From: Heiko Carstens <hca@xxxxxxxxxxxxx> commit b5efb63acf7bddaf20eacfcac654c25c446eabe8 upstream. crst_table_free() used to work with NULL pointers before the conversion to ptdescs. Since crst_table_free() can be called with a NULL pointer (error handling in crst_table_upgrade() add an explicit check. Also add the same check to base_crst_free() for consistency reasons. In real life this should not happen, since order two GFP_KERNEL allocations will not fail, unless FAIL_PAGE_ALLOC is enabled and used. Reported-by: Yunseong Kim <yskelg@xxxxxxxxx> Fixes: 6326c26c1514 ("s390: convert various pgalloc functions to use ptdescs") Signed-off-by: Heiko Carstens <hca@xxxxxxxxxxxxx> Acked-by: Alexander Gordeev <agordeev@xxxxxxxxxxxxx> Cc: stable@xxxxxxxxxx Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/s390/mm/pgalloc.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/arch/s390/mm/pgalloc.c +++ b/arch/s390/mm/pgalloc.c @@ -53,6 +53,8 @@ unsigned long *crst_table_alloc(struct m void crst_table_free(struct mm_struct *mm, unsigned long *table) { + if (!table) + return; pagetable_free(virt_to_ptdesc(table)); } @@ -500,6 +502,8 @@ static unsigned long *base_crst_alloc(un static void base_crst_free(unsigned long *table) { + if (!table) + return; pagetable_free(virt_to_ptdesc(table)); } Patches currently in stable-queue which might be from hca@xxxxxxxxxxxxx are queue-6.6/s390-mark-psw-in-__load_psw_mask-as-__unitialized.patch queue-6.6/s390-mm-add-null-pointer-check-to-crst_table_free-base_crst_free.patch