Re: [PATCH v2] mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing NULL check for alloc_percpu() in setup_zone_pageset() causes a kernel panic if allocation fails.
--

commit a2befab1623f901bf46191ea77de8329bd1c4f4a
Author: Gregory Price <gourry@gourry.net>

mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

We miss a failed allocation check for pgdat->per_cpu_nodestats, which
results in a NULL deref when we offset into the per-cpu area. Propagate
-ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats
so a later online can retry the allocation.

Link: https://sashiko.dev/#/patchset/20260627202243.758289-1-gourry%40gourry.net

> diff --git a/mm/mm_init.c b/mm/mm_init.c
> index cfd0b2722d836..07a8c74cf7ade 100644
> --- a/mm/mm_init.c
> +++ b/mm/mm_init.c
> @@ -1534,8 +1534,14 @@ void __ref free_area_init_core_hotplug(struct pglist_data *pgdat)
>  
>  	pgdat_init_internals(pgdat);
>  
> -	if (pgdat->per_cpu_nodestats == &boot_nodestats)
> -		pgdat->per_cpu_nodestats = alloc_percpu(struct per_cpu_nodestat);
> +	if (pgdat->per_cpu_nodestats == &boot_nodestats) {
> +		struct per_cpu_nodestat __percpu *p;
> +
> +		p = alloc_percpu(struct per_cpu_nodestat);
> +		if (!p)
> +			return -ENOMEM;
> +		pgdat->per_cpu_nodestats = p;
> +	}

[Severity: High]
This isn't a bug introduced by this patch, but while checking the
alloc_percpu() handling here, I noticed a similar missing NULL check in 
setup_zone_pageset() over in mm/page_alloc.c:

mm/page_alloc.c:setup_zone_pageset() {
    ...
    if (sizeof(struct per_cpu_zonestat) > 0)
        zone->per_cpu_zonestats = alloc_percpu(struct per_cpu_zonestat);

    zone->per_cpu_pageset = alloc_percpu(struct per_cpu_pages);
    for_each_possible_cpu(cpu) {
        struct per_cpu_pages *pcp;
        struct per_cpu_zonestat *pzstats;

        pcp = per_cpu_ptr(zone->per_cpu_pageset, cpu);
        pzstats = per_cpu_ptr(zone->per_cpu_zonestats, cpu);
        per_cpu_pages_init(pcp, pzstats);
    }
    ...
}

If alloc_percpu() fails here due to memory pressure during runtime memory 
hotplug, could the returned NULL pointers cause a kernel panic when 
dereferenced by per_cpu_ptr() and per_cpu_pages_init()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701221613.2818148-1-gourry@gourry.net?part=1