Files
linux-stable-mirror/include/linux/page_ext.h
T
KetanandAndrew Morton ffd017237c mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
The page_ext iteration API does not validate if the PFN still belongs to a
valid section while advancing the iterator.  When dynamically adding
memory in the hotplug path, it can lead to a NULL pointer dereference
during page_ext_lookup at the boundary of the last valid section when
iterator count equals __pgcount.

The for_each_page_ext() macro calls page_ext_iter_next() as its loop
increment.  for_each_page_ext() does a "__page_ext =
page_ext_iter_next(&__iter)" at the end.  This causes page_ext_iter_next()
to increment iter->index past __pgcount and call page_ext_lookup(start_pfn
+ __pgcount).  During memory hotplug (online), the PFN at start_pfn +
__pgcount may belong to a section that has not yet been initialized,
causing page_ext_lookup() to trigger a NULL pointer dereference.

[   14.555124][  T846] Call trace:
[   14.555125][  T846]  lookup_page_ext+0x6c/0x108 (P)
[   14.555127][  T846]  page_ext_lookup+0x30/0x3c
[   14.555129][  T846]  __reset_page_owner+0x11c/0x260
[   14.571201][  T846]  __free_pages_ok+0x5e8/0x8e0
[   14.571204][  T846]  __free_pages_core+0x78/0xf0
[   14.571206][  T846]  generic_online_page+0x14/0x24
[   14.597782][  T846]  online_pages+0x178/0x30c
[   14.597784][  T846]  memory_block_change_state+0x284/0x32c
[   14.597787][  T846]  memory_subsys_online+0x4c/0x64
[   14.597789][  T846]  device_online+0x88/0xb0
[   14.597791][  T846]  online_memory_block+0x30/0x40
[   14.597793][  T846]  walk_memory_blocks+0xac/0xe8
[   14.597794][  T846]  add_memory_resource+0x280/0x298
[   14.656161][  T846]  add_memory+0x60/0x98

Move the iteration boundary enforcement inside the iterator functions, so
callers cannot inadvertently access beyond the requested range.

Link: https://lore.kernel.org/20260623-page_ext-v3-1-a89799a5367c@oss.qualcomm.com
Fixes: 9039b9096e ("mm: page_ext: add an iteration API for page extensions")
Signed-off-by: Ketan Kishore <ketan.kishore@oss.qualcomm.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Suggested-by: Matthew Wilcox <willy@infradead.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Luiz Capitulino <luizcap@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-01 19:02:54 -07:00

236 lines
5.6 KiB
C

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef __LINUX_PAGE_EXT_H
#define __LINUX_PAGE_EXT_H
#include <linux/types.h>
#include <linux/mmzone.h>
#include <linux/stacktrace.h>
struct pglist_data;
#ifdef CONFIG_PAGE_EXTENSION
/**
* struct page_ext_operations - per page_ext client operations
* @offset: Offset to the client's data within page_ext. Offset is returned to
* the client by page_ext_init.
* @size: The size of the client data within page_ext.
* @need: Function that returns true if client requires page_ext.
* @init: (optional) Called to initialize client once page_exts are allocated.
* @need_shared_flags: True when client is using shared page_ext->flags
* field.
*
* Each Page Extension client must define page_ext_operations in
* page_ext_ops array.
*/
struct page_ext_operations {
size_t offset;
size_t size;
bool (*need)(void);
void (*init)(void);
bool need_shared_flags;
};
/*
* The page_ext_flags users must set need_shared_flags to true.
*/
enum page_ext_flags {
PAGE_EXT_OWNER,
PAGE_EXT_OWNER_ALLOCATED,
#if defined(CONFIG_PAGE_IDLE_FLAG) && !defined(CONFIG_64BIT)
PAGE_EXT_YOUNG,
PAGE_EXT_IDLE,
#endif
};
/*
* Page Extension can be considered as an extended mem_map.
* A page_ext page is associated with every page descriptor. The
* page_ext helps us add more information about the page.
* All page_ext are allocated at boot or memory hotplug event,
* then the page_ext for pfn always exists.
*/
struct page_ext {
unsigned long flags;
};
extern bool early_page_ext;
extern unsigned long page_ext_size;
extern void pgdat_page_ext_init(struct pglist_data *pgdat);
static inline bool early_page_ext_enabled(void)
{
return early_page_ext;
}
#ifdef CONFIG_SPARSEMEM
static inline void page_ext_init_flatmem(void)
{
}
extern void page_ext_init(void);
static inline void page_ext_init_flatmem_late(void)
{
}
static inline bool page_ext_iter_next_fast_possible(unsigned long next_pfn)
{
/*
* page_ext is allocated per memory section. Once we cross a
* memory section, we have to fetch the new pointer.
*/
return next_pfn % PAGES_PER_SECTION;
}
#else
extern void page_ext_init_flatmem(void);
extern void page_ext_init_flatmem_late(void);
static inline void page_ext_init(void)
{
}
static inline bool page_ext_iter_next_fast_possible(unsigned long next_pfn)
{
return true;
}
#endif
extern struct page_ext *page_ext_get(const struct page *page);
extern struct page_ext *page_ext_from_phys(phys_addr_t phys);
extern void page_ext_put(struct page_ext *page_ext);
extern struct page_ext *page_ext_lookup(unsigned long pfn);
static inline void *page_ext_data(struct page_ext *page_ext,
struct page_ext_operations *ops)
{
return (void *)(page_ext) + ops->offset;
}
static inline struct page_ext *page_ext_next(struct page_ext *curr)
{
void *next = curr;
next += page_ext_size;
return next;
}
struct page_ext_iter {
unsigned long index;
unsigned long start_pfn;
struct page_ext *page_ext;
};
/**
* page_ext_iter_begin() - Prepare for iterating through page extensions.
* @iter: page extension iterator.
* @pfn: PFN of the page we're interested in.
* @count: maximum number of page extensions to return.
*
* Must be called with RCU read lock taken.
*
* Return: NULL if no page_ext exists for this page.
*/
static inline struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter,
unsigned long pfn, unsigned long count)
{
if (!count)
return NULL;
iter->index = 0;
iter->start_pfn = pfn;
iter->page_ext = page_ext_lookup(pfn);
return iter->page_ext;
}
/**
* page_ext_iter_next() - Get next page extension
* @iter: page extension iterator.
* @count: maximum number of page extensions to return.
*
* Must be called with RCU read lock taken.
*
* Return: NULL if no next page_ext exists.
*/
static inline struct page_ext *page_ext_iter_next(struct page_ext_iter *iter,
unsigned long count)
{
unsigned long pfn;
if (WARN_ON_ONCE(!iter->page_ext))
return NULL;
if (++iter->index >= count)
return NULL;
pfn = iter->start_pfn + iter->index;
if (page_ext_iter_next_fast_possible(pfn))
iter->page_ext = page_ext_next(iter->page_ext);
else
iter->page_ext = page_ext_lookup(pfn);
return iter->page_ext;
}
/**
* page_ext_iter_get() - Get current page extension
* @iter: page extension iterator.
*
* Return: NULL if no page_ext exists for this iterator.
*/
static inline struct page_ext *page_ext_iter_get(const struct page_ext_iter *iter)
{
return iter->page_ext;
}
/**
* for_each_page_ext(): iterate through page_ext objects.
* @__page: the page we're interested in
* @__pgcount: how many pages to iterate through
* @__page_ext: struct page_ext pointer where the current page_ext
* object is returned
* @__iter: struct page_ext_iter object (defined in the stack)
*
* IMPORTANT: must be called with RCU read lock taken.
*/
#define for_each_page_ext(__page, __pgcount, __page_ext, __iter) \
for (__page_ext = page_ext_iter_begin(&__iter, page_to_pfn(__page), __pgcount); \
__page_ext; \
__page_ext = page_ext_iter_next(&__iter, __pgcount))
#else /* !CONFIG_PAGE_EXTENSION */
struct page_ext;
static inline bool early_page_ext_enabled(void)
{
return false;
}
static inline void pgdat_page_ext_init(struct pglist_data *pgdat)
{
}
static inline void page_ext_init(void)
{
}
static inline void page_ext_init_flatmem_late(void)
{
}
static inline void page_ext_init_flatmem(void)
{
}
static inline struct page_ext *page_ext_get(const struct page *page)
{
return NULL;
}
static inline struct page_ext *page_ext_from_phys(phys_addr_t phys)
{
return NULL;
}
static inline void page_ext_put(struct page_ext *page_ext)
{
}
#endif /* CONFIG_PAGE_EXTENSION */
#endif /* __LINUX_PAGE_EXT_H */