Re: [PATCH v5] mm/hugetlb_cma: Fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

[Andrew Morton]

On Sun, 9 Aug 2026 23:39:22 -0700 Sourav Panda <souravpanda@xxxxxxxxxx> wrote:

> > That way, we can remove the 'if (!page)' check here.
> 
> Sure thing! Thanks! I shall send this tomorrow noon (PST) since I am
> OOO starting Thursday.

Sashiko said a thing - I don't think it reported this against previous
iterations:
	https://sashiko.dev/#/patchset/20260726072935.3513996-1-souravpanda@xxxxxxxxxx

I'll add this v4->v5 update to mm-hotfixes-unstable, assuming it gets
us a bit closer to the final version.

--- a/mm/hugetlb_cma.c~mm-hugetlb_cma-fix-null-nodemask-dereference-in-hugetlb_cma_alloc_frozen_folio-v5
+++ a/mm/hugetlb_cma.c
@@ -3,6 +3,7 @@
 #include <linux/mm.h>
 #include <linux/cma.h>
 #include <linux/compiler.h>
+#include <linux/cpuset.h>
 #include <linux/mm_inline.h>
 
 #include <asm/page.h>
@@ -30,12 +31,21 @@ struct folio *hugetlb_cma_alloc_frozen_f
 	int node;
 	struct folio *folio;
 	struct page *page = NULL;
+	nodemask_t local_node_mask;
 
 	if (!hugetlb_cma_size)
 		return NULL;
 
-	if (!nodemask)
-		nodemask = &node_states[N_MEMORY];
+	if (!nodemask) {
+		unsigned int cpuset_mems_cookie;
+
+		do {
+			cpuset_mems_cookie = read_mems_allowed_begin();
+			local_node_mask = cpuset_current_mems_allowed;
+		} while (read_mems_allowed_retry(cpuset_mems_cookie));
+
+		nodemask = &local_node_mask;
+	}
 
 	if (hugetlb_cma[nid] && node_isset(nid, *nodemask))
 		page = cma_alloc_frozen_compound(hugetlb_cma[nid], order);
_