mm/page_table_check: add explicit pmd_none check in pte_clear_range

In __page_table_check_pte_clear_range(), the condition to determine
whether to iterate over PTEs only checked pmd_bad() and pmd_leaf().  This
relies on the implicit assumption that pmd_none() is always a subset of
pmd_bad() on all architectures supporting PAGE_TABLE_CHECK.

While this assumption currently holds for x86_64, arm64, s390, riscv, and
powerpc, it is an architecture-dependent behavior that may not hold for
future architectures.  Add an explicit pmd_none() check to make the intent
clear and avoid calling pte_offset_map() on an empty PMD, which could lead
to undefined behavior.

Link: https://lore.kernel.org/20260819025516.2967199-1-ye.liu@linux.dev
Signed-off-by: Ye Liu <liuye@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
This commit is contained in:
Ye Liu 2026-08-19 10:55:15 +08:00 committed by Andrew Morton
parent a09bf22530
commit 0224133dba

View File

@ -278,7 +278,7 @@ void __page_table_check_pte_clear_range(struct mm_struct *mm,
if (&init_mm == mm)
return;
if (!pmd_bad(pmd) && !pmd_leaf(pmd)) {
if (!pmd_none(pmd) && !pmd_bad(pmd) && !pmd_leaf(pmd)) {
pte_t *ptep = pte_offset_map(&pmd, addr);
unsigned long i;