From nobody Thu Apr 16 22:34:16 2026 Received: from lf-1-130.ptr.blmpb.com (lf-1-130.ptr.blmpb.com [103.149.242.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A70E22301 for ; Wed, 25 Feb 2026 09:39:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=103.149.242.130 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772012402; cv=none; b=EGNNX+UXRIO4Oeh99zTJXaXJmZ6YZhdXSqcKJZdqFJHQrJtW8L0WByCTmLMKF9HpWZodFdvOtV+8A2RFUBE1ENrYKo0sDPlpCaZ+PD1Q6rXEaj+Cq8OZyToV/TM4P65MrMg2yniOe/v9No1qL868xQ6WlsjeLlFUvvM18mJo32s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772012402; c=relaxed/simple; bh=b1scu3Xlgw2u0P/VOPr7i3EJQWeuDXORCeZImlO9Exo=; h=Mime-Version:Cc:From:Subject:To:Message-Id:Content-Type:Date; b=cfJGH/P6QTC6H9/MJhQv04SR91+p594MAb7wzTmp/Uh40HY3QQv1ouxcFxpQ1VZueTOlrfjRYWkrcqd1fkyrliTTIHoC9M5FMBiB81bnmPTzSekelFesftMXzNoOIBDEXLX26M6VHADBdoNG3SkTihI491bagkoRjF6rn5LBVpg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=GqT2PZBp; arc=none smtp.client-ip=103.149.242.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="GqT2PZBp" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=2212171451; d=bytedance.com; t=1772011669; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=EyFMWTwGWSbAiRL/vJa/jH/xyi3CrIaWxwsCjWHQ2Dc=; b=GqT2PZBpBEjiC70/lEUoRApLHj4gDFwrSWL56QHtLVW8CUMWtc1SJKpFK83fElheZAWQ0l M6j3hlSVanQpp63ZQLq3j9yVrk24kOhmWrm6nf4QHxqAhndKK4DKA/v83G/JkY6cuIBzXI Lh07/qUGSWKnNw5oxzab7BX3mP6ZaiUsEFWjx7bb/Oi4yUQQIyfgQKREw3vymx3xy03923 m0zEiCjYPAoPZSCllUqvvfWlbwFGpXkABqqsyDQhVik5PThhxdpngIuCCD6EQxBGL5iOrg sYxZ70N07q67cqgRhdIdv/HdiAKI+PnBC7wWNxibF2C9FWFXyQWp15SK4Cft1A== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Original-From: Li Zhe Cc: , , From: "Li Zhe" Subject: [PATCH] mm: Avoid calling folio_page() with an out-of-bounds index X-Mailer: git-send-email 2.45.2 To: , , , , , , , , Message-Id: <20260225092628.11687-1-lizhe.67@bytedance.com> Content-Transfer-Encoding: quoted-printable Date: Wed, 25 Feb 2026 17:26:28 +0800 X-Lms-Return-Path: Content-Type: text/plain; charset="utf-8" In folio_zero_user(), the page pointer is calculated via folio_page() before checking if the number of pages to be cleared is greater than zero. Furthermore, folio_page() does not verify that the page number lies within folio. When 'addr_hint' is near the end of a large folio, the range 'r[0]' represents an empty interval. In this scenario, 'nr_pages' will be calculated as 0 and 'r[0].start' can be an index that is out-of-bounds for folio_page(). The code unconditionally calls folio_page() on a wrong index, even though the subsequent clearing logic is correctly skipped. While this does not cause a functional bug today, calculating a page pointer for an out-of-bounds index is logically unsound and fragile. It could pose a risk for future refactoring or trigger warnings from static analysis tools. To fix this, move the call to folio_page() inside the 'if (nr_pages > 0)' block. This ensures that the page pointer is only calculated when it is actually needed for a valid, non-empty range of pages, thus making the code more robust and logically correct. Signed-off-by: Li Zhe Reviewed-by: Dev Jain --- mm/memory.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index 07778814b4a8..6f8c55d604b5 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -7343,12 +7343,14 @@ void folio_zero_user(struct folio *folio, unsigned = long addr_hint) r[0] =3D DEFINE_RANGE(r[2].end + 1, pg.end); =20 for (i =3D 0; i < ARRAY_SIZE(r); i++) { - const unsigned long addr =3D base_addr + r[i].start * PAGE_SIZE; const long nr_pages =3D (long)range_len(&r[i]); - struct page *page =3D folio_page(folio, r[i].start); =20 - if (nr_pages > 0) + if (nr_pages > 0) { + const unsigned long addr =3D base_addr + r[i].start * PAGE_SIZE; + struct page *page =3D folio_page(folio, r[i].start); + clear_contig_highpages(page, addr, nr_pages); + } } } =20 --=20 2.20.1