From: Qi Zheng <zhengqi.arch@bytedance.com>

In clear_flush(), the original pte may be a present entry, so we should
use ptep_clear() to let page_table_check track the pte clearing operation,
otherwise it may cause false positive in subsequent set_pte_at().

Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
---
 arch/arm64/mm/hugetlbpage.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 21716c940682..9c52718ea750 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -236,7 +236,7 @@ static void clear_flush(struct mm_struct *mm,
 	unsigned long i, saddr = addr;
 
 	for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
-		pte_clear(mm, addr, ptep);
+		ptep_clear(mm, addr, ptep);
 
 	flush_tlb_range(&vma, saddr, addr);
 }
-- 
2.30.2

On Thu, Aug 10, 2023 at 09:32:41AM +0000, Qi Zheng wrote:
> From: Qi Zheng <zhengqi.arch@bytedance.com>
> 
> In clear_flush(), the original pte may be a present entry, so we should
> use ptep_clear() to let page_table_check track the pte clearing operation,
> otherwise it may cause false positive in subsequent set_pte_at().

Isn't this true for most users of pte_clear()? There are some in the core
code, so could they trigger the false positive as well?

Will

I wrote wrong Kefeng's email address before, correct it now.


On 2023/8/10 17:32, Qi Zheng wrote:
> From: Qi Zheng <zhengqi.arch@bytedance.com>
> 
> In clear_flush(), the original pte may be a present entry, so we should
> use ptep_clear() to let page_table_check track the pte clearing operation,
> otherwise it may cause false positive in subsequent set_pte_at().
> 
> Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
> Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
> ---
>   arch/arm64/mm/hugetlbpage.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
> index 21716c940682..9c52718ea750 100644
> --- a/arch/arm64/mm/hugetlbpage.c
> +++ b/arch/arm64/mm/hugetlbpage.c
> @@ -236,7 +236,7 @@ static void clear_flush(struct mm_struct *mm,
>   	unsigned long i, saddr = addr;
>   
>   	for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
> -		pte_clear(mm, addr, ptep);
> +		ptep_clear(mm, addr, ptep);
>   
>   	flush_tlb_range(&vma, saddr, addr);
>   }