From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f51.google.com (mail-oo1-f51.google.com [209.85.161.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D30AB3101D4 for ; Mon, 9 Feb 2026 23:16:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770679017; cv=none; b=O1hRIQHDOQ03GPbgMJq2qIZdJxak3DgiKUlvzcQXXACR09PjF7tmnB3rcgK4e9syfnf40VF/IM4f64emXOl+SOApdgPwyLoPb+H5SuS2QVf32AbVdNVEI2l1fbba4J3xsOAx021vn6/EgMdAJOeZIrpkvNUScz0rwXbmfmt1dKQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770679017; c=relaxed/simple; bh=/O5fEIv7xrVi7LFyYIUuqG5EWVz4Jw9h9NsefSpOBHU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=O50r9ExkldbkPz22Kts/vIbew166udHd7wXAEKTLi9aOGLWANh9NyjouxtpOJTmYcraxGuOSo7aUB2qODgHRl9AsQ3q73gCP3NnIRtBPRYiI5/Cw8ExSBKK/GsA+bYngMH4IcDakuSnjU4FPROTMZAxGj/u+DuiHsMG8ITPRu1s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hLw4MwtM; arc=none smtp.client-ip=209.85.161.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hLw4MwtM" Received: by mail-oo1-f51.google.com with SMTP id 006d021491bc7-6726f320b4fso392420eaf.2 for ; Mon, 09 Feb 2026 15:16:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1770679015; x=1771283815; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=9KPSiJIKj/b8QQwFvGSiwvCphuT1m/bq196d1vnTPzE=; b=hLw4MwtMzPowlBYZOU5s5pNYd91s/E+Yt2TfUd9P9L4nKLgHebxTkzOuazLyPzRLRl /vl/RRhk8zOZHeRns0uwrFD9ghrvSK226F++NNcm6B1yKUR6+pnjomHhcc4ViHZu4iO3 pwWJEIs8z8U1l0ixq9jhedZgXZLW7FP2jEcK2mEMYqQjARchEDug5wh3XvwjrsVXDQzu 7c0m9fW2FahVyUrbl5+Uiuc8yeVHC6+r3Z/MSzax0TBh+WNv2ZtUw5KyehDh3X/qsnMu QaPA2F/R8nj2fKmqM3RRXF3QpXJ8APclnZx+3DBFrC0/ZBs1U9OI2hWZsyKmp1I1iYUP ZbXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770679015; x=1771283815; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=9KPSiJIKj/b8QQwFvGSiwvCphuT1m/bq196d1vnTPzE=; b=BCYQ+7sZlsItIajAw6Ig0cZeDVAAxEsd4eSVhSgReuLP7ykD0fW5zcvSPPRSi2PnqK IvQgj1NWFIoaqSRRSzqDenopIm8XYnbgJxeI4MjzHdFz8KbiQlpzJ/VOwSkYAI/XyqOS VX+9XrK4YQXEWXt6IoRtztPRsi6XwwZMrAEY3vXqaZOEJuCyrXSASokMhq/LDfnyWSUy xNtGZK0i5EOaV836TqzuipWQ4zrz13xGPf0d8TpHMymauuNNgxQAe9P5zIGNoYJVk67+ pQqyqUnDPq4KDhsS9BenfAtdMBzflAA5FlUYJFWL+WEQidJqAk25v+EkCZkd8ospcNWA OlyQ== X-Forwarded-Encrypted: i=1; AJvYcCWkiokG10yF5m9ideCZyhTOoNSXU3es7cYnUOk0Fyo6vs7DEeWHITh6qPjamwQNw6YMgVIIaqaoXmpmNt4=@vger.kernel.org X-Gm-Message-State: AOJu0Yypo+dwop0NcwMPTE3G4117SAPqG8i6hzrTOuDUlsMFVQeiR3XB gunvsyCfCfYYMzkcX5p2C0pAzptRzEzKiscVug1xJ0kvk30EITEzO/9L X-Gm-Gg: AZuq6aJCNm97kdZblI2aZf1gszAphubJOMhk79M4Lc+U+8xDlQK/GjAX6OpvvoNm3gq d30DlsmF2jQBUWFAFB2sMf7XyXcC5rcC7CJY8WSkN2EY8b32FWepASsEAXmptgBDgL8GTrvgmWR 9UCcA3zBl7pdzVFJ3qDhVnvlVlUBVeGWypnmghA9BxjiWEU6iYMHyWlhZ7f3slBTpJy0ZSL8Hi0 fIyeVy+3iOKOwx7x7yu5/p2LUAF4XYOjpLf1KKVS2wG6wurZGo5fKG4GoHgSI+I18rQ1zbSySBZ wRkEiq02Ei7Ohxo1dpAGVbgPi23VjqypU2JezVYLFT3GIT26vO5SRdCeSRzj+zTnss6q8fgkhDf bobenwFWIlxwsJLGIA9blI2fKgeo42IVibzeeznrmNjjNCP85MbLSCjAm6KE/+8K3sliaLmjHTw E4PtjHtgU0o7hFShWbfWwa X-Received: by 2002:a05:6820:3088:b0:662:f91f:4a98 with SMTP id 006d021491bc7-66d0c18aba2mr5686178eaf.41.1770679014745; Mon, 09 Feb 2026 15:16:54 -0800 (PST) Received: from localhost ([2a03:2880:10ff:70::]) by smtp.gmail.com with ESMTPSA id 006d021491bc7-66d3adcae3csm6928357eaf.9.2026.02.09.15.16.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Feb 2026 15:16:54 -0800 (PST) From: Joshua Hahn To: Joshua Hahn Cc: Minchan Kim , Michael Fara , senozhatsky@chromium.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, akpm@linux-foundation.org Subject: Re: [PATCH] mm/zsmalloc: fix NULL pointer dereference in get_next_zpdesc Date: Mon, 9 Feb 2026 15:16:52 -0800 Message-ID: <20260209231652.1806289-1-joshua.hahnjy@gmail.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260209225018.1541260-1-joshua.hahnjy@gmail.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit I just noticed that Minchan wasn't Cc-ed in the patch. Adding him to the conversation here. On Mon, 9 Feb 2026 14:50:16 -0800 Joshua Hahn wrote: > On Mon, 9 Feb 2026 19:32:57 +0000 Michael Fara wrote: > > Hello Michael, > > I hope you are doing well! Thank you for the patch. I'm not entirely sure if > the race condition that you note here is correct, and also if this is the > right fix. > > > get_next_zpdesc() calls get_zspage() which unconditionally dereferences > > zpdesc->zspage without a NULL check. This causes a kernel oops when > > zpdesc->zspage has been set to NULL by reset_zpdesc() during a race > > between zspage destruction and page compaction/migration. [...snip...] Should we add a Fixes tag here as well? > > Signed-off-by: Michael Fara > > --- > > mm/zsmalloc.c | 14 +++++++++++++- > > 1 file changed, 13 insertions(+), 1 deletion(-) > > > > diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c > > --- a/mm/zsmalloc.c > > +++ b/mm/zsmalloc.c > > @@ -735,7 +735,19 @@ static struct zspage *get_zspage(struct zpdesc *zpdesc) > > > > static struct zpdesc *get_next_zpdesc(struct zpdesc *zpdesc) > > { > > - struct zspage *zspage = get_zspage(zpdesc); > > + struct zspage *zspage = zpdesc->zspage; > > + > > + /* > > + * If the backpointer is NULL, this zpdesc was already freed via > > + * reset_zpdesc() by a racing async_free_zspage() while isolated > > + * for compaction. See the TODO comment in zs_page_migrate(). > > + */ > > + if (unlikely(!zspage)) { > > + WARN_ON_ONCE(1); > > + return NULL; > > + } > > + > > + BUG_ON(zspage->magic != ZSPAGE_MAGIC); > > > > if (unlikely(ZsHugePage(zspage))) > > return NULL; > > -- > > 2.39.0