Re: linux-next: manual merge of the tip tree with the mm-hotfixes-unstable tree

[Mike Rapoport]

Hi Mark,

On Sun, Jul 26, 2026 at 10:33:53PM +0100, Mark Brown wrote:
> Hi all,
> 
> Today's linux-next merge of the tip tree got a conflict in:
> 
>   arch/x86/mm/pat/set_memory.c
> 
> between commits:
> 
>   7a7c16a2d2b4d ("x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF")
>   25a54f65ccbaf ("x86/mm/pat: allocate split page tables as kernel page tables")
> 
> from the mm-hotfixes-unstable tree and commit:
> 
>   5fce67641a3ed ("x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()")
> 
> from the tip tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
> 
> diff --cc arch/x86/mm/pat/set_memory.c
> index 422ce7fba00c6,1f2a2ba9ce57d..0000000000000
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@@ -440,30 -441,12 +443,32 @@@ static void __cpa_collapse_large_pages(
>   
>   	list_for_each_entry_safe(ptdesc, tmp, &pgtables, pt_list) {
>   		list_del(&ptdesc->pt_list);
>  -		pagetable_free(ptdesc);
>  +		/*
>  +		 * Only early alloc'd direct map should not be flagged PG_table
>  +		 * here and those shouldn't be collapsed. However be abundantly
>  +		 * cautious and handle the !PG_table case too.
>  +		 */
>  +		if (PageTable((ptdesc_page(ptdesc))))
>  +			pagetable_dtor_free(ptdesc);
>  +		else
>  +			pagetable_free(ptdesc);
>   	}
> + 
> + 	spin_unlock(&cpa_lock);
>   }
>   
>  +static void cpa_collapse_large_pages(struct cpa_data *cpa)
>  +{
>  +	/*
>  +	 * Take the mmap write lock on init_mm to:
>  +	 * - Avoid a use-after-free if raced by ptdump (which takes its own
>  +	 *   write lock on init_mm).
>  +	 * - Serialise concurrent CPA walkers.
>  +	 */
>  +	scoped_guard(mmap_write_lock, &init_mm)
>  +		__cpa_collapse_large_pages(cpa);
>  +}
>  +
>   static void cpa_flush(struct cpa_data *cpa, int cache)
>   {
>   	unsigned int i;
> @@@ -1254,22 -1237,16 +1258,20 @@@ __split_large_page(struct cpa_data *cpa
>   static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
>   			    unsigned long address)
>   {
>  -	struct ptdesc *ptdesc;
>  +	pte_t *pte;
>   
> - 	if (!debug_pagealloc_enabled())
> - 		spin_unlock(&cpa_lock);
> + 	spin_unlock(&cpa_lock);

This should be

 	if (!debug_pagealloc_enabled())
 		spin_unlock(&cpa_lock);

>  -	ptdesc = pagetable_alloc(GFP_KERNEL, 0);
>  +	if (cpa->init_mm_read_locked)
>  +		mmap_read_unlock(&init_mm);
>  +	pte = pte_alloc_one_kernel(&init_mm);
>  +	if (cpa->init_mm_read_locked)
>  +		mmap_read_lock(&init_mm);
> - 	if (!debug_pagealloc_enabled())
> - 		spin_lock(&cpa_lock);
> + 	spin_lock(&cpa_lock);

And this 

	if (!debug_pagealloc_enabled())
 		spin_lock(&cpa_lock);

>  -	if (!ptdesc)
>  +	if (!pte)
>   		return -ENOMEM;
>   
>  -	if (__split_large_page(cpa, kpte, address, ptdesc))
>  -		pagetable_free(ptdesc);
>  +	if (__split_large_page(cpa, kpte, address, pte))
>  +		pte_free_kernel(&init_mm, pte);
>   
>   	return 0;
>   }



-- 
Sincerely yours,
Mike.