Re: [PATCH] mm/page_isolation: fix UBSAN shift-out-of-bounds warning

[Zi Yan]

On Tue Aug 18, 2026 at 7:28 AM EDT, Qi Xi wrote:
> A contig-range allocation racing with buddy allocation on the adjacent
> pageblock can trigger:
>
>  UBSAN: shift-out-of-bounds in mm/page_isolation.c:393:15
>  shift exponent -749042176 is negative
>  Call trace:
>   isolate_single_pageblock
>   start_isolate_page_range
>   alloc_contig_frozen_range_noprof
>   alloc_contig_range_noprof
>
> isolate_single_pageblock() first calls set_migratetype_isolate() with
> zone->lock held, which marks the pageblock MIGRATE_ISOLATE and moves any
> free page straddling the boundary out of the way.  Once the lock is
> dropped, it scans the MAX_ORDER_NR_PAGES-aligned window [start_pfn,
> boundary_pfn) locklessly, only to skip the free pages already handled
> above and to detect in-use pages straddling the boundary.  Since this
> scan only reads page state to decide how far to skip and returns -EBUSY
> on a straddling in-use page, it does not take the lock.
>
> The window also covers the adjacent pageblock, whose free pages stay on
> the normal movable/CMA freelist and can be allocated concurrently.  So
> after the scan observes PageBuddy(page), another CPU can allocate the
> page, leaving a stale value in page->private that makes "1 << order" shift
> out of range.
>
> Use buddy_order_unsafe() to read the order exactly once (READ_ONCE), and
> guard the shift with an order <= MAX_PAGE_ORDER check so it is never
> performed with a bogus value.
>
> Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
> Signed-off-by: Qi Xi <xiqi2@xxxxxxxxxx>
> ---
>  mm/page_isolation.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
>

The fix makes sense to me.
Please Cc stable for this. Thanks.

Sashiko has two more concerns:

1. order can still be bogus even if it is within MAX_PAGE_ORDER.
    a. it can trigger VM_WARN_ON_ONCE();
    b. it can skip arbitrary pages and miss an in-use compound page.

For 1a, we can remove VM_WARN_ON_ONCE() and just fail
isolate_single_pageblock() if PageBuddy crosses the boundary, since
pageblock_isolate_and_move_free_pages() handles it.

For 1b, after we makes the change in 1a, PageBuddy skip cannot land us
beyond the boundary, so the concern is gone.


2. In PageCompound() branch, a bogus nr_pages can also cause the
shift-out-of-bounds.

It will need a different fix.


Hi Qi,

Do you mind fixing 1a along with this patch?

For this patch alone,

Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>


-- 
Best Regards,
Yan, Zi