From nobody Mon Feb 9 07:22:52 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 30211381B1 for ; Mon, 15 Apr 2024 09:40:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713174015; cv=none; b=FraiYiThmCRi/zto/CaECAHWJpZ4OZ6lxvYdgBrUUSRoEyj0x43bsQ/qihfg0s6wxu7BXTO7HA+G865rWca9bTHzgj4i1SVT7gg/U6o1PzlfeO41lQ43WeODXpM7Ck8pXwAHJGiOH3VshuIIoj/ybX08/AAoiK8IrIUWVxzLdKI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713174015; c=relaxed/simple; bh=UWcSykms/3W1cLCsqlcxa3BR55AijHkwwsOVvXTBJ5E=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=FSCfP49A6DTxmpXtf26UBUuk6Nq2CvZ0sKxco7kwN8dRvffu0hP1lrgxxe/j7nh7mcTa0drSMVvTzylubufX9/G4kJLo+48Y0wnF8oJ61sUW2hkplg/Xj1K+SKs1aJyArvlsnkKAYlhE7McI2qmjEiLpBTA1oHJx9DV8XaxPweA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id C74332F4; Mon, 15 Apr 2024 02:40:40 -0700 (PDT) Received: from a077893.blr.arm.com (a077893.blr.arm.com [10.162.41.8]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 312863F64C; Mon, 15 Apr 2024 02:40:08 -0700 (PDT) From: Anshuman Khandual To: linux-arm-kernel@lists.infradead.org Cc: Anshuman Khandual , Catalin Marinas , Will Deacon , Ard Biesheuvel , Ryan Roberts , Mark Rutland , linux-kernel@vger.kernel.org, Dev Jain Subject: [PATCH V2] arm64/hugetlb: Fix page table walk in huge_pte_alloc() Date: Mon, 15 Apr 2024 15:10:03 +0530 Message-Id: <20240415094003.1812018-1-anshuman.khandual@arm.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently normal HugeTLB fault ends up crashing the kernel, as p4dp derived from p4d_offset() is an invalid address when PGTABLE_LEVEL =3D 5. A p4d lev= el entry needs to be allocated when not available while walking the page table during HugeTLB faults. Let's call p4d_alloc() to allocate such entries when required instead of current p4d_offset(). Unable to handle kernel paging request at virtual address ffffffff80000000 Mem abort info: ESR =3D 0x0000000096000005 EC =3D 0x25: DABT (current EL), IL =3D 32 bits SET =3D 0, FnV =3D 0 EA =3D 0, S1PTW =3D 0 FSC =3D 0x05: level 1 translation fault Data abort info: ISV =3D 0, ISS =3D 0x00000005, ISS2 =3D 0x00000000 CM =3D 0, WnR =3D 0, TnD =3D 0, TagAccess =3D 0 GCS =3D 0, Overlay =3D 0, DirtyBit =3D 0, Xs =3D 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=3D0000000081da9000 [ffffffff80000000] pgd=3D1000000082cec003, p4d=3D0000000082c32003, pud=3D0= 000000000000000 Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 108 Comm: high_addr_hugep Not tainted 6.9.0-rc4 #48 Hardware name: Foundation-v8A (DT) pstate: 01402005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=3D--) pc : huge_pte_alloc+0xd4/0x334 lr : hugetlb_fault+0x1b8/0xc68 sp : ffff8000833bbc20 x29: ffff8000833bbc20 x28: fff000080080cb58 x27: ffff800082a7cc58 x26: 0000000000000000 x25: fff0000800378e40 x24: fff00008008d6c60 x23: 00000000de9dbf07 x22: fff0000800378e40 x21: 0004000000000000 x20: 0004000000000000 x19: ffffffff80000000 x18: 1ffe00010011d7a1 x17: 0000000000000001 x16: ffffffffffffffff x15: 0000000000000001 x14: 0000000000000000 x13: ffff8000816120d0 x12: ffffffffffffffff x11: 0000000000000000 x10: fff00008008ebd0c x9 : 0004000000000000 x8 : 0000000000001255 x7 : fff00008003e2000 x6 : 00000000061d54b0 x5 : 0000000000001000 x4 : ffffffff80000000 x3 : 0000000000200000 x2 : 0000000000000004 x1 : 0000000080000000 x0 : 0000000000000000 Call trace: huge_pte_alloc+0xd4/0x334 hugetlb_fault+0x1b8/0xc68 handle_mm_fault+0x260/0x29c do_page_fault+0xfc/0x47c do_translation_fault+0x68/0x74 do_mem_abort+0x44/0x94 el0_da+0x2c/0x9c el0t_64_sync_handler+0x70/0xc4 el0t_64_sync+0x190/0x194 Code: aa000084 cb010084 b24c2c84 8b130c93 (f9400260) ---[ end trace 0000000000000000 ]--- Cc: Catalin Marinas Cc: Will Deacon Cc: Ard Biesheuvel Cc: Ryan Roberts Cc: Mark Rutland Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Fixes: a6bbf5d4d9d1 ("arm64: mm: Add definitions to support 5 levels of pag= ing") Reported-by: Dev Jain Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Signed-off-by: Anshuman Khandual Reviewed-by: Ryan Roberts --- This patch applies on v6.9-rc4 Changes in V2: - Added NULL check for p4dp V1: https://lore.kernel.org/all/20240415063110.1795707-1-anshuman.khandual@= arm.com/ arch/arm64/mm/hugetlbpage.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c index 0f0e10bb0a95..b872b003a55f 100644 --- a/arch/arm64/mm/hugetlbpage.c +++ b/arch/arm64/mm/hugetlbpage.c @@ -276,7 +276,10 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_= area_struct *vma, pte_t *ptep =3D NULL; =20 pgdp =3D pgd_offset(mm, addr); - p4dp =3D p4d_offset(pgdp, addr); + p4dp =3D p4d_alloc(mm, pgdp, addr); + if (!p4dp) + return NULL; + pudp =3D pud_alloc(mm, p4dp, addr); if (!pudp) return NULL; --=20 2.25.1