Re: [PATCH v2 2/2] mm/hugetlb: optimize bootmem hugepage tail vmemmap init

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] mm/hugetlb: out-of-bounds write in
  hugetlb_folio_init_tail_vmemmap()
--

commit 5be89b38412d58045fd600596787f54c7559d32c
Author: Li Zhe <lizhe.67@bytedance.com>

mm/hugetlb: optimize bootmem hugepage tail vmemmap init

This commit optimizes bootmem hugepage tail struct page initialization by
seeding a template from the first tail page and initializing the remaining
tail pages via memmap_init_page_from_template().

> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index cb2de24affdc4..6ae5d2679e3aa 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -3239,6 +3239,7 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
>  	enum zone_type zone = folio_zonenum(folio);
>  	int nid = folio_nid(folio);
>  	struct page *page = folio_page(folio, start_page_number);
> +	struct page template;
>  	unsigned long head_pfn = folio_pfn(folio);
>  	unsigned long pfn, end_pfn = head_pfn + end_page_number;
>  	unsigned int order = huge_page_order(h);
> @@ -3247,11 +3248,20 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
>  	 * As we marked all tail pages with memblock_reserved_mark_noinit(),
>  	 * we must initialize them ourselves here.
>  	 */
> -	for (pfn = head_pfn + start_page_number; pfn < end_pfn; page++, pfn++) {
> -		__init_single_page(page, pfn, zone, nid);
> -		prep_compound_tail(page, &folio->page, order);
> -		set_page_count(page, 0);
> -	}
> +	pfn = head_pfn + start_page_number;
> +
> +	/*
> +	 * Seed a template from the first real tail page and refresh only
> +	 * PFN-dependent fields before copying it.
> +	 */
> +	__init_single_page(page, pfn, zone, nid);
> +	prep_compound_tail(page, &folio->page, order);
> +	set_page_count(page, 0);
> +	memcpy(&template, page, sizeof(template));
> +
> +	for (pfn++; pfn < end_pfn; pfn++)
> +		memmap_init_page_from_template(pfn_to_page(pfn), pfn, zone,
> +					       &template);

[Severity: High]
Can peeling the first iteration out of the loop overwrite the struct page
past the end of folio when start_page_number >= end_page_number?

Previously, the loop was a no-op when pfn >= end_pfn.  Now, when HVO does
not optimize a gigantic folio, prep_and_add_bootmem_folios() calls
hugetlb_folio_init_tail_vmemmap(folio, h,
VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES, pages_per_huge_page(h)) after
gather_bootmem_prealloc_node() has already initialized the first
VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES pages.

On configurations where a gigantic page has pages_per_huge_page(h) <=
VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES (for example, powerpc
mpc885_ads_defconfig with 16 KiB pages, MAX_PAGE_ORDER == 8, and 8 MiB
gigantic hugepages of order 9, where both values are 512), this
unconditionally initializes folio_page(folio, start_page_number) and marks
the adjacent physical page's struct page as a compound tail of folio,
corrupting mem_map.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110114859.76343-1-lizhe.67@bytedance.com?part=2