From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794048287; b=WcLpTg7tROH3tJUKiEQ+/aTt3FXfO4O4VWPGxOQqUkW6FySgVEiv2y9+/k6QAE8OIHDS Bm6B67Ih/xc+zOgf6+Ys0vSSOmUkQuZr5OMPYw4SUjqh5FFN6AnOrEnDXTYXL8FkC+aj2 lLMwxiVmMD3sLHpZnge1hpfXXsAuGhalO5ix2yNGLNANFl+fS2uRm08LwJWarpgbM7Nrf N2149glcmRkQILZF4WrXxdt9o7Zrdfhd/vmdbq6DEDl8XvlVwYNVltP2W3VDH81etbpQ9 luyvZUrQ9FXw+XbrQO8cMcesrFfkLRlYLrhWmxRSdf0eBoMHsYo4Pr8T29KAisLbWjg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794048287; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=eKofzCL9sjLIN1Ea1LlgqqQ8nQ1pePQujCYm1QWSExA=; b=cyhKsfAZpeEJ7fmPP4KzUM15MGKpXQMCW9CYvNwHFDjlu72LnL1TUjLSCVBiLS47ovwB 51t0NfafyVAu/YSjA0Tq8HK+n9bJk3vBAjqoVa7FjVEtwYzmSSWTzMvkBOU4guCI6vygr 31SsoRCnFEbIoXXFsHC1f3TSbi3/S2UeG0JmnqD9Zh7fTswCasqRPow6Q0LL5BEgIGgGI 5hxNHo0ByBmuGZQ9so5nWjNY7s8HSZi+nQGd6Egp6puBlJk8C6egnPDgkC0CzNblDFwRa 0LKtt6wHTBXEtJZY0MiGEO5nj1xURkGTc6r4wJvkO8ViWFqmcRTH8+BtTLdx6Rxz3KA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=kYyfTBML; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0FE8606A326 for ; Sat, 7 Nov 2026 10:44:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=kYyfTBML Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA5B01F0089F; Sat, 7 Nov 2026 10:44:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794048286; bh=eKofzCL9sjLIN1Ea1LlgqqQ8nQ1pePQujCYm1QWSExA=; h=From:To:Cc:Subject:Date; b=kYyfTBMLtDYXrQQTdFiuyoAE/DATgzV1REVrDaElS4aVq5O66mHXGjCzC+PhV7vDr n7BgBVVpqO2jHnV4DQt1sk9OCrEl+LyOvyrAh56+TvM6BUowk4RwOGx11lmEKtsQ6S kkXep2LbfagYjEiC/SNC3MHHtVlV+xTYIRudJCLVbyI5BDzC152ouizCnT5oMgdzKZ +Gif8uNpeUDKwyXpd/XHsnLUlMSzvlN1jClaKwIYs8u0MiTgZkTNPB3gQXEXXZTfPP KqYggCNUnNCpNP5PJcwAV/lXzmTai8SJyajyZfgH+HGGjBAWginABfhSm6XbPpTSOY KXUHQagKWu+UA== From: Sasha Levin To: xiqi2@huawei.com, akpm@linux-foundation.org, ziy@nvidia.com, brendan.jackman@linux.dev, hannes@cmpxchg.org, wangkefeng.wang@huawei.com, mhocko@suse.com, sunnanyong@huawei.com, surenb@google.com, vbabka@kernel.org Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] mm/page_isolation: guard compound_order() against racing" failed to apply to 6.1-stable tree Date: Sat, 7 Nov 2026 05:44:44 -0500 Message-ID: <20261107054444-failed-6.1-4c767c5dd9bc@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 4c767c5dd9bc3521fed11e6fe1d52621fe5abf7b # git commit -s git send-email --to '' --in-reply-to '20261107054444-failed-6.1-4c767c5dd9bc@kernel.org' --subject-prefix 'PATCH 6.1.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From 4c767c5dd9bc3521fed11e6fe1d52621fe5abf7b Mon Sep 17 00:00:00 2001 From: Qi Xi Date: Tue, 25 Aug 2026 20:05:49 +0800 Subject: [PATCH] mm/page_isolation: guard compound_order() against racing The PageCompound branch reads compound_head() without holding a reference. A racing split or free can cause compound_head() to return a stale pointer, and compound_nr() reads the order from that stale head, leading to out-of-range shifts and making the skip distance meaningless. Read the order explicitly with compound_order() and validate it is within MAX_FOLIO_ORDER before shifting. Also verify the derived head_pfn against the legitimate pfn: the head must not be past pfn, must be aligned to nr_pages, and pfn must fall within the compound page. Bail out with -EBUSY if any check fails. Link: https://lore.kernel.org/20260825120549.966271-3-xiqi2@huawei.com Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity") Signed-off-by: Qi Xi Signed-off-by: Andrew Morton Suggested-by: Zi Yan Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: Johannes Weiner Cc: Kefeng Wang Cc: Michal Hocko Cc: Nanyong Sun Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: --- mm/page_isolation.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/mm/page_isolation.c b/mm/page_isolation.c index e4ee998c00f3b..5aaad037384e4 100644 --- a/mm/page_isolation.c +++ b/mm/page_isolation.c @@ -419,10 +419,28 @@ static int isolate_single_pageblock(unsigned long boundary_pfn, if (PageCompound(page)) { struct page *head = compound_head(page); unsigned long head_pfn = page_to_pfn(head); - unsigned long nr_pages = compound_nr(head); + unsigned int order = compound_order(head); + unsigned long nr_pages; + + /* compound_order() is racy. Cap it at MAX_FOLIO_ORDER. */ + if (order > MAX_FOLIO_ORDER) + goto failed; + + nr_pages = 1UL << order; + + /* + * compound_head() is also racy, so the derived head_pfn + * needs additional checks to make sure it is valid. + * Otherwise, just fail the check. pfn comes from + * __first_valid_page() as a legitimate PFN, so use it to + * check head_pfn. + */ + if (head_pfn > pfn || !IS_ALIGNED(head_pfn, nr_pages) || + pfn - head_pfn >= nr_pages) + goto failed; if (head_pfn + nr_pages <= boundary_pfn || - PageHuge(page)) { + PageHuge(head)) { pfn = head_pfn + nr_pages; continue; } -- 2.53.0