Re: [PATCH v2] mm: fix address wraparound when scanning large folio PTEs

[Barry Song]

On Thu, Oct 15, 2026 at 2:34 AM David Hildenbrand (Arm)
<david@xxxxxxxxxx> wrote:
>
> numa_rebuild_large_mapping() and do_swap_page() can be tricked into
> generating an address wraparound, crashing the kernel. All that's required
> is to map a tail page of a large folio close enough to the start/end of
> the address space to e.g., make
>
>         unsigned long addr_start = addr - (nr << PAGE_SHIFT);
>
> to wrap around.
>
> Let's fix it by providing a better helper, folio_scan_range(), that
> takes care of staying within VMA and page table boundaries while
> handling possible wraparounds.
>
> There are some nasty details, like not being able to use pmd_addr_end()
> in this context. Add some helpful comments for these cases.
>
> Reported-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> Fixes: d2136d749d76 ("mm: support multi-size THP numa balancing")
> Fixes: 508758960b8d ("mm: swap: entirely map large folios found in swapcache")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>
> Reviewed-by: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>
> Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>

Reviewed-by: Barry Song <baohua@xxxxxxxxxx>