[PATCH 01/46] mm/mglru: don't use stack pointers when walking PUD and PMD tables

[David Hildenbrand (Arm)]

On 10/27/26 09:06, Lorenzo Stoakes (ARM) wrote:
> On Tue, Oct 27, 2026 at 12:17:21AM +0100, David Hildenbrand (Arm) wrote:
>> From: Josef Bacik <josef at toxicpanda.com>
>>
>> MGLRU passes stack copies of page-table entries in walk_pud_range() and
>> walk_pmd_range() when walking to the next level. These copies can become
>> stale when khugepaged or MADV_DONTNEED (CONFIG_PT_RECLAIM) removes a PTE
>> table concurrently.
>>
>> This pattern dates back to commit bd74fdaea146 ("mm: multi-gen LRU:
>> support page table walks"). Likely, earlier locking masked the latent
>> bug. Later changes exposed it: commit 1d65b771bc08 ("mm/khugepaged:
>> retract_page_tables() without mmap or vma lock") allowed concurrent
>> retraction, and commit cf4a65539c13 ("memcg-v1: no need for memcg locking
>> for MGLRU") dropped the walker's outer RCU protection.
>>
>> The fix is simple, so just fix the original commit so we don't have to
>> speculate. To fix it, pass the actual PMD/PUD pointers. This restores the
>> RCU-protected lookup and validation against the live PMD. Note that the PUD
>> handling is required as well to handle folded page tables correctly in all
>> cases.
>>
>> Fix generated by an LLM and sent by Josef Bacik in private.
>>
>> Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks")
>> Cc: stable at vger.kernel.org
>> Signed-off-by: Josef Bacik <josef at toxicpanda.com>
>> [ david: handle walk_pud_range() as well, clarify+simplify description,
>>          adjust Fixes: ]
>> Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>
>> ---
> 
> God, terrible. And why does MGLRU feel it needs its own independent page
> walking mechanism?...

It's all a big mess. I think at LSF/MM there was some talk of using that also
for traditional LRU, but I guess it might take a while ...

-- 
Cheers,

David