linux-kernel - Re: [PATCH v3 11/11] mm: Use unmap_desc struct for freeing page tables.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ctz32d6kigivl2fb5ll7as7roa6kwptjjzhf7d7ozpazifapg5@w3ol42q343y3>
Date: Tue, 10 Feb 2026 20:41:26 +0000
From: "Liam R. Howlett" <Liam.Howlett@...cle.com>
To: Chris Mason <clm@...a.com>, Andrew Morton <akpm@...ux-foundation.org>,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Suren Baghdasaryan <surenb@...gle.com>,
        Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
        Pedro Falcato <pfalcato@...e.de>, David Hildenbrand <david@...hat.com>,
        Vlastimil Babka <vbabka@...e.cz>, Michal Hocko <mhocko@...e.com>,
        Jann Horn <jannh@...gle.com>, shikemeng@...weicloud.com,
        kasong@...cent.com, nphamcs@...il.com, bhe@...hat.com,
        baohua@...nel.org, chrisl@...nel.org,
        Matthew Wilcox <willy@...radead.org>
Subject: Re: [PATCH v3 11/11] mm: Use unmap_desc struct for freeing page
 tables.

* Liam R. Howlett <Liam.Howlett@...cle.com> [260207 12:37]:
> * Chris Mason <clm@...a.com> [260124 18:51]:
> > On Wed, 21 Jan 2026 11:49:46 -0500 "Liam R. Howlett" <Liam.Howlett@...cle.com> wrote:
> > 
> > > Pass through the unmap_desc to free_pgtables() because it almost has
> > > everything necessary and is already on the stack.
> > > 
> > > Updates testing code as necessary.
> > > 
> > > No functional changes intended.
> > >
> > 
> > Hi everyone,
> > 
> > I'm running some more aggressive prompts through linux-next and this one was
> > flagged.  Apologies in advance if it's way off:
> > 
> > > diff --git a/mm/memory.c b/mm/memory.c
> > > --- a/mm/memory.c
> > > +++ b/mm/memory.c

...

> > > +	WARN_ON_ONCE(unmap->vma_end - 1 > unmap->pg_end - 1);
...

> #ifdef CONFIG_ARM_LPAE
> #define USER_PGTABLES_CEILING   TASK_SIZE
> #endif
> 

This does trigger on arm32 with ARM_LPAE set.

Dropping the warning is the easiest fix, but not the right fix.  The
code will execute fine, as the upper entries are not in the vma tree but
exist in the page tables.

I think the right thing to do is to reset the unmap desc vma limits to
only include the user pagetable range.  This would result in the same
numbers being used during exit_mmap() and during the unmap of the vma;
that path would still use 0 - ULONG_MAX.

Thanks,
Liam