mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

PATCH Applied Sasha Levin 3 participants 6 messages Jul 31, 2025 – Aug 21, 2025

Subsystems (2)

Memory management userfaultfd

lore

Share & tools

lore

Sasha Levin

author

2025-07-31 14:44 UTC #0 lore raw

PATCH 1/1 mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order.

The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed():

  WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c
  addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)

Fix this by reversing the unmap order to respect LIFO ordering.

This issue follows the same pattern as similar fixes:
- commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
- commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")

Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.

Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")

Co-developed-by Claude claude-opus-4-20250514

Signed-off-by Sasha Levin <[email protected]>

Acked-by David Hildenbrand <[email protected]>

Reviewed-by Suren Baghdasaryan <[email protected]>

---
 mm/userfaultfd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

mm/userfaultfd.c +7 -2

index 8253978ee0fb..bf7a57ea71e0 100644
@@ -1453,10 +1453,15 @@ static int move_pages_pte(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd,
 		folio_unlock(src_folio);
 		folio_put(src_folio);
 	}
-	if (dst_pte)
-		pte_unmap(dst_pte);
+	/*
+	 * Unmap in reverse order (LIFO) to maintain proper kmap_local
+	 * index ordering when CONFIG_HIGHPTE is enabled. We mapped dst_pte
+	 * first, then src_pte, so we must unmap src_pte first, then dst_pte.
+	 */
 	if (src_pte)
 		pte_unmap(src_pte);
+	if (dst_pte)
+		pte_unmap(dst_pte);
 	mmu_notifier_invalidate_range_end(&range);
 	if (si)
 		put_swap_device(si);

Signature · 1 line

2.39.5

Andrew Morton

maintainer

2025-08-01 21:11 UTC #1 lore raw

Quoted 16 lines · On Thu, 31 Jul 2025 10:44:31 -0400 Sasha Levin <[email protected]> wrote:

With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order.
The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed():
  WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c
  addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)
Fix this by reversing the unmap order to respect LIFO ordering.
This issue follows the same pattern as similar fixes:
- commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
- commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")

Quoted 5 lines

Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.
Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Co-developed-by Claude claude-opus-4-20250514

Well this is innovative. I doubt if Co-developed-by: is appropriate for this (where's Claude's Signed-off-by:?)

I'd support creating a new changelog tag for this case.

And really, if AI was recruited in developing a kernel patch, it would be helpful if the changelog were to have a paragraph describing just how the AI assist was used. At least, until everyone knows all about this? You probably already have a presentation or a web page, so adding a link to that would suffice, thanks.

Sasha Levin

author

2025-08-01 21:56 UTC #2 lore raw

Quoted 18 lines · Andrew Morton

Quoted 16 lines · On Thu, 31 Jul 2025 10:44:31 -0400 Sasha Levin <[email protected]> wrote:
With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order.
The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed():
  WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c
  addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)
Fix this by reversing the unmap order to respect LIFO ordering.
This issue follows the same pattern as similar fixes:
- commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
- commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")

Quoted 8 lines

Quoted 5 lines
Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.
Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Co-developed-by Claude claude-opus-4-20250514
Well this is innovative. I doubt if Co-developed-by: is appropriate for this (where's Claude's Signed-off-by:?)

Claude (or any other AI) can't legally sign off on code :)

Quoted 1 line

I'd support creating a new changelog tag for this case.

This is in the context of a proposal on workflows@:
https://lore.kernel.org/workflows/[email protected]/T/#t

The Co-developed-by: usage wasn't my proposal, but it looked like the majority of folks were okay with it.

Input is definitely welcome!

Quoted 5 lines

And really, if AI was recruited in developing a kernel patch, it would be helpful if the changelog were to have a paragraph describing just how the AI assist was used. At least, until everyone knows all about this? You probably already have a presentation or a web page, so adding a link to that would suffice, thanks.

Kees actually has a good writeup about his experience with AI tooling
here: https://hachyderm.io/@kees/114907228284590439 , my experience is fairly similar.

Kees logged his prompts as part of the patch he sent in
(https://lore.kernel.org/lkml/[email protected]/)
which was interesting, but I didn't see much value in doing that beyond the demo purposes as this is not really reproducible.

Signature · 2 lines

Thanks,
Sasha

David Hildenbrand

2025-08-04 08:09 UTC #3 lore raw

Quoted 22 lines · Sasha Levin

Quoted 21 lines · Andrew Morton
Quoted 19 lines · On Thu, 31 Jul 2025 10:44:31 -0400 Sasha Levin <[email protected]> wrote:
With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order.
The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed():
   WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c
   addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)
Fix this by reversing the unmap order to respect LIFO ordering.
This issue follows the same pattern as similar fixes:
- commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
- commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")
Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.

Quoted 7 lines

Quoted 5 lines
Quoted 2 lines
Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Co-developed-by Claude claude-opus-4-20250514
Well this is innovative. I doubt if Co-developed-by: is appropriate for this (where's Claude's Signed-off-by:?)
Claude (or any other AI) can't legally sign off on code :)

I think we need a different tag than Co-developed-by. Avocado [1] seems to use

Assisted-by:

Which I prefer over things like Generated-by o co-developed-by:

[1] https://avocado-framework.readthedocs.io/en/latest/guides/contributor/chapters/ai_policy.html

Signature · 3 lines

Cheers,

David / dhildenb

Andrew Morton

maintainer

2025-08-21 04:24 UTC #4 lore raw

In reply to Sasha Levin

Quoted 8 lines · On Fri, 1 Aug 2025 17:56:25 -0400 Sasha Levin <[email protected]> wrote:

Quoted 5 lines
Quoted 2 lines
Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Co-developed-by Claude claude-opus-4-20250514
Well this is innovative. I doubt if Co-developed-by: is appropriate for this (where's Claude's Signed-off-by:?)
Claude (or any other AI) can't legally sign off on code :)

Quoted 8 lines

Quoted 1 line
I'd support creating a new changelog tag for this case.
This is in the context of a proposal on workflows@:
https://lore.kernel.org/workflows/[email protected]/T/#t
The Co-developed-by: usage wasn't my proposal, but it looked like the majority of folks were okay with it.

I need to do something about this and the discussion over on [email protected] has been as beer-addled as one would expect.

Oh well. I guess for now we can welcome Claude to the kernel development team.

Sasha Levin

author

2025-08-21 13:02 UTC #5 lore raw

Quoted 19 lines · Andrew Morton

Quoted 8 lines · On Fri, 1 Aug 2025 17:56:25 -0400 Sasha Levin <[email protected]> wrote:
Quoted 5 lines
Quoted 2 lines
Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Co-developed-by Claude claude-opus-4-20250514
Well this is innovative. I doubt if Co-developed-by: is appropriate for this (where's Claude's Signed-off-by:?)
Claude (or any other AI) can't legally sign off on code :)
Quoted 8 lines
Quoted 1 line
I'd support creating a new changelog tag for this case.
This is in the context of a proposal on workflows@:
https://lore.kernel.org/workflows/[email protected]/T/#t
The Co-developed-by: usage wasn't my proposal, but it looked like the majority of folks were okay with it.

Quoted 5 lines

I need to do something about this and the discussion over on [email protected] has been as beer-addled as one would expect.
Oh well. I guess for now we can welcome Claude to the kernel development team.

FWIW, I've switched the new RFC to use Assisted-by: as suggested by yourself and David. If you'd prefer, I can resend it with the Assisted-by tag instead.

Signature · 2 lines

Thanks,
Sasha