Re: [PATCH 1/3] mm/userfaultfd: fix PTE table overruns in UFFDIO_MOVE

[Baolin Wang <baolin.wang@linux.alibaba.com>]

On 11/12/26 5:59 AM, David Hildenbrand (Arm) wrote:
> With a folded PMD, pmd_addr_end() simply returns the supplied end.
> move_present_ptes() can therefore walk past the source or destination
> PTE table during UFFDIO_MOVE.
> 
> pmd_addr_end() is only intended for page table traversal, in patterns
> like "next = pmd_addr_end(addr, end);". With folded PMDs, a higher level
> has already clamped the range to the PTE table.
> 
> Folded PMDs are uncommon, but can occur even on arm64, for example
> with 64K pages and a 42-bit virtual address space.
> 
> Extract the calculation from folio_pte_range() into
> pte_table_clamped_end() and use it to clamp both ranges. This preserves
> the wraparound handling from commit f681d4580d5c ("mm: fix address
> wraparound when scanning large folio PTEs").
> 
> Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
> Cc: stable@vger.kernel.org
> Reported-by: Chris Mason <mason@kernel.org>
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---
>   include/linux/pgtable.h | 24 ++++++++++++++++++++++++
>   mm/memory.c             |  7 +------
>   mm/userfaultfd.c        |  4 ++--
>   3 files changed, 27 insertions(+), 8 deletions(-)
> 
> diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h
> index 780fe849ff8b7..66d369870a740 100644
> --- a/include/linux/pgtable.h
> +++ b/include/linux/pgtable.h
> @@ -12,6 +12,7 @@
>   #ifdef CONFIG_MMU
>   
>   #include <linux/mm_types.h>
> +#include <linux/minmax.h>
>   #include <linux/bug.h>
>   #include <linux/errno.h>
>   #include <asm-generic/pgtable_uffd.h>
> @@ -1518,6 +1519,29 @@ static inline void arch_swap_restore(swp_entry_t entry, struct folio *folio)
>   })
>   #endif
>   
> +/**
> + * pte_table_clamped_end() - Limit a range to a single PTE table.
> + * @addr: Start address.
> + * @end: Exclusive end address.
> + *
> + * Only use pmd_addr_end() when traversing page tables, in a pattern like::
> + *
> + *     next = pmd_addr_end(addr, end);
> + *
> + * Higher levels already bound the range when PMDs are folded. Use this
> + * helper elsewhere to clamp the range regardless of PMD folding.
> + *
> + * Return: The exclusive end of the PTE table containing @addr, capped at @end.
> + */
> +static inline unsigned long pte_table_clamped_end(unsigned long addr,
> +		unsigned long end)
> +{
> +	const unsigned long pmd_end = (addr & PMD_MASK) + PMD_SIZE;
> +
> +	/* Compare inclusive ends to avoid wraparounds. */
> +	return min(pmd_end - 1, end - 1) + 1;
> +}

Thanks. The helper makes the code more readable.
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>