dequeue_hugetlb_folio_nodemask() expects a preferred node where to get the
hugetlb page from.
It does not expect, though, users to pass NUMA_NO_NODE, otherwise we will
get trash when trying to get the zonelist from that node.
All current users are careful enough to not pass NUMA_NO_NODE, but
it opens the door for new users to get this wrong since it is not
documented [0].
Guard against this by getting the local nid if NUMA_NO_NODE was passed.

[0] https://lore.kernel.org/linux-mm/0000000000004f12bb061a9acf07@google.com/

Closes: https://lore.kernel.org/linux-mm/0000000000004f12bb061a9acf07@google.com/
Reported-and-tested-by: syzbot+569ed13f4054f271087b@syzkaller.appspotmail.com
Signed-off-by: Oscar Salvador <osalvador@suse.de>
---
 mm/hugetlb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 3518321f6598..6a5ea898e4da 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1355,6 +1355,10 @@ static struct folio *dequeue_hugetlb_folio_nodemask(struct hstate *h, gfp_t gfp_
 	struct zoneref *z;
 	int node = NUMA_NO_NODE;
 
+	/* 'nid' should not be NUMA_NO_NODE. Try to catch any misuse of it and rectifiy. */
+	if (nid == NUMA_NO_NODE)
+		nid = numa_node_id();
+
 	zonelist = node_zonelist(nid, gfp_mask);
 
 retry_cpuset:
-- 
2.45.2

> dequeue_hugetlb_folio_nodemask() expects a preferred node where to get
> the
> hugetlb page from.
> It does not expect, though, users to pass NUMA_NO_NODE, otherwise we
> will
> get trash when trying to get the zonelist from that node.
> All current users are careful enough to not pass NUMA_NO_NODE, but
> it opens the door for new users to get this wrong since it is not
> documented [0].
> Guard against this by getting the local nid if NUMA_NO_NODE was passed.
> 
> [0] https://lore.kernel.org/linux-
> mm/0000000000004f12bb061a9acf07@google.com/
> 
> Closes: https://lore.kernel.org/linux-
> mm/0000000000004f12bb061a9acf07@google.com/
> Reported-and-tested-by:
> syzbot+569ed13f4054f271087b@syzkaller.appspotmail.com
> Signed-off-by: Oscar Salvador <osalvador@suse.de>
> ---
>  mm/hugetlb.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 3518321f6598..6a5ea898e4da 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -1355,6 +1355,10 @@ static struct folio
> *dequeue_hugetlb_folio_nodemask(struct hstate *h, gfp_t gfp_
>  	struct zoneref *z;
>  	int node = NUMA_NO_NODE;
> 
> +	/* 'nid' should not be NUMA_NO_NODE. Try to catch any misuse of it
> and rectifiy. */
> +	if (nid == NUMA_NO_NODE)
> +		nid = numa_node_id();
> +
>  	zonelist = node_zonelist(nid, gfp_mask);
Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com>

> 
>  retry_cpuset:
> --
> 2.45.2

> On Jun 12, 2024, at 16:29, Oscar Salvador <osalvador@suse.de> wrote:
> 
> dequeue_hugetlb_folio_nodemask() expects a preferred node where to get the
> hugetlb page from.
> It does not expect, though, users to pass NUMA_NO_NODE, otherwise we will
> get trash when trying to get the zonelist from that node.
> All current users are careful enough to not pass NUMA_NO_NODE, but
> it opens the door for new users to get this wrong since it is not
> documented [0].
> Guard against this by getting the local nid if NUMA_NO_NODE was passed.
> 
> [0] https://lore.kernel.org/linux-mm/0000000000004f12bb061a9acf07@google.com/
> 
> Closes: https://lore.kernel.org/linux-mm/0000000000004f12bb061a9acf07@google.com/
> Reported-and-tested-by: syzbot+569ed13f4054f271087b@syzkaller.appspotmail.com
> Signed-off-by: Oscar Salvador <osalvador@suse.de>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.