From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CO1PR03CU002.outbound.protection.outlook.com (mail-westus2azon11010005.outbound.protection.outlook.com [52.101.46.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B2A6E2E8B71 for ; Thu, 20 Nov 2025 14:45:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.46.5 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763649924; cv=fail; b=bOhHCTQ4A2OSuZqvr1VsqZH1R+WcXrht2McBVITWpoYY2SlmWOFN3IklRDhjXZIBF0yXTdoi2dWirrmZL6ZAyktFuzE5P232J8idkcmm/NTzYToEl4+f3WEdrRXRHm6uThbrZXKnTb/zOV3eib4oAOKLwhdmItRkzkHUxe2vBqQ= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763649924; c=relaxed/simple; bh=SwaQtCHccfPf/4iAh0+jHEIyWIUl87zVcGO1/WQsOik=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=rQdrPviX8tCKPzg85Mvp5pEjxjbQUo/lxBUhmWu/gHNTQb/GBcygPU6CBLkEXM5KTmJJ1AZDUZXhsV/2/9EKajvk2WIGoI8fz9RrUeqqboXkNzVNW2ow0IQWf92qrUnea5qVlbAITdC1f8q7H9U1YGOG7abShCGJO+yM3j7Hgdc= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=qeGnJT+q; arc=fail smtp.client-ip=52.101.46.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="qeGnJT+q" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wSJuU1ExZQ1LKm5s6nGeMCkQfVaztrJpoi+oN1MnrRsDucMB15jC28Je12Mwx6d3d60M/e3dtE0XxCe5EsgACR7YEDUg7XJ5Y1lIJ6Kbp/Ho1O1euoqXm1ddflQY3fhhbHJOwmnPbM1pjeXMuvseX43qM24oZjbE+kKdQGuvCacWKhkW4qQc0HBLo1BJgcZxegXf82d+B96w0MA1SsWkhctRP23aIDjhH3q8dMh6monwXcABYZ/L+bUr7KZrLL5seEiaC1i8FID9qhG8DWmVpC0AzpSji2DjeuRq+lWRoClwv13EUqsZ/5U1zlBlZ9Xr8hPVlrE9qkr9ljWNodGkuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5n+fdoQYwsWwDhz4wLUVZU95qwLeVfj7tA8i3zjqn4c=; b=QskYeo9yCmpQ2oNZZtNujPTJd2UD2IuIs9Yr/bCuyJc+6dYBqmmHvLNLT4elmVfoLLkjGA0dkHWz4dY58tEvuVRDhT0YgSryuQd20JJjGShIrQsmrocjera8vZOi2q5rINVfrxez0DeKRK0E1o8fLiidgc1L3POO7yEEaVa0qWKw8lpo1/xcuTAj6mB5C5Li5a9Z2977z287V7L+0Xp9ThmKq92Dhmc90ERDyDeI+iIHDEcEsxGVnZBeEKc2aeCS5iP+17YFCJ7Q2AwtDDZDdGZp4O8pNA/RkyiYlHNIVzk4NM7n0XdseGeShph+EA+tpt9BK4oEzqXHDXFF42FK8A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5n+fdoQYwsWwDhz4wLUVZU95qwLeVfj7tA8i3zjqn4c=; b=qeGnJT+q3otyJp4TlyY+SfEcKVg7gbpEsC5OAghxRwjN7PoEth0VYuusR1MNsbE7SWFUb6exsHA3pcUh2NWnzS2niFkxNTZz+jif8tOaCZjqla34FIXWDPTuiEAozitXWqVEf/9oLwkCYZGduH6CnrnZV+mWpsrO8JSMVYpQy/oggarTc3Kp6T7X5ktGGdQ6P86RRS90udJzvn440tN59bSxK1JWeKnv43+V+L8T+RB5w7tTabhbZ3wc7UGHjKVxSoy0dXWlxuZRDl6tgZZQsgqXuXxodo4yr0bh67tBgpnfNuiZEnnoYtPsKC8kkAHycXJ/LguQuTytD2h0NGPHug== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from DS7PR12MB9473.namprd12.prod.outlook.com (2603:10b6:8:252::5) by DS7PR12MB5837.namprd12.prod.outlook.com (2603:10b6:8:78::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9343.10; Thu, 20 Nov 2025 14:45:19 +0000 Received: from DS7PR12MB9473.namprd12.prod.outlook.com ([fe80::5189:ecec:d84a:133a]) by DS7PR12MB9473.namprd12.prod.outlook.com ([fe80::5189:ecec:d84a:133a%5]) with mapi id 15.20.9343.011; Thu, 20 Nov 2025 14:45:19 +0000 From: Zi Yan To: Balbir Singh Cc: David Hildenbrand , Lorenzo Stoakes , Andrew Morton , Baolin Wang , "Liam R. Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Miaohe Lin , Naoya Horiguchi , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [RFC PATCH 1/3] mm/huge_memory: prevent NULL pointer dereference in try_folio_split_to_order() Date: Thu, 20 Nov 2025 09:45:16 -0500 X-Mailer: MailMate (2.0r6290) Message-ID: In-Reply-To: <010f0f19-8b87-4537-8c0b-bc8f9263aab4@nvidia.com> References: <20251120035953.1115736-1-ziy@nvidia.com> <20251120035953.1115736-2-ziy@nvidia.com> <010f0f19-8b87-4537-8c0b-bc8f9263aab4@nvidia.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0228.namprd03.prod.outlook.com (2603:10b6:408:f8::23) To DS7PR12MB9473.namprd12.prod.outlook.com (2603:10b6:8:252::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS7PR12MB9473:EE_|DS7PR12MB5837:EE_ X-MS-Office365-Filtering-Correlation-Id: f23868ca-d901-4e8e-1297-08de28436d02 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|366016|1800799024; X-Microsoft-Antispam-Message-Info: =?utf-8?B?OUVySXVUVHFVbkJpVk9Bd1BPSVFTQWtkMFY1T1VUZFkzZllBNkQ2eUZ5N09E?= =?utf-8?B?cyt3V3ZTSm14V2hHTnpVVmFLc0FqeTJMWFdreGYrOGtBbmFidDU2dmlPWG9Q?= =?utf-8?B?MjBtOWF0alA5Sm1xdVVNeUFVQUZvRjhDdjRIOG54eVNjcTg0emFDUTQyQmw1?= =?utf-8?B?OFFmN2FmWmZMSDd3L01NL000T1JJaEFIQ0p0VWVoTFdsekcveTdjUmUrTXFY?= =?utf-8?B?NjRtMS9lVDRZREFNTCswWUFxYm5Gb1E0bnBiU2c5Y21HNUljUUdWeW1Pei9l?= =?utf-8?B?QS90OXNvUnFSRGh2MDl3QTNqbHppdkVGNTJkam40NTF6VERrOHp0cm5TVHlv?= =?utf-8?B?N0lYc0tnTE1SZnhLQ2FxVU1NakgvODdWdDAzdVlmWlBnc3lkU290TERXQVFH?= =?utf-8?B?YVJ4T1h0NGJrZDRvdjY2YkpJQkRPQ3kvODFJNUpUY05CVUVXQmt0blBqakJ4?= =?utf-8?B?NDVJNytNU3dBckVYT2NoM28vOVB3U0lvb1lhQUt5RHJKZDFYSENvbFJCd0RV?= =?utf-8?B?S0pPRmhYMitDNzN2TTlrZFVIUWhQVlBoSDk1M2tiL3BVbVVYdXpqdVMvNW5r?= =?utf-8?B?TTlBb2Z0RWNIU3NHMWZWOXRRQmdyQjVjYVV0elU3NkVZQWVkOE1XS2pvalpB?= =?utf-8?B?M1orQytWWElxWjNxUk9iYVNNQjJvU3htSk9lVk96YTZvUnpRUEUvWjlrNHhJ?= =?utf-8?B?UWQ4QjlNeitoK29KbjQrZWxEbjU4MlhPb2JGTllUalVXbWxUeTdxRzRKSEZs?= =?utf-8?B?dVRCSk9SVVEvM05uRUF0bUh6MjgrektSWWM0bVV2N0dyTVhzMG44SzR4dUtW?= =?utf-8?B?Y2VqMTNNUGhnZGpEaHMyRlNtenBQMkEzM2xPcEZ3RHhGK3VBYTRtMU10SjA3?= =?utf-8?B?UitPa3NmUGRFdjZBbENnc0Vib29KWnlhVGg3bWkrK2VXQlRIb0FXQ24rYjhp?= =?utf-8?B?SlVOLzNTMzVCUWRVSnJRR2N5dFB2b2ZhOWl5c0VrV1FOV1ZZdkhwMSt1WGs3?= =?utf-8?B?eERCbTFpQ3BiL2hKWS91SURCQU9YWGdUMS8raTZ6OFNyRmFZd0F3N29ZTlpk?= =?utf-8?B?U29zdERGQ2ZTYmJqRzdsTS9KTVJXeDNhbGl1OGZlOXBHTlhnZFprcXd5KzBS?= =?utf-8?B?aXRPbHIyQmQySmFsUlRuSkF3T0tKbHNJWkROdUlJVzRNMEp2ZDdFOGhsWGdq?= =?utf-8?B?TmtOLzRLMjJLV0txbVFVN2VQVjhuUGRCaDB6M1p2RGF3RkVqMjdVS2JndnMr?= =?utf-8?B?K0dqZkNTQXQzVW84SlpYcjJiUmlUMzl6MXNsZlJmc1RiRlZGbTJjTEY2TUpZ?= =?utf-8?B?OE1XbDZFRE1qRm9iZHo0eXY3Z1Rqb1JoRkE4SVdEcWJGaWYrTkFlMEZrWHhn?= =?utf-8?B?akp3dWVhYk52UFMvSnNwZlFvSElOTlJ1RUtKYXhKbUVnQ2tHWXhBRjhZZGRS?= =?utf-8?B?MVFaVmVZUFd1Z0hmV1VaT09DbHpVRWNHWFk4bUNTRm00YnpsWDZJeUc1MHZK?= =?utf-8?B?U00zamloNUFYaUJWd21OM0diZ2R5NnpNNGY2bFhiYXVtVVNmVnk3RkprcFVE?= =?utf-8?B?WldOUlFkZUlYL0pXNjdDeG00Vlp6VDdUVTNtUVVLb0FDd2U0dm4wV3JIVHhv?= =?utf-8?B?RzZET0piTUZvVlhjZXJqdmVTL2RHK2FLa3dIR21BOXlxZlN2OXFNdHhlT01w?= =?utf-8?B?NFVlaXJmSXpjQWd6dkpkTGFKK1I5czhaaXlKNVJualNPQ0VwcEMwNkR2a1NF?= =?utf-8?B?S001NHB0SERFNmFReUtHbUFlckpnVVNGb202bTY5MHRucWZVaDlUcXFBbFhN?= =?utf-8?B?S1hXVFl1NXBXTFE3TXdZYVp6QmJ6QklNcC9VV2ltWmo0RTBQMUx1Q0dOUXpR?= =?utf-8?B?MXhRYldpaW8zQk5maGRkL1V2VzczSGpmdmVYM1FTc3dobjN5MjlWeVBXcWEw?= =?utf-8?B?bWZ5ekZxV0pSQXljRlVVbDgwTEd2dEozVUdQMnRoRmRhZDNLZkEvRmw3T2lu?= =?utf-8?B?U1RGTnpwQ0JRPT0=?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DS7PR12MB9473.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(366016)(1800799024);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?OHE3YUsxSG5sMmR4WTdTdGQ5bU9pdHhVdlUwUEdDMzFrUC9rSzZvTVlXYU5l?= =?utf-8?B?RnBCY0lCUURteFg2TnlsbUJKTGNIOGdVMGRQUm5JTkwvVzdTSzBDZDkxWGU5?= =?utf-8?B?U1dtcGpRVjUyNE1Fb200MjdiT055VVRGd0VhdHZEempYNkw5Z0Nid1VQemhS?= =?utf-8?B?Nk55SENzdmtjcmUxQVlFckQ3Y1ptenZtRzJPSjlyNnNTWGdUVkthM1FoZ1Ra?= =?utf-8?B?UnNzV1VVUW1wQklPUTVsUWF5R0pDL0RMZXgwZ1lBOFhrUEJSNWRPSTNlK0NW?= =?utf-8?B?VlpBSXBOaTZxUUpxeW1XOVNUb1NITDFtZ2h5QWVWcm5DOTNSaE5IRXhBVi8r?= =?utf-8?B?eU9va2tPTnZiekdaUTVRSkZSVG9tV0wwQnJDbmpNcnFwOEpvVDJ6cXlqc3Q1?= =?utf-8?B?TjVJT05xMm1SWmRmZ052QXQycnZ2UXdHblFreHNqbERkYzRLSjBLdlRNRjhl?= =?utf-8?B?am5Rc0FsbmlJbGgrRHAvMFBuWXpubC9lQlNOdFU2ZFlDNUY2RE40eW5XWEFH?= =?utf-8?B?NDZCV2tJNC9yTGpVcGNpNit3V0d5Uk9OVko2c3BCUnViMFU2UkU5ek1Xb0o4?= =?utf-8?B?emtCdWtmb0JHUTB1MVZjYnpiMDUycE4vRjFWSlZBSWg4Smo1Y1o2dkkzZnZO?= =?utf-8?B?TEhVQzV5M1E5Y0c5UEt4aGZSN2IvNTQ4V1VFdTNKSEZNTGpkRUJuUXR4elBM?= =?utf-8?B?NVdldDRjYnBNWkM5MlhiblcySzJUSjB2dkZyWHhHSlVRZ1FJWU9PaTFiZFdo?= =?utf-8?B?L2gvKzZORHN5WVNtYjJnTDdkVEIrQTJWVlkrUFNWWjFPL2ZiUG9pb0JwaXcw?= =?utf-8?B?aHhMWXo0c25nUnl0WEJWeHVtLzc4ZkU0dDUvSFdLWWp1cURFT3dHY0NGMlUw?= =?utf-8?B?eElFV1pxNkxuOHVubzl5VEVFbXI0MFFQYVdHbmRBeHJ4cWJQM1E0QitCWEtr?= =?utf-8?B?eFNnOG1QaDg4Y3J6NGNVNmo4SnVLUTgzQmM4bC9zcGpNZzdwcWp3L0JrV0or?= =?utf-8?B?SzVwaElvdXZ0NUpRRnZ6d25hcDQvSlluM1kxWU1ValIxOVpqcTd3VXRYOGNj?= =?utf-8?B?bWpkM2hxRXRuOTRPVmNjZi92TWFtMDhDSXBWWWNiY01MVERNMVo2bnZXUVhP?= =?utf-8?B?MFdmejBaZFpzdndlbGhGMDUzVzBrNW9yTktnK1BIbHdCK2NMbmMyRmVQd0Rz?= =?utf-8?B?RUwxSk1IRFc2Undva3JnM2tmaGVJclZLOGZwYkxtcEliR0MwaFlRTGRxeU9x?= =?utf-8?B?SWdRMjhKejFjNHdoeUNtTDZSenZFNWU3SkR6d2gydUR6ZUJuWDRNSzYxcE0r?= =?utf-8?B?QXJWemlaTGc4YjVpanJIRTkxaExGcHh2N3NSdmtqMENxZXdyd0ZsVHh6WXlr?= =?utf-8?B?ZDNvY3hPaHNzRGgvM1pLVTNTVTNTV3BEUUxsc3QySnhGKzF4b1dPQzhUNkU5?= =?utf-8?B?ZEcxNXRJbVJhTEF6UEJtNnRzU0pSL0NKamdnYlYwY3UzQi9Jcjk3MmprTjBI?= =?utf-8?B?UXJ2Zng1a1NGVGoxNUd3bnFDYWZPUlFZUFFpRmtjdCtrMGR6QnRSN25mMncv?= =?utf-8?B?NWtTK1NUalFqU3VwYlArWHRTZk1nOWVKTFZsbDkwYS9VMHhsTk5jZmpBZHlw?= =?utf-8?B?bnhXR0tmdXIvVVUvaE9iTVFCQVZyR21aK1IzOHl2SXlyOFZNSmw3OEtqdFBh?= =?utf-8?B?bjlkOUNIdlZndGRwenFBK2NNZmRtVGszZWcyb2hmYysreHFhM3NqdkNlb21u?= =?utf-8?B?WDF2cU83Uzd5SjNlVElTTE1HTkFpZFExUU5GVTk2SEE5NVV4SHpNU25RdXRW?= =?utf-8?B?TjhZT2pFNnBVZUMwRkh1anhDOUZ0aW5uWUlUUHFEWkE3OVZIa1dDOXhFMkhU?= =?utf-8?B?MHVTYlVHNHFPS2pDVDhtOCtCeVUwMHBmVDNacUV5S1JNQm1KNDk5UlVrVW5u?= =?utf-8?B?U3BjL2hMMFdTNktyNmxucDNzV2tIY1hZZ3N2ajgyMGFwVEI4enhud2F0VW1S?= =?utf-8?B?ODkwazJpbTdQM0R5OHlabzhJSTVQNTF5YUJuZjVBYjNMWU5HYVN4TUs0K1VC?= =?utf-8?B?bjNNT1hsSGc2dXRWK2dTODJQSlpIbDZXOElyREo4MkltNGlZZE1DL3hGZ1lI?= =?utf-8?Q?srEvwi2PcoG7L1/rVMYhh/Dzm?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: f23868ca-d901-4e8e-1297-08de28436d02 X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB9473.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Nov 2025 14:45:19.1538 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: e1GMWFikmwuMrufYFjpG2mqA6gJYnC24rfF8w9Bwd0KeZcl338t12B27RVUgCl0e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB5837 On 19 Nov 2025, at 23:28, Balbir Singh wrote: > On 11/20/25 14:59, Zi Yan wrote: >> folio_split_supported() used in try_folio_split_to_order() requires >> folio->mapping to be non NULL, but current try_folio_split_to_order() do= es >> not check it. Add the check to prevent NULL pointer dereference. >> >> There is no issue in the current code, since try_folio_split_to_order() = is >> only used in truncate_inode_partial_folio(), where folio->mapping is not >> NULL. >> > > Just reading through the description does not clarify one thing > > What is the race between just truncated and trying to split them - is the= re a common lock > that needs to be held? Is it the subsequent call in truncate_inode_partia= l_folio() > that causes the race? > > IOW, if a folio is not anonymous and does not have a mapping, how is it > being passed to this function? Quote David=E2=80=99s explanation[1] (note: shmem is not anonymous): vmscan triggers shmem_writeout() after unmapping the folio and after making sure that there are no unexpected folio references. shmem_writeout() will do the shmem_delete_from_page_cache() where we set folio->mapping =3D NULL. So anything walking the page tables (like s390x) could never find it. Such shmem folios really cannot get split right now until we either reclaimed them (-> freed) or until shmem_swapin_folio() re-obtained them from the swapcache to re-add them to the swapcache through shmem_add_to_page_cache(). [1] https://lore.kernel.org/all/14253d62-0a85-4f61-aed6-72da17bcef77@kernel= .org/ > >> Signed-off-by: Zi Yan >> --- >> include/linux/huge_mm.h | 7 +++++++ >> 1 file changed, 7 insertions(+) >> >> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h >> index 1d439de1ca2c..0d55354e3a34 100644 >> --- a/include/linux/huge_mm.h >> +++ b/include/linux/huge_mm.h >> @@ -407,6 +407,13 @@ static inline int split_huge_page_to_order(struct p= age *page, unsigned int new_o >> static inline int try_folio_split_to_order(struct folio *folio, >> struct page *page, unsigned int new_order) >> { >> + /* >> + * Folios that just got truncated cannot get split. Signal to the >> + * caller that there was a race. >> + */ >> + if (!folio_test_anon(folio) && !folio->mapping) >> + return -EBUSY; >> + >> if (!folio_split_supported(folio, new_order, SPLIT_TYPE_NON_UNIFORM, /= * warns=3D */ false)) >> return split_huge_page_to_order(&folio->page, new_order); >> return folio_split(folio, new_order, page, NULL); Best Regards, Yan, Zi