Re: [PATCH v5] mm/hugetlb_cma: Fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

[Sourav Panda]

On Mon, Aug 10, 2026 at 3:36 PM Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> On Sun, 9 Aug 2026 23:39:22 -0700 Sourav Panda <souravpanda@xxxxxxxxxx> wrote:
>
> > > That way, we can remove the 'if (!page)' check here.
> >
> > Sure thing! Thanks! I shall send this tomorrow noon (PST) since I am
> > OOO starting Thursday.
>
> Sashiko said a thing - I don't think it reported this against previous
> iterations:
>         https://sashiko.dev/#/patchset/20260726072935.3513996-1-souravpanda@xxxxxxxxxx
>

Thanks Andrew!

Got the same response when I ran v6 against internal Shashiko. Sending v6 now.

> I'll add this v4->v5 update to mm-hotfixes-unstable, assuming it gets
> us a bit closer to the final version.
>
> --- a/mm/hugetlb_cma.c~mm-hugetlb_cma-fix-null-nodemask-dereference-in-hugetlb_cma_alloc_frozen_folio-v5
> +++ a/mm/hugetlb_cma.c
> @@ -3,6 +3,7 @@
>  #include <linux/mm.h>
>  #include <linux/cma.h>
>  #include <linux/compiler.h>
> +#include <linux/cpuset.h>
>  #include <linux/mm_inline.h>
>
>  #include <asm/page.h>
> @@ -30,12 +31,21 @@ struct folio *hugetlb_cma_alloc_frozen_f
>         int node;
>         struct folio *folio;
>         struct page *page = NULL;
> +       nodemask_t local_node_mask;
>
>         if (!hugetlb_cma_size)
>                 return NULL;
>
> -       if (!nodemask)
> -               nodemask = &node_states[N_MEMORY];
> +       if (!nodemask) {
> +               unsigned int cpuset_mems_cookie;
> +
> +               do {
> +                       cpuset_mems_cookie = read_mems_allowed_begin();
> +                       local_node_mask = cpuset_current_mems_allowed;
> +               } while (read_mems_allowed_retry(cpuset_mems_cookie));
> +
> +               nodemask = &local_node_mask;
> +       }
>
>         if (hugetlb_cma[nid] && node_isset(nid, *nodemask))
>                 page = cma_alloc_frozen_compound(hugetlb_cma[nid], order);
> _
>