[PATCH] mm/khugepaged: fix a tracepoint for error cases

[PATCH] mm/khugepaged: fix a tracepoint for error cases

[Sweet Tea Dorminy]

Fix a potential NULL pointer dereference in trace_mm_khugepaged_scan_pmd()
when folio is NULL. This is possible if vm_normal_page() returned a NULL
page -- which is unlikely, but was hit in testing.

(The tracepoint in include/trace/events/huge_memory.h can already deal
with a NULL page.)

Signed-off-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>

---
Based on akpm/mm-unstable.

 mm/khugepaged.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index cc945c6ab3bd..eb7b019159d4 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1435,8 +1435,9 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm,
 		*mmap_locked = false;
 	}
 out:
-	trace_mm_khugepaged_scan_pmd(mm, &folio->page, writable, referenced,
-				     none_or_zero, result, unmapped);
+	trace_mm_khugepaged_scan_pmd(mm, folio ? &folio->page : NULL,
+				     writable, referenced, none_or_zero,
+				     result, unmapped);
 	return result;
 }
 

base-commit: e026356e4192ff5a52c1d535e6b9e3fa50def2c4
-- 
2.48.1

Re: [PATCH] mm/khugepaged: fix a tracepoint for error cases

[Andrew Morton]

On Tue,  1 Apr 2025 16:23:53 -0400 Sweet Tea Dorminy <sweettea-kernel@dorminy.me> wrote:

> Fix a potential NULL pointer dereference in trace_mm_khugepaged_scan_pmd()
> when folio is NULL. This is possible if vm_normal_page() returned a NULL
> page -- which is unlikely, but was hit in testing.
> 
> (The tracepoint in include/trace/events/huge_memory.h can already deal
> with a NULL page.)
>
> ...
>
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -1435,8 +1435,9 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm,
>  		*mmap_locked = false;
>  	}
>  out:
> -	trace_mm_khugepaged_scan_pmd(mm, &folio->page, writable, referenced,
> -				     none_or_zero, result, unmapped);
> +	trace_mm_khugepaged_scan_pmd(mm, folio ? &folio->page : NULL,
> +				     writable, referenced, none_or_zero,
> +				     result, unmapped);
>  	return result;

Confused.  If folio==NULL then &folio->page==NULL also.  The patch
appears to be a no-op?

Do you have the messages from that oops?