaAJTnP8HzWzwbXkrhnakz0juGztxB5HybC5p6WE9cgiXVEWOcm5kCARZbwcgjpx4oZQJKTkjabA8n/bgb9+C+Slp8sk8kLSlNJay/bv2XFWP6IrOJ25VKjD2o3RrY57VhD0uEyGLuy3DNTWXXToZbsbU+OmpiwJa2FO2CHyepF45qOi1jMJkC2+EyJAsJyejp8cE3SzKhbLNH3oLf7sEV2vbU1LkikA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1tZX1Ov7ZOqYkweJIdEOoT8LgqybBKko9wIMFyD9LcQ=; b=Rn3ksJST09KTvz6UmoDeC6IA5er5dZpow8D/9F+gdgNdT346TY5VbuGfupMHim4/IuJJ4oACaZ+rc5BBmh1afQux3ROW3eXzx4SlDAJ3Eq+RcNHOuPUeL5vxHw2dweIJIlMgBIk5DqQ950nOfD++RhthfN5lSlhm0lpqhotaoV4vpuo78h51ItMETBrG4zG28xiC8Trs+OTxn+y9OfxVnyO4GEz7eDIEkF9VkfVcBCg0jd9aWFoxv11YRtkQi1wG0sMtiV5oIwM9UZ+feViRL580hYdVe5JCORtAzeEV17ik5ZvF+hrN1wJB8Qt49TGkFwqRvAO5KhijVTItyeqFUw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1tZX1Ov7ZOqYkweJIdEOoT8LgqybBKko9wIMFyD9LcQ=; b=d6ggQtqOLIfS282s2ODBwD754z3DbE39K3SRJSBZ69iWXHO/tUcFyEA+numQE9HReoq8ryW8Qr24WlnIK9/kQIAutzyC/7NtNz6tKA7KDLSb8KibavDv58agF24J1lHi/VB0lPoD8iHoGCgOpv6p/Zxg043E4TlprR0M4b2X+jSv2cXv2UkXpPB3GAoqIHqf5Bq2hvsC0WqHtP/z7tEC5IpxRJpP5wDy5a4XZIFX0AaU062Mp2zYUp1K7wE73HUVGD6cKivwkpDY1ZGQOQ3N8JRnitsjwk/n+xZLLsjS1ahe0q1kkDPiYMdGnVTp1scGXdMsXfBu9ULzWUidaGyuSw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from AM9PR08MB5892.eurprd08.prod.outlook.com (2603:10a6:20b:2dd::16) by DB4PR08MB8103.eurprd08.prod.outlook.com (2603:10a6:10:385::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.10; Wed, 15 Jul 2026 12:21:02 +0000 Received: from AM9PR08MB5892.eurprd08.prod.outlook.com ([fe80::94bb:633f:1f55:4bbd]) by AM9PR08MB5892.eurprd08.prod.outlook.com ([fe80::94bb:633f:1f55:4bbd%2]) with mapi id 15.21.0223.008; Wed, 15 Jul 2026 12:21:00 +0000 Message-ID: <3ddb7f76-db6e-4453-b5db-fb13d8fc1f2d@virtuozzo.com> Date: Wed, 15 Jul 2026 14:20:59 +0200 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] x86/mm/pat: take cpa_lock around large-page collapse To: "Denis V. Lunev" , Dave Hansen , Andy Lutomirski , Peter Zijlstra , x86@kernel.org Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , "Mike Rapoport (Microsoft)" , Juergen Gross , Kiryl Shutsemau , linux-kernel@vger.kernel.org References: <20260626163213.2284080-1-den@openvz.org> Content-Language: en-US From: "Denis V. Lunev" In-Reply-To: <20260626163213.2284080-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0015.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34e::16) To AM9PR08MB5892.eurprd08.prod.outlook.com (2603:10a6:20b:2dd::16) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM9PR08MB5892:EE_|DB4PR08MB8103:EE_ X-MS-Office365-Filtering-Correlation-Id: f2b9bbcf-5b03-4148-262e-08dee26b8804 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|366016|10070799003|1800799024|23010399003|5023799004|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: HB+xoZoHvDYWzDCvWJKItKnJZiNlzpQaHk5I3sOV0utf08ApZSyXveo3Xx/+Iew1lzPMfAeSOf2Kse0a/SxOsaEosAuUAf0ZTMdvfUO3OrsUCCM8hwboMYPKXGZaGgJr3GFF0EUMOUY1ZMMLebkw4YkIA0Lk6H2++g2uiu+Ye8S4nptTfdSdt9wrVefP62BZ7hbsKakxb6i6jWZWITNh69ae5ahAPyHFzxl60hZK/RHmMIHwYZXwQlwoARKs7JOg5ZkKbwb5a7otOCPR4ovCJfYDcwG9A/JnkGo9L4nvaK+0hAPnBl8KhUe5OLEbLOgOYGtBMCP/nVRKLaRBU0INibZRSlKA9+05rHrq8CuKVbVyk02HlfBjxAAQJj85pU0lhMGuiqKhb/BJjBdfsELLQz5vPn0ArH3K0CgTFz2qcIETBt4BvCE/vuJjCHApnSUf0lPzoLlnUL4AMIHS6+OouumPjni2zXLlMFUwUlb4e4o7D5NlJt1KbmLzZFAfg2dutVhsQPA9pwcPGUlAMH45XhaRBuMYWNFTjUxPGFY1f/ne9R5XPciIgmJQked4XKNOeQQdMG8ndvxqh9oXsCfBPRtAdK3bzXTjtR9GJnHrs1/qX0JnyOaLDwmtUp6UR1FkxVT0v3mVBC/O45Jr43CfN4QjXYG4B9EeLixMahSpmaE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9PR08MB5892.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(366016)(10070799003)(1800799024)(23010399003)(5023799004)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?KyttS3pUay94eStMcFEwb2ZOeTVRNWJHZXFWdUVQQWJUT0Y5NkhvQUpNNFov?= =?utf-8?B?dkFGMEpmdXVIT1V2dzVZSElJZFRackRVdVFiQWJjUysyMUlCM29BNjRPaG53?= =?utf-8?B?aUM0V0dJN1dpK1F0MjhwZzFBS3AxMTlkbnhvbHZvRmxGYW1UcHJNa3BBZVNp?= =?utf-8?B?NzFVSmQrVWdwZ2NmWGYwNE5vSG1QTmp6Rm5nQU5YdHhkV25jMklVMmVyeUM1?= =?utf-8?B?UktKKzFWL3k1VW9GSFh5T3JOMCswUzVTbXdUSmg5RHFhVFMyNlF5cEdHeitR?= =?utf-8?B?ZnNJeWJEY2g2eFA5UVhST2l0MGVURG1iWEVzTFFHcVhaenhMY29zMWFJVUl5?= =?utf-8?B?cEVVVGlNVllBSEx5RVdPZEZMOVhubW51SklndzhRS0lmSGlUN1hKLzFOVVJu?= =?utf-8?B?RkZNN08zSmpMN0VLRFlPVTY1bGtNYk1Mb0ZUZDZtZU9Ka1UycmtRV2ZIUjN2?= =?utf-8?B?Q1ZveGhlSnBtRHJmWHoyZ0JwdlVBRFJSNE16c2hUWm5aZFBxSWVNQlowVlFm?= =?utf-8?B?QjcycmxzMTRFMVZTL1ZNbnNlQm9QY21NWDE4R1I1eWE2cE5jb084UGcrTzVQ?= =?utf-8?B?N3JsMWphenF6YlAyMVFtNjhyMW9laGN2NURCcFJmQ3hhc1Z4NmhZUGtnaWVR?= =?utf-8?B?MERtcWNJZGxjUXNCRkwyeFVtQnh0V0R0TytaSndiM0J6RHhNL2pLUFd4UW04?= =?utf-8?B?ZXhFdlJTV2Y0d1paa01JaW1HTzhKc3J2SDVZdlZVQk1adExUbm5FeDFCZWQv?= =?utf-8?B?QUk2Q0NzKzdoMDlsamRIdWZIL1BsWi9EZ1NFT3AzQkg5cWdjK3NZRGMrR1I2?= =?utf-8?B?ZTUxY3gyWkRnZ1hUdjBvRWJCaXZHOGorTzdvZ2NFVzJYNEVpckRObkJwVDNy?= =?utf-8?B?cjdCUFFlcTdWeGdML3hNVkRCOGhTem02OWRqK0hoaUhRMlVNQ2tmVUEzUUd5?= =?utf-8?B?b21QaGx1eVMxRVl6b1J5akdGS291MGtUNTM3TDZJQ01FS1ViK3RrUENOUWE0?= =?utf-8?B?Q2F5dTQzN3dlZVpyZVBEY0k1NmxJQm5aS1dsQUxoWUJTWnczSURVUWc0Z3Vm?= =?utf-8?B?VStUQ0djT0hqNWcvNnhtR3N2WndFUFo4amdENWh3UU9uVEtUTGNzK0RUdkhE?= =?utf-8?B?akEvNGlWREdtc25ESEI4THFIUFNLYmZSM0xQd21HYm5lYXd5SGRNclJraS83?= =?utf-8?B?VFlYQm9ESFhxRW5qTHVIZUJBZkxoMnQ2Tnp4MTlkWUR1ejJRVENhNUM5VTNK?= =?utf-8?B?cWptM3Uzc0ExS2FSMjkxNXg2VjBmQkF3VTdDbzdualh2M1M0RkdoeDI0NDh0?= =?utf-8?B?UHd6dm5GSjJnVUpubFpmaFBLZnJhOGxBR2RQd2RDaGFZbjVKQ1loYnN6OS9z?= =?utf-8?B?UHJzYkNac0FYOC85cy82R2pXS0J1Mi9va0RBRlVuUzVRNUlHeC9TMldGTThO?= =?utf-8?B?YldUbVlFbGVBVENvNmhycXJXOG9UU3h0dzlaQ0RJWmN2a2RSNTlkekZEYTdX?= =?utf-8?B?eWZmTGNEM29BQXlWcTdKc21OSElSMnBkZ1NuenVacVdYUTJpMnpzcjd5NEdI?= =?utf-8?B?MEVMZHUzQ01sYzFuMFAyM0x3SHJONUV5UWxPYjlBeGdoYzhFZjF4WEpFWDEr?= =?utf-8?B?MmFTbW9wUGpxOHB0YkE2eDFFVGNiWVNTOHhmbStvWG5YVU5uYUZIS0J6Qm1X?= =?utf-8?B?TFFzTUd1Wk1ZS3VwbklyMnZ0cmNJdUlwVW5QSTZOaDBWZ0hGdlNIT0ZBNUx3?= =?utf-8?B?ejd4UWUyUnQrYUY1UllqeVp4YnN1L1hNWFovREZWMzdINDNmaFdPa1N0VE9o?= =?utf-8?B?V2xqMzBtOHZUQUtmZ2E2MFBvT1VqcVVqclY3VW5XREZTVnBhbWR1M2NMWm5R?= =?utf-8?B?cFJKdlBMUHExUkduV2RxNDNPd0F1Q21YZGpqTEM1ZjV2OXlLZDhIM2Y0Q3ZB?= =?utf-8?B?cy82enU1c3JVd3BSZzFvekg3K1QrdUJIQjE0NFYrTERGVjZ0N3NvU2pjVVMw?= =?utf-8?B?SnJIYklLT0ViSHUzTE1ZN1p4L1RUV2VDZmpIdUcrSHZsWGRMcFErQjVqK292?= =?utf-8?B?RTcxMHdmS0tnMFBReTlQWlFZNmtJN1B1Y3NHSkk1UnRqMFFBNkd4Q0RPMy9O?= =?utf-8?B?YktrK3VXa25qOTFWR0UwWlBnODBXSXFOemxiYTR3VjJiZmFDd082MWVVM0Vi?= =?utf-8?B?eEYyajdQdVFxYXVTYzVYOWQ3S2s0WnVKaEdzNnQ5d2R6bWZNeXpWejR6Y2lP?= =?utf-8?B?UWdaelVxbVdUa0xRT2c3Z2Z5QmM2aE1DNUp4U1VKdDRIaDNFa0s0dlhaRU5K?= =?utf-8?B?UHdkVVQva0tTM0xkMTVHZG5UUDJEcm9CNUNSZjdYMlJzd0NTYU5xUGJWQ0hp?= =?utf-8?Q?lCjyitjSOcZzQhyXnIMrNOi6l/0KtJqbNsrI2aNYmCJp8?= X-MS-Exchange-AntiSpam-MessageData-1: RUTmwkWOUOnjmA== X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: f2b9bbcf-5b03-4148-262e-08dee26b8804 X-MS-Exchange-CrossTenant-AuthSource: AM9PR08MB5892.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jul 2026 12:21:00.6425 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: FhwIGEWsVuQSslYYqb5HMz72YFmmp/zD7BHZtMOkjOmcgAqSZn85Uw6vEq4RMCKwJD0yO4QQEjvECo29d58FsA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB8103 On 6/26/26 18:32, Denis V. Lunev wrote: > This email originated from an IP that might not be authorized by the domain it was sent from. > Do not click links or open attachments unless it is an email you expected to receive. > Loading and unloading modules concurrently on several CPUs on a KASAN > build, with a short delay injected at the CPA page-table lookup to > widen the window, faults within minutes: > > BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0 > Write of size 8 at addr ffff888181139718 by task modprobe > ... > The buggy address belongs to the physical page: > pfn:0x181139 ... page_type: f2(table) > > cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and > frees the old PTE-table pages, while __change_page_attr() fetches a > PTE pointer from a lockless lookup_address_in_pgd_attr() and writes > it with set_pte_atomic() only later. When module text is served from > a shared large ROX mapping the two run on the same PMD: > > CPU A (module load) CPU B (module finalize) > ------------------- ----------------------- > execmem_make_temp_rw > set_memory_nx > __change_page_attr > split 2M -> 4K table P > kpte = &P[i] (lockless) > execmem_restore_rox > set_memory_rox (CPA_COLLAPSE) > cpa_collapse_large_pages > rebuild leaf PMD > flush_tlb_all > pagetable_free(P) > set_pte_atomic(kpte, ...) > -> writes into freed P > > P is a page-table page (page_type: table), reused at once, so the > write corrupts whatever got the page next: a bad-pte or bad-page > splat, or a fatal fault once P has been turned into read-only text. > > The flush_tlb_all() before the free does not close this: its IPI only > serializes against page-table walkers that run with interrupts off > (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts > on, so nothing stops it from holding a stale pointer into P. > > Serialize the collapse - the PMD rebuild, TLB flush and PTE-table > free - under cpa_lock, the lock __change_page_attr() takes for the > split path, so a concurrent walker can no longer hold a pointer into > a table the collapse is about to free. > > debug_pagealloc bypasses cpa_lock in __change_page_attr() (the direct > map is 4K then, with no large pages to serialize), so the lock cannot > order the two there. Skip the collapse in that config: it is only an > optimization, and not freeing the tables leaves the unserialized walk > nothing to race. > > Fixes: 41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation") > Signed-off-by: Denis V. Lunev > --- > arch/x86/mm/pat/set_memory.c | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c > index d023a40a1e03..ff6e3f612986 100644 > --- a/arch/x86/mm/pat/set_memory.c > +++ b/arch/x86/mm/pat/set_memory.c > @@ -418,6 +418,16 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa) > int collapsed = 0; > int i; > > + /* > + * debug_pagealloc bypasses cpa_lock, so __change_page_attr() walks > + * unserialized and freeing collapsed PTE-tables could race it; skip > + * the optional merge there. > + */ > + if (debug_pagealloc_enabled()) > + return; > + > + spin_lock(&cpa_lock); > + > if (cpa->flags & (CPA_PAGES_ARRAY | CPA_ARRAY)) { > for (i = 0; i < cpa->numpages; i++) > collapsed += collapse_large_pages(__cpa_addr(cpa, i), > @@ -431,8 +441,10 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa) > collapsed += collapse_large_pages(addr, &pgtables); > } > > - if (!collapsed) > + if (!collapsed) { > + spin_unlock(&cpa_lock); > return; > + } > > flush_tlb_all(); > > @@ -440,6 +452,8 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa) > list_del(&ptdesc->pt_list); > pagetable_free(ptdesc); > } > + > + spin_unlock(&cpa_lock); > } > > static void cpa_flush(struct cpa_data *cpa, int cache) > > base-commit: b81d185839fade27f7c4e885856696cf497d53c1 ok, guys :-) What is the direction to go with this change? (the patch is working for me well in downstream). Thank you in advance,     Den