Re: [PATCH v2 2/2] mm/page_isolation: guard compound_order() against racing
"Zi Yan" <[email protected]>
| Newsgroups | org.kvack.linux-mm,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Thu Aug 20, 2026 at 10:55 PM EDT, Qi Xi wrote:
> The PageCompound branch reads compound_head() without holding a reference.
> A racing split or free can cause compound_head() to return a stale pointer,
> and compound_nr() reads the order from that stale head, leading to
> out-of-range shifts and making the skip distance meaningless.
>
> Read the order explicitly with compound_order() and validate it is within
> MAX_FOLIO_ORDER before shifting. Also verify the derived head_pfn against
> the legitimate pfn: the head must not be past pfn, must be aligned to
> nr_pages, and pfn must fall within the compound page. Bail out with
> -EBUSY if any check fails.
>
> Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
> Cc: [email protected]
> Suggested-by: Zi Yan <[email protected]>
> Signed-off-by: Qi Xi <[email protected]>
> ---
> mm/page_isolation.c | 22 ++++++++++++++++++++--
> 1 file changed, 20 insertions(+), 2 deletions(-)
>
LGTM.
Reviewed-by: Zi Yan <[email protected]>
--
Best Regards,
Yan, Zi