show_pte() walks the page tables locklessly and can run with interrupts
enabled, so a concurrent teardown (e.g. munmap() in another thread of
the faulting mm) can free a table page from under it. Dereferencing the
freed page can fault again or print garbage in the oops report.

arm64 selects MMU_GATHER_RCU_TABLE_FREE, and the documented protection
for lockless walkers is disabling interrupts, as gup_fast() does. That
holds off the RCU-deferred table frees and, unlike rcu_read_lock(),
also blocks the IPI-based synchronisation (tlb_remove_table_sync_one())
that khugepaged collapse uses before reusing a table.

Use guard(irqsave)() around the complete walk. This does not make the
diagnostic output a consistent snapshot, but prevents it from
dereferencing a released page-table page.

Fixes: 1d18c47c735e ("arm64: MMU fault handling and page table management")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Testing: QEMU arm64 virt guest, 2 vCPUs, debug_pagealloc=on. A racing
page-table unmap triggered a nested fault in the walk without this
patch, none with it.

 arch/arm64/mm/fault.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 0b52557652be6..b173eebd3cd19 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -16,6 +16,7 @@
 #include <linux/mm.h>
 #include <linux/hardirq.h>
 #include <linux/init.h>
+#include <linux/irqflags.h>
 #include <linux/kasan.h>
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
@@ -151,6 +152,8 @@ static void show_pte(unsigned long addr)
 		return;
 	}
 
+	guard(irqsave)();
+
 	pr_alert("%s pgtable: %luk pages, %llu-bit VAs, pgdp=%016lx\n",
 		 mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
 		 vabits_actual, mm_to_pgd_phys(mm));
-- 
2.53.0

On Sat, Aug 15, 2026 at 11:13:16PM +0200, Karl Mehltretter wrote:
> show_pte() walks the page tables locklessly and can run with interrupts
> enabled, so a concurrent teardown (e.g. munmap() in another thread of
> the faulting mm) can free a table page from under it. Dereferencing the
> freed page can fault again or print garbage in the oops report.
> 
> arm64 selects MMU_GATHER_RCU_TABLE_FREE, and the documented protection
> for lockless walkers is disabling interrupts, as gup_fast() does. That
> holds off the RCU-deferred table frees and, unlike rcu_read_lock(),
> also blocks the IPI-based synchronisation (tlb_remove_table_sync_one())
> that khugepaged collapse uses before reusing a table.
> 
> Use guard(irqsave)() around the complete walk. This does not make the
> diagnostic output a consistent snapshot, but prevents it from
> dereferencing a released page-table page.
> 
> Fixes: 1d18c47c735e ("arm64: MMU fault handling and page table management")
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Testing: QEMU arm64 virt guest, 2 vCPUs, debug_pagealloc=on. A racing
> page-table unmap triggered a nested fault in the walk without this
> patch, none with it.
> 
>  arch/arm64/mm/fault.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
> index 0b52557652be6..b173eebd3cd19 100644
> --- a/arch/arm64/mm/fault.c
> +++ b/arch/arm64/mm/fault.c
> @@ -16,6 +16,7 @@
>  #include <linux/mm.h>
>  #include <linux/hardirq.h>
>  #include <linux/init.h>
> +#include <linux/irqflags.h>
>  #include <linux/kasan.h>
>  #include <linux/kprobes.h>
>  #include <linux/uaccess.h>
> @@ -151,6 +152,8 @@ static void show_pte(unsigned long addr)
>  		return;
>  	}
>  
> +	guard(irqsave)();
> +
>  	pr_alert("%s pgtable: %luk pages, %llu-bit VAs, pgdp=%016lx\n",
>  		 mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
>  		 vabits_actual, mm_to_pgd_phys(mm));

Curious, but why did you add the guard before the print?

Will

On Thu, Aug 27, 2026 at 03:30:24PM +0100, Will Deacon wrote:
> > @@ -151,6 +152,8 @@ static void show_pte(unsigned long addr)
> >  		return;
> >  	}
> >  
> > +	guard(irqsave)();
> > +
> >  	pr_alert("%s pgtable: %luk pages, %llu-bit VAs, pgdp=%016lx\n",
> >  		 mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
> >  		 vabits_actual, mm_to_pgd_phys(mm));
> 
> Curious, but why did you add the guard before the print?

Good point. No need to cover the print, I'll move it below in v2.

Thanks,
Karl