Re: [PATCH] mm: fix address wraparound when scanning large folio PTEs

[Lorenzo Stoakes (ARM)]

On Wed, Oct 14, 2026 at 03:49:05PM +0200, David Hildenbrand (Arm) wrote:
> > I think we have to assume here that with NOPMD we will never end up in this code
> > because large folios will not apply (each PMD table has exactly one entry as of
> > today, so we cannot map large folios .... I think).
> >
> > I can try condensing that in a comment and cross my fingers that that is the
> > case. I tried that now. and codex review already tells me:
> >
> >   • [P1] Folded PMDs can reach this helper — memory.c:4948 (mm/memory.c:4948).
> > The comment’s assumption is false: arm64 with 64 KiB pages and 42-bit VA uses
> > folded PMDs and supports THP and
> >     NUMA balancing. Here, pmd_addr_end() returns vma->vm_end without clamping. A
> > large folio remapped across a PTE-table boundary can therefore make
> > numa_rebuild_large_mapping() walk beyond
> >     the mapped PTE table. The previous code explicitly limited this to pt_start
> > + PMD_SIZE. Cap the forward distance at PMD_SIZE - (addr & ~PMD_MASK) as well as
> > the VMA and folio limits.
> >
> > Let me see if there is any truth to that ...
>
> Ok, the PMD table as a single entry, but the PTE table obviously has 2k entries :)
>
> So large folios are possible and pmd_addr_end() would be wrong in this context.
>
> pmd_addr_end() really only works in page table walkers ...

Ack!

OK yeah, I missed that it gets redefined when wrapped, so forget about that.

A quick comment should do the job re: understanding.

--
Cheers, Lorenzo