[PATCH v2] mm/util: don't read __page_2 for order-1 folios in snapshot_page()

[PATCH v2] mm/util: don't read __page_2 for order-1 folios in snapshot_page()

[Aboorva Devarajan]

snapshot_page() currently reads __page_2 after checking nr_pages > 1,
but it should only do so when nr_pages > 2.

During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page()
oopsed on the page isolation path while reading an order-1 folio's
__page_2 from an adjacent absent section (unmapped vmemmap).

Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap
hole).

Fixes: 31a31da8a618 ("mm: move _pincount in folio to page[2] on 32bit")
Cc: stable@vger.kernel.org # v6.15+
Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
---
v1 -> v2:
 - Condense the commit message.
 - Drop the code comment.

 mm/util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/util.c b/mm/util.c
index af2c2103f0d95..34cb43b3eaa4c 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -1353,7 +1353,7 @@ void snapshot_page(struct page_snapshot *ps, const struct page *page)
 	if (ps->idx < MAX_FOLIO_NR_PAGES) {
 		memcpy(&ps->folio_snapshot, foliop, 2 * sizeof(struct page));
 		nr_pages = folio_nr_pages(&ps->folio_snapshot);
-		if (nr_pages > 1)
+		if (nr_pages > 2)
 			memcpy(&ps->folio_snapshot.__page_2, &foliop->__page_2,
 			       sizeof(struct page));
 		set_ps_flags(ps, foliop, page);
-- 
2.54.0

Re: [PATCH v2] mm/util: don't read __page_2 for order-1 folios in snapshot_page()

[Matthew Wilcox]

On Thu, Jul 09, 2026 at 01:49:54AM +0530, Aboorva Devarajan wrote:
> snapshot_page() currently reads __page_2 after checking nr_pages > 1,
> but it should only do so when nr_pages > 2.
> 
> During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page()
> oopsed on the page isolation path while reading an order-1 folio's
> __page_2 from an adjacent absent section (unmapped vmemmap).
> 
> Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap
> hole).

I appreciate you're absolutely swimming in it, but there's absolutely
no need to inflict IBM terminology on the rest of us ;-)
That second paragraph could simply be:

If an order-1 folio is allocated at the end of a vmemmap section,
__page_2 will not exist and reading it will cause a fault.

Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>

> Fixes: 31a31da8a618 ("mm: move _pincount in folio to page[2] on 32bit")
> Cc: stable@vger.kernel.org # v6.15+
> Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
> Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
> ---
> v1 -> v2:
>  - Condense the commit message.
>  - Drop the code comment.
> 
>  mm/util.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/util.c b/mm/util.c
> index af2c2103f0d95..34cb43b3eaa4c 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -1353,7 +1353,7 @@ void snapshot_page(struct page_snapshot *ps, const struct page *page)
>  	if (ps->idx < MAX_FOLIO_NR_PAGES) {
>  		memcpy(&ps->folio_snapshot, foliop, 2 * sizeof(struct page));
>  		nr_pages = folio_nr_pages(&ps->folio_snapshot);
> -		if (nr_pages > 1)
> +		if (nr_pages > 2)
>  			memcpy(&ps->folio_snapshot.__page_2, &foliop->__page_2,
>  			       sizeof(struct page));
>  		set_ps_flags(ps, foliop, page);
> -- 
> 2.54.0
> 
> 

Re: [PATCH v2] mm/util: don't read __page_2 for order-1 folios in snapshot_page()

[Luiz Capitulino]

On 2026-07-08 16:31, Matthew Wilcox wrote:
> On Thu, Jul 09, 2026 at 01:49:54AM +0530, Aboorva Devarajan wrote:
>> snapshot_page() currently reads __page_2 after checking nr_pages > 1,
>> but it should only do so when nr_pages > 2.
>>
>> During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page()
>> oopsed on the page isolation path while reading an order-1 folio's
>> __page_2 from an adjacent absent section (unmapped vmemmap).
>>
>> Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap
>> hole).
> 
> I appreciate you're absolutely swimming in it, but there's absolutely
> no need to inflict IBM terminology on the rest of us ;-)
> That second paragraph could simply be:
> 
> If an order-1 folio is allocated at the end of a vmemmap section,
> __page_2 will not exist and reading it will cause a fault.

I think having a brief description on how the issue was originally
reproduced can be useful for determining impact and validating
backports.

> 
> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> 
>> Fixes: 31a31da8a618 ("mm: move _pincount in folio to page[2] on 32bit")
>> Cc: stable@vger.kernel.org # v6.15+
>> Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
>> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
>> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
>> Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
>> ---
>> v1 -> v2:
>>   - Condense the commit message.
>>   - Drop the code comment.
>>
>>   mm/util.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/mm/util.c b/mm/util.c
>> index af2c2103f0d95..34cb43b3eaa4c 100644
>> --- a/mm/util.c
>> +++ b/mm/util.c
>> @@ -1353,7 +1353,7 @@ void snapshot_page(struct page_snapshot *ps, const struct page *page)
>>   	if (ps->idx < MAX_FOLIO_NR_PAGES) {
>>   		memcpy(&ps->folio_snapshot, foliop, 2 * sizeof(struct page));
>>   		nr_pages = folio_nr_pages(&ps->folio_snapshot);
>> -		if (nr_pages > 1)
>> +		if (nr_pages > 2)
>>   			memcpy(&ps->folio_snapshot.__page_2, &foliop->__page_2,
>>   			       sizeof(struct page));
>>   		set_ps_flags(ps, foliop, page);
>> -- 
>> 2.54.0
>>
>>
> 

Re: [PATCH v2] mm/util: don't read __page_2 for order-1 folios in snapshot_page()

[Luiz Capitulino]

On 2026-07-08 16:19, Aboorva Devarajan wrote:
> snapshot_page() currently reads __page_2 after checking nr_pages > 1,
> but it should only do so when nr_pages > 2.
> 
> During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page()
> oopsed on the page isolation path while reading an order-1 folio's
> __page_2 from an adjacent absent section (unmapped vmemmap).
> 
> Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap
> hole).

Reviewed-by: Luiz Capitulino <luizcap@redhat.com>

> 
> Fixes: 31a31da8a618 ("mm: move _pincount in folio to page[2] on 32bit")
> Cc: stable@vger.kernel.org # v6.15+
> Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
> Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
> ---
> v1 -> v2:
>   - Condense the commit message.
>   - Drop the code comment.
> 
>   mm/util.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/util.c b/mm/util.c
> index af2c2103f0d95..34cb43b3eaa4c 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -1353,7 +1353,7 @@ void snapshot_page(struct page_snapshot *ps, const struct page *page)
>   	if (ps->idx < MAX_FOLIO_NR_PAGES) {
>   		memcpy(&ps->folio_snapshot, foliop, 2 * sizeof(struct page));
>   		nr_pages = folio_nr_pages(&ps->folio_snapshot);
> -		if (nr_pages > 1)
> +		if (nr_pages > 2)
>   			memcpy(&ps->folio_snapshot.__page_2, &foliop->__page_2,
>   			       sizeof(struct page));
>   		set_ps_flags(ps, foliop, page);