From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id AB7B438F940 for ; Wed, 25 Feb 2026 10:05:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772013941; cv=none; b=aR7uNGONT6j3aBe9KuiodCeBCA1S5SG+RCqMRgvZL8LLSj8JFq0EIGCr+wbxedhSl09dCt7ssepVjN3/6uJFwaZ9lXPOuLgvWhoaW7aicQzGv/qHEmIJyiH8d3HJbNBjhioQ77B18R7LnYZV6fg81OuXHmjR92g7fb6wzfhray8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772013941; c=relaxed/simple; bh=eR8LAh34JdSHdEhN2CXCeuAbsdY8T2fnGbsJ5hSlE1k=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Vnci5okhSgi/7uh8SFXVhLuV4cV8HH3mpFasZuu6eI9eD07nmHJDapWr+GQdY50xxtul3Ak/U/Q3NIVc9aXs3kw1+dvJ6UWXvvn2JcBE1ZmNQgrVjBSKa4llupV5ZE7wfYgfk3rEmQ30j6h7jgPSoqXlvM9jgHZ3jqcgp3T0wrA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id AEF90165C; Wed, 25 Feb 2026 02:05:32 -0800 (PST) Received: from [10.164.19.28] (unknown [10.164.19.28]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 8AF8D3F59E; Wed, 25 Feb 2026 02:05:35 -0800 (PST) Message-ID: Date: Wed, 25 Feb 2026 15:35:32 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm: Avoid calling folio_page() with an out-of-bounds index To: Li Zhe , akpm@linux-foundation.org, david@kernel.org, lorenzo.stoakes@oracle.com, Liam.Howlett@oracle.com, vbabka@suse.cz, rppt@kernel.org, surenb@google.com, mhocko@suse.com, ankur.a.arora@oracle.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20260225092628.11687-1-lizhe.67@bytedance.com> Content-Language: en-US From: Dev Jain In-Reply-To: <20260225092628.11687-1-lizhe.67@bytedance.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 25/02/26 2:56 pm, Li Zhe wrote: > In folio_zero_user(), the page pointer is calculated via folio_page() > before checking if the number of pages to be cleared is greater than zero. > Furthermore, folio_page() does not verify that the page number lies > within folio. > > When 'addr_hint' is near the end of a large folio, the range 'r[0]' > represents an empty interval. In this scenario, 'nr_pages' will be > calculated as 0 and 'r[0].start' can be an index that is out-of-bounds > for folio_page(). The code unconditionally calls folio_page() on a wrong > index, even though the subsequent clearing logic is correctly skipped. > > While this does not cause a functional bug today, calculating a page > pointer for an out-of-bounds index is logically unsound and fragile. It > could pose a risk for future refactoring or trigger warnings from static > analysis tools. > > To fix this, move the call to folio_page() inside the 'if (nr_pages > 0)' > block. This ensures that the page pointer is only calculated when it is > actually needed for a valid, non-empty range of pages, thus making the code > more robust and logically correct. > > Signed-off-by: Li Zhe > --- Not only the correctness, but even from a perf PoV (folio_zero_user is a hot path) it may make sense to initialize the variable only when required. Reviewed-by: Dev Jain > mm/memory.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/mm/memory.c b/mm/memory.c > index 07778814b4a8..6f8c55d604b5 100644 > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -7343,12 +7343,14 @@ void folio_zero_user(struct folio *folio, unsigned long addr_hint) > r[0] = DEFINE_RANGE(r[2].end + 1, pg.end); > > for (i = 0; i < ARRAY_SIZE(r); i++) { > - const unsigned long addr = base_addr + r[i].start * PAGE_SIZE; > const long nr_pages = (long)range_len(&r[i]); > - struct page *page = folio_page(folio, r[i].start); > > - if (nr_pages > 0) > + if (nr_pages > 0) { > + const unsigned long addr = base_addr + r[i].start * PAGE_SIZE; > + struct page *page = folio_page(folio, r[i].start); > + > clear_contig_highpages(page, addr, nr_pages); > + } > } > } >