Re: [PATCH 01/46] mm/mglru: don't use stack pointers when walking PUD and PMD tables

[Kairui Song]

On Wed, Oct 28, 2026 at 3:07 AM David Hildenbrand (Arm)
<david@xxxxxxxxxx> wrote:
>
> On 10/27/26 09:06, Lorenzo Stoakes (ARM) wrote:
> > On Tue, Oct 27, 2026 at 12:17:21AM +0100, David Hildenbrand (Arm) wrote:
> >> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> >>
> >> MGLRU passes stack copies of page-table entries in walk_pud_range() and
> >> walk_pmd_range() when walking to the next level. These copies can become
> >> stale when khugepaged or MADV_DONTNEED (CONFIG_PT_RECLAIM) removes a PTE
> >> table concurrently.
> >>
> >> This pattern dates back to commit bd74fdaea146 ("mm: multi-gen LRU:
> >> support page table walks"). Likely, earlier locking masked the latent
> >> bug. Later changes exposed it: commit 1d65b771bc08 ("mm/khugepaged:
> >> retract_page_tables() without mmap or vma lock") allowed concurrent
> >> retraction, and commit cf4a65539c13 ("memcg-v1: no need for memcg locking
> >> for MGLRU") dropped the walker's outer RCU protection.
> >>
> >> The fix is simple, so just fix the original commit so we don't have to
> >> speculate. To fix it, pass the actual PMD/PUD pointers. This restores the
> >> RCU-protected lookup and validation against the live PMD. Note that the PUD
> >> handling is required as well to handle folded page tables correctly in all
> >> cases.
> >>
> >> Fix generated by an LLM and sent by Josef Bacik in private.
> >>
> >> Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks")
> >> Cc: stable@xxxxxxxxxxxxxxx
> >> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> >> [ david: handle walk_pud_range() as well, clarify+simplify description,
> >>          adjust Fixes: ]
> >> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> >> ---
> >
> > God, terrible. And why does MGLRU feel it needs its own independent page
> > walking mechanism?...
>
> It's all a big mess. I think at LSF/MM there was some talk of using that also
> for traditional LRU, but I guess it might take a while ...

Right, there are reasons, MGLRU's page table walker uses a bloom
filter and have some zig-zag avoidance. It would be nice to fold that
into the generic walker eventually, but it’s not a high priority right
now, but we’ll get there eventually. And using that for CLRU lacks
support for lazy promotion so I'm not very sure about that, but still
things are being unified bit by bit, so it will at least looks better
step by step. :)