Re: [PATCH v2] drm/pagemap: Fix folio allocation fallback and use-after-put

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unconditional use of __GFP_NOWARN suppresses OOM warnings for order-0 allocations.
--

--- Patch [1]: [PATCH v2] drm/pagemap: Fix folio allocation fallback and use-after-put ---
commit 8cbd3237a69e546db0a488ed740897837ca90e44
Author: Matthew Brost <[email protected]>

drm/pagemap: Fix folio allocation fallback and use-after-put

This commit fixes an issue where higher-order folio allocations lacking
warning suppression would spam the kernel log on failure. It adds a fallback
path to use order-0 allocations for the entire range if the higher-order
allocation fails. It also fixes a use-after-free issue when retrieving the
folio order after the page reference was dropped.

> diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c
> index 15c78eca180b7..aeb8ba0017e5f 100644
> --- a/drivers/gpu/drm/drm_pagemap.c
> +++ b/drivers/gpu/drm/drm_pagemap.c
> @@ -886,11 +886,34 @@ static int drm_pagemap_migrate_populate_ram_pfn(struct vm_area_struct *vas,
>  
>  		order = folio_order(page_folio(src_page));
>  
> -		/* TODO: Support fallback to single pages if THP allocation fails */
>  		if (vas)
> -			folio = vma_alloc_folio(GFP_HIGHUSER, order, vas, addr);
> +			folio = vma_alloc_folio(GFP_HIGHUSER | __GFP_NOWARN, order, vas, addr);
>  		else
> -			folio = folio_alloc(GFP_HIGHUSER, order);
> +			folio = folio_alloc(GFP_HIGHUSER | __GFP_NOWARN, order);

[Severity: Medium]
The commit message notes that __GFP_NOWARN is added to the higher-order
allocation, but does this unconditionally apply __GFP_NOWARN even when
order is 0?

If the source page is order-0, the primary allocation in
drm_pagemap_migrate_populate_ram_pfn() will use __GFP_NOWARN. If that
allocation fails, the subsequent fallback block is skipped because its
condition requires a non-zero order.

This means the function will jump directly to the free_pages error path
without logging any OOM warning for the failed order-0 allocation. Since
the fallback order-0 allocations explicitly use GFP_HIGHUSER without
__GFP_NOWARN, should the primary allocation also avoid __GFP_NOWARN when
order is 0?

> +
> +		if (!folio && order) {
> +			/*
> +			 * Higher-order allocation failed, fall back to

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1