Re: [PATCH v3] mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access

[Zi Yan]

On Mon Jun 22, 2026 at 5:18 PM EDT, Ketan wrote:
> The page_ext iteration API does not validate if the PFN still
> belongs to a valid section while advancing the iterator. When
> dynamically adding memory in the hotplug path, it can lead to a
> NULL pointer dereference during page_ext_lookup at the boundary
> of the last valid section when iterator count equals __pgcount.
>
> The for_each_page_ext() macro calls page_ext_iter_next() as its
> loop increment. for_each_page_ext() does a
> "__page_ext = page_ext_iter_next(&__iter)" at the end. This
> causes page_ext_iter_next() to increment iter->index past
> __pgcount and call page_ext_lookup(start_pfn + __pgcount).
> During memory hotplug (online), the PFN at start_pfn + __pgcount
> may belong to a section that has not yet been initialized,
> causing page_ext_lookup() to trigger a NULL pointer dereference.
>
> [   14.555124][  T846] Call trace:
> [   14.555125][  T846]  lookup_page_ext+0x6c/0x108 (P)
> [   14.555127][  T846]  page_ext_lookup+0x30/0x3c
> [   14.555129][  T846]  __reset_page_owner+0x11c/0x260
> [   14.571201][  T846]  __free_pages_ok+0x5e8/0x8e0
> [   14.571204][  T846]  __free_pages_core+0x78/0xf0
> [   14.571206][  T846]  generic_online_page+0x14/0x24
> [   14.597782][  T846]  online_pages+0x178/0x30c
> [   14.597784][  T846]  memory_block_change_state+0x284/0x32c
> [   14.597787][  T846]  memory_subsys_online+0x4c/0x64
> [   14.597789][  T846]  device_online+0x88/0xb0
> [   14.597791][  T846]  online_memory_block+0x30/0x40
> [   14.597793][  T846]  walk_memory_blocks+0xac/0xe8
> [   14.597794][  T846]  add_memory_resource+0x280/0x298
> [   14.656161][  T846]  add_memory+0x60/0x98
>
> Move the iteration boundary enforcement inside the iterator
> functions, so callers cannot inadvertently access beyond the
> requested range.
>
> Fixes: 9039b9096ea2 ("mm: page_owner: use new iteration API")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: David Hildenbrand <david@xxxxxxxxxx>
> Suggested-by: Matthew Wilcox <willy@xxxxxxxxxxxxx>
> Signed-off-by: Ketan Kishore <ketan.kishore@xxxxxxxxxxxxxxxx>
> Tested-by: syzbot@xxxxxxxxxxxxxxxxxxxxxxxxx
This is probably not needed.
> ---
> Changes in v3:
> - Fix the iter->index++ increment to pre increment(++iter->index)
> - modify the (count == 0) check to (!count)
> - Link to v2: https://patch.msgid.link/20260622-page_ext-v2-1-135d4cfbc42f@xxxxxxxxxxxxxxxx
>
> Changes in v2:
> - Incorporated comments from David and Matthew to check for invalid PFN
>   in page_ext iterator rather than checking for NULL section in
>   page_ext_lookup.
> - Minor improvement in commit description to include the issue with
>   page_ext_iter_next
> - Link to v1: https://patch.msgid.link/20260617-page_ext-v1-1-37ad802b1a38@xxxxxxxxxxxxxxxx
>
> To: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> To: David Hildenbrand <david@xxxxxxxxxx>
> To: Lorenzo Stoakes <ljs@xxxxxxxxxx>
> To: "Liam R. Howlett" <liam@xxxxxxxxxxxxx>
> To: Vlastimil Babka <vbabka@xxxxxxxxxx>
> To: Mike Rapoport <rppt@xxxxxxxxxx>
> To: Suren Baghdasaryan <surenb@xxxxxxxxxx>
> To: Michal Hocko <mhocko@xxxxxxxx>
> To: Luiz Capitulino <luizcap@xxxxxxxxxx>
> Cc: kernel@xxxxxxxxxxxxxxxx
> Cc: linux-mm@xxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx
> ---
>  include/linux/page_ext.h | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)
>

LGTM.
Acked-by: Zi Yan <ziy@xxxxxxxxxx>


-- 
Best Regards,
Yan, Zi