This is a note to let you know that I've just added the patch titled
alloc_tag: fix page_ext_get/page_ext_put sequence during page splitting
to the 6.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alloc_tag-fix-page_ext_get-page_ext_put-sequence-dur.patch
and it can be found in the queue-6.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 66b986594391bb2d2a9c2dda61ae9c7f89bc497d
Author: Suren Baghdasaryan <surenb@xxxxxxxxxx>
Date: Thu Jul 11 15:04:57 2024 -0700
alloc_tag: fix page_ext_get/page_ext_put sequence during page splitting
[ Upstream commit 6ab42fe21c84d72da752923b4bd7075344f4a362 ]
pgalloc_tag_sub() might call page_ext_put() using a page different from
the one used in page_ext_get() call. This does not pose an issue since
page_ext_put() ignores this parameter as long as it's non-NULL but
technically this is wrong. Fix it by storing the original page used in
page_ext_get() and passing it to page_ext_put().
Link: https://lkml.kernel.org/r/20240711220457.1751071-3-surenb@xxxxxxxxxx
Fixes: be25d1d4e822 ("mm: create new codetag references during page splitting")
Signed-off-by: Suren Baghdasaryan <surenb@xxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Kent Overstreet <kent.overstreet@xxxxxxxxx>
Cc: Pasha Tatashin <pasha.tatashin@xxxxxxxxxx>
Cc: Sourav Panda <souravpanda@xxxxxxxxxx>
Cc: Vlastimil Babka <vbabka@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/include/linux/pgalloc_tag.h b/include/linux/pgalloc_tag.h
index acb1e9ce79815..18cd0c0c73d93 100644
--- a/include/linux/pgalloc_tag.h
+++ b/include/linux/pgalloc_tag.h
@@ -71,6 +71,7 @@ static inline void pgalloc_tag_sub(struct page *page, unsigned int nr)
static inline void pgalloc_tag_split(struct page *page, unsigned int nr)
{
int i;
+ struct page_ext *first_page_ext;
struct page_ext *page_ext;
union codetag_ref *ref;
struct alloc_tag *tag;
@@ -78,7 +79,7 @@ static inline void pgalloc_tag_split(struct page *page, unsigned int nr)
if (!mem_alloc_profiling_enabled())
return;
- page_ext = page_ext_get(page);
+ first_page_ext = page_ext = page_ext_get(page);
if (unlikely(!page_ext))
return;
@@ -94,7 +95,7 @@ static inline void pgalloc_tag_split(struct page *page, unsigned int nr)
page_ext = page_ext_next(page_ext);
}
out:
- page_ext_put(page_ext);
+ page_ext_put(first_page_ext);
}
static inline struct alloc_tag *pgalloc_tag_get(struct page *page)
