Re: [PATCH v2 2/2] mm/page_isolation: guard compound_order() against racing

[Zi Yan]

On Thu Aug 20, 2026 at 10:55 PM EDT, Qi Xi wrote:
> The PageCompound branch reads compound_head() without holding a reference.
> A racing split or free can cause compound_head() to return a stale pointer,
> and compound_nr() reads the order from that stale head, leading to
> out-of-range shifts and making the skip distance meaningless.
>
> Read the order explicitly with compound_order() and validate it is within
> MAX_FOLIO_ORDER before shifting. Also verify the derived head_pfn against
> the legitimate pfn: the head must not be past pfn, must be aligned to
> nr_pages, and pfn must fall within the compound page. Bail out with
> -EBUSY if any check fails.
>
> Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Zi Yan <ziy@xxxxxxxxxx>
> Signed-off-by: Qi Xi <xiqi2@xxxxxxxxxx>
> ---
>  mm/page_isolation.c | 22 ++++++++++++++++++++--
>  1 file changed, 20 insertions(+), 2 deletions(-)
>
LGTM.

Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>

-- 
Best Regards,
Yan, Zi