From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F4614F30CB for ; Tue, 13 Oct 2026 12:57:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791896250; cv=none; b=ZrIpY6cXmW9Co4cdVVltdVEJ6RDDupvHN5gVd4yGrFunaL2dYK5P+grw3bN97Q0ztFzQyVBdhx2px7v9h7oZonQ9ntImg2QJbziYO8MOgZNdlLTZyk0lwlA/DZsR3w6v0IRrQ4+mXUGqBwddwrC7IcjmD7f12spfJ23GVypuDOE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791896250; c=relaxed/simple; bh=EMvZFec+aEZgob/bO36XSk9Xavr5m3zM18K2N4GEyaI=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=c0M8prIH+k3KkrAZSJ5PHY+90SCJ/SZdhFk5nC27CEhNo47ZsGujUzUrNKaFb5Gq8VvE0CRSTqLsQ4lm/KfRfCCTZ/W7gG9Uf0eHIbxqKPxi4HIh3FIl4rMRcz/AKZnrF6zf+aelBg57nZR08mvXIJxHWD9K9hbYQsszy6rkDRo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XkezcZFO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XkezcZFO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2B431F00893; Tue, 13 Oct 2026 12:57:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791896247; bh=X9BFwpcjmKrDdzhZwTDHl5KDt9LrzcnjBY0dqWfL9Uo=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=XkezcZFOnBges/No52JV7lJNChBh2uB/GmGh3tX/uB94BDHnIf+kSMHqz0Vs5wEM2 U+eP0xko4YeYYnKDCOCOyXyrxGwNLfEhR3p1Lnkv9eoef7oLmBNoZMZgjvJBKgisqr fX3GPojftjXN8slL6pIFo+UY+/OiqBGSJ4GCYNdCtV9/o9d4041q8eV7EU5s63CCqC tYeDXHaD8ItI5Q172odKRM7uPdhkQLYKqZUOZ776OhtXwJxVuB/cb4b2tZH6NRnuVR rAKBkQh5k60awOuaonXW0fkUiRnZDkBHh2aG/rVUvjZ6M+JFW1mdkG1ryWakILxnV6 QTeixMb1Zgpcw== Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfauth.ams.internal (Postfix) with ESMTP id B609F198003A; Tue, 13 Oct 2026 08:57:22 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-01.internal (MEProxy); Tue, 13 Oct 2026 08:57:25 -0400 X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEetqmizud+clew86He+iiifUKs94ePsfMAGNNPMmxgxaJcQtNwftmQ4FOsIRMZFd p1MeZZgEA67dwqEqwnkr9c8OjvKQsDfeAsifflVQReL3Pft+JJQzZK/OJoNXOjH6QFKY1a 532uP9WhuX8Gl/oakRel8YxZcScQ182XP8mCDVloKrpc1ubB/YrgUwTFFzCtyoDK8vabJ4 KmBMY3r/03LHp3KTiVQvPSpcMw8RIXIkBRo7d2UWWyg5HdQDMUQ5SJD4LgUB2hnRqejjuE E1ZFIiECiniGuVUPUMgC7vY+pflwKfQx2mdVyPbFen760/u7kdhq25cN79pi87MrgbR2HB i9QhoZxOz7VJYTBjfS2SH6+BIM6AqXvlQY7HkAxNrn/CUD3hBligPhZqBs1MWtMk1rjQrR CdLfeZu3RDnu2z2nrTqzR3NwlFsfj3utQppyMi+BQeDGbR2iO2rxS/p49qPmDzD6HmCLG+ Dx8/Gem37n8bZyTqaMbP7yuyN4BXCyyTLaJCOhtODibFchmq18+3ExOlh0DHAaJmILTeYz NHZyQ9ZtbVyS+Qat+s5v5hPzl/+hCEfxyaOVr70AjmzlWwcuyHHjrvN4xJWidHZfUMsVLj qhKdlGgOAZX5kE2Jmf5p+9IAEihQKqaiu7KnsGEes40g2HF423c3tJ48JKyw X-ME-Proxy: Feedback-ID: i10464835:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 13 Oct 2026 08:57:21 -0400 (EDT) Date: Tue, 13 Oct 2026 13:57:20 +0100 From: Kiryl Shutsemau To: "David Hildenbrand (Arm)" Cc: Andrew Morton , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Ying Huang , Baolin Wang , Barry Song , Ryan Roberts , Chuanhua Han , Kyle Zeng , linux-mm@kvack.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] mm: fix address wraparound when scanning large folio PTEs Message-ID: References: <20261013-folio_pte_scan_range-v1-1-c50dc30bf6ad@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20261013-folio_pte_scan_range-v1-1-c50dc30bf6ad@kernel.org> On Tue, Oct 13, 2026 at 02:30:37PM +0200, David Hildenbrand (Arm) wrote: > numa_rebuild_large_mapping() and do_swap_page() can be tricked into > generating an address wraparound, crashing the kernel. All that's required > is to map a tail page of a large folio close enough to the start/end of > the address space to e.g., make > > unsigned long addr_start = addr - (nr << PAGE_SHIFT); > > to wrap around. > > Let's fix it by providing a better helper, folio_pte_scan_range(), that > takes care of staying within VMA and page table boundaries while > handling possible wraparounds. > > Reported-by: Kyle Zeng > Fixes: d2136d749d76 ("mm: support multi-size THP numa balancing") > Fixes: 508758960b8d ("mm: swap: entirely map large folios found in swapcache") > Cc: stable@vger.kernel.org > Signed-off-by: David Hildenbrand (Arm) > --- > mm/memory.c | 43 +++++++++++++++++++++++++++++-------------- > 1 file changed, 29 insertions(+), 14 deletions(-) > > diff --git a/mm/memory.c b/mm/memory.c > index 1f5d5f7d39cd2..a3823010aa981 100644 > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -4933,6 +4933,27 @@ static void check_swap_exclusive(struct folio *folio, swp_entry_t entry, > } while (--nr_pages); > } > > +/* > + * Get the address range in which a folio might be mapped, assuming its pages > + * are mapped consecutively and the folio page at the given idx is mapped at > + * the given address. > + */ > +static void folio_pte_scan_range(const struct folio *folio, > + const struct vm_area_struct *vma, unsigned long addr, > + unsigned long idx, unsigned long *start, unsigned long *end) > +{ > + /* Stay within the page table and VMA boundaries. */ > + const unsigned long pmd_start = addr & PMD_MASK; > + const unsigned long pmd_end = pmd_start + PMD_SIZE; > + const unsigned long lower = max(pmd_start, vma->vm_start); > + const unsigned long upper = min(pmd_end - 1, vma->vm_end - 1) + 1; These -1/+1 gave me a pause. I guess it is for pmd_end wrapping to 0 in the top PMD? A comment would be nice. Otherwise: Reviewed-by: Kiryl Shutsemau (Meta) -- Kiryl Shutsemau / Kirill A. Shutemov