From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-184.mta0.migadu.com (out-184.mta0.migadu.com [91.218.175.184]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1153B46AEF3 for ; Wed, 21 Jan 2026 09:26:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.184 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768987566; cv=none; b=Jh2albtWElJUllyOJMOdbuCKAUSO3xTm9XT3wESxzg48eybaYjVO8sidpQ0+uXNIVpUY2OuYCpyS4ooISbi6a7aTERMFFZbGU4IJC77pqr0iftYImh2IZkS8/YrYGWms01LFhsDqaWD9okmeGtglC6CE3mMxmKUHGIH5kbc4MbU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768987566; c=relaxed/simple; bh=/7aZMEsNk9BGZKviqndCUzGn1fbLfYsk0vmOxkIWUPg=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=U+//Lg8aYIhi/0NgimLCuWAomvJX2CJNbWmYnCuJYCd02NS65adfKue8ULqAWWztFUJd663Ivr5ON6e3s1urrjlfv3qyCGNB3hC5BrVmydN4Nlgx1f2FAGCnorwImCFxWE/ISlk50G9i5J9DEiZbqneJ/0YBZHTftMIWJEvPmiA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=cANjJVKg; arc=none smtp.client-ip=91.218.175.184 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="cANjJVKg" Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768987559; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0TUVbXynyLiYQadP11oFngQdXW1RS17OiZEoFg4sbNI=; b=cANjJVKg9+YX4wbUw7+xxjGI+2kHi0RBTQw2PT1VqgYo3aPEHbwW+2SXNAEk64x/Yex66c zNc5XiHbmwRUUuy2TiSVwfDKt96ZVv/3Nb22ZIe4SJb2EFeLGDhoSCK1i2qoMvK/oyjbeV 7d/31LQqqiwjELibZP/1vC9YlsFi8tw= Date: Wed, 21 Jan 2026 17:25:49 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH] mm/huge_memory: Fix iterator variable usage after swap() To: zenghongling , Qi Zheng , Muchun Song Cc: linux-mm@kvack.org, dev.jain@arm.com, akpm@linux-foundation.org, ryan.roberts@arm.com, baolin.wang@linux.alibaba.com, npache@redhat.com, linux-kernel@vger.kernel.org, baohua@kernel.org, Liam.Howlett@oracle.com, zhongling0719@126.com, ziy@nvidia.com, david@kernel.org, lorenzo.stoakes@oracle.com References: <20260121081343.713715-1-zenghongling@kylinos.cn> Content-Language: en-US X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Lance Yang In-Reply-To: <20260121081343.713715-1-zenghongling@kylinos.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT On 2026/1/21 16:13, zenghongling wrote: > The iterator variable 'folio' is swapped with 'prev' in the else > branch. Using 'folio' after swap() checks the potentially NULL > 'prev' value, not the original iterator value. > > Fix by moving folio_put() call before the swap operation in the > path where swap() occurs. > > Found by: > ./huge_memory.c:4225:6-11: ERROR: iterator variable bound on line 4178 cannot be NULL Good catch! But which tree is your patch based on? Seems like that was already fixed in commit 776bde7caf80[1]. The whole thing deferred_split_scan() was refactored using folio_batch, so the buggy code with swap(folio, prev) is gone ... Ccing Muchun and Qi who fixed that. [1] https://lore.kernel.org/all/59cb6b6fb5ffcff9d23b81890b252960139ad8e7.1762762324.git.zhengqi.arch@bytedance.com/ Thanks, Lance > > Signed-off-by: zenghongling > --- > mm/huge_memory.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index 6cba1cb14b23..258bf4725aea 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -4212,6 +4212,7 @@ static unsigned long deferred_split_scan(struct shrinker *shrink, > ; /* folio already removed from list */ > } else if (!folio_test_partially_mapped(folio)) { > list_del_init(&folio->_deferred_list); > + folio_put(folio); > removed++; > } else { > /* > @@ -4220,10 +4221,9 @@ static unsigned long deferred_split_scan(struct shrinker *shrink, > * left on the list (which may be concurrently unqueued) > * by one safe folio with refcount still raised. > */ > + folio_put(folio); > swap(folio, prev); > } > - if (folio) > - folio_put(folio); > } > > spin_lock_irqsave(&ds_queue->split_queue_lock, flags);