From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D450B322768 for ; Fri, 19 Jun 2026 20:36:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781901371; cv=none; b=JBCXEpb4xngPooQ00BDZ7llRna9JmzBIRKJZBWy2AtcCxoM9WqitWRmTMGFw7UQ7xrY0ZSMGkXmEDAFeXRHyAvtuQZWrd0UWQ88hVXPioHp4I82vvZM33iROzz1Q2mOA1TLdV6uTRaWEIk6DVk106Qr4Y8fyT5fLK+KuTx2Zjxw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781901371; c=relaxed/simple; bh=Mu/r6oz1T8PnJywQYJvbtKSSlCSnAOpWEvmEFSduxg0=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=eIui2flr6St/hKlFI530AgqiEOByNGh8Xg+PwmLB1f4eLCpY/lydTb+dc9RruXb4+bKoOUX8xf/3Quf82Lg82Y071Asdg8jHslE59yQx1KfKs5zkQ8EbLuB+ZBVYFfqn0jlkdqUp+rioj7ZHVgxHGQ6L+uzmbook/6daDhM90ws= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=mnmKjTkP; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=AljRb5KQ; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="mnmKjTkP"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="AljRb5KQ" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65JHVmS11156147 for ; Fri, 19 Jun 2026 20:36:08 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 9GLtWWqWktjBsO6zUS9H3pH7linCcBMrn4b8Id1EqCo=; b=mnmKjTkPWPoCwaUT LxhBBEEXXGk9WNnyhFzSBuWEYy2N11iQv6BeZEOCkGH45d8lr1wZ+7sSfCeyO/WX Pc1vaYX2Ntup12I3MOYsjS14ZjYJ1DYsdGz4u3zTdtZKmqAAiO5FcS+KBt5r35kK Aep2JMrSNp6p5llkGS295Y1rRwRvS5OeK1RR8IiTg4E9CPUgOnNL2XNusZWIoXah rjr7qgop7fWR6nxsV6hxzEVkqTTmd69C+eSiOOvSr7iBs1BtIy5+VJZuURhONN8p g0c7sMQXdyxGAkY9zRLBV4MWOmGfTNQzvhz0WOT9uXBJZPjYXLmu4uRNuKP7vi4y 4IQKUg== Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4evp6scww4-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 19 Jun 2026 20:36:08 +0000 (GMT) Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-37c64f7ff48so2819049a91.2 for ; Fri, 19 Jun 2026 13:36:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1781901368; x=1782506168; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=9GLtWWqWktjBsO6zUS9H3pH7linCcBMrn4b8Id1EqCo=; b=AljRb5KQJAY16/m6XMT0wSvLok/ngAww43KAyHCQihhvtPcLNZ16d0ZS49ZwV3Q2UF +NQH2Ff2P/GSFqUNhURwZVUHW+fxrHU4Q+l5HbpBgXsppwG7jGyzeft0McmvWu1iRuq5 dcMePR+W/5WeYlaI9m1cpjUVJ/H6iX6ZuLZC9KQ/DzVvv92r+4ExJeVrog9QaOIjsfbU AEvkRht5//Prd2zzdGWT+FZJeDHXmjhP3Gy99H/qq7C5MdMi0/vEOGxdi37AeDoKzIic ZaGjfE/97zxYU73qzEUA76FbaWVWLGzFkmtm9QGcJtZlGHqu77TjtRSLLG+Gkr+omtz1 MC1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781901368; x=1782506168; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=9GLtWWqWktjBsO6zUS9H3pH7linCcBMrn4b8Id1EqCo=; b=tG0irVUR1OEDSnJbxWXB8BfA+TSH+FkI8dqwbelZxko9t2uIKP+HrBdl/x1Jq8qJ+f DnCPPL/ipVBggz7j4Henjf4qhQDXUjbkD7ArogJENDRnpl9CVm6uMyZ1PVBxnkeDNc1L nZ+/2TVo1tNv4x3F75Egc55fsnfr9QeVIvcWEKZNN+Zd1Pih6oVg+SjMJu6BnvlJ3L7I KiSLdu+ro67mEM9RmCfv3RByidkTEU4f+zbxuB/xC+U+nKbLzOr5e49DrtKeF5FPwhlg fXIx823yCaauLh1h/Ub6LYgNK+/eD4zwYIXEuUaVdloes6VCFqJqc4PnbtCKqi3pqknZ vVBA== X-Forwarded-Encrypted: i=1; AFNElJ8YN6/7OFUIUeySgJW2FJ8lKpO5uOXXrKp8GTxL9Mn9T7DzAK+3TEuAp40hGtwBOFOdvJ7s0bEaTdrusXU=@vger.kernel.org X-Gm-Message-State: AOJu0YyOJJuEMreWxIyS6MBqWNhEpxyjRqsPkktprI0dCwSyUptk/Isb qoWXsFIswoRYiJYY6YJtH+HZZdrtGl2Gf8GUl4fwcA1EWD3C+igsD6C8btm4e2l5anFHToJya/G ticv50TV1xNp45VogYFH16/9/pg7sjfw8DO9TbgyR06h2VTSXXnb5yFMxeqHezGkFiAE= X-Gm-Gg: AfdE7cnOBOWv+72nhSJx8/p5EOthnADZBAdCRh46c7rpjwXUdZ4/qizNgE5Edr7saay 6CzhNhTt/Gf2lo4IBgHufqX2EF41AIWsyrnceBy2GmWury3xGtTMF9NUNB2AbDGDmh9pJWyKRHu cxqMYSTqpXHELq2Uwbd5zygYAG1Qa17WCHu1BGwU90CRBZscitXzAgDFq0M4nf7x9UIbDT+6RPq z+AX6Bo29nIv/quspdzd1R/W9cdhIIUq/RnEpvDHfzN1Ky2agzb1d7BPwztD87aL+2o0r4lOBrA 8kOXP0ulBpUXnuWEDgaSMO9f1pZsWOs3lKBDNZKenI93OP6ysXKJmENl78D5RU0WMvvPTwt5TEu UcxhrfQNGG+U8W8FfbcbMAjwEPkE0A90zGEjTA1ImHA== X-Received: by 2002:a17:902:f70c:b0:2c0:d91d:c3e8 with SMTP id d9443c01a7336-2c725ba5b74mr43431335ad.4.1781901367621; Fri, 19 Jun 2026 13:36:07 -0700 (PDT) X-Received: by 2002:a17:902:f70c:b0:2c0:d91d:c3e8 with SMTP id d9443c01a7336-2c725ba5b74mr43431085ad.4.1781901367119; Fri, 19 Jun 2026 13:36:07 -0700 (PDT) Received: from [192.168.0.8] ([49.205.250.131]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c743bfd9ddsm2903105ad.55.2026.06.19.13.36.02 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 19 Jun 2026 13:36:06 -0700 (PDT) Message-ID: <38a6af85-7691-446d-ac7f-5430347030da@oss.qualcomm.com> Date: Sat, 20 Jun 2026 02:06:01 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm: page_ext: validate section in for_each_page_ext iterator To: "David Hildenbrand (Arm)" , Luiz Capitulino , Andrew Morton , Vlastimil Babka , Suren Baghdasaryan , Michal Hocko , Brendan Jackman , Johannes Weiner , Zi Yan Cc: kernel@oss.qualcomm.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20260617-page_ext-v1-1-37ad802b1a38@oss.qualcomm.com> <1dbebf73-6c46-44e1-ac6a-f5ffa9849b37@kernel.org> <698e5cdc-8f1d-4984-bb54-a4b7979b4dc8@redhat.com> <3149fcee-eded-49b0-baf4-ab69c27ff063@kernel.org> Content-Language: en-US From: Ketan Kishore In-Reply-To: <3149fcee-eded-49b0-baf4-ab69c27ff063@kernel.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Proofpoint-GUID: XT8XsLhT2L-w4TZvWKvHFx55ydQX5sHs X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjE5MDE5NyBTYWx0ZWRfXxQcP8R/l4htf wwm5fzBqo7GQIjt9RIR6qrZ+aKrL883zlFEvCIi7Tk0gFf/PLs9mb+pIibSWL52R6GN86EvuKoZ muvlIvGS/f0O1VP3Uzn5J8neNlQK065h+EEIdJH3wqgoZ+9wcmu6PutVmgI1g4AEkRaYKeXYsYU DwE7UarUcTj3FEuuQ/NXhSG7REXAx3boMUncdhGj4b/2IBVP8HR7N9pwgXA2WkPKI816/FdvXee XqgtlKXgpaVfe3TFqNIq5dHrgt725kiCQw+an4zAqXHk1QXO+kkgDaGgvy1ad3c6CfJWaz3f7+q TUYEIAsmXjFVnf3zs0MMzlyLTz+PZiQm+z04QzxyZ+PqJ4pyNTjjZwRoZyMWCR4telf+OGsfNK0 XK3Af3lx2T9678lMFwrH12hA3zeVlrNqQO/yQ8Xf+vJgb54Up960OybXwMs/CG/suHr7B4ulKAR 86czZJcf81O4c4efUXw== X-Proofpoint-Spam-Info: AW1haW4tMjYwNjE5MDE5NyBTYWx0ZWRfX+DjWklOZUYDN 9RrSObuAfX2/dC2p8lJWPaskSCnO+dPGDUvA2t7PxejC9dshRs/EgP8kr1Rl6MNrHq0nFsoR8hy fXy2aZHrGqA8Xl6q74tk24GC76tSZGk= X-Proofpoint-ORIG-GUID: XT8XsLhT2L-w4TZvWKvHFx55ydQX5sHs X-Authority-Analysis: v=2.4 cv=KbzidwYD c=1 sm=1 tr=0 ts=6a35a838 cx=c_pps a=UNFcQwm+pnOIJct1K4W+Mw==:117 a=BL6/p84Y3ifFzq3ZkNxHwA==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=VwQbUJbxAAAA:8 a=3o2e-M2zIh-Jw1OuFa8A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=uKXjsCUrEbL0IQVhDsJ9:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-19_04,2026-06-18_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 priorityscore=1501 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 phishscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606190197 On 6/19/2026 1:30 PM, David Hildenbrand (Arm) wrote: > On 6/19/26 04:38, Luiz Capitulino wrote: >> On 2026-06-18 05:04, David Hildenbrand (Arm) wrote: >>> On 6/17/26 17:09, Ketan wrote: >>>> The page_ext iteration API do not validate if the PFN still >>>> belongs to a valid section while advancing the iterator. >>>> >>>> When dynamically adding memory in hotplug path, it can lead >>>> to a NULL pointer dereference during page_ext_lookup at the >>>> boundary of the last valid section. >>>> >>>> [   14.555124][  T846] Call trace: >>>> [   14.555125][  T846]  lookup_page_ext+0x6c/0x108 (P) >>>> [   14.555127][  T846]  page_ext_lookup+0x30/0x3c >>>> [   14.555129][  T846]   +0x11c/0x260 >>>> [   14.571201][  T846]  __free_pages_ok+0x5e8/0x8e0 >>>> [   14.571204][  T846]  __free_pages_core+0x78/0xf0 >>>> [   14.571206][  T846]  generic_online_page+0x14/0x24 >>>> [   14.597782][  T846]  online_pages+0x178/0x30c >>>> [   14.597784][  T846]  memory_block_change_state+0x284/0x32c >>>> [   14.597787][  T846]  memory_subsys_online+0x4c/0x64 >>>> [   14.597789][  T846]  device_online+0x88/0xb0 >>>> [   14.597791][  T846]  online_memory_block+0x30/0x40 >>>> [   14.597793][  T846]  walk_memory_blocks+0xac/0xe8 >>>> [   14.597794][  T846]  add_memory_resource+0x280/0x298 >>>> [   14.656161][  T846]  add_memory+0x60/0x98 >>> >>> So, we do allocate the page_ext in memory_notify(MEM_GOING_ONLINE) -> ... >>> page_ext_callback() -> online_page_ext(). >>> >>> Which makes sure that all page_ext is actually allocated (for the full section). >>> >>> So when we later end up in generic_online_page(), the page_ext should be there >>> and the memory section should be valid. >>> >>> >>> How can online_pages(), which onlines memory part of present memory sections, >>> online (free) memory that suddenly does not belong to a present memory section? >>> >>> Something doesn't make sense here. >> >> Ketan, would you please share the full OOPs message and maybe tell us >> how you reproduce this issue? > > Ah, I think I figured it out. > > for_each_page_ext() does a "__page_ext = page_ext_iter_next(&__iter)" and the end. > > That is the real problem and should be spelled out in the patch description. > > Likely we should just handle that in the iterator, looking up page-ext for something > that doesn't exist is weird. > > > From ce41607a4e4c1d872b6d3050da2e24d41a30d822 Mon Sep 17 00:00:00 2001 > From: "David Hildenbrand (Arm)" > Date: Fri, 19 Jun 2026 09:58:46 +0200 > Subject: [PATCH] tmp > > Signed-off-by: David Hildenbrand (Arm) > --- > include/linux/page_ext.h | 16 +++++++++++----- > 1 file changed, 11 insertions(+), 5 deletions(-) > > diff --git a/include/linux/page_ext.h b/include/linux/page_ext.h > index 61e876e255e8..468c074582e1 100644 > --- a/include/linux/page_ext.h > +++ b/include/linux/page_ext.h > @@ -112,6 +112,7 @@ static inline struct page_ext *page_ext_next(struct page_ext *curr) > > struct page_ext_iter { > unsigned long index; > + unsigned long pgcount; > unsigned long start_pfn; > struct page_ext *page_ext; > }; > @@ -120,15 +121,19 @@ struct page_ext_iter { > * page_ext_iter_begin() - Prepare for iterating through page extensions. > * @iter: page extension iterator. > * @pfn: PFN of the page we're interested in. > + * @pgcount: number of page_ext entries to iterate > * > * Must be called with RCU read lock taken. > * > * Return: NULL if no page_ext exists for this page. > */ > static inline struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter, > - unsigned long pfn) > + unsigned long pfn, unsigned long pgcount) > { > + VM_WARN_ON_ONCE(!pgcount); > + > iter->index = 0; > + iter->pgcount = pgcount; > iter->start_pfn = pfn; > iter->page_ext = page_ext_lookup(pfn); > > @@ -149,8 +154,9 @@ static inline struct page_ext *page_ext_iter_next(struct page_ext_iter *iter) > > if (WARN_ON_ONCE(!iter->page_ext)) > return NULL; > + if (++iter->index >= iter->pgcount) > + return NULL; > > - iter->index++; > pfn = iter->start_pfn + iter->index; > > if (page_ext_iter_next_fast_possible(pfn)) > @@ -183,9 +189,9 @@ static inline struct page_ext *page_ext_iter_get(const struct page_ext_iter *ite > * IMPORTANT: must be called with RCU read lock taken. > */ > #define for_each_page_ext(__page, __pgcount, __page_ext, __iter) \ > - for (__page_ext = page_ext_iter_begin(&__iter, page_to_pfn(__page));\ > - __page_ext && __iter.index < __pgcount; \ > - __page_ext = page_ext_iter_next(&__iter)) > + for (__page_ext = page_ext_iter_begin(&__iter, page_to_pfn(__page), __pgcount);\ > + __page_ext; \ > + __page_ext = page_ext_iter_next(&__iter)) > > #else /* !CONFIG_PAGE_EXTENSION */ > struct page_ext; Sure David, your above understanding is correct. Thankyou for the suggested alternative fix, fixing the iterator itself seems to be a better approach than having the section check in lookup_page_ext. Thanks & Regards, Ketan