From: "Oscar Salvador (SUSE)" <osalvador@kernel.org>
To: Muchun Song <songmuchun@bytedance.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
David Hildenbrand <david@kernel.org>,
linux-mm@kvack.org, Lorenzo Stoakes <ljs@kernel.org>,
"Liam R. Howlett" <liam@infradead.org>,
Vlastimil Babka <vbabka@kernel.org>,
Mike Rapoport <rppt@kernel.org>,
Suren Baghdasaryan <surenb@google.com>,
Michal Hocko <mhocko@suse.com>,
Frank van der Linden <fvdl@google.com>,
Stefan Strogin <stefan.strogin@gmail.com>,
Dmitry Safonov <0x7f454c46@gmail.com>,
Michal Nazarewicz <mina86@mina86.com>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
muchun.song@linux.dev
Subject: Re: [PATCH] mm/cma_debug: fix invalid accesses for inactive CMA areas
Date: Wed, 20 May 2026 09:27:44 +0200 [thread overview]
Message-ID: <ag1icL5DPMVXwRta@localhost.localdomain> (raw)
In-Reply-To: <20260520061025.3971821-1-songmuchun@bytedance.com>
On Wed, May 20, 2026 at 02:10:25PM +0800, Muchun Song wrote:
> cma_activate_area() can fail after allocating range bitmaps. Its cleanup
> path frees those bitmaps, but only clears cma->count and
> cma->available_count. It leaves cma->nranges and each range's count in
> place, so cma_debugfs_init() can still register debugfs files for an area
> that never activated successfully.
>
> That exposes two problems. Reading the bitmap file can make debugfs walk a
> freed range bitmap and trigger an invalid memory access. Reading maxchunk
> can also take cma->lock even though that lock is initialized only on the
> successful activation path.
>
> Fix this by creating debugfs entries only for CMA areas that reached
> CMA_ACTIVATED.
>
> Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
> Fixes: 2e32b947606d ("mm: cma: add functions to get region pages counters")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muchun Song <songmuchun@bytedance.com>
For the change:
Acked-by: Oscar Salvador (SUSE) <osalvador@kernel.org>
About Fixes, does this mean that before c009da4258f9 ("mm, cma: support
multiple contiguous ranges, if requested"), this was already triggerable
after 2e32b947606d?
--
Oscar Salvador
SUSE Labs
next prev parent reply other threads:[~2026-05-20 7:27 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-20 6:10 [PATCH] mm/cma_debug: fix invalid accesses for inactive CMA areas Muchun Song
2026-05-20 6:28 ` Mike Rapoport
2026-05-20 7:27 ` Oscar Salvador (SUSE) [this message]
2026-05-20 7:37 ` Muchun Song
2026-05-20 8:19 ` David Hildenbrand (Arm)
2026-05-20 8:28 ` Muchun Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ag1icL5DPMVXwRta@localhost.localdomain \
--to=osalvador@kernel.org \
--cc=0x7f454c46@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=david@kernel.org \
--cc=fvdl@google.com \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=mhocko@suse.com \
--cc=mina86@mina86.com \
--cc=muchun.song@linux.dev \
--cc=rppt@kernel.org \
--cc=songmuchun@bytedance.com \
--cc=stable@vger.kernel.org \
--cc=stefan.strogin@gmail.com \
--cc=surenb@google.com \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.