Re: [PATCH v5 8/9] mm/page_owner: clamp skip_buddy_pages() PFN advance at MAX_ORDER_NR_PAGES boundary

[Zi Yan]

On 1 Jul 2026, at 2:10, Ye Liu wrote:

> The lockless buddy_order_unsafe() read can return a garbage order
> value if the page is concurrently allocated between the PageBuddy
> check and the private read.  If this bogus order is <= MAX_PAGE_ORDER,
> skip_buddy_pages() would arbitrarily advance the PFN, potentially
> jumping past a MAX_ORDER_NR_PAGES boundary whose pfn_valid() check
> would have caught an offline memory section.
>
> In read_page_owner(), which relies solely on boundary-aligned
> pfn_valid() to guard pfn_to_page(), skipping the boundary could
> cause pfn_to_page() to access an unmapped mem_section.
>
> Clamp the advance so it never crosses the next MAX_ORDER_NR_PAGES
> boundary.  This is safe for all three callers: the pageblock-iterating
> ones already handle boundary transitions in their outer loops, and
> for read_page_owner() the worst case is one extra PageBuddy check per
> 1024 pages for a huge buddy block straddling the boundary.

Like Vlastimil said, a buddy block cannot straddling the boundary.
__find_buddy_pfn() prevents that.

>
> Signed-off-by: Ye Liu <ye.liu@xxxxxxxxx>
> ---
>  mm/page_owner.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
>
Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>

Best Regards,
Yan, Zi