From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from BN8PR05CU002.outbound.protection.outlook.com (mail-eastus2azon11011021.outbound.protection.outlook.com [52.101.57.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75292431E49 for ; Thu, 2 Jul 2026 02:44:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.57.21 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782960297; cv=fail; b=TO3GLP6MD6AThpbwlFscUYCgfM2wRu5aWDmV+BnTO5PTn7lrLtpI7ziqzHdWlPg0XE8KcJYpKDooRqZgtoifX41deAdsiUMntp49gJei4F967YfD0+jNUKMyCaT/3voc9jtRT5wkMa4WWpOkyvwn61K0RUyr2reAMHUzamotfRc= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782960297; c=relaxed/simple; bh=McTKqaqopVrbNH93wby6t2rxGfgmEtwdoNUiMHHo0gY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=M6fpsrvFRMcHr5gqu48gURhKaEl3h8rtZ+SvEY801naD/JAIVH/srP9D1ZpSbBHaUClP7P8KTT9FOAXuPHw9Ut6GXHsmfuY2S0WGVgOdbWxW9x7SC8zqnVSU9Kfzf2JTTi7nZJZb2Sz0Tgun6mfyjsrnE6FYD4J7TCI12YH4nyw= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=gP6Gui8A; arc=fail smtp.client-ip=52.101.57.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="gP6Gui8A" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=TWLGyC12tpLyg9T/KY76rZ5nXozy3qRYF2OmjU1VXJOki9Hyry47f9Bous5GYAv0QLXwnfQn7oSUqMO16g5hQXd1uwcq2T57W3Bvd1PwbL51fvEcfwdZkwvz4YaLs5yoTLuVVlBpDXZuoRGnVNfa+S61HOoZ2m1xwoJWtf1rQC3vfY8//8c6FYzCrRkKpjV9aencPZgr950fR7PomzU+4R7FsK0lX19eHjFx/58kef8gUkx9+Rvz90PmV6hNnbh8tCZU/BCnd/1QGyikJVWS0vCS0jR04sBhfxtBeddQqdy1VPNn5PBpMmrtvi4Q2mLRvGXeFOKJRTNtyBiKRisOcg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NgOsCPd/gw49/fN/1V8AVMUdWxSPAOwUyDjsbNZX3iw=; b=GBMZUSYrU+r72vbVYm82Mk3OhPOClhSMerSvPk7+QN62SbXRl4+UCv/cYIPzI59WD+8jeALDFTbQxvxHIicc2d8spv4WjcC64fLh6HAMm8wOrq22f/m76FKDgnwsLGQAGvJNEatii4xLD11DHasjRWzxx/ESP81f73pu4s5tWRWUZL0tYzP/6PN+felwCToqv8yXDHBi90flTc2Cwv0jmmuu/OkWL4lJQhceEBrsWfimkQs3fFqnDOeGOF/28rNMSyXyK9kC6h4Jac2Z4qLeQCF5n/PHS3S838u+ObDKnAabT0wBYEiQKfdSjd/1iqb7UhV54oyWLFTZLsBa2wm6hg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NgOsCPd/gw49/fN/1V8AVMUdWxSPAOwUyDjsbNZX3iw=; b=gP6Gui8ARvXSEN5jWDzj6CqVuTuD8TyJrkgZfy1FRfnH2VUDEm3vQjWQ/ndS4FJRKh+Ad4Yf4rgSsMZIfm4cdMyARdLPBVQKBX4ee3coZjoHyAkhdW+r2CT3yopB+Ba9HmPczwkTv0YCfNGcWeCSNfK+XbDJbqsLi5A8rxzewpgB0hTeahF2hRSGWE2yLQRtOhyzxoa4p9lh1rhrlTCFLa7phsxAQxpVRl5pSO2WwwuugC45tLtZnGgaWEWx/q/J/9JPa7GjydxX6UtB48rm2+bZ5IvrMxtgLZIPEhih6Cc1h91q7MVAb4fEAdSiL8QlPylw50AEAJlPNbet7F4v2A== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by SA1PR12MB9470.namprd12.prod.outlook.com (2603:10b6:806:459::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Thu, 2 Jul 2026 02:44:53 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%5]) with mapi id 15.21.0181.008; Thu, 2 Jul 2026 02:44:53 +0000 From: Zi Yan To: Ye Liu Cc: Andrew Morton , Vlastimil Babka , Suren Baghdasaryan , Michal Hocko , Brendan Jackman , Johannes Weiner , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v5 8/9] mm/page_owner: clamp skip_buddy_pages() PFN advance at MAX_ORDER_NR_PAGES boundary Date: Wed, 01 Jul 2026 22:44:51 -0400 X-Mailer: MailMate (2.0r6290) Message-ID: <3598B746-05D8-4E52-93DE-F3AC909D5C90@nvidia.com> In-Reply-To: <20260701061101.344679-9-ye.liu@linux.dev> References: <20260701061101.344679-1-ye.liu@linux.dev> <20260701061101.344679-9-ye.liu@linux.dev> Content-Type: text/plain X-ClientProxiedBy: BLAPR03CA0132.namprd03.prod.outlook.com (2603:10b6:208:32e::17) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|SA1PR12MB9470:EE_ X-MS-Office365-Filtering-Correlation-Id: ed5d1a7c-36a5-4c40-6062-08ded7e3e4d7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|366016|1800799024|6133799003|11063799006|56012099006|4143699003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: GKkjfxgA9MseH/5mkLgsTo1DME4X/JDy9VyVyrQF1lLxgIA9w1PjdqHm9nt8z7LlkVnidBB230avtFZ/u2KQS53XJj9JfZu72FvVOV8FCKcfrBDisRDV9f21FfMACWunCNXOVjgucqaexSsVsyMEekb7sJEJ9vifl9ZWv7desoZRuq0s1v88LoKm6iT0Lxbg9VYopHTVNF112AHfsp0WcMpfyKGvtlclskOuGjOqsb2/pfTJiEbclUoTvku1ByISsstnMUSFXHnXWwop0AUaq2q/ckW53Z9isEaf1HGPAIpdl36GgRrx4bbbhmB+m6WoQFJmC0iSin3G6YuKELwC88lumbFc6DEdpJWt1d1eWozs1WdIGQTqtK80HObBvr/gh4DMUvZbxNIYbL+qPef/SEkXS2xEcKr0QncJo+uNKg4Tw/sZs7x8YJMm52Gzjs4Rf90ZubwpGMQ3LzgTBm/sa/cWBxvdYJnC6UonrbzT2N+egm7ajh1lorcQCDlh217MDmTFBgHJt7MQMTrCMwlcS0YI4/getsdP3LHhWJbX1yyUl0YSo2wloeWLMFmqhNpI2h8EvcG4+IvSZXMoU3Y6eKElaAfKvi/alQbL8cZJh+nm3BWhewxPaxDEpKkxO2pbHVRcXSfRR64nvyQDVfxGKWJHQaCYaKCzsyO6MMK41Gg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(366016)(1800799024)(6133799003)(11063799006)(56012099006)(4143699003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?7IQGgurzEAJgHRvyAOGyCF+k7enh3FFREjy8MqDLXxlULWwW0p0L6Eib4KBK?= =?us-ascii?Q?kVZfuYbgB68KmNW1nFQ3sljsQMGxiKuvrf7Y6MBXU89xXNh0VHEt4YuMTtyf?= =?us-ascii?Q?ga692BofFlXVJX5L3ObJg09EEVBCF8PiCvT/h10PJJ80eXqwu2dXOaUZ/7zO?= =?us-ascii?Q?32BhmcNR6PKD9dU9dYFCt1A3FS2Tm5GOGL0g7aPKEI24wQhqCD7k8HFxNh7d?= =?us-ascii?Q?08ILuGtl0SHPNWn5hCM43AxtF49ifxzuQjL2+xHSJN4VWtJyWD96ENNZt/Sa?= =?us-ascii?Q?2zlGCEtMjWj4cBdUSVB6eSJqGxyfiE/J6Asdn47Mi9zYJtR5XiCs0/9kutni?= =?us-ascii?Q?YkSK9gItAvo1OcCg95ZKY5nwgvB8kS7gGyDlXF0LiwQZPNbRvB8f17glF/dV?= =?us-ascii?Q?FNFKGZHrEZ5oGulNckjAzXvmdphnYOuh8lmdFKX4MF6THNs5k1aVQYtCV+TT?= =?us-ascii?Q?XLyjf7rx4pp4I+VFLluxS2MsFGlvTzHzYK4VKgdVVsZN8EJywDu36nj+jC6s?= =?us-ascii?Q?8S+MmKdS4pgQ8obmIjx9NsA8ztKqHmd6Fy/P//ETVvz8ov/b3kJajysY4TO0?= =?us-ascii?Q?RPu0Jvov5XryY99D8JRP3fzVI2KQXbZMijkuuYd7LRiezJcVPhCVPogBaoe7?= =?us-ascii?Q?k8fjLmmmkHbOmnlHLtcwxYjv9L5uLuZIgqcRAdIgKL6R0O/OjqQAW7EVr4HY?= =?us-ascii?Q?BYNYFw1jkoT9j0BvdjjdxwYjz0XxeN4MxMv5VCxDyEBjfc+xPG53OwadpcQU?= =?us-ascii?Q?UMcFReMxc08UIOXHAUa5B7+FIvQ6WtBw2RPnf3XcRDmj5QvH9lw5XXFcSGPZ?= =?us-ascii?Q?Ajv3aJUOsJIm6dc/bXBByhBDYoJQS4kxj/RY84WSWy1F5zBN5qiUCmueOZh4?= =?us-ascii?Q?Ezl9BodFmh7cioK+i5v65UAgEVAd/MfMvsUURb30OamyL+CxsVvGypHBY1QN?= =?us-ascii?Q?/k6XP2q4o0V+w3L/roIkbcOKWEpkQUJ3cTBuZRTdYYJePgHAPEOaguvQR+gp?= =?us-ascii?Q?l15WvajmjmHg+yvyuq9sSkylZvWX0pDTFwSLYoKcOiMWv0h703Y+9vg8bYkW?= =?us-ascii?Q?FMWOCp0mBXEbEyHdPYSvTGHEUfz2jPS/ChsVP7anF9+RZjQ1nSSXGYgnkHoq?= =?us-ascii?Q?CxhGaXeu7ud4y3Q0MYJ1jeePpgNRq+ghmgn4Y6VxF6pldd9rKKzOabVRK5K1?= =?us-ascii?Q?ORTOso+BrYb9fpVBrM7degssRvj5snwkJ04MrFFxxlkNmNMYylgjWy9oBMLi?= =?us-ascii?Q?BHEX+xkmtdd2m1e2Y6+lrxsUnQC8QTdxm1NBGyZimNa1rVR++1TCz+2bVAg5?= =?us-ascii?Q?+qdtGg360oYLLgoNU2pJQutI7VomdGr03Dzrm8KaB99tbFQOkcaJdooVPRfn?= =?us-ascii?Q?aGsePsdko/Ci5lsufDhdOliAHyBIi5yuAjiPCK6Fe3EsPD8OJX/kKMTivMJK?= =?us-ascii?Q?2SJq31LMdya8MqCkyKTqyb4srUT/KEDmEPB6cz/oF9wZgJIVOx1Bb8Qk+qbe?= =?us-ascii?Q?+1KXgGRYpKGSeJfGguWLqDLnk+Kt2hxUNWW0K+JiW/IpXSq4UnJX3+HflEAH?= =?us-ascii?Q?kLp328Fl0QT8TzF1D4pvguSpdYCOOFPWwMbDrxxa+aNvaJAB45hrYy4+Yxyn?= =?us-ascii?Q?cKoO44IXn7GzFxhZaJwcC2YgvuCdcZd8hP02o50PPn3mqnTcV5CLSSru5L90?= =?us-ascii?Q?t0mVR24uMi/pprPCelUg5JloyWBxO1EaBTavwJuBr+Bl7IIUI3CL1XBReOlK?= =?us-ascii?Q?kxIIFlOxBg=3D=3D?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: ed5d1a7c-36a5-4c40-6062-08ded7e3e4d7 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Jul 2026 02:44:53.1120 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 0ItPNxs4EQvfyJQIn18NcUIK5LF6raHto6zeHZ9elbV2cTgLIcSkku3IUg3fwHnB X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR12MB9470 On 1 Jul 2026, at 2:10, Ye Liu wrote: > The lockless buddy_order_unsafe() read can return a garbage order > value if the page is concurrently allocated between the PageBuddy > check and the private read. If this bogus order is <= MAX_PAGE_ORDER, > skip_buddy_pages() would arbitrarily advance the PFN, potentially > jumping past a MAX_ORDER_NR_PAGES boundary whose pfn_valid() check > would have caught an offline memory section. > > In read_page_owner(), which relies solely on boundary-aligned > pfn_valid() to guard pfn_to_page(), skipping the boundary could > cause pfn_to_page() to access an unmapped mem_section. > > Clamp the advance so it never crosses the next MAX_ORDER_NR_PAGES > boundary. This is safe for all three callers: the pageblock-iterating > ones already handle boundary transitions in their outer loops, and > for read_page_owner() the worst case is one extra PageBuddy check per > 1024 pages for a huge buddy block straddling the boundary. Like Vlastimil said, a buddy block cannot straddling the boundary. __find_buddy_pfn() prevents that. > > Signed-off-by: Ye Liu > --- > mm/page_owner.c | 14 ++++++++++++-- > 1 file changed, 12 insertions(+), 2 deletions(-) > Reviewed-by: Zi Yan Best Regards, Yan, Zi