Re: [PATCH] mm/util: fix off-by-one when checking folio index in snapshot_page()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] mm/util: head page with zero _nr_pages hits tail fallback in
  snapshot_page()
--

commit c1bbaeb218bb3e6717e9e858cb2ae698eb9ee371
Author: Shao Mingyin <shao.mingyin@zte.com.cn>

mm/util: fix off-by-one when checking folio index in snapshot_page()

This commit changes the folio index bounds check in snapshot_page() from
> to >= so that snapshots whose page index equals the copied folio's
page count are retried or treated as unfaithful.

> diff --git a/mm/util.c b/mm/util.c
> index a5140b3b70f33..6e6a8f8640a75 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -1462,7 +1462,7 @@ void snapshot_page(struct page_snapshot *ps, const struct page *page)
>  		set_ps_flags(ps, foliop, page);
>  	}
>  
> -	if (ps->idx > nr_pages) {
> +	if (ps->idx >= nr_pages) {
>  		if (loops-- > 0)
>  			goto again;
>  		clear_compound_head(&ps->page_snapshot);

[Severity: Medium]
Can this cause a compound head page with folio->_nr_pages == 0 to enter
the tail-page fallback block?

When snapshot_page() inspects a compound head page (ps->idx == 0) while
folio->_nr_pages is 0 under NR_PAGES_IN_LARGE_FOLIO, nr_pages is 0 and
ps->idx >= nr_pages now evaluates to true.  This happens deterministically
when __free_pages_prepare() reports a bad compound page, because it zeroes
folio->_nr_pages before calling free_page_is_bad() -> bad_page() ->
dump_page() and before clearing PG_head:

mm/page_alloc.c:__free_pages_prepare() {
    ...
		if (compound) {
			page[1].flags.f &= ~PAGE_FLAGS_SECOND;
#ifdef NR_PAGES_IN_LARGE_FOLIO
			folio->_nr_pages = 0;
#endif
		}
    ...
	if (is_check_pages_enabled()) {
		if (free_page_is_bad(page))
			bad++;
    ...
}

After the retries expire, the fallback calls
clear_compound_head(&ps->page_snapshot), which overwrites the compound_info
union word (lru.next or pp_magic on a head page) with 0, copies only
sizeof(struct page) into ps->folio_snapshot while leaving PG_head set, and
clears ps->flags.  In __dump_page(), this triggers a bogus "page does not
match folio" warning on a head page and zeroes the lru.next word in the hex
dump.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115004657890Pz8ERDf5nCtE-B6M7KFzu@zte.com.cn?part=1