From: Max Kellermann <max.kellermann@ionos.com>
To: akpm@linux-foundation.org, david@redhat.com,
lorenzo.stoakes@oracle.com, ziy@nvidia.com,
baolin.wang@linux.alibaba.com, Liam.Howlett@oracle.com,
npache@redhat.com, ryan.roberts@arm.com, dev.jain@arm.com,
baohua@kernel.org, shikemeng@huaweicloud.com, kasong@tencent.com,
nphamcs@gmail.com, bhe@redhat.com, chrisl@kernel.org,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Cc: Max Kellermann <max.kellermann@ionos.com>
Subject: [PATCH 2/2] mm/swap: add BUG_ON(folio==NULL) to folios_put_refs()
Date: Wed, 27 Aug 2025 01:16:25 +0200 [thread overview]
Message-ID: <20250826231626.218675-2-max.kellermann@ionos.com> (raw)
In-Reply-To: <20250826231626.218675-1-max.kellermann@ionos.com>
It is not legal to have NULL pointers in a folio_batch.
However, the Ceph code does exactly this, and a refactoring patch gone
wrong has exposed this to folios_put_refs(), see
https://lore.kernel.org/ceph-devel/aK4v548CId5GIKG1@swift.blarg.de/
I believe this should Oops instead of crashing due to NULL pointer
reference (guarded by is_huge_zero_folio(), which may silently hide
the bug).
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
mm/swap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/swap.c b/mm/swap.c
index 3632dd061beb..07ccda00e7ee 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -952,6 +952,7 @@ void folios_put_refs(struct folio_batch *folios, unsigned int *refs)
for (i = 0, j = 0; i < folios->nr; i++) {
struct folio *folio = folios->folios[i];
unsigned int nr_refs = refs ? refs[i] : 1;
+ BUG_ON(folio == NULL);
if (is_huge_zero_folio(folio))
continue;
--
2.47.2
next prev parent reply other threads:[~2025-08-26 23:16 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-26 23:16 [PATCH 1/2] huge_mm.h: is_huge_zero_folio(NULL) should return false Max Kellermann
2025-08-26 23:16 ` Max Kellermann [this message]
2025-08-27 1:42 ` [PATCH 2/2] mm/swap: add BUG_ON(folio==NULL) to folios_put_refs() Zi Yan
2025-08-27 2:12 ` Chris Li
2025-08-27 9:38 ` David Hildenbrand
2025-08-27 1:19 ` [PATCH 1/2] huge_mm.h: is_huge_zero_folio(NULL) should return false Zi Yan
2025-08-27 1:55 ` Andrew Morton
2025-08-27 4:39 ` Max Kellermann
2025-08-27 9:36 ` David Hildenbrand
2025-08-27 10:13 ` Max Kellermann
2025-08-27 11:56 ` David Hildenbrand
2025-08-27 13:06 ` Max Kellermann
2025-08-27 14:34 ` David Hildenbrand
2025-08-27 15:03 ` [PATCH v2] huge_mm.h: disallow is_huge_zero_folio(NULL) Max Kellermann
2025-08-27 15:16 ` Lorenzo Stoakes
2025-08-27 15:38 ` Max Kellermann
2025-08-27 20:01 ` David Hildenbrand
2025-08-27 20:26 ` David Hildenbrand
2025-08-27 20:44 ` Lorenzo Stoakes
2025-08-28 8:48 ` [PATCH v3] " Max Kellermann
2025-08-28 9:35 ` Lorenzo Stoakes
2025-08-29 1:25 ` Zi Yan
2025-08-27 23:53 ` [PATCH v2] " Andrew Morton
2025-08-28 5:17 ` Max Kellermann
2025-08-28 7:57 ` David Hildenbrand
2025-08-27 15:05 ` [PATCH 1/2] huge_mm.h: is_huge_zero_folio(NULL) should return false Max Kellermann
2025-08-27 9:35 ` David Hildenbrand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250826231626.218675-2-max.kellermann@ionos.com \
--to=max.kellermann@ionos.com \
--cc=Liam.Howlett@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=baohua@kernel.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=bhe@redhat.com \
--cc=chrisl@kernel.org \
--cc=david@redhat.com \
--cc=dev.jain@arm.com \
--cc=kasong@tencent.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=npache@redhat.com \
--cc=nphamcs@gmail.com \
--cc=ryan.roberts@arm.com \
--cc=shikemeng@huaweicloud.com \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).