* [merged mm-stable] mm-fix-parameter-passed-to-page_mapcount_is_type.patch removed from -mm tree
@ 2025-05-12 0:50 Andrew Morton
0 siblings, 0 replies; only message in thread
From: Andrew Morton @ 2025-05-12 0:50 UTC (permalink / raw)
To: mm-commits, willy, vbabka, linmiaohe, gehao, david, gshan, akpm
The quilt patch titled
Subject: mm: fix parameter passed to page_mapcount_is_type()
has been removed from the -mm tree. Its filename was
mm-fix-parameter-passed-to-page_mapcount_is_type.patch
This patch was dropped because it was merged into the mm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Gavin Shan <gshan@redhat.com>
Subject: mm: fix parameter passed to page_mapcount_is_type()
Date: Fri, 21 Mar 2025 22:02:21 +1000
Patch series "Fix parameter passed to page_mapcount_is_type()", v2.
Found by code inspection. There are two places where the parameter passed
to page_mapcount_is_type() is (page->_mapcount), which is incorrect since
it should be one more than the value, as explained in the comments to
page_mapcount_is_type(): (a) page_has_type() in page-flags.h (b)
__dump_folio() in mm/debug.c
PATCH[1] fixes the parameter for (a)
PATCH[2] fixes the parameter for (b)
Note that the issue doesn't cause any visible impacts due to the safety
gap introduced by PGTY_mapcount_underflow limit. So the tag 'Cc:
stable@vger.kernel.org' isn't needed.
This patch (of 2):
As the comments of page_mapcount_is_type() indicate, the parameter passed
to the function should be one more than page->_mapcount. However,
page->_mapcount (equivalent to page->page_type) is passed to the function
by commit 4ffca5a96678 ("mm: support only one page_type per page")
page_type_has_type() is replaced by page_mapcount_is_type(), but the
parameter isn't adjusted.
Fix it by replacing page_mapcount_is_type() with page_type_has_type() in
page_has_type(). Note that the issue doesn't cause any visible impacts
due to the safety gap introduced by PGTY_mapcount_underflow limit.
Link: https://lkml.kernel.org/r/20250321120222.1456770-1-gshan@redhat.com
Link: https://lkml.kernel.org/r/20250321120222.1456770-2-gshan@redhat.com
Fixes: 4ffca5a96678 ("mm: support only one page_type per page")
Signed-off-by: Gavin Shan <gshan@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: gehao <gehao@kylinos.cn>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
include/linux/page-flags.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/page-flags.h~mm-fix-parameter-passed-to-page_mapcount_is_type
+++ a/include/linux/page-flags.h
@@ -982,7 +982,7 @@ static inline bool page_mapcount_is_type
static inline bool page_has_type(const struct page *page)
{
- return page_mapcount_is_type(data_race(page->page_type));
+ return page_type_has_type(data_race(page->page_type));
}
#define FOLIO_TYPE_OPS(lname, fname) \
_
Patches currently in -mm which might be from gshan@redhat.com are
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2025-05-12 0:50 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-12 0:50 [merged mm-stable] mm-fix-parameter-passed-to-page_mapcount_is_type.patch removed from -mm tree Andrew Morton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.