raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 01:49:46 +00:00
Code Issues Projects Releases Wiki Activity
Files
03f159df3ef8ca33fa7692e132e0207c28ca2e4f
linux/mm
History
Vlastimil Babka 6a13b56537 mm/mempool: fix poisoning order>0 pages with HIGHMEM 
commit ec33b59542 upstream.

The kernel test has reported:

  BUG: unable to handle page fault for address: fffba000
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  *pde = 03171067 *pte = 00000000
  Oops: Oops: 0002 [#1]
  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE  a1d066dfe789f54bc7645c7989957d2bdee593ca
  Tainted: [T]=RANDSTRUCT
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)
  Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56
  EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b
  ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8
  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287
  CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690
  Call Trace:
   poison_element (mm/mempool.c:83 mm/mempool.c:102)
   mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)
   mempool_init_noprof (mm/mempool.c:250 (discriminator 1))
   ? mempool_alloc_pages (mm/mempool.c:640)
   bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))
   ? mempool_alloc_pages (mm/mempool.c:640)
   do_one_initcall (init/main.c:1283)

Christoph found out this is due to the poisoning code not dealing
properly with CONFIG_HIGHMEM because only the first page is mapped but
then the whole potentially high-order page is accessed.

We could give up on HIGHMEM here, but it's straightforward to fix this
with a loop that's mapping, poisoning or checking and unmapping
individual pages.

Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202511111411.9ebfa1ba-lkp@intel.com
Analyzed-by: Christoph Hellwig <hch@lst.de>
Fixes: bdfedb76f4 ("mm, mempool: poison elements backed by slab allocator")
Cc: stable@vger.kernel.org
Tested-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251113-mempool-poison-v1-1-233b3ef984c3@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-01 11:43:23 +01:00
..
damon
mm/damon/lru_sort: use param_ctx for damon_attrs staging
2025-10-19 16:33:58 +02:00
kasan
mm: introduce and use {pgd,p4d}_populate_kernel()
2025-09-19 16:35:42 +02:00
kfence
kfence: skip __GFP_THISNODE allocations on NUMA systems
2025-02-17 10:05:31 +01:00
kmsan
kmsan: fix out-of-bounds access to shadow memory
2025-10-02 13:44:14 +02:00
backing-dev.c
writeback: support retrieving per group debug writeback stats of bdi
2024-05-05 17:53:51 -07:00
balloon_compaction.c
mm: remove MIGRATE_SYNC_NO_COPY mode
2024-07-03 19:30:00 -07:00
bootmem_info.c
bootmem: use kmemleak_free_part_phys in put_page_bootmem
2023-10-25 16:47:13 -07:00
cma_debug.c
…
cma_sysfs.c
mm/cma: add sysfs file 'release_pages_success'
2024-02-22 10:24:57 -08:00
cma.c
mm/cma: add cma_{alloc,free}_folio()
2024-09-03 21:15:36 -07:00
cma.h
mm/cma: add sysfs file 'release_pages_success'
2024-02-22 10:24:57 -08:00
compaction.c
mm/compaction: fix bug in hugetlb handling pathway
2025-04-25 10:47:53 +02:00
debug_page_alloc.c
mm: page_alloc: consolidate free page accounting
2024-04-25 20:56:04 -07:00
debug_page_ref.c
…
debug_vm_pgtable.c
mm/debug_vm_pgtable: clear page table entries at destroy_args()
2025-08-28 16:31:05 +02:00
debug.c
mm: open-code page_folio() in dump_page()
2024-12-14 20:03:33 +01:00
dmapool_test.c
mm/dmapool: add MODULE_DESCRIPTION()
2024-07-03 19:29:58 -07:00
dmapool.c
mm/mempool/dmapool: remove CONFIG_DEBUG_SLAB ifdefs
2023-12-05 11:17:58 +01:00
early_ioremap.c
…
execmem.c
mm/execmem, arch: convert remaining overrides of module_alloc to execmem
2024-05-14 00:31:43 -07:00
fadvise.c
introduce fd_file(), convert all accessors to it.
2024-08-12 22:00:43 -04:00
fail_page_alloc.c
fault-inject: improve build for CONFIG_FAULT_INJECTION=n
2024-09-01 20:43:33 -07:00
failslab.c
fault-inject: improve build for CONFIG_FAULT_INJECTION=n
2024-09-01 20:43:33 -07:00
filemap.c
mm/memory: do not populate page table entries beyond i_size
2025-11-24 10:36:07 +01:00
folio-compat.c
mm: remove putback_lru_page()
2024-09-09 16:38:59 -07:00
gup_test.c
…
gup_test.h
…
gup.c
mm: folio_may_be_lru_cached() unless folio_test_large()
2025-10-02 13:44:11 +02:00
highmem.c
mm/highmem: make nr_free_highpages() return "unsigned long"
2024-07-03 19:30:06 -07:00
hmm.c
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
2025-08-15 12:14:13 +02:00
huge_memory.c
mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
2025-11-24 10:36:07 +01:00
hugetlb_cgroup.c
mm: memcg: don't call propagate_protected_usage() needlessly
2024-09-01 20:25:50 -07:00
hugetlb_vmemmap.c
mm/hugetlb_vmemmap: don't synchronize_rcu() without HVO
2024-09-01 20:25:45 -07:00
hugetlb_vmemmap.h
mm: hugetlb_vmemmap: fix reference to nonexistent file
2023-10-25 16:47:14 -07:00
hugetlb.c
mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
2025-10-19 16:33:58 +02:00
hwpoison-inject.c
mm/hwpoison: add MODULE_DESCRIPTION()
2024-07-03 19:29:58 -07:00
init-mm.c
mm: Deprecate pasid field
2023-12-12 10:11:32 +01:00
internal.h
mm: fix folio_pte_batch() on XEN PV
2025-05-18 08:24:51 +02:00
interval_tree.c
…
io-mapping.c
…
ioremap.c
mm: ioremap: remove unneeded ioremap_allowed and iounmap_allowed
2023-08-18 10:12:36 -07:00
Kconfig
Disable SLUB_TINY for build testing
2025-09-19 16:35:48 +02:00
Kconfig.debug
slub: Introduce CONFIG_SLUB_RCU_DEBUG
2024-08-27 14:12:51 +02:00
khugepaged.c
mm/khugepaged: fix the address passed to notifier on testing young
2025-09-19 16:35:46 +02:00
kmemleak.c
mm: fix possible deadlock in kmemleak
2025-09-09 18:58:16 +02:00
ksm.c
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
2025-11-24 10:35:59 +01:00
list_lru.c
mm: list_lru: fix UAF for memory cgroup
2024-08-07 18:33:56 -07:00
maccess.c
…
madvise.c
mm: close theoretical race where stale TLB entries could linger
2025-06-27 11:11:38 +01:00
Makefile
mm: introduce numa_emulation
2024-09-03 21:15:31 -07:00
mapping_dirty_helpers.c
mm: fix clean_record_shared_mapping_range kernel-doc
2023-08-24 16:20:30 -07:00
memblock.c
memblock: Accept allocated memory before use in memblock_double_array()
2025-05-18 08:24:54 +02:00
memcontrol-v1.c
mm/thp: fix deferred split unqueue naming and locking
2024-11-05 16:49:54 -08:00
memcontrol-v1.h
mm: memcg: declare do_memsw_account inline
2024-12-14 20:03:33 +01:00
memcontrol.c
memcg: always call cond_resched() after fn()
2025-05-29 11:03:22 +02:00
memfd.c
mm: reinstate ability to map write-sealed memfd mappings read-only
2025-01-09 13:33:54 +01:00
memory_hotplug.c
mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper
2025-04-20 10:15:50 +02:00
memory-failure.c
mm/memory-failure: fix redundant updates for already poisoned pages
2025-09-19 16:35:46 +02:00
memory-tiers.c
memory tiers: use default_dram_perf_ref_source in log message
2024-09-26 14:01:44 -07:00
memory.c
mm/memory: do not populate page table entries beyond i_size
2025-11-24 10:36:07 +01:00
mempolicy.c
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
2024-12-14 20:03:32 +01:00
mempool.c
mm/mempool: fix poisoning order>0 pages with HIGHMEM
2025-12-01 11:43:23 +01:00
memremap.c
mm: convert put_devmap_managed_page_refs() to put_devmap_managed_folio_refs()
2024-05-05 17:53:49 -07:00
memtest.c
memtest: use {READ,WRITE}_ONCE in memory scanning
2024-03-13 12:12:21 -07:00
migrate_device.c
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
2025-02-27 04:30:22 -08:00
migrate.c
mm: prevent poison consumption when splitting THP
2025-10-29 14:08:57 +01:00
mincore.c
mm: provide mm_struct and address to huge_ptep_get()
2024-07-12 15:52:15 -07:00
mlock.c
mm: folio_may_be_lru_cached() unless folio_test_large()
2025-10-02 13:44:11 +02:00
mm_init.c
mm/mm_init: fix hash table order logging in alloc_large_system_hash()
2025-11-24 10:36:00 +01:00
mm_slot.h
…
mmap_lock.c
mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer
2024-07-03 19:30:26 -07:00
mmap.c
mm: reinstate ability to map write-sealed memfd mappings read-only
2025-01-09 13:33:54 +01:00
mmu_gather.c
mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing
2024-02-22 15:27:17 -08:00
mmu_notifier.c
mm: move internal core VMA manipulation functions to own file
2024-09-01 20:25:54 -07:00
mmzone.c
mm: improve code consistency with zonelist_* helper functions
2024-09-01 20:25:55 -07:00
mprotect.c
mm: refactor map_deny_write_exec()
2024-11-05 16:49:55 -08:00
mremap.c
mm/mremap: correctly handle partial mremap() of VMA starting at 0
2025-04-20 10:15:49 +02:00
mseal.c
Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2024-09-21 07:29:05 -07:00
msync.c
…
nommu.c
nommu: pass NULL argument to vma_iter_prealloc()
2024-11-11 17:20:23 -08:00
numa_emulation.c
mm: introduce numa_emulation
2024-09-03 21:15:31 -07:00
numa_memblks.c
mm: numa_clear_kernel_node_hotplug: Add NUMA_NO_NODE check for node id
2024-10-28 21:40:40 -07:00
numa.c
mm: make range-to-target_node lookup facility a part of numa_memblks
2024-09-03 21:15:32 -07:00
oom_kill.c
memcg: fix soft lockup in the OOM process
2025-02-08 09:58:19 +01:00
page_alloc.c
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
2025-10-19 16:33:58 +02:00
page_counter.c
mm, memcg: cg2 memory{.swap,}.peak write handlers
2024-09-01 20:25:53 -07:00
page_ext.c
mm: don't account memmap per-node
2024-08-15 22:16:14 -07:00
page_idle.c
…
page_io.c
mm: count zeromap read and set for swapout and swapin
2024-11-11 00:00:37 -08:00
page_isolation.c
mm/hugetlb: wait for hugetlb folios to be freed
2025-03-22 12:54:28 -07:00
page_owner.c
mm/page-owner: use gfp_nested_mask() instead of open coded masking
2024-05-19 14:40:44 -07:00
page_poison.c
mm/page_poison: replace kmap_atomic() with kmap_local_page()
2023-12-10 16:51:50 -08:00
page_reporting.c
mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER
2024-01-08 15:27:15 -08:00
page_reporting.h
…
page_table_check.c
mm/page_table_check: fix crash on ZONE_DEVICE
2024-06-15 10:43:04 -07:00
page_vma_mapped.c
mm: make page_mapped_in_vma() hugetlb walk aware
2025-04-20 10:15:49 +02:00
page-writeback.c
mm: fix ratelimit_pages update error in dirty_ratio_handler()
2025-06-27 11:11:22 +01:00
pagewalk.c
mm/pagewalk: fix usage of pmd_leaf()/pud_leaf() without present check
2024-10-28 21:40:38 -07:00
percpu-internal.h
mm: remove CONFIG_MEMCG_KMEM
2024-07-10 12:14:54 -07:00
percpu-km.c
…
percpu-stats.c
…
percpu-vm.c
percpu: clean up all mappings when pcpu_map_pages() fails
2024-04-25 20:55:49 -07:00
percpu.c
mm, percpu: do not consider sleepable allocations atomic
2025-11-24 10:36:05 +01:00
pgalloc-track.h
…
pgtable-generic.c
mm: fix race between __split_huge_pmd_locked() and GUP-fast
2024-05-07 10:37:00 -07:00
process_vm_access.c
mm: fix process_vm_rw page counts
2023-12-10 16:51:39 -08:00
ptdump.c
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
2025-08-20 18:30:55 +02:00
readahead.c
mm/readahead: fix large folio support in async readahead
2025-01-09 13:33:54 +01:00
rmap.c
mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
2025-04-20 10:15:49 +02:00
rodata_test.c
…
secretmem.c
mm/secretmem: fix use-after-free race in fault handler
2025-11-24 10:36:07 +01:00
shmem_quota.c
shmem_quota: build the object file conditionally to the config option
2024-09-01 20:25:45 -07:00
shmem.c
shmem: fix tmpfs reconfiguration (remount) when noswap is set
2025-12-01 11:43:21 +01:00
show_mem.c
mm/show_mem.c: report alloc tags in human readable units
2024-09-17 01:07:00 -07:00
shrinker_debug.c
mm: shrinker: use min() to improve shrinker_debugfs_scan_write()
2024-09-03 21:15:40 -07:00
shrinker.c
mm: shrinker: avoid memleak in alloc_shrinker_info
2024-10-31 20:27:04 -07:00
shuffle.c
…
shuffle.h
mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER
2024-01-08 15:27:15 -08:00
slab_common.c
slab: Fix too strict alignment check in create_cache()
2024-12-09 10:41:07 +01:00
slab.h
slab: prevent warnings when slab obj_exts vector allocation fails
2025-10-19 16:33:57 +02:00
slub.c
codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext
2025-11-24 10:36:01 +01:00
sparse-vmemmap.c
mm: introduce and use {pgd,p4d}_populate_kernel()
2025-09-19 16:35:42 +02:00
sparse.c
mm: fix accounting of memmap pages
2025-09-09 18:58:22 +02:00
swap_cgroup.c
mm: attempt to batch free swap entries for zap_pte_range()
2024-09-03 21:15:33 -07:00
swap_slots.c
mm: swap: update get_swap_pages() to take folio order
2024-04-25 20:56:37 -07:00
swap_state.c
mm: add nr argument in mem_cgroup_swapin_uncharge_swap() helper to support large folios
2024-09-17 01:07:01 -07:00
swap.c
mm: folio_may_be_lru_cached() unless folio_test_large()
2025-10-02 13:44:11 +02:00
swap.h
mm: fix swap_read_folio_zeromap() for large folios with partial zeromap
2024-09-17 01:07:01 -07:00
swapfile.c
mm: swap: check for stable address space before operating on the VMA
2025-10-06 11:17:52 +02:00
truncate.c
mm/truncate: unmap large folio on split failure
2025-11-24 10:36:07 +01:00
usercopy.c
…
userfaultfd.c
mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
2025-09-09 18:58:15 +02:00
util.c
mm: only enforce minimum stack gap size if it's sensible
2024-09-01 20:26:02 -07:00
vma_internal.h
mm/hugetlb: unshare page tables during VMA split, not before
2025-06-27 11:11:40 +01:00
vma.c
mm/vma: reset VMA iterator on commit_merge() OOM failure
2025-07-06 11:01:48 +02:00
vma.h
mm/vma: add give_up_on_oom option on modify/merge, use in uffd release
2025-04-25 10:48:06 +02:00
vmalloc.c
mm/vmalloc: leave lazy MMU mode on PTE mapping error
2025-07-17 18:37:14 +02:00
vmpressure.c
eventfd: simplify eventfd_signal()
2023-11-28 14:08:38 +01:00
vmscan.c
mm: revert "mm: vmscan.c: fix OOM on swap stress test"
2025-09-25 11:13:45 +02:00
vmstat.c
vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
2024-12-09 10:41:01 +01:00
workingset.c
cachestat: do not flush stats in recency check
2024-07-03 22:40:37 -07:00
z3fold.c
mm/z3fold: add __percpu annotation to *unbuddied pointer in struct z3fold_pool
2024-09-01 20:25:56 -07:00
zbud.c
mm: zpool: return pool size in pages
2024-04-25 20:55:48 -07:00
zpool.c
mm: zpool: return pool size in pages
2024-04-25 20:55:48 -07:00
zsmalloc.c
mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
2025-08-01 09:48:44 +01:00
zswap.c
mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
2025-04-10 14:39:40 +02:00