[PATCH] arm64/mm: restrict transparent contpte mappings to valid PTEs

[Zhao Gongyi]

On 10/25/26 8:34 PM, David Hildenbrand (Arm) wrote:
> 
> Can you paste the code here for easy review if that it the right approach?
> 

Hi David,

Sure. Here is the minimal prototype I tested. It leaves
contpte_set_ptes() unchanged, so present-invalid PTEs can retain
PTE_CONT. The pte_present() check excludes swap entries, where the
same bit position can be part of the swap offset.

diff --git a/arch/arm64/include/asm/pgtable.h 
b/arch/arm64/include/asm/pgtable.h
index 6000905a2..2f89959ec 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -185,6 +185,7 @@ static __always_inline bool pte_present(pte_t pte)
   * Returns true if the pte is valid and has the contiguous bit set.
   */
  #define pte_valid_cont(pte)	(pte_valid(pte) && pte_cont(pte))
+#define pte_present_cont(pte)	(pte_present(pte) && pte_cont(pte))
  /*
   * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
   * so that we don't erroneously return false for pages that have been
@@ -1704,7 +1705,7 @@ static __always_inline void 
contpte_try_fold(struct mm_struct *mm,
  static __always_inline void contpte_try_unfold(struct mm_struct *mm,
  				unsigned long addr, pte_t *ptep, pte_t pte)
  {
-	if (unlikely(pte_valid_cont(pte)))
+	if (unlikely(pte_present_cont(pte)))
  		__contpte_try_unfold(mm, addr, ptep, pte);
  }

The diff is against 24a19b953e2a. The runtime tests used the same
changes on an arm64 tree whose base pgtable.h and contpte.c blobs
matched. In a QEMU/KVM guest with KASAN enabled, the guard-marker
reproducer passed 100 iterations, and the fork and PMD-split probes
passed five runs each, without warnings or KASAN reports. The
unmodified kernel failed on the first guard-marker iteration in the
earlier A/B test.

This shows that the reported failure can be prevented by a small
change to the unfold check. As Catalin pointed out, this prototype
does not extend pte_batch_hint() to present-invalid entries or address
the other pte_valid_cont() users. I agree with taking v2 as the current
fix and considering the broader grouping changes separately.

Thanks,
Gongyi