Re: [PATCH 3/3] mm/rmap: fix PTE table overruns during batched reference checks

[David Hildenbrand (Arm)]

On 11/12/26 08:25, Baolin Wang wrote:
> 
> 
> On 11/12/26 6:00 AM, David Hildenbrand (Arm) wrote:
>> With a folded PMD, pmd_addr_end() simply returns the supplied end.
>> folio_referenced_one() can therefore walk past the PTE table when
>> checking references to a large folio.
>>
>> Folded PMDs are uncommon, but can occur even on arm64, for example
>> with 64K pages and a 42-bit virtual address space.
>>
>> Use pte_table_clamped_end() to clamp the range to the PTE table and
>> VMA boundaries.
>>
>> Fixes: 52e054f71840 ("mm: rmap: support batched checks of the references for
>> large folios")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Reported-by: Chris Mason <mason@xxxxxxxxxx>
>> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>> ---
> 
> LGTM.
> Reviewed-by: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>
> 
> BTW, the 'end' calculation for the batch operation in lru_gen_look_around()
> could also use the pte_table_clamped_end() helper. But this can be a follow-up.
> 
> end = min(addr | ~PMD_MASK, vma->vm_end - 1) + 1;

Cool, can you send a cleanup patch? I'd pick it up once these patches are upstream.

I'll move these into core.git today, so you can send against that for-next later
today.

-- 
Cheers,

David