Re: [PATCH] arm64: mm: Walk page tables with interrupts disabled in show_pte()

[Will Deacon <will@kernel.org>]

On Sat, Aug 15, 2026 at 11:13:16PM +0200, Karl Mehltretter wrote:
> show_pte() walks the page tables locklessly and can run with interrupts
> enabled, so a concurrent teardown (e.g. munmap() in another thread of
> the faulting mm) can free a table page from under it. Dereferencing the
> freed page can fault again or print garbage in the oops report.
> 
> arm64 selects MMU_GATHER_RCU_TABLE_FREE, and the documented protection
> for lockless walkers is disabling interrupts, as gup_fast() does. That
> holds off the RCU-deferred table frees and, unlike rcu_read_lock(),
> also blocks the IPI-based synchronisation (tlb_remove_table_sync_one())
> that khugepaged collapse uses before reusing a table.
> 
> Use guard(irqsave)() around the complete walk. This does not make the
> diagnostic output a consistent snapshot, but prevents it from
> dereferencing a released page-table page.
> 
> Fixes: 1d18c47c735e ("arm64: MMU fault handling and page table management")
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Testing: QEMU arm64 virt guest, 2 vCPUs, debug_pagealloc=on. A racing
> page-table unmap triggered a nested fault in the walk without this
> patch, none with it.
> 
>  arch/arm64/mm/fault.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
> index 0b52557652be6..b173eebd3cd19 100644
> --- a/arch/arm64/mm/fault.c
> +++ b/arch/arm64/mm/fault.c
> @@ -16,6 +16,7 @@
>  #include <linux/mm.h>
>  #include <linux/hardirq.h>
>  #include <linux/init.h>
> +#include <linux/irqflags.h>
>  #include <linux/kasan.h>
>  #include <linux/kprobes.h>
>  #include <linux/uaccess.h>
> @@ -151,6 +152,8 @@ static void show_pte(unsigned long addr)
>  		return;
>  	}
>  
> +	guard(irqsave)();
> +
>  	pr_alert("%s pgtable: %luk pages, %llu-bit VAs, pgdp=%016lx\n",
>  		 mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
>  		 vabits_actual, mm_to_pgd_phys(mm));

Curious, but why did you add the guard before the print?

Will