Re: [PATCH v3] mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access

[David Hildenbrand (Arm)]

On 6/23/26 01:27, Zi Yan wrote:
> On Mon Jun 22, 2026 at 5:18 PM EDT, Ketan wrote:
>> The page_ext iteration API does not validate if the PFN still
>> belongs to a valid section while advancing the iterator. When
>> dynamically adding memory in the hotplug path, it can lead to a
>> NULL pointer dereference during page_ext_lookup at the boundary
>> of the last valid section when iterator count equals __pgcount.
>>
>> The for_each_page_ext() macro calls page_ext_iter_next() as its
>> loop increment. for_each_page_ext() does a
>> "__page_ext = page_ext_iter_next(&__iter)" at the end. This
>> causes page_ext_iter_next() to increment iter->index past
>> __pgcount and call page_ext_lookup(start_pfn + __pgcount).
>> During memory hotplug (online), the PFN at start_pfn + __pgcount
>> may belong to a section that has not yet been initialized,
>> causing page_ext_lookup() to trigger a NULL pointer dereference.
>>
>> [   14.555124][  T846] Call trace:
>> [   14.555125][  T846]  lookup_page_ext+0x6c/0x108 (P)
>> [   14.555127][  T846]  page_ext_lookup+0x30/0x3c
>> [   14.555129][  T846]  __reset_page_owner+0x11c/0x260
>> [   14.571201][  T846]  __free_pages_ok+0x5e8/0x8e0
>> [   14.571204][  T846]  __free_pages_core+0x78/0xf0
>> [   14.571206][  T846]  generic_online_page+0x14/0x24
>> [   14.597782][  T846]  online_pages+0x178/0x30c
>> [   14.597784][  T846]  memory_block_change_state+0x284/0x32c
>> [   14.597787][  T846]  memory_subsys_online+0x4c/0x64
>> [   14.597789][  T846]  device_online+0x88/0xb0
>> [   14.597791][  T846]  online_memory_block+0x30/0x40
>> [   14.597793][  T846]  walk_memory_blocks+0xac/0xe8
>> [   14.597794][  T846]  add_memory_resource+0x280/0x298
>> [   14.656161][  T846]  add_memory+0x60/0x98
>>
>> Move the iteration boundary enforcement inside the iterator
>> functions, so callers cannot inadvertently access beyond the
>> requested range.
>>
>> Fixes: 9039b9096ea2 ("mm: page_owner: use new iteration API")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Suggested-by: David Hildenbrand <david@xxxxxxxxxx>
>> Suggested-by: Matthew Wilcox <willy@xxxxxxxxxxxxx>
>> Signed-off-by: Ketan Kishore <ketan.kishore@xxxxxxxxxxxxxxxx>
>> Tested-by: syzbot@xxxxxxxxxxxxxxxxxxxxxxxxx
> This is probably not needed.

Agreed, we usually don't include this.

Acked-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>

-- 
Cheers,

David