[PATCH v2 0/2] mm/cma: fix range selection in cma_declare_contiguous_multi()

[PATCH v2 0/2] mm/cma: fix range selection in cma_declare_contiguous_multi()

[Ivy Lopez]

These two patches fix two independent bugs in the multi-range selection
of cma_declare_contiguous_multi(), found by code inspection with the
help of an LLM (both patches carry Assisted-by: LLM).

Patch 1 fixes list_insert_sorted(), which does not actually sort: it
stops at the wrong entry and, when no entry matches, inserts before the
last entry instead of appending. The caller assumes the list tail is the
smallest recorded range and that the list is walked largest first.

Patch 2 fixes sizesum counting the size of ranges that were skipped
because the list was full, so the sizesum < total_size check can pass
when the recorded ranges cannot cover the request, and the function
returns 0 having reserved less than asked for.

Each patch fixes a distinct failure and neither depends on the other.
No kernel-level reproducer was produced and nothing was tested beyond
compiling; the examples in the commit messages come from a userspace
copy of the helper and the selection loop, written from the source.

Changes in v2:
- resend as a series with a cover letter, as requested by Lorenzo
- commit messages now state how the bugs were found and that they were
  not tested on hardware or in a booted kernel
- add Assisted-by: LLM
- patch 1: correct the sentence about the first inserted range staying
  at the tail (only until it is evicted)
- rebased on the current akpm/mm-new
- no code changes

v1: https://lore.kernel.org/all/20261011003059.169430-1-skunkolee@gmail.com/

Ivy Lopez (2):
  mm/cma: fix list_insert_sorted() ordering
  mm/cma: do not count skipped ranges in cma_declare_contiguous_multi()

 mm/cma.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

-- 
2.56.0

[PATCH v2 1/2] mm/cma: fix list_insert_sorted() ordering

[Ivy Lopez]

cma_declare_contiguous_multi() uses list_insert_sorted() to keep its
candidate ranges sorted by size, largest first (revsizecmp()), and by
base address, lowest first (basecmp()). Both comparators return true
when the first argument sorts before the second.

The helper stops at the first existing entry for which cmp(entry, new)
is true and inserts the new range before it, which is the reverse of
what is needed. If no entry matches, mlp is left pointing at the last
entry and the new range is inserted before it instead of being
appended. With revsizecmp(), inserting sizes 1 2 3 4 yields 2 3 4 1
and inserting 4 3 2 1 yields 1 2 3 4. The first range inserted stays
at the tail until it is evicted.

The caller relies on list_last_entry() being the smallest recorded
range when deciding whether to skip or replace a candidate, and on
walking the list largest first when picking the final ranges. With the
list misordered, a candidate larger than some recorded ranges can be
skipped because it is smaller than the first range found, so the
function can fail or reserve less than requested where a valid layout
exists. For example, free ranges of 4G, 7 x 1G and 2G, in address
order, with a request of 12G: the 2G range is dropped instead of
replacing a 1G one.

Insert before the first entry the new range sorts before, and append
when there is none.

Found by code inspection with the help of an LLM. No kernel-level
reproducer was produced and this was not tested on hardware or in a
booted kernel. The example above comes from a userspace copy of the
helper and the selection loop, written from the source.

Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
Cc: <stable@vger.kernel.org> # 6.15+
Assisted-by: LLM
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 mm/cma.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/mm/cma.c b/mm/cma.c
index a10ea37a261d..527b2d894f3e 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -348,16 +348,12 @@ static void __init list_insert_sorted(
 	struct list_head *mp;
 	struct cma_init_memrange *mlp;
 
-	if (list_empty(ranges))
-		list_add(&mrp->list, ranges);
-	else {
-		list_for_each(mp, ranges) {
-			mlp = list_entry(mp, struct cma_init_memrange, list);
-			if (cmp(mlp, mrp))
-				break;
-		}
-		__list_add(&mrp->list, mlp->list.prev, &mlp->list);
+	list_for_each(mp, ranges) {
+		mlp = list_entry(mp, struct cma_init_memrange, list);
+		if (cmp(mrp, mlp))
+			break;
 	}
+	list_add_tail(&mrp->list, mp);
 }
 
 static int __init cma_fixed_reserve(phys_addr_t base, phys_addr_t size)
-- 
2.56.0