From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 169F3568FDC; Wed, 9 Sep 2026 14:35:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788964541; cv=none; b=A+Id4rFwnsf8HSg0nNvI0PNXdJ3lotY/jQJYZntSSsiVFVZnDNNxHgXXyBFz2Kq79fT0zjZARCS/nDXo5IvVcw0TKvmfcmamn/mwYlwvQhZg3BwwvcGNborRjlRKp3R4j9rNVnRrxH7/N+pgH92tN9hxpDBQu4pkX4BiVqM+17Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788964541; c=relaxed/simple; bh=/0Wnf3oB9njGTbMrNZvRbhJPtVQEkOIdJlOGUsY7raM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S22Y06IGQOj6CxrXvqPCFNwU3Ldkh4pCjHXOeezt8DbNZErg1F2QM0MOb2odYE0+zbdR+lqCSvRf89VuYlnZasNz11YY/Q55kB9asghGe517FZywKEoikQQIEVMv5dN+Bj+U7quVW7iJLdK1J+ndmg1t0dm8CqtguElmPvk8iJk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JKTL07Bd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JKTL07Bd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D4DA1F00A3F; Wed, 9 Sep 2026 14:35:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788964540; bh=iuIh2NeI87EQX1TZjDbJUpUyFNjkauJNOKiehjP056s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JKTL07Bd5JoLUeSMhHZX9TKExRmsACMMHk0Kxr2vI+0roWAS7r/ljQJIqNlTpeAp9 d2fd9+Cawa6XLInUJBKtaTAOnKabtqnB4vJoBWTQqMla+PozvG3KnSQMBaj9dfgNK9 dCI8k+QbwvLjDoY3FRbFIlFjMWbBWxCvcbfw4MSs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Brendan Jackman , sashiko-bot@kernel.org, "Vlastimil Babka (SUSE)" , "Harry Yoo (Oracle)" , Brendan Jackman , Alexei Starovoitov , Johannes Weiner , Michal Hocko , Sebastian Andrzej Siewior , Shakeel Butt , Steven Rostedt , Suren Baghdasaryan , Zi Yan , Andrew Morton , Sasha Levin Subject: [PATCH 6.18 458/583] mm/page_alloc: dont spin_trylock() in NMI on UP Date: Wed, 9 Sep 2026 15:42:23 +0200 Message-ID: <20260909134253.792955180@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260909134237.773280130@linuxfoundation.org> References: <20260909134237.773280130@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Brendan Jackman [ Upstream commit 3105ae628fb785d48b49256468be4f21a7b3cfc0 ] Patch series "mm/page_alloc: fixes for free_pages_nolock() on RT/UP". Pre-existing bugs found by Sashiko during review of this other series: https://lore.kernel.org/all/20260703-alloc-trylock-v5-0-c87b714e19d3@google.com/ I have not reproduced these bugs, and I suspect there is no real-world user that is affected by them. This patch (of 2): As noted in can_spin_trylock(), using this is unsafe in this context. commit 620b46ed6ae17 ("mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP") fixed this on the alloc side but missed the free side. Impact: If BPF programs using these features in NMI (probably tracing) are present on non-SMP builds this might crash the kernel and is probably exploitable by local attackers for privilege escalation. Link: https://lore.kernel.org/20260715-alloc-nolock-fixes-v1-0-fadc49952dda@google.com Link: https://lore.kernel.org/20260715-alloc-nolock-fixes-v1-1-fadc49952dda@google.com Fixes: 8c57b687e833 ("mm, bpf: Introduce free_pages_nolock()") Signed-off-by: Brendan Jackman Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260703-alloc-trylock-v5-0-c87b714e19d3%40google.com?part=18 Reviewed-by: Vlastimil Babka (SUSE) Reviewed-by: Harry Yoo (Oracle) Cc: Brendan Jackman Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Michal Hocko Cc: Sebastian Andrzej Siewior Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Cc: Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- mm/page_alloc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2965,8 +2965,10 @@ static void __free_frozen_pages(struct p migratetype = MIGRATE_MOVABLE; } - if (unlikely((fpi_flags & FPI_TRYLOCK) && IS_ENABLED(CONFIG_PREEMPT_RT) - && (in_nmi() || in_hardirq()))) { + if (unlikely((fpi_flags & FPI_TRYLOCK) && + ((IS_ENABLED(CONFIG_PREEMPT_RT) && + (in_nmi() || in_hardirq())) || + (!IS_ENABLED(CONFIG_SMP) && in_nmi())))) { add_page_to_zone_llist(zone, page, order); return; }