Re: linux-next: manual merge of the tip tree with the mm-hotfixes-unstable tree

[Lorenzo Stoakes (ARM)]

On Mon, Jul 27, 2026 at 08:48:31AM +0300, Mike Rapoport wrote:
> Hi Mark,
>
> On Sun, Jul 26, 2026 at 10:33:53PM +0100, Mark Brown wrote:
> > Hi all,
> >
> > Today's linux-next merge of the tip tree got a conflict in:
> >
> >   arch/x86/mm/pat/set_memory.c
> >
> > between commits:
> >
> >   7a7c16a2d2b4d ("x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF")
> >   25a54f65ccbaf ("x86/mm/pat: allocate split page tables as kernel page tables")
> >
> > from the mm-hotfixes-unstable tree and commit:
> >
> >   5fce67641a3ed ("x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()")
> >
> > from the tip tree.
> >
> > I fixed it up (see below) and can carry the fix as necessary. This
> > is now fixed as far as linux-next is concerned, but any non trivial
> > conflicts should be mentioned to your upstream maintainer when your tree
> > is submitted for merging.  You may also want to consider cooperating
> > with the maintainer of the conflicting tree to minimise any particularly
> > complex conflicts.
> >
> > diff --cc arch/x86/mm/pat/set_memory.c
> > index 422ce7fba00c6,1f2a2ba9ce57d..0000000000000
> > --- a/arch/x86/mm/pat/set_memory.c
> > +++ b/arch/x86/mm/pat/set_memory.c
> > @@@ -440,30 -441,12 +443,32 @@@ static void __cpa_collapse_large_pages(
> >
> >   	list_for_each_entry_safe(ptdesc, tmp, &pgtables, pt_list) {
> >   		list_del(&ptdesc->pt_list);
> >  -		pagetable_free(ptdesc);
> >  +		/*
> >  +		 * Only early alloc'd direct map should not be flagged PG_table
> >  +		 * here and those shouldn't be collapsed. However be abundantly
> >  +		 * cautious and handle the !PG_table case too.
> >  +		 */
> >  +		if (PageTable((ptdesc_page(ptdesc))))
> >  +			pagetable_dtor_free(ptdesc);
> >  +		else
> >  +			pagetable_free(ptdesc);
> >   	}
> > +
> > + 	spin_unlock(&cpa_lock);
> >   }
> >
> >  +static void cpa_collapse_large_pages(struct cpa_data *cpa)
> >  +{
> >  +	/*
> >  +	 * Take the mmap write lock on init_mm to:
> >  +	 * - Avoid a use-after-free if raced by ptdump (which takes its own
> >  +	 *   write lock on init_mm).
> >  +	 * - Serialise concurrent CPA walkers.
> >  +	 */
> >  +	scoped_guard(mmap_write_lock, &init_mm)
> >  +		__cpa_collapse_large_pages(cpa);
> >  +}
> >  +
> >   static void cpa_flush(struct cpa_data *cpa, int cache)
> >   {
> >   	unsigned int i;
> > @@@ -1254,22 -1237,16 +1258,20 @@@ __split_large_page(struct cpa_data *cpa
> >   static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
> >   			    unsigned long address)
> >   {
> >  -	struct ptdesc *ptdesc;
> >  +	pte_t *pte;
> >
> > - 	if (!debug_pagealloc_enabled())
> > - 		spin_unlock(&cpa_lock);
> > + 	spin_unlock(&cpa_lock);
>
> This should be
>
>  	if (!debug_pagealloc_enabled())
>  		spin_unlock(&cpa_lock);
>
> >  -	ptdesc = pagetable_alloc(GFP_KERNEL, 0);
> >  +	if (cpa->init_mm_read_locked)
> >  +		mmap_read_unlock(&init_mm);
> >  +	pte = pte_alloc_one_kernel(&init_mm);
> >  +	if (cpa->init_mm_read_locked)
> >  +		mmap_read_lock(&init_mm);
> > - 	if (!debug_pagealloc_enabled())
> > - 		spin_lock(&cpa_lock);
> > + 	spin_lock(&cpa_lock);
>
> And this
>
> 	if (!debug_pagealloc_enabled())
>  		spin_lock(&cpa_lock);
>
> >  -	if (!ptdesc)
> >  +	if (!pte)
> >   		return -ENOMEM;
> >
> >  -	if (__split_large_page(cpa, kpte, address, ptdesc))
> >  -		pagetable_free(ptdesc);
> >  +	if (__split_large_page(cpa, kpte, address, pte))
> >  +		pte_free_kernel(&init_mm, pte);
> >
> >   	return 0;
> >   }
>
>
>
> --
> Sincerely yours,
> Mike.

Hmm, what's the status of the x86/mm trees on this though? AFAICT Denis's
patch is still as-is and the spin_lock() vs. spin_[un]lock_irq*() issue
raised in [0] is unaddressed?

So is this fixup actually representative of what's going upstream?

Thanks, Lorenzo

[0]:https://lore.kernel.org/all/al-MrKyIafA8QR_8@lucifer/