Re: [PATCH v2 4/5] mm/page_alloc: make sure tail_page->private is zero at page free time

[Zi Yan]

On 9 Jul 2026, at 4:24, Vlastimil Babka (SUSE) wrote:

> On 7/3/26 15:47, Zi Yan wrote:
>> Any code using tail_page->private of a folio, a compound page or a
>> high-order page is supposed to reset it after use, otherwise ->private data
>> can leak to new page user and cause unexpected issues. Add a bad_page()
>> check at page free path for it.
>>
>> Signed-off-by: Zi Yan <ziy@xxxxxxxxxx>
>
> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>
>
> Nit:
>
>> ---
>>  mm/page_alloc.c | 13 ++++++++++---
>>  1 file changed, 10 insertions(+), 3 deletions(-)
>>
>> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
>> index 762d9b6bc792f..723a52dfc80f6 100644
>> --- a/mm/page_alloc.c
>> +++ b/mm/page_alloc.c
>> @@ -1376,15 +1376,22 @@ static __always_inline bool __free_pages_prepare(struct page *page,
>>  #endif
>>  		}
>>  		for (i = 1; i < (1 << order); i++) {
>> +			struct page *tail_page = page + i;
>> +
>>  			if (compound)
>> -				bad += free_tail_page_prepare(page, page + i);
>> +				bad += free_tail_page_prepare(page, tail_page);
>>  			if (is_check_pages_enabled()) {
>> -				if (free_page_is_bad(page + i)) {
>> +				if (free_page_is_bad(tail_page)) {
>>  					bad++;
>>  					continue;
>>  				}
>>  			}
>> -			(page + i)->flags.f &= ~PAGE_FLAGS_CHECK_AT_PREP;
>> +			tail_page->flags.f &= ~PAGE_FLAGS_CHECK_AT_PREP;
>> +			if (is_check_pages_enabled() && tail_page->private) {
>> +				bad_page(tail_page, "nonzero private");
>> +				bad++;
>> +				continue;
>
> It could be moved to the already existing is_check_pages_enabled() block
> above. The flags reset doesn't need to happen before the check, no?
>

You are right. Will change it. Thanks.

>> +			}
>>  		}
>>  	}
>>  	if (folio_test_anon(folio)) {
>>


Best Regards,
Yan, Zi