David Hildenbrand 4234ca9884 mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() ...

commit faeec8e23c upstream.

In split_large_buddy(), we might call pfn_to_page() on a PFN that might
not exist.  In corner cases, such as when freeing the highest pageblock in
the last memory section, this could result with CONFIG_SPARSEMEM &&
!CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and
__section_mem_map_addr() dereferencing that NULL pointer.

Let's fix it, and avoid doing a pfn_to_page() call for the first
iteration, where we already have the page.

So far this was found by code inspection, but let's just CC stable as the
fix is easy.

Link: https://lkml.kernel.org/r/20241210093437.174413-1-david@redhat.com
Fixes: fd919a85cd ("mm: page_isolation: prepare for hygienic freelists")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Closes: https://lkml.kernel.org/r/e1a898ba-a717-4d20-9144-29df1a6c8813@suse.cz
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-12-27 14:02:13 +01:00

..

damon

mm/damon/vaddr: fix issue in damon_va_evenly_split_region()

2024-12-09 10:41:02 +01:00

kasan

kasan: make report_lock a raw spinlock

2024-12-14 20:03:32 +01:00

kfence

mm: kfence: fix elapsed time for allocated/freed track

2024-09-26 14:01:44 -07:00

kmsan

kmsan: do not pass NULL pointers as 0

2024-07-03 19:30:26 -07:00

backing-dev.c

writeback: support retrieving per group debug writeback stats of bdi

2024-05-05 17:53:51 -07:00

balloon_compaction.c

mm: remove MIGRATE_SYNC_NO_COPY mode

2024-07-03 19:30:00 -07:00

bootmem_info.c

…

cma_debug.c

…

cma_sysfs.c

…

cma.c

mm/cma: add cma_{alloc,free}_folio()

2024-09-03 21:15:36 -07:00

cma.h

…

compaction.c

mm:page_alloc: fix the NULL ac->nodemask in __alloc_pages_slowpath()

2024-09-03 21:15:47 -07:00

debug_page_alloc.c

mm: page_alloc: consolidate free page accounting

2024-04-25 20:56:04 -07:00

debug_page_ref.c

…

debug_vm_pgtable.c

mm/debug_vm_pgtable: Use pxdp_get() for accessing page table entries

2024-09-17 01:07:01 -07:00

debug.c

mm: open-code page_folio() in dump_page()

2024-12-14 20:03:33 +01:00

dmapool_test.c

mm/dmapool: add MODULE_DESCRIPTION()

2024-07-03 19:29:58 -07:00

dmapool.c

…

early_ioremap.c

…

execmem.c

mm/execmem, arch: convert remaining overrides of module_alloc to execmem

2024-05-14 00:31:43 -07:00

fadvise.c

introduce fd_file(), convert all accessors to it.

2024-08-12 22:00:43 -04:00

fail_page_alloc.c

fault-inject: improve build for CONFIG_FAULT_INJECTION=n

2024-09-01 20:43:33 -07:00

failslab.c

fault-inject: improve build for CONFIG_FAULT_INJECTION=n

2024-09-01 20:43:33 -07:00

filemap.c

filemap: Fix bounds checking in filemap_read()

2024-11-10 14:07:08 -08:00

folio-compat.c

mm: remove putback_lru_page()

2024-09-09 16:38:59 -07:00

gup_test.c

…

gup_test.h

…

gup.c

mm/gup: handle NULL pages in unpin_user_pages()

2024-12-14 20:03:32 +01:00

highmem.c

mm/highmem: make nr_free_highpages() return "unsigned long"

2024-07-03 19:30:06 -07:00

hmm.c

mm: provide mm_struct and address to huge_ptep_get()

2024-07-12 15:52:15 -07:00

huge_memory.c

mm/thp: fix deferred split queue not partially_mapped: fix

2024-11-12 10:14:00 -08:00

hugetlb_cgroup.c

mm: memcg: don't call propagate_protected_usage() needlessly

2024-09-01 20:25:50 -07:00

hugetlb_vmemmap.c

mm/hugetlb_vmemmap: don't synchronize_rcu() without HVO

2024-09-01 20:25:45 -07:00

hugetlb_vmemmap.h

…

hugetlb.c

mm/hugetlb: fix memfd_pin_folios resv_huge_pages leak

2024-09-26 14:01:43 -07:00

hwpoison-inject.c

mm/hwpoison: add MODULE_DESCRIPTION()

2024-07-03 19:29:58 -07:00

init-mm.c

…

internal.h

Rename .data.once to .data..once to fix resetting WARN*_ONCE

2024-12-05 14:03:08 +01:00

interval_tree.c

…

io-mapping.c

…

ioremap.c

…

Kconfig

resource: remove dependency on SPARSEMEM from GET_FREE_REGION

2024-10-28 21:40:39 -07:00

Kconfig.debug

slub: Introduce CONFIG_SLUB_RCU_DEBUG

2024-08-27 14:12:51 +02:00

khugepaged.c

mm: khugepaged: fix the incorrect statistics when collapsing large file folios

2024-10-17 00:28:10 -07:00

kmemleak.c

mm/kmemleak: use IS_ERR_PCPU() for pointer in the percpu address space

2024-09-03 21:15:38 -07:00

ksm.c

mm: remove PageSwapCache

2024-09-03 21:15:44 -07:00

list_lru.c

mm: list_lru: fix UAF for memory cgroup

2024-08-07 18:33:56 -07:00

maccess.c

…

madvise.c

Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-09-21 07:29:05 -07:00

Makefile

mm: introduce numa_emulation

2024-09-03 21:15:31 -07:00

mapping_dirty_helpers.c

…

memblock.c

memblock: allow zero threshold in validate_numa_converage()

2024-12-14 20:03:34 +01:00

memcontrol-v1.c

mm/thp: fix deferred split unqueue naming and locking

2024-11-05 16:49:54 -08:00

memcontrol-v1.h

mm: memcg: declare do_memsw_account inline

2024-12-14 20:03:33 +01:00

memcontrol.c

mm: count zeromap read and set for swapout and swapin

2024-11-11 00:00:37 -08:00

memfd.c

mm/hugetlb: simplify refs in memfd_alloc_folio

2024-09-26 14:01:44 -07:00

memory_hotplug.c

Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-09-21 07:29:05 -07:00

memory-failure.c

mm: migrate: add isolate_folio_to_list()

2024-09-03 21:15:59 -07:00

memory-tiers.c

memory tiers: use default_dram_perf_ref_source in log message

2024-09-26 14:01:44 -07:00

memory.c

mm: avoid unconditional one-tick sleep when swapcache_prepare fails

2024-10-28 21:40:41 -07:00

mempolicy.c

mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM

2024-12-14 20:03:32 +01:00

mempool.c

mm: fix xyz_noprof functions calling profiled functions

2024-06-05 19:19:26 -07:00

memremap.c

mm: convert put_devmap_managed_page_refs() to put_devmap_managed_folio_refs()

2024-05-05 17:53:49 -07:00

memtest.c

…

migrate_device.c

mm: remap unused subpages to shared zeropage when splitting isolated thp

2024-09-09 16:39:03 -07:00

migrate.c

mm/thp: fix deferred split unqueue naming and locking

2024-11-05 16:49:54 -08:00

mincore.c

mm: provide mm_struct and address to huge_ptep_get()

2024-07-12 15:52:15 -07:00

mlock.c

mm/mlock: set the correct prev on failure

2024-11-07 14:14:58 -08:00

mm_init.c

mm: drop CONFIG_HAVE_ARCH_NODEDATA_EXTENSION

2024-09-03 21:15:28 -07:00

mm_slot.h

…

mmap_lock.c

mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer

2024-07-03 19:30:26 -07:00

mmap.c

mm: respect mmap hint address when aligning for THP

2024-12-14 20:03:34 +01:00

mmu_gather.c

…

mmu_notifier.c

mm: move internal core VMA manipulation functions to own file

2024-09-01 20:25:54 -07:00

mmzone.c

mm: improve code consistency with zonelist_* helper functions

2024-09-01 20:25:55 -07:00

mprotect.c

mm: refactor map_deny_write_exec()

2024-11-05 16:49:55 -08:00

mremap.c

mm/mremap: fix address wraparound in move_page_tables()

2024-11-14 22:43:48 -08:00

mseal.c

Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-09-21 07:29:05 -07:00

msync.c

…

nommu.c

nommu: pass NULL argument to vma_iter_prealloc()

2024-11-11 17:20:23 -08:00

numa_emulation.c

mm: introduce numa_emulation

2024-09-03 21:15:31 -07:00

numa_memblks.c

mm: numa_clear_kernel_node_hotplug: Add NUMA_NO_NODE check for node id

2024-10-28 21:40:40 -07:00

numa.c

mm: make range-to-target_node lookup facility a part of numa_memblks

2024-09-03 21:15:32 -07:00

oom_kill.c

memory: remove the now superfluous sentinel element from ctl_table array

2024-04-25 20:56:32 -07:00

page_alloc.c

mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()

2024-12-27 14:02:13 +01:00

page_counter.c

mm, memcg: cg2 memory{.swap,}.peak write handlers

2024-09-01 20:25:53 -07:00

page_ext.c

mm: don't account memmap per-node

2024-08-15 22:16:14 -07:00

page_idle.c

…

page_io.c

mm: count zeromap read and set for swapout and swapin

2024-11-11 00:00:37 -08:00

page_isolation.c

mm: remove migration for HugePage in isolate_single_pageblock()

2024-09-03 21:15:40 -07:00

page_owner.c

mm/page-owner: use gfp_nested_mask() instead of open coded masking

2024-05-19 14:40:44 -07:00

page_poison.c

…

page_reporting.c

…

page_reporting.h

…

page_table_check.c

mm/page_table_check: fix crash on ZONE_DEVICE

2024-06-15 10:43:04 -07:00

page_vma_mapped.c

mm: make page_mapped_in_vma conditional on CONFIG_MEMORY_FAILURE

2024-05-05 17:53:45 -07:00

page-writeback.c

Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-09-21 07:29:05 -07:00

pagewalk.c

mm/pagewalk: fix usage of pmd_leaf()/pud_leaf() without present check

2024-10-28 21:40:38 -07:00

percpu-internal.h

mm: remove CONFIG_MEMCG_KMEM

2024-07-10 12:14:54 -07:00

percpu-km.c

…

percpu-stats.c

…

percpu-vm.c

percpu: clean up all mappings when pcpu_map_pages() fails

2024-04-25 20:55:49 -07:00

percpu.c

percpu: remove pcpu_alloc_size()

2024-09-01 20:26:04 -07:00

pgalloc-track.h

…

pgtable-generic.c

mm: fix race between __split_huge_pmd_locked() and GUP-fast

2024-05-07 10:37:00 -07:00

process_vm_access.c

…

ptdump.c

…

readahead.c

Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"

2024-12-14 20:03:26 +01:00

rmap.c

mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify()

2024-11-03 10:47:03 -08:00

rodata_test.c

…

secretmem.c

secretmem: disable memfd_secret() if arch cannot set direct map

2024-10-09 12:47:19 -07:00

shmem_quota.c

shmem_quota: build the object file conditionally to the config option

2024-09-01 20:25:45 -07:00

shmem.c

mm: revert "mm: shmem: fix data-race in shmem_getattr()"

2024-11-16 15:30:32 -08:00

show_mem.c

mm/show_mem.c: report alloc tags in human readable units

2024-09-17 01:07:00 -07:00

shrinker_debug.c

mm: shrinker: use min() to improve shrinker_debugfs_scan_write()

2024-09-03 21:15:40 -07:00

shrinker.c

mm: shrinker: avoid memleak in alloc_shrinker_info

2024-10-31 20:27:04 -07:00

shuffle.c

…

shuffle.h

…

slab_common.c

slab: Fix too strict alignment check in create_cache()

2024-12-09 10:41:07 +01:00

slab.h

mm/slub: Avoid list corruption when removing a slab from the full list

2024-12-09 10:41:04 +01:00

slub.c

memcg: slub: fix SUnreclaim for post charged objects

2024-12-19 18:13:01 +01:00

sparse-vmemmap.c

LoongArch: Set initial pte entry with PAGE_GLOBAL for kernel space

2024-10-21 22:11:19 +08:00

sparse.c

Merge tag 'x86-urgent-2024-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2024-09-01 14:43:08 -07:00

swap_cgroup.c

mm: attempt to batch free swap entries for zap_pte_range()

2024-09-03 21:15:33 -07:00

swap_slots.c

mm: swap: update get_swap_pages() to take folio order

2024-04-25 20:56:37 -07:00

swap_state.c

mm: add nr argument in mem_cgroup_swapin_uncharge_swap() helper to support large folios

2024-09-17 01:07:01 -07:00

swap.c

mm: page_alloc: move mlocked flag clearance into free_pages_prepare()

2024-11-11 17:20:23 -08:00

swap.h

mm: fix swap_read_folio_zeromap() for large folios with partial zeromap

2024-09-17 01:07:01 -07:00

swapfile.c

mm, swap: fix allocation and scanning race with swapoff

2024-11-14 15:25:07 -08:00

truncate.c

mm: Fix missing folio invalidation calls during truncation

2024-08-24 16:09:16 +02:00

usercopy.c

…

userfaultfd.c

Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-09-21 07:29:05 -07:00

util.c

mm: only enforce minimum stack gap size if it's sensible

2024-09-01 20:26:02 -07:00

vma_internal.h

mm: remove duplicated include in vma_internal.h

2024-09-01 20:26:02 -07:00

vma.c

mm: unconditionally close VMAs on error

2024-11-05 16:49:55 -08:00

vma.h

mm: refactor map_deny_write_exec()

2024-11-05 16:49:55 -08:00

vmalloc.c

vmalloc: fix accounting with i915

2024-12-27 14:02:13 +01:00

vmpressure.c

…

vmscan.c

mm/thp: fix deferred split unqueue naming and locking

2024-11-05 16:49:54 -08:00

vmstat.c

vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event

2024-12-09 10:41:01 +01:00

workingset.c

cachestat: do not flush stats in recency check

2024-07-03 22:40:37 -07:00

z3fold.c

mm/z3fold: add __percpu annotation to *unbuddied pointer in struct z3fold_pool

2024-09-01 20:25:56 -07:00

zbud.c

mm: zpool: return pool size in pages

2024-04-25 20:55:48 -07:00

zpool.c

mm: zpool: return pool size in pages

2024-04-25 20:55:48 -07:00

zsmalloc.c

Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-09-21 07:29:05 -07:00

zswap.c

mm: count zeromap read and set for swapout and swapin

2024-11-11 00:00:37 -08:00