From: Ye Liu <ye.liu@linux.dev>
To: Andrew Morton <akpm@linux-foundation.org>,
Vlastimil Babka <vbabka@kernel.org>
Cc: Ye Liu <liuye@kylinos.cn>, Suren Baghdasaryan <surenb@google.com>,
Michal Hocko <mhocko@suse.com>,
Brendan Jackman <brendan.jackman@linux.dev>,
Johannes Weiner <hannes@cmpxchg.org>, Zi Yan <ziy@nvidia.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: [PATCH] mm: debug_page_alloc: fix NULL buf in debug_guardpage_minorder_setup
Date: Thu, 6 Aug 2026 08:45:55 +0800 [thread overview]
Message-ID: <20260806004556.2633049-1-ye.liu@linux.dev> (raw)
From: Ye Liu <liuye@kylinos.cn>
If the kernel command line includes "debug_guardpage_minorder" without
an equals sign (i.e., no value is provided), the early parameter
parser passes a NULL buf pointer to the setup function.
kstrtouint() does not perform a NULL check on its input and calls
directly into kstrtoull() which dereferences s[0] unconditionally,
leading to a NULL pointer dereference and early boot crash.
Additionally, the error path's pr_err("%s", buf) would also crash with
a NULL format argument.
Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
mm/debug_page_alloc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/debug_page_alloc.c b/mm/debug_page_alloc.c
index 41e3d1f1ad96..fd2664c3c86a 100644
--- a/mm/debug_page_alloc.c
+++ b/mm/debug_page_alloc.c
@@ -22,8 +22,8 @@ static int __init debug_guardpage_minorder_setup(char *buf)
{
unsigned int res;
- if (kstrtouint(buf, 10, &res) < 0 || res > MAX_PAGE_ORDER / 2) {
- pr_err("Bad debug_guardpage_minorder value: %s\n", buf);
+ if (!buf || kstrtouint(buf, 10, &res) < 0 || res > MAX_PAGE_ORDER / 2) {
+ pr_err("Bad debug_guardpage_minorder value: %s\n", buf ?: "(missing)");
return 0;
}
_debug_guardpage_minorder = res;
--
2.25.1
next reply other threads:[~2026-08-06 0:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-06 0:45 Ye Liu [this message]
2026-08-06 1:00 ` [PATCH] mm: debug_page_alloc: fix NULL buf in debug_guardpage_minorder_setup Zi Yan
2026-08-06 1:08 ` John Hubbard
2026-08-06 1:56 ` Ye Liu
2026-08-06 2:36 ` John Hubbard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260806004556.2633049-1-ye.liu@linux.dev \
--to=ye.liu@linux.dev \
--cc=akpm@linux-foundation.org \
--cc=brendan.jackman@linux.dev \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=liuye@kylinos.cn \
--cc=mhocko@suse.com \
--cc=surenb@google.com \
--cc=vbabka@kernel.org \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox