raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 01:49:46 +00:00
Code Issues Projects Releases Wiki Activity
Files
359e196aee83d26c9745a639e5553160a61f9890
linux/mm
History
Vlastimil Babka a79e49e170 mm/mempool: fix poisoning order>0 pages with HIGHMEM 
commit ec33b59542 upstream.

The kernel test has reported:

  BUG: unable to handle page fault for address: fffba000
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  *pde = 03171067 *pte = 00000000
  Oops: Oops: 0002 [#1]
  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE  a1d066dfe789f54bc7645c7989957d2bdee593ca
  Tainted: [T]=RANDSTRUCT
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)
  Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56
  EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b
  ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8
  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287
  CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690
  Call Trace:
   poison_element (mm/mempool.c:83 mm/mempool.c:102)
   mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)
   mempool_init_noprof (mm/mempool.c:250 (discriminator 1))
   ? mempool_alloc_pages (mm/mempool.c:640)
   bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))
   ? mempool_alloc_pages (mm/mempool.c:640)
   do_one_initcall (init/main.c:1283)

Christoph found out this is due to the poisoning code not dealing
properly with CONFIG_HIGHMEM because only the first page is mapped but
then the whole potentially high-order page is accessed.

We could give up on HIGHMEM here, but it's straightforward to fix this
with a loop that's mapping, poisoning or checking and unmapping
individual pages.

Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202511111411.9ebfa1ba-lkp@intel.com
Analyzed-by: Christoph Hellwig <hch@lst.de>
Fixes: bdfedb76f4 ("mm, mempool: poison elements backed by slab allocator")
Cc: stable@vger.kernel.org
Tested-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251113-mempool-poison-v1-1-233b3ef984c3@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-01 11:45:41 +01:00
..
damon
mm/damon/stat: change last_refresh_jiffies to a global variable
2025-11-24 10:37:44 +01:00
kasan
mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
2025-09-08 23:45:11 -07:00
kfence
kfence: Remove mention of PG_slab
2025-07-23 11:55:22 +02:00
kmsan
mm/kmsan: fix kmsan kmalloc hook when no stack depots are allocated yet
2025-11-24 10:37:44 +01:00
backing-dev.c
treewide: Switch/rename to timer_delete[_sync]()
2025-04-05 10:30:12 +02:00
balloon_compaction.c
mm/migrate: fix NULL movable_ops if CONFIG_ZSMALLOC=m
2025-08-19 16:35:57 -07:00
bootmem_info.c
mm/sparse: allow for alternate vmemmap section init at boot
2025-03-16 22:06:27 -07:00
cma_debug.c
mm: cma: simplify cma_maxchunk_get()
2025-07-24 19:12:36 -07:00
cma_sysfs.c
mm/cma: export total and free number of pages for CMA areas
2025-03-16 22:06:24 -07:00
cma.c
mm: cma: simplify cma_debug_show_areas()
2025-07-24 19:12:36 -07:00
cma.h
mm: cma: set early_pfn and bitmap as a union in cma_memrange
2025-05-22 14:55:36 -07:00
compaction.c
mm: rename PG_isolated to PG_movable_ops_isolated
2025-07-13 16:38:30 -07:00
debug_page_alloc.c
mm/debug_page_alloc: improve error message for invalid guardpage minorder
2025-05-12 23:50:38 -07:00
debug_page_ref.c
…
debug_vm_pgtable.c
mm/debug_vm_pgtable: clear page table entries at destroy_args()
2025-08-19 16:35:54 -07:00
debug.c
mm/util: introduce snapshot_page()
2025-07-24 19:12:35 -07:00
dmapool_test.c
mm/dmapool: add MODULE_DESCRIPTION()
2024-07-03 19:29:58 -07:00
dmapool.c
docs: dma-api: replace consistent with coherent
2025-07-01 13:25:36 -06:00
early_ioremap.c
mm/early_ioremap: add null pointer checks to prevent NULL-pointer dereference
2025-01-13 22:40:59 -08:00
execmem.c
mm: correct type for vmalloc vm_flags fields
2025-08-02 12:06:13 -07:00
fadvise.c
fdget(), trivial conversions
2024-11-03 01:28:06 -05:00
fail_page_alloc.c
fault-inject: improve build for CONFIG_FAULT_INJECTION=n
2024-09-01 20:43:33 -07:00
failslab.c
fault-inject: improve build for CONFIG_FAULT_INJECTION=n
2024-09-01 20:43:33 -07:00
filemap.c
mm/memory: do not populate page table entries beyond i_size
2025-11-24 10:37:50 +01:00
folio-compat.c
mm: Remove grab_cache_page_write_begin()
2025-03-04 17:02:25 +00:00
gup_test.c
…
gup_test.h
…
gup.c
mm: folio_may_be_lru_cached() unless folio_test_large()
2025-09-13 13:05:36 -07:00
highmem.c
mm/highmem: make nr_free_highpages() return "unsigned long"
2024-07-03 19:30:06 -07:00
hmm.c
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
2025-07-19 18:59:53 -07:00
huge_memory.c
mm/huge_memory: do not change split_huge_page*() target order silently
2025-11-24 10:37:50 +01:00
hugetlb_cgroup.c
page_counter: track failcnt only for legacy cgroups
2025-03-17 00:05:35 -07:00
hugetlb_cma.c
mm/hugetlb: use separate nodemask for bootmem allocations
2025-05-12 23:50:35 -07:00
hugetlb_cma.h
mm/hugetlb: move hugetlb CMA code in to its own file
2025-03-16 22:06:31 -07:00
hugetlb_vmemmap.c
mm/pagewalk: split walk_page_range_novma() into kernel/user parts
2025-07-09 22:42:05 -07:00
hugetlb_vmemmap.h
mm/hugetlb: do pre-HVO for bootmem allocated pages
2025-03-16 22:06:29 -07:00
hugetlb.c
mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
2025-10-19 16:37:38 +02:00
hwpoison-inject.c
mm/hwpoison: add MODULE_DESCRIPTION()
2024-07-03 19:29:58 -07:00
init-mm.c
mm: replace vm_lock and detached flag with a reference count
2025-03-16 22:06:20 -07:00
internal.h
Merge tag 'mm-stable-2025-08-03-12-35' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-08-05 16:02:07 +03:00
interval_tree.c
…
ioremap.c
mm/ioremap: pass pgprot_t to ioremap_prot() instead of unsigned long
2025-03-16 22:06:23 -07:00
Kconfig
mm: remove mm/io-mapping.c
2025-08-02 12:06:10 -07:00
Kconfig.debug
mm: rename GENERIC_PTDUMP and PTDUMP_CORE
2025-03-17 00:05:32 -07:00
khugepaged.c
mm/khugepaged: fix the address passed to notifier on testing young
2025-09-03 17:10:35 -07:00
kmemleak.c
mm: fix possible deadlock in kmemleak
2025-09-01 17:11:37 -07:00
ksm.c
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
2025-11-24 10:37:42 +01:00
list_lru.c
mm, list_lru: refactor the locking code
2025-07-09 22:41:56 -07:00
maccess.c
mm: unexport globally copy_to_kernel_nofault
2025-07-09 22:42:22 -07:00
madvise.c
mm/mseal: small cleanups
2025-08-02 12:06:09 -07:00
Makefile
mm: remove mm/io-mapping.c
2025-08-02 12:06:10 -07:00
mapping_dirty_helpers.c
mm: remove redundant pXd_devmap calls
2025-07-09 22:42:17 -07:00
memblock.c
memblock: fix kernel-doc for MEMBLOCK_RSRV_NOINIT
2025-08-26 10:47:03 +03:00
memcontrol-v1.c
memcg: make count_memcg_events re-entrant safe against irqs
2025-05-22 14:55:38 -07:00
memcontrol-v1.h
memcg: move do_memsw_account() to CONFIG_MEMCG_V1
2025-03-21 22:03:11 -07:00
memcontrol.c
memcg: skip cgroup_file_notify if spinning is not allowed
2025-10-19 16:37:00 +02:00
memfd.c
mm/memfd: replace deprecated strcpy() with memcpy() in alloc_name()
2025-07-19 18:59:57 -07:00
memory_hotplug.c
mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range()
2025-09-03 17:10:35 -07:00
memory-failure.c
mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
2025-09-08 23:45:11 -07:00
memory-tiers.c
mm,memory-tiers: use node-notifier instead of memory-notifier
2025-07-13 16:38:15 -07:00
memory.c
mm/memory: do not populate page table entries beyond i_size
2025-11-24 10:37:50 +01:00
mempolicy.c
mm: split folio_pte_batch() into folio_pte_batch() and folio_pte_batch_flags()
2025-07-19 18:59:45 -07:00
mempool.c
mm/mempool: fix poisoning order>0 pages with HIGHMEM
2025-12-01 11:45:41 +01:00
memremap.c
mm/page_alloc: add support for initializing pageblock as isolated
2025-07-13 16:38:17 -07:00
memtest.c
memtest: use {READ,WRITE}_ONCE in memory scanning
2024-03-13 12:12:21 -07:00
migrate_device.c
treewide: remove MIGRATEPAGE_SUCCESS
2025-10-29 14:10:32 +01:00
migrate.c
treewide: remove MIGRATEPAGE_SUCCESS
2025-10-29 14:10:32 +01:00
mincore.c
mm/mincore: hold PTL in mincore_hugetlb
2025-08-02 12:06:10 -07:00
mlock.c
mm: folio_may_be_lru_cached() unless folio_test_large()
2025-09-13 13:05:36 -07:00
mm_init.c
mm/mm_init: fix hash table order logging in alloc_large_system_hash()
2025-11-24 10:37:44 +01:00
mm_slot.h
…
mmap_lock.c
mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped
2025-08-02 12:06:11 -07:00
mmap.c
Merge tag 'mm-stable-2025-07-30-15-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-07-31 14:57:54 -07:00
mmu_gather.c
mmu_gather: move tlb flush for VM_PFNMAP/VM_MIXEDMAP vmas into free_pgtables()
2025-05-31 22:46:12 -07:00
mmu_notifier.c
Update Christoph's Email address and make it consistent
2025-05-12 23:50:31 -07:00
mmzone.c
mm: improve code consistency with zonelist_* helper functions
2024-09-01 20:25:55 -07:00
mprotect.c
mm: pass page directly instead of using folio_page
2025-08-11 23:00:59 -07:00
mremap.c
mm/mremap: honour writable bit in mremap pte batching
2025-11-24 10:37:44 +01:00
mseal.c
mm/mseal: rework mseal apply logic
2025-08-02 12:06:09 -07:00
msync.c
…
nommu.c
Merge tag 'mm-stable-2025-08-03-12-35' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-08-05 16:02:07 +03:00
numa_emulation.c
mm: numa,memblock: Use SZ_1M macro to denote bytes to MB conversion
2025-08-20 16:31:23 +03:00
numa_memblks.c
mm: numa,memblock: Use SZ_1M macro to denote bytes to MB conversion
2025-08-20 16:31:23 +03:00
numa.c
mm/numa: remove unnecessary local variable in alloc_node_data()
2025-05-12 23:50:38 -07:00
oom_kill.c
mm/oom_kill: fix trivial typo in comment
2025-03-16 22:05:55 -07:00
page_alloc.c
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
2025-10-19 16:37:38 +02:00
page_counter.c
page_counter: track failcnt only for legacy cgroups
2025-03-17 00:05:35 -07:00
page_ext.c
mm,page_ext: derive the node from the pfn
2025-07-13 16:38:16 -07:00
page_frag_cache.c
mm/page_alloc: export free_frozen_pages() instead of free_unref_page()
2025-01-13 22:40:31 -08:00
page_idle.c
sysfs: treewide: switch back to attribute_group::bin_attrs
2025-06-17 10:44:15 +02:00
page_io.c
mm: stop passing a writeback_control structure to swap_writeout
2025-07-09 22:41:58 -07:00
page_isolation.c
mm/page_isolation: drop __folio_test_movable() check for large folios
2025-07-13 16:38:29 -07:00
page_owner.c
mm: don't spin in add_stack_record when gfp flags don't allow
2025-10-29 14:10:21 +01:00
page_poison.c
…
page_reporting.c
mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER
2024-01-08 15:27:15 -08:00
page_reporting.h
…
page_table_check.c
mm/page_table_check: Batch-check pmds/puds just like ptes
2025-05-09 13:43:07 +01:00
page_vma_mapped.c
mm: remove redundant pXd_devmap calls
2025-07-09 22:42:17 -07:00
page-writeback.c
mm, vmstat: remove the NR_WRITEBACK_TEMP node_stat_item counter
2025-07-19 18:59:47 -07:00
pagewalk.c
mm: remove redundant pXd_devmap calls
2025-07-09 22:42:17 -07:00
percpu-internal.h
mm: remove CONFIG_MEMCG_KMEM
2024-07-10 12:14:54 -07:00
percpu-km.c
…
percpu-stats.c
mm: remove outdated filename comment in percpu-stats.c
2025-07-13 16:38:23 -07:00
percpu-vm.c
percpu: clean up all mappings when pcpu_map_pages() fails
2024-04-25 20:55:49 -07:00
percpu.c
percpu: fix race on alloc failed warning limit
2025-09-08 23:45:10 -07:00
pgalloc-track.h
…
pgtable-generic.c
mm: remove redundant pXd_devmap calls
2025-07-09 22:42:17 -07:00
process_vm_access.c
mm: refactor mm_access() to not return NULL
2024-11-05 16:56:23 -08:00
pt_reclaim.c
mm: pgtable: reclaim empty PTE page in madvise(MADV_DONTNEED)
2025-01-13 22:40:48 -08:00
ptdump.c
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
2025-07-09 22:42:20 -07:00
readahead.c
readahead: use folio_nr_pages() instead of shift operation
2025-07-19 18:59:53 -07:00
rmap.c
mm: add get_and_clear_ptes() and clear_ptes()
2025-08-02 12:06:10 -07:00
rodata_test.c
mm/rodata_test: verify test data is unchanged, rather than non-zero
2025-01-13 22:40:38 -08:00
secretmem.c
mm/secretmem: fix use-after-free race in fault handler
2025-11-24 10:37:43 +01:00
shmem_quota.c
shmem_quota: build the object file conditionally to the config option
2024-09-01 20:25:45 -07:00
shmem.c
shmem: fix tmpfs reconfiguration (remount) when noswap is set
2025-12-01 11:45:36 +01:00
show_mem.c
mm, vmstat: remove the NR_WRITEBACK_TEMP node_stat_item counter
2025-07-19 18:59:47 -07:00
shrinker_debug.c
mm/shrinker: fix name consistency issue in shrinker_debugfs_rename()
2025-03-17 00:05:40 -07:00
shrinker.c
mm: shrinker: avoid memleak in alloc_shrinker_info
2024-10-31 20:27:04 -07:00
shuffle.c
…
shuffle.h
mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER
2024-01-08 15:27:15 -08:00
slab_common.c
Update Christoph's Email address and make it consistent
2025-05-12 23:50:31 -07:00
slab.h
slab: prevent warnings when slab obj_exts vector allocation fails
2025-10-19 16:37:37 +02:00
slub.c
codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext
2025-11-24 10:37:45 +01:00
sparse-vmemmap.c
mm: introduce and use {pgd,p4d}_populate_kernel()
2025-08-27 22:45:44 -07:00
sparse.c
mm: fix accounting of memmap pages
2025-08-27 22:45:43 -07:00
swap_cgroup.c
mm: swap_cgroup: remove double initialization of locals
2025-03-17 22:06:58 -07:00
swap_state.c
mm, swap: fix potential UAF issue for VMA readahead
2025-11-24 10:37:44 +01:00
swap.c
mm: folio_may_be_lru_cached() unless folio_test_large()
2025-09-13 13:05:36 -07:00
swap.h
mm: stop passing a writeback_control structure to swap_writeout
2025-07-09 22:41:58 -07:00
swapfile.c
mm: swap: check for stable address space before operating on the VMA
2025-10-06 11:20:05 +02:00
truncate.c
mm/huge_memory: do not change split_huge_page*() target order silently
2025-11-24 10:37:50 +01:00
usercopy.c
mm: security: Check early if HARDENED_USERCOPY is enabled
2025-02-28 11:51:31 -08:00
userfaultfd.c
mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
2025-08-27 22:45:41 -07:00
util.c
fsnotify: pass correct offset to fsnotify_mmap_perm()
2025-10-19 16:37:25 +02:00
vma_exec.c
mm/vma: use vmg->target to specify target VMA for new VMA merge
2025-07-09 22:42:11 -07:00
vma_init.c
mm: convert VM_PFNMAP tracking to pfnmap_track() + pfnmap_untrack()
2025-05-22 14:55:37 -07:00
vma_internal.h
mm/vma: move brk() internals to mm/vma.c
2025-01-13 22:40:42 -08:00
vma.c
Merge tag 'mm-stable-2025-08-03-12-35' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-08-05 16:02:07 +03:00
vma.h
mm/mseal: small cleanups
2025-08-02 12:06:09 -07:00
vmalloc.c
mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
2025-09-08 23:45:11 -07:00
vmpressure.c
memcg: convert memcg->socket_pressure to u64
2025-07-24 19:12:32 -07:00
vmscan.c
mm: revert "mm: vmscan.c: fix OOM on swap stress test"
2025-09-13 13:05:36 -07:00
vmstat.c
mm, vmstat: remove the NR_WRITEBACK_TEMP node_stat_item counter
2025-07-19 18:59:47 -07:00
workingset.c
mm: workingset: simplify lockdep check in update_node
2025-05-12 23:50:44 -07:00
zpdesc.h
mm: convert "movable" flag in page->mapping to a page flag
2025-07-13 16:38:30 -07:00
zpool.c
zsmalloc: prefer the the original page's node for compressed data
2025-05-11 17:48:06 -07:00
zsmalloc.c
treewide: remove MIGRATEPAGE_SUCCESS
2025-10-29 14:10:32 +01:00
zswap.c
mm: stop passing a writeback_control structure to __swap_writepage
2025-07-09 22:41:57 -07:00