Commit 288b3732 authored by Aneesh Kumar K.V's avatar Aneesh Kumar K.V Committed by Greg Kroah-Hartman
Browse files

powerpc/mm/hash64: Zero PGD pages on allocation

[ Upstream commit fc5c2f4a


On powerpc we allocate page table pages from slab caches of different
sizes. Currently we have a constructor that zeroes out the objects when
we allocate them for the first time.

We expect the objects to be zeroed out when we free the the object
back to slab cache. This happens in the unmap path. For hugetlb pages
we call huge_pte_get_and_clear() to do that.

With the current configuration of page table size, both PUD and PGD
level tables are allocated from the same slab cache. At the PUD level,
we use the second half of the table to store the slot information. But
we never clear that when unmapping.

When such a freed object is then allocated for a PGD page, the second
half of the page table page will not be zeroed as expected. This
results in a kernel crash.

Fix it by always clearing PGD pages when they're allocated.
Signed-off-by: default avatarAneesh Kumar K.V <>
[mpe: Change log wording and formatting, add whitespace]
Signed-off-by: default avatarMichael Ellerman <>
Signed-off-by: default avatarSasha Levin <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent f4d6e459
......@@ -73,10 +73,16 @@ static inline void radix__pgd_free(struct mm_struct *mm, pgd_t *pgd)
static inline pgd_t *pgd_alloc(struct mm_struct *mm)
pgd_t *pgd;
if (radix_enabled())
return radix__pgd_alloc(mm);
return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
pgtable_gfp_flags(mm, GFP_KERNEL));
pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
pgtable_gfp_flags(mm, GFP_KERNEL));
memset(pgd, 0, PGD_TABLE_SIZE);
return pgd;
static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment