Re: [PATCH v4 3/3] mm: khugepaged: fix folio is used after folio_put/unlock()

[David Hildenbrand (Arm)]

On 8/28/26 07:59, Vernon Yang wrote:
> From: Vernon Yang <yanglincheng@xxxxxxxxxx>
> 
> On the rollback path, folio_put() has already dropped the last reference
> of new_folio. On the success path, new_folio is already unlocked and can
> be freed concurrently. The trace_mm_khugepaged_collapse_file() is left
> with a dangling folio pointer.
> 
> So using the folio_pfn() before dropping the reference, closing
> use-after-free window.
> 
> Acked-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
> Fixes: 4c9473e87e75 ("mm/khugepaged: add tracepoint to collapse_file()")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Vernon Yang <yanglincheng@xxxxxxxxxx>
> ---

Acked-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>

-- 
Cheers,

David