From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from SN4PR0501CU005.outbound.protection.outlook.com (mail-southcentralusazon11011028.outbound.protection.outlook.com [40.93.194.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38EF04A33F6 for ; Wed, 17 Jun 2026 15:52:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.194.28 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781711582; cv=fail; b=Zg+jY9m/k8emPN2yfDUagOeP4IPyt13WzaVZyF+Sj6dlGYADE7D7OI2nUNlxo04PSnQaVwO0R8yEy5gptu8/koXZaWnkmRlkVEP6U8RtG3BbOiq/GvqBMweY2ok5ggLy8mKaTdGxgapxtcjlwdS2/e3PIoxP9LhL/ZQP+0eWui0= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781711582; c=relaxed/simple; bh=EjjXDBXm8oKBnAYy1qQgMakYvXyvvgHpeOsneVZbi30=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=UfLmO+0sBnCp6ltNIn/O7AqjwZmqvHei7zHXyQlY87q+DRC0jAzZAdetX9kwFOgwp3jGg6U8xBvmSRPPXU6fvV6YTLjLzbEMWfrlXoWeUSbhKtY0v6e73N5sA/UGyqzocWfUEmCMlK5zy8RnZuvfvvZpmkeDDRqsZq4pcKlQacw= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=InYYAgFe; arc=fail smtp.client-ip=40.93.194.28 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="InYYAgFe" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=EHPMRIJ4UbNKZMR+Ai9/fQP9SfZ/3OukU1N6BPyLMwXdZlJPo5BJTlW508lOxlk46LnuSq+bOCKTJJJfLLikpDZOMZcnAslLVlmZ169LYjJzV4Td0tooEPPaAlKrxQnyhp7BtinMkd9a4VK5jzhbGIz92CS8vZEnoVz9gJZJgQ94cBz12rEnfTI2jkwnu5dbIAuQl6Asftv0WSawpWi5j0gs5s28Ir5LUdk07Q3QtLUGwCcpN/GfsiI/qB/Uz812n2WaLsE38NRGBviXNuPKO+U6ydpTplh+J/zLiL5NNdoK58Ex75nXdrElD+P1UWLNeEt+QVyceNiFCohJJGoIhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EMD5XWhhc5twxHGn/FXdfnHPkdNIkoea3dWVU2ve2oA=; b=fhMcBj4zX3a2QdTCi2rF6AfWx5xQL/63zRSAfQXSxEJsoILgSEl24Lz7ET7bPFIb59GVQuLdBVEvYJikHUPLiXcSwnlY5XJm16t1D6ieoQ5rlKQm4zCb5C226FoR5CoydJkkP3Uo1yVqrNRfGY/0QPu9pXoa/TZXn3pcvcADeZN+56iXxrkl0PnXRbUfTSsmmW3N5HR196L3IU6sDtjP0WG1tT0M6IM6kadLred4Y/hd6JCK28MK1WXBlegkX1wBKbkaWxzYivyIV8K35BBTmm/v5R1OKDCHLmei5Kfe/SOcsj7bXc/K2LTjyRIErboPbF9fRpJRrQ8t8XaFy0DalQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EMD5XWhhc5twxHGn/FXdfnHPkdNIkoea3dWVU2ve2oA=; b=InYYAgFeX4CC7eiwRs2n8NMT5yReXx+b3FWZCM9EUOChROBMRSwoI7ifFPOAgSOCRSPebcCVCTrvHTv6KsiAGSvrQQ2oTrW2gsOWWS6BjbIAPcaMgz8NeetE8muH9G7WRVznj10y1iGl8dPOJi3BqiTU6E2FBW/LZqWSncbhNOSCS7iJQpeGnzIhMUvRfVVAp1cLWKtCRoJj7Nl/BegCqz9D2l9y5XgV0AsvqAzNKWYToy+BVObsKFT1lE8Kx34LR8FBqA4plDNDrTwgG0FsHq+rUvWqpJCtsWJM1U5koTICxu78TzkyYtpjGWheZ8uFsKjyLKXdepkFbs30AFLw/A== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by DS7PR12MB6359.namprd12.prod.outlook.com (2603:10b6:8:94::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.113.18; Wed, 17 Jun 2026 15:52:43 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%5]) with mapi id 15.21.0139.011; Wed, 17 Jun 2026 15:52:42 +0000 From: Zi Yan To: Ketan Cc: Andrew Morton , Vlastimil Babka , Suren Baghdasaryan , Michal Hocko , Brendan Jackman , Johannes Weiner , Luiz Capitulino , David Hildenbrand , kernel@oss.qualcomm.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm: page_ext: validate section in for_each_page_ext iterator Date: Wed, 17 Jun 2026 11:52:40 -0400 X-Mailer: MailMate (2.0r6290) Message-ID: <46EFC111-106F-4C41-88C8-4966AB5D2DF8@nvidia.com> In-Reply-To: <20260617-page_ext-v1-1-37ad802b1a38@oss.qualcomm.com> References: <20260617-page_ext-v1-1-37ad802b1a38@oss.qualcomm.com> Content-Type: text/plain X-ClientProxiedBy: BN9PR03CA0495.namprd03.prod.outlook.com (2603:10b6:408:130::20) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|DS7PR12MB6359:EE_ X-MS-Office365-Filtering-Correlation-Id: 57e8f2de-7dcd-4f04-a41e-08decc88779e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|7416014|366016|23010399003|376014|1800799024|56012099006|11063799006|6133799003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: kKNEJB07sYoNLdva63CA91ztCWY89PfEAs0Y9uZQ5bev44MYzPNzuG4Y1SFbvMHCYM1vsOBNlztN6D8j98pgvpKr0YiGHYtMuCUDOMO6Fb304OLjGyMpsM7IJDmIMM6jxkgDZztoeBNg75nrcl2KgMTJDpv6ilyRUG9DJBIYbe30rZc+NcmLgpzqx8qQmFOwY4/36zaMZ13cGB2NQzro8/s9LwsIUxC4r9gH1mGqyYpl3dXlfKFwnREstrubOnpMKTTG1sADKAdtZMTcaxs6kju7IWx0bUqw3QbKnG/QeS83Tkvh+IrDChlzVl1XT/DRychu7ZInWDNLAm8y7DiemFkSoym3v9ktI4CME4u6bIB8i1ActbzFgV3ToYYdyeaYnGt2TPZ5bzGR25VRWwO/Pq+96ljH5lRNdDihhpL03VGugTq60NwzqpYq07nkwN0KQAB+Z0Lsk/5nJZFmiZPotQ0UNIusOrzgEj+uGSqgh2q2DNuVxXHWADcyb66tkQs2aZhjBpYL85yJjAh5jmhuvR6ndmCSvm4WQSJknnD0F9z7uxmN2Le7yRU6j64Lr7Dj7p5qyMMK7YP57CuKJzn/GiewLefPpimITLwZ5t3SdXN6W5t7/p3jTSqyCyRRt1NxOkDcLihlIk27PiFTkYa/0fwPHR8aoGrUr0Aw93rQ3l225OL88a2cTSOHwqTmwnMe X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(7416014)(366016)(23010399003)(376014)(1800799024)(56012099006)(11063799006)(6133799003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?LJlgWgwyQnqxtVrki74ghAfKzzE9VczNtcUVcoOYAIkS0eHOXkAk6IkeWwP3?= =?us-ascii?Q?+5HkgdJ6z8d95gpSuowHwcK1E7qLG8yqumRyRKEiBicrZNvfbIapy/fyRSjO?= =?us-ascii?Q?3EuF+cHXg3Er0omZrupSYKpQN42AIk/QK7Mm6g92wWLzBmMKya6JL8UhfREU?= =?us-ascii?Q?MXgmlFycYcABCze2ojUKf4Z1CcAVD9viFHSvlYPTrunArYuKXxHQvmGj+QZ1?= =?us-ascii?Q?jXn692Zbu9FHhXW4LBAm+cxdrFy3DGDCKLLvOsKvczntEvz0A1iTdntudpOj?= =?us-ascii?Q?f9oM3K8RJ686u2XgI9qCO5nL8gYwW5lmDYHEHd+ImybEo59INyxV3bNxskUk?= =?us-ascii?Q?dZSZ0IqyQGOw4QmS2EZrvUk+p7wAM+Q8s0/GYaI399sRMyRlYM8n5jH23qi3?= =?us-ascii?Q?5UZGBDiFDrskCfdN5tcHDXQ2lV0KLNgMXiEgbQJr4c3kpf0hrNXgB8nlfLqC?= =?us-ascii?Q?ZVmra5Pt+uyB4sfWMTm/dkFU9qUDzD4H5FbK0fZy5g+jr+cwYcoIoSWEbT2g?= =?us-ascii?Q?Mho98K7JdhzTY3hDO0S6E0pFhZQjD6Kpmk48bn1OZrEApWqPk5qH75wt546m?= =?us-ascii?Q?nWPctwjRyb84habfqLTcrSWiAhiUCMII3qewDLp/HwVspe266wF88sZ8o4+F?= =?us-ascii?Q?YzhTLQQd/9r2v/pNZ0URjjLu2LpZGEyUclN8mjt+uZ7nC3O/BFAh67WVToy9?= =?us-ascii?Q?F/J6AiAx+xQYbzf+S4xK92qfoVTY5XhqfTJp1gWl3EKplJ2mrUKCc2zhz1z1?= =?us-ascii?Q?nlURNsuKlbmpCKwckziZZWCk7/CZEOMEGfqUasHGnKTqvGpLh2RuP5MvfALp?= =?us-ascii?Q?24Zwz2vm4NFFjSdxkNfmJix8QyGRA9SN9kVNbhEQyFFgFqi/sVtNi6pIdeq0?= =?us-ascii?Q?iJr6tOK+bBy5cR2tl9rvCJ7EJvbNKNxFCcCwLMC8zMrcZKp8v7mh+OzA/2DA?= =?us-ascii?Q?gbJcLgvC502DBAH5K5HrgOmVZN2X/p4YTC1hzHoepVWf+aEKGmKH5FpbBF4X?= =?us-ascii?Q?bh2AMbBmDURiUEPW+ixGq6l5rzkVkRNwFkQh3EAXkdUVsVjOooLoX3N1dhZK?= =?us-ascii?Q?mhJDt+tP+F822W2iO6wQLXKXgZPP39FPvR+iYfCISEcw5TisQnG7c0B/8DAH?= =?us-ascii?Q?HuuZh0Q2lOC26TG2YKV9jCRzJsE9nif/pUBEODZuCKt3V86tdUhcOk3aVxrG?= =?us-ascii?Q?96uqhnIEWOKlFQWhb15XBPDkIb6gQjaiL1R5q2aCXZ+XkNR6L4QzIhMXMcm9?= =?us-ascii?Q?laIw+5UtsD6u06P53Sku0F84uWFcfbDtwQihcROHsAUlfWsq0ypX8yMGisC2?= =?us-ascii?Q?LJmwsAWOZE5C5zuGdNMrMrljp0lsY6Hg8yrhiTU90i48GQsqk28YF6b3lFgc?= =?us-ascii?Q?PGL9PMrrn0Law0RaA97JsZN0H8Zzo5af5nsNR8BxYUQPgG4A3bi/h9UXfhdw?= =?us-ascii?Q?mZ9hsd8lrRh3ZOHdxHg1XRO2HcvudHBNnl3LPowvWlOL71ezgy++iwwqnADU?= =?us-ascii?Q?UYs8a3vRk1GZdq6QW22pxpD+gbe26lL6hZbEoaZWOgTMvH2b4sfsWAmkQ2gc?= =?us-ascii?Q?Ipwbnkh/rJUK+iENiOgqDiPYL7pOzYZXr/cneCiNQJDWCwSalI5OUOPubwm3?= =?us-ascii?Q?H0LLWT+VtpAyqOOqKFhLw5A4+sKWdEpfM9MdiU4+3myKGLkJKeudNV2r9PyB?= =?us-ascii?Q?G+FMJEok/zfauzdz3a0JgW3TOznjgy6TN4f3qfNzlcGm41XG?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 57e8f2de-7dcd-4f04-a41e-08decc88779e X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Jun 2026 15:52:42.8593 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: mqPmZNcs2l+na5N15V1lqvVjuFgP1Ty2eu+cN/yHrL01K7cjCVNcgHuLaU+9muYN X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB6359 On 17 Jun 2026, at 11:09, Ketan wrote: > The page_ext iteration API do not validate if the PFN still > belongs to a valid section while advancing the iterator. > > When dynamically adding memory in hotplug path, it can lead > to a NULL pointer dereference during page_ext_lookup at the > boundary of the last valid section. > > [ 14.555124][ T846] Call trace: > [ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P) > [ 14.555127][ T846] page_ext_lookup+0x30/0x3c > [ 14.555129][ T846] __reset_page_owner+0x11c/0x260 > [ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0 > [ 14.571204][ T846] __free_pages_core+0x78/0xf0 > [ 14.571206][ T846] generic_online_page+0x14/0x24 > [ 14.597782][ T846] online_pages+0x178/0x30c > [ 14.597784][ T846] memory_block_change_state+0x284/0x32c > [ 14.597787][ T846] memory_subsys_online+0x4c/0x64 > [ 14.597789][ T846] device_online+0x88/0xb0 > [ 14.597791][ T846] online_memory_block+0x30/0x40 > [ 14.597793][ T846] walk_memory_blocks+0xac/0xe8 > [ 14.597794][ T846] add_memory_resource+0x280/0x298 > [ 14.656161][ T846] add_memory+0x60/0x98 > > Add a valid-section check before looking up the next page_ext > so the iterator stops cleanly at section boundaries. > > Fixes: 9039b9096ea2 ("mm: page_owner: use new iteration API") > Signed-off-by: Ketan Kishore > --- > mm/page_ext.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/mm/page_ext.c b/mm/page_ext.c > index e2e92bd27ebd..74067ea740fe 100644 > --- a/mm/page_ext.c > +++ b/mm/page_ext.c > @@ -253,6 +253,18 @@ static struct page_ext *lookup_page_ext(const struct page *page) > { > unsigned long pfn = page_to_pfn(page); > struct mem_section *section = __pfn_to_section(pfn); > + > + /* > + * section can be NULL when the page_ext iterator's for-loop increment > + * computes a PFN one step beyond the last registered section. This > + * occurs because pfn_to_page() uses __nr_to_section() which succeeds > + * for unregistered sections that share a root array with registered > + * sections,while __pfn_to_section() returns NULL for them. > + * > + */ > + if (!section) > + return NULL; > + > struct page_ext *page_ext = READ_ONCE(section->page_ext); Please move up the definition of page_ext to make code clean, although I know it is supported to have a definition after a statement. > > WARN_ON_ONCE(!rcu_read_lock_held()); > > --- > base-commit: c425609d6ac4012c8bbf01ec2e10e801b1923a7b > change-id: 20260616-page_ext-31ef555456fc > > Best regards, > -- > Ketan Kishore Best Regards, Yan, Zi