From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023113.outbound.protection.outlook.com [40.107.159.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC607360EF2 for ; Thu, 2 Jul 2026 17:47:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.159.113 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783014481; cv=fail; b=kt7h2q9osu+RLVnICZD8GaG4hJz7WjvQoGvFzMX2B3YnJ0zCmLE6Ynv+DgswRraYHPMfxVAOEvTGJxNd24QRDOMbtl+iXtoV+oibJPj3TMosxxL5nJtHL99t4GpU0FQ7bI7B7RUnTHqqlCOg4Kww/kXO4GVUG+5R0dlinBt1tu0= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783014481; c=relaxed/simple; bh=vnPkk1jww7PuiHOxnP/TEanq882AVKFS2dKDjUABDVs=; h=Message-ID:Date:Subject:To:Cc:References:From:In-Reply-To: Content-Type:MIME-Version; b=ufz/iHyFKbsdFnZZ1DE1jb30GikCNbhSuPig47etQJHyxg7aBOjcobTWROyJo7lxvMOu/wtmKRWuPXoAzNuGrNIvU8kGFD2WTK7VhyOXM3dceTDFBcibxcSSOtfutyTARQvwJUV7Yl6ua+oiE06+2rW0YB5J2kUVTQY/tvjvjjs= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=virtuozzo.com; spf=pass smtp.mailfrom=virtuozzo.com; dkim=pass (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b=xmgFjHr0; arc=fail smtp.client-ip=40.107.159.113 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=virtuozzo.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=virtuozzo.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="xmgFjHr0" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sU8C30U5sqokEKHzT/liBkhBFqk/yw3QFGDI2z3mhDGyvQ6dhLlAxGszFtBOg3QLSxzxCCNfMoSj5VpOvjEERX5XLbav9KmmBnedRhGSSFlQqoCE9h22+f/gx+RF0HsCPYqQ7vTN+8Ezevs56r3YFT1XFo79JmP9TsjzAW5YZ6f6xDaiHLVuIMgyrrgjWYx6KDPIQs9thSrxwkW06YXRAwYt/uod7hgCBltv1KQOHICtmX9V1MZp+Jn4RvVPTHEBII0yalBVURsJDdydHmxqmRh6IZCxnZMo8SeWUeCWmcq5YF+C+EHJUvSiwICkT6phBxNFoexsCQcJQnGqQNC4gA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9wmyPtNv3zPldk941EtV5fMRuha88j2lmjCgHbIDLjQ=; b=m/JPc+gBCtP9eW7rYvba6uH5GQQuH9jarf8DPpU4gD0Is5flrcQnHzULedmxuTokAc0jJ+vNYaOJYmyGyVyY7cLmSKiORD5FyKsMLJIgUyzLu9r6Xr9innrMd/3tq0wEbYsj87zGgmAYU3pEf9Afg+awNbz2ua7KrQMXfKF3GxQhw3OSo/nvRHEqeFw5FsKFCeqAMPvgSyt8Uyih4cstooyDGmb/nekqJSZsPew1sy8PpDU5meoE+hDkR2+aXlWgkdKdW1Oo+FpDbhSq4T1NohfH0c7zGcWG8OZwCTjvc9Fz8RoczjJry6Z0Cp/L0IV3DnIcj13huEvZlVeu9XbqJg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9wmyPtNv3zPldk941EtV5fMRuha88j2lmjCgHbIDLjQ=; b=xmgFjHr01GEa1yqjBHxa5ulfCA81hnvsAgPWcOzytot7gQSdZEgjbg4FjgqBTMgO3tMtZlJ23b9kTk8HmzYHu0cRirY1vNbw/ygJc9wMa6M3RFxCEM9eA5NoITLCHd87LGDBcIN/RBjDEjNJOoAPvjvcduk915/tQmGZg9eRjghbxgNsyauFjhLrmss61uPMC8nE0aWLTgDBaguTwJ6Z/ishZH4wA3lmgDGCU0SHcSmlA822B5+qPONCAZmh5HMMQ2eCAltnrkRkti31P3ZaOOg0bPhxpXcXBKI+GNzVAfrkkG2CXOR05gf2OpOr7KE7Wuh+mx+cTQfxnyzB1Qw8Dg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from AM9PR08MB5892.eurprd08.prod.outlook.com (2603:10a6:20b:2dd::16) by GVXPR08MB10431.eurprd08.prod.outlook.com (2603:10a6:150:15c::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Thu, 2 Jul 2026 17:47:57 +0000 Received: from AM9PR08MB5892.eurprd08.prod.outlook.com ([fe80::94bb:633f:1f55:4bbd]) by AM9PR08MB5892.eurprd08.prod.outlook.com ([fe80::94bb:633f:1f55:4bbd%2]) with mapi id 15.21.0181.010; Thu, 2 Jul 2026 17:47:57 +0000 Message-ID: <740d8aef-1acc-403f-ba1f-601e3205e452@virtuozzo.com> Date: Thu, 2 Jul 2026 19:47:55 +0200 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] x86/mm/pat: take cpa_lock around large-page collapse To: "Denis V. Lunev" , Dave Hansen , Andy Lutomirski , Peter Zijlstra , x86@kernel.org Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , "Mike Rapoport (Microsoft)" , Juergen Gross , Kiryl Shutsemau , linux-kernel@vger.kernel.org References: <20260626163213.2284080-1-den@openvz.org> Content-Language: en-US From: "Denis V. Lunev" In-Reply-To: <20260626163213.2284080-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: VI1PR0102CA0062.eurprd01.prod.exchangelabs.com (2603:10a6:803::39) To AM9PR08MB5892.eurprd08.prod.outlook.com (2603:10a6:20b:2dd::16) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM9PR08MB5892:EE_|GVXPR08MB10431:EE_ X-MS-Office365-Filtering-Correlation-Id: 1d93ba50-77de-48df-2519-08ded8620d03 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|23010399003|7416014|376014|1800799024|5023799004|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: ichUw/F7VPELrreD2qOtazKN3zjQRM6x8yATL/wFxaQAT/b9jokb1xdLJzs7FqGJ4Q2r0yLKyttT0Sr3QJSKOD2SgC6Bol5mTgCprlzkesVzSbkEs5j+zftcW7d2xI42VqNUIbz9H9llCEmJ0DgqFI5xEvvZmT2HebiNIK6X4gFo98wEp3glp+pYhWxaaW56p64zbS81PbrsqgrQV3WnL3yP8HOJhojQ2G+Al8uEikXx6s5hsf2LlnsGoPkmm0y8jgxYiHjJWiLE9VZ8l0kF2AXpr59yeI7TCf1IB85JhLAzOr59dIHBG/l09iT63Xfx/0hGpBOCmiwZxI9aKE3y5IFiHGFd7VKIuh7Dg5dpmryHlhMQzyC03WHY2gyz7hxVhbB8JDQNEz+sgQ3c/ta6owdrLP8InYimG4VIyocYHgypD8r+uQU+K0FZ0ODJfvRz9oY+c8/Jl1xYs/K5hmY2V0Au3VfkDUiJq2Mva5L18G85vG7VdVL4SDclEW7fWAQavx47R2TaL8Vs0BhgJeQ/NU/LAFyvfXmFgaPJ20vfO03rrK5Z+qWTmXjkhWLSEAyWDHIQK9dFoNEYXM6EZradfpZhOPeRv9VGDoVdCNjXbhfM4AlHTwKmtXwEZ7ZN/LPPqZ9HGQ9BBLflB+G9Jky01LIof2R1ZL3GsM8E6O/Zveg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9PR08MB5892.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(23010399003)(7416014)(376014)(1800799024)(5023799004)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cGJlcjBzT2ZpaklIQWJja0dweGNqVS9NcElwV1NIR0NEN2p6ZDNxejRlMmlS?= =?utf-8?B?QmdjakhwQ3huOTlKOHh1aFN4ZFZBWm1Db0JBL05EeUxOM0loQVN1Ym5xNGhW?= =?utf-8?B?QVFNSVk5dzVRbEhZQlArL21qL3h6NExaNEhNbVBjVkRQVWlxRnNyVkd2blZB?= =?utf-8?B?VTR6RWxnLzFhVmhYNTdPd1Bnc1lvTHV0bVFaU3BLbm9mb2RJbndRbzA1NHR5?= =?utf-8?B?R01ZSFpNeEFsdURUZlhhZ2dBWm54MUh6RnFBak9wZTR3OUYvQ3R1UmJ1Q0lM?= =?utf-8?B?Qnk1b1lTSVNIaXBET2NQMjNRRmNYMnNPNmFneEs1MThGdDg3VUpOYmozaHoy?= =?utf-8?B?cDdYc01sSmZtY2dvbG9TS0JFRzVDT3hWWDMvRDB3LzQxMTRIMEhaUThPTVJT?= =?utf-8?B?YTB5SnJBelBJNmVzNGxMOUV2MklUMWo1WUlNVjhSTjFPTXU1akRwVlF0dlRT?= =?utf-8?B?MWh4c3gvbFE1K1d3VUdESjBCRlFZQnN0UHpPQ0hUOEtkeW5iN1RpRUpqenBG?= =?utf-8?B?eTA2WmltaktFdFRJMjl2NmFybjI2MHg2a0tCRHJuRVdSbjJ2ZHpiaDdmdU5R?= =?utf-8?B?bytFamMvdlQrRXZZRHUxZ2pacjh1TUNlS253UGhIbUVSekVLWTd1TkN4Q3Ny?= =?utf-8?B?UFZMZmd2SHlYTVF3UE1rNStnSDRpME02QjY2RGhETEowVVJZcTRRemkyNHBN?= =?utf-8?B?S1lCMElGcjVBcy9IODEwZmVhQ2xjUmFOamN3TWdEdkZPQUN2VkhVbm4vTkRG?= =?utf-8?B?a0RrV21DeWhVTFVFZTBIZk9WMmlkcmdSNk93Y1MxclZsKzVqRGo2RGtsWFRs?= =?utf-8?B?QktpQ1FYbElUREdyTExjVkxQeENwNmNJSFVaSFlPK0RCRnRhcmpLSi9sT3d5?= =?utf-8?B?WWYyRkJSUEZ2TmZzTWxZYTY2NklSVzBVc0hJSUFoZmdCQ1c2eG55QzVYZFVX?= =?utf-8?B?bk43TCt6QlppRUlLT3NNNVh2T3JhcllDUVFtRXZzT05QSTlJbGlMTkNyWGdQ?= =?utf-8?B?T1dReDN6WU5DaW9uOCtYSXVaN0N1V2Y3bGpaZGlUcW9XL1IvVEYxZTVLMXNM?= =?utf-8?B?SlF6a2QwNzJIOWd6dFZSdFhmWStVQTdrTFJ5WlhuLzU2UE55MUhsNlMyYlRt?= =?utf-8?B?QVFsYTYvZTQ5NHo5cHdmWDMrNS9sMTZma0puN3grenFFQlFKSnVzKy9FdFVk?= =?utf-8?B?bWhDSDVNUHcyaG16Tk5LRjgwbnpCY1M3a1FtSzJlQzhMb3doV2EybHZpd0ww?= =?utf-8?B?V1dRb00vSVZHMHprM05iaHY2RUdDcGdUUWhycFE0cyt3OCs0aUhKMEhRaFh3?= =?utf-8?B?OHhscHpndUNJbVY5Vk1CRFN6cXVkWXhSQ1BTNmZxSlA4d1ViNlRNOTNDQjhB?= =?utf-8?B?VU5HVU8xcStEWW55VThnSFlSVTZBZ242SlNvVFlpditzTjlGZkZZbHV1L3dB?= =?utf-8?B?WVdpdlN0aGZCS2p5KzkyRmdBYUcwaGMzNHhnTnJXS1ZjcVRWQjhDVE1UZjNk?= =?utf-8?B?Qk9McDA5YzRJYmMvbTQzanZFUzY1Mm40bTFBYjBXL254WUd1MkNXNU00d095?= =?utf-8?B?Mjdob1pVV3NtL2lHOVdnTERDMjRaN1NQNXIzNC9LRlM5YXljMEpqU053N3pQ?= =?utf-8?B?YWhialg1YUI3aG1hVmFoY3N6MzVmbEN4bndVd0ZTTnZoR3NXcGxkOFZHVk1V?= =?utf-8?B?bEhFVDI3R05tbzZ6Um5QRmhldmQwS25qL05TTExFUlg3Q1VwWVN4VytTNS9i?= =?utf-8?B?UnVWQWt6SGk4NWpVKzRackdyK2VQWE5wMEJpZVh4U2tnMm5nYUdCdFZvOFpM?= =?utf-8?B?QlcwMlNxSGN6dDV0TkRSM2plQllweEZlU2hQV0cvS1VFQXovR29RNHBIeERp?= =?utf-8?B?K1VMT1RRN2lGWDIvRWc4LzNmUXcxVy81SDk0aS9BTHBBdStXai9iWjZxSXAw?= =?utf-8?B?NFVVWURmZVBGdUFSVzFyRVV3NGxBN0ZRb3ljWlBidmJxVXYxTklDd1ltb25C?= =?utf-8?B?RW83N0Q3alVzRUNRVC9wZjRidzM4WGlEekhhMVRLNzE5NXRyUGJGb1ZBbEZ2?= =?utf-8?B?cUdHQUpQKzFBdkZIVU4xMkZQZStRUkttbjNrcitQY1hxa1BDWGhwNnVyUzNt?= =?utf-8?B?RVdkMU1XOG0yYVAvM0VKZzhnbUYxcENtdFF4b1lweFExWmFpVWxwZ0pCc2JN?= =?utf-8?B?MVFZTi85VVFFb1U4S2c4OFRYc2xWMGpzMFl6TXNWbkxhdFlwWnBEeDlTRjR0?= =?utf-8?B?cEwxMWMvQnhhblZmQ2huM1RHYUhKUTRPNm9lNjlBd1M4SHhsandaZnM5bVVh?= =?utf-8?B?RTNZWTZnK1NPRjhUTmlvMytmeHZSemxpckVoQ1crZXMreHZKSzVCb2J2cWNp?= =?utf-8?Q?bOdwoKs4yRzG7T6o/f+aTKtQHFhXfMioHT3aX+ZDebw2B?= X-MS-Exchange-AntiSpam-MessageData-1: 4r7S1f7+QSKH8Q== X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1d93ba50-77de-48df-2519-08ded8620d03 X-MS-Exchange-CrossTenant-AuthSource: AM9PR08MB5892.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Jul 2026 17:47:57.0937 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: nMteBdQ3YaAEImwVSLBtiz2SO2JYQ4yiWAkq8uF8tyyzFJGCx2Z2lY0+WdxCrg9c/bR5ZTrp6hBsuki3pe0rHQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVXPR08MB10431 On 6/26/26 18:32, Denis V. Lunev wrote: > This email originated from an IP that might not be authorized by the domain it was sent from. > Do not click links or open attachments unless it is an email you expected to receive. > Loading and unloading modules concurrently on several CPUs on a KASAN > build, with a short delay injected at the CPA page-table lookup to > widen the window, faults within minutes: > > BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0 > Write of size 8 at addr ffff888181139718 by task modprobe > ... > The buggy address belongs to the physical page: > pfn:0x181139 ... page_type: f2(table) > > cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and > frees the old PTE-table pages, while __change_page_attr() fetches a > PTE pointer from a lockless lookup_address_in_pgd_attr() and writes > it with set_pte_atomic() only later. When module text is served from > a shared large ROX mapping the two run on the same PMD: > > CPU A (module load) CPU B (module finalize) > ------------------- ----------------------- > execmem_make_temp_rw > set_memory_nx > __change_page_attr > split 2M -> 4K table P > kpte = &P[i] (lockless) > execmem_restore_rox > set_memory_rox (CPA_COLLAPSE) > cpa_collapse_large_pages > rebuild leaf PMD > flush_tlb_all > pagetable_free(P) > set_pte_atomic(kpte, ...) > -> writes into freed P > > P is a page-table page (page_type: table), reused at once, so the > write corrupts whatever got the page next: a bad-pte or bad-page > splat, or a fatal fault once P has been turned into read-only text. > > The flush_tlb_all() before the free does not close this: its IPI only > serializes against page-table walkers that run with interrupts off > (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts > on, so nothing stops it from holding a stale pointer into P. > > Serialize the collapse - the PMD rebuild, TLB flush and PTE-table > free - under cpa_lock, the lock __change_page_attr() takes for the > split path, so a concurrent walker can no longer hold a pointer into > a table the collapse is about to free. > > debug_pagealloc bypasses cpa_lock in __change_page_attr() (the direct > map is 4K then, with no large pages to serialize), so the lock cannot > order the two there. Skip the collapse in that config: it is only an > optimization, and not freeing the tables leaves the unserialized walk > nothing to race. > > Fixes: 41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation") > Signed-off-by: Denis V. Lunev > --- > arch/x86/mm/pat/set_memory.c | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c > index d023a40a1e03..ff6e3f612986 100644 > --- a/arch/x86/mm/pat/set_memory.c > +++ b/arch/x86/mm/pat/set_memory.c > @@ -418,6 +418,16 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa) > int collapsed = 0; > int i; > > + /* > + * debug_pagealloc bypasses cpa_lock, so __change_page_attr() walks > + * unserialized and freeing collapsed PTE-tables could race it; skip > + * the optional merge there. > + */ > + if (debug_pagealloc_enabled()) > + return; > + > + spin_lock(&cpa_lock); > + > if (cpa->flags & (CPA_PAGES_ARRAY | CPA_ARRAY)) { > for (i = 0; i < cpa->numpages; i++) > collapsed += collapse_large_pages(__cpa_addr(cpa, i), > @@ -431,8 +441,10 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa) > collapsed += collapse_large_pages(addr, &pgtables); > } > > - if (!collapsed) > + if (!collapsed) { > + spin_unlock(&cpa_lock); > return; > + } > > flush_tlb_all(); > > @@ -440,6 +452,8 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa) > list_del(&ptdesc->pt_list); > pagetable_free(ptdesc); > } > + > + spin_unlock(&cpa_lock); > } > > static void cpa_flush(struct cpa_data *cpa, int cache) > > base-commit: b81d185839fade27f7c4e885856696cf497d53c1 ping