Re: [PATCH v7] mm/hugetlb_cma: Fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

[Muchun Song <muchun.song@linux.dev>]

> On Aug 12, 2026, at 09:55, Andrew Morton <akpm@linux-foundation.org> wrote:
> 
> On Tue, 11 Aug 2026 05:29:09 +0000 Sourav Panda <souravpanda@google.com> wrote:
> 
>> alloc_buddy_hugetlb_folio_with_mpol() can pass a NULL nodemask to
>> alloc_fresh_hugetlb_folio() as a fallback to allocate from all
>> nodes. If order is gigantic, alloc_fresh_hugetlb_folio() propagates
>> the NULL nodemask down to hugetlb_cma_alloc_frozen_folio() via
>> alloc_gigantic_frozen_folio().
>> 
>> Additionally, hugetlb_cma_alloc_frozen_folio() previously attempted
>> allocation on hugetlb_cma[nid] without verifying if nid is included in
>> the caller's nodemask. Adding a node_isset(nid, *nodemask) check ensures
>> the initial preferred node allocation honors the memory policy / nodemask.
>> 
>> However, hugetlb_cma_alloc_frozen_folio() dereferences the nodemask in
>> node_isset(nid, *nodemask) and for_each_node_mask(node, *nodemask),
>> leading to a null pointer dereference kernel panic when nodemask is NULL.
>> 
>> Fix this by checking if nodemask is NULL in
>> hugetlb_cma_alloc_frozen_folio() and defaulting it to
>> cpuset_current_mems_allowed. Enclose the allocation attempts within
>> the cpuset seqcount retry loop so that if the cpuset changes concurrently
>> during allocation, the attempts are retried using the updated nodemask.
>> This ensures that the initial node check and fallback loop safely honor
>> the task's cpuset without violating cpuset constraints or causing NULL
>> pointer dereferences or unexpected allocation failures.
>> 
>> From a userspace perspective, this bug allows an unprivileged user to
>> crash the kernel (trigger a panic) by requesting a gigantic hugepage
>> allocation with MPOL_PREFERRED_MANY on a system where CMA is only
>> configured on a subset of NUMA nodes.
> 
> Thanks.  Sashio might have found another thing with MPOL_PREFERRED_MANY
> and CMA:
> 
> https://sashiko.dev/#/patchset/20260811052909.475635-1-souravpanda@google.com

Yes, we already noticed that issue in the previous version. However, I believe
this should be addressed as a separate patch within alloc_contig_frozen_pages
itself, rather than in the HugeTLB code, since this is a low-level memory
allocation interface that should not be tied solely to HugeTLB usage.

Muchun,
Thanks.

> 
> 
> 
> We're days away from 7.2 and I do dislike sending hotfixes upstream at
> such a late stage.  I expect I'll upstream this and a few other
> hotfixes after 7.2 is released.  It'll all end up in the same place.
> 
> I would still upstream hotfixes which address added-in-this-cycle bugs,
> but there aren't any of those at present.