Re: [PATCH 6.6.y] arm64: mm: clear extra idmap level before use

[Greg Kroah-Hartman]

On Mon, Aug 31, 2026 at 07:42:47AM +0200, Karl Mehltretter wrote:
> The 6.6.y adaptation of commit 0e9df1c905d8 ("arm64: mm: Don't remap
> pgtables for allocate vs populate") removes the clearing performed by
> early_pgtable_alloc().  Its replacement clears allocations made by the
> generic page-table walkers, but 6.6's create_idmap() still allocates an
> extra root level directly when a sub-48-bit VA kernel is loaded
> sufficiently high in physical memory.
> 
> memblock_phys_alloc_range() does not zero the returned memory.  The direct
> caller therefore publishes an uncleared root page and passes it to
> __create_pgd_mapping().  A stale nonzero entry can trip the bad-descriptor
> BUG_ON or be followed as a page-table descriptor, preventing the kernel
> from booting.
> 
> Clear the direct allocation through its linear alias before publishing it.
> init_clear_pgtable() also supplies the barrier required before the table
> descriptor becomes visible.
> 
> Mainline is not affected because commit e6128a8e523c ("arm64: mm: Use
> 48-bit virtual addressing for the permanent ID map") removed the dynamic
> extra level before page-table initialization moved out of the allocator.

Why can't we take that change instead?

> 
> Fixes: 54322d95309d ("arm64: mm: Don't remap pgtables for allocate vs populate")

No signed-off-by?

thanks,

greg k-h