Hi Pavel, On 21/08/2019 19:31, Pavel Tatashin wrote: > There is a bug in create_safe_exec_page(), when page table is allocated > it is not checked that table is allocated successfully: > > But it is dereferenced in: pgd_none(READ_ONCE(*pgdp)). If there is a bug, it shouldn't be fixed part way through a series. This makes it difficult to backport the fix. Please split this out as an independent patch with a 'Fixes:' tag for the commit that introduced the bug. > Another issue, So this patch does two things? That is rarely a good idea. Again, this makes it difficult to backport the fix. > is that phys_to_ttbr() uses an offset in page table instead > of pgd directly. If you were going to reuse this, that would be a bug. But because the only page that is being mapped, is mapped to PAGE_SIZE, all the top bits will be 0. The offset calls are boiler-plate. It doesn't look intentional, but its harmless. Please separate out the potential NULL-dereference bits so there is a clean stand-alone fix that can be sent to the stable trees. Thanks, James
