* Re: [PATCH] mm/gup: fix handling of zero page in follow_page_pte()
2025-11-12 7:24 [PATCH] mm/gup: fix handling of zero page in follow_page_pte() peng8420.li
@ 2025-11-12 8:05 ` David Hildenbrand (Red Hat)
2025-11-17 13:48 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: David Hildenbrand (Red Hat) @ 2025-11-12 8:05 UTC (permalink / raw)
To: peng8420.li, linux-mm, akpm
Cc: osalvador, jgg, jhubbard, peterx, linux-kernel, dan.j.williams
On 12.11.25 08:24, peng8420.li@gmail.com wrote:
> From: "peng8420.li" <peng8420.li@gmail.com>
>
> In some scenarios, `__vm_normal_page` might return NULL.
> In this case, if `is_zero_pfn(pte_pfn(pte))` is true, simply return `page = pte_page(pte)`;
> no further folio processing is needed.
>
> Signed-off-by: peng8420.li <peng8420.li@gmail.com>
> ---
> mm/gup.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/mm/gup.c b/mm/gup.c
> index 95d948c8e86c..60ae5f0c20e0 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -838,6 +838,7 @@ static struct page *follow_page_pte(struct vm_area_struct *vma,
>
> if (is_zero_pfn(pte_pfn(pte))) {
> page = pte_page(pte);
> + goto out;
> } else {
> ret = follow_pfn_pte(vma, address, ptep, flags);
> page = ERR_PTR(ret);
I'm sorry, but that's just wrong. Observe how me might run into the
gup_must_unshare() branch and how try_grab_folio() would grab references
on the FOLL_GET path.
--
Cheers
David
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] mm/gup: fix handling of zero page in follow_page_pte()
2025-11-12 7:24 [PATCH] mm/gup: fix handling of zero page in follow_page_pte() peng8420.li
2025-11-12 8:05 ` David Hildenbrand (Red Hat)
@ 2025-11-17 13:48 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2025-11-17 13:48 UTC (permalink / raw)
To: peng8420.li
Cc: oe-lkp, lkp, linux-mm, akpm, david, osalvador, jgg, jhubbard,
peterx, linux-kernel, dan.j.williams, peng8420.li, oliver.sang
Hello,
kernel test robot noticed "BUG:Bad_page_state_in_process" on:
commit: 4e691413bed009d7bd6198eb8fcebd4559a9e017 ("[PATCH] mm/gup: fix handling of zero page in follow_page_pte()")
url: https://github.com/intel-lab-lkp/linux/commits/peng8420-li-gmail-com/mm-gup-fix-handling-of-zero-page-in-follow_page_pte/20251112-152851
base: https://git.kernel.org/cgit/linux/kernel/git/akpm/mm.git mm-everything
patch link: https://lore.kernel.org/all/20251112072424.125514-1-peng8420.li@gmail.com/
patch subject: [PATCH] mm/gup: fix handling of zero page in follow_page_pte()
in testcase: trinity
version:
with following parameters:
runtime: 300s
group: group-04
nr_groups: 5
config: x86_64-randconfig-001-20251114
compiler: clang-20
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202511172111.32f89804-lkp@intel.com
[ 271.087528][ T5904] BUG: Bad page state in process trinity-c1 pfn:05d00
[ 271.088206][ T5904] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5d00
[ 271.088949][ T5904] flags: 0x2000000000002000(reserved|zone=1)
[ 271.089455][ T5904] raw: 2000000000002000 ffffea0000174008 ffffea0000174008 0000000000000000
[ 271.090260][ T5904] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 271.090973][ T5904] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 271.091567][ T5904] Modules linked in: uvesafb input_leds pcspkr
[ 271.092115][ T5904] CPU: 0 UID: 16384 PID: 5904 Comm: trinity-c1 Tainted: G T 6.18.0-rc5-00409-g4e691413bed0 #1 PREEMPT(none)
[ 271.093592][ T5904] Tainted: [T]=RANDSTRUCT
[ 271.094176][ T5904] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 271.095412][ T5904] Call Trace:
[ 271.095916][ T5904] <TASK>
[ 271.096360][ T5904] __dump_stack (lib/dump_stack.c:95)
[ 271.096928][ T5904] dump_stack_lvl (lib/dump_stack.c:123)
[ 271.097534][ T5904] dump_stack (lib/dump_stack.c:130)
[ 271.098105][ T5904] bad_page (mm/page_alloc.c:?)
[ 271.098668][ T5904] __free_frozen_pages (mm/page_alloc.c:?)
[ 271.099331][ T5904] free_frozen_pages (mm/page_alloc.c:2987)
[ 271.099969][ T5904] __folio_put (mm/swap.c:?)
[ 271.100495][ T5904] page_cache_pipe_buf_release (fs/splice.c:112)
[ 271.100975][ T5904] __se_sys_vmsplice (include/linux/pipe_fs_i.h:? fs/splice.c:261 fs/splice.c:1475 fs/splice.c:1555 fs/splice.c:1610 fs/splice.c:1580)
[ 271.101425][ T5904] ? _raw_spin_unlock_irq (arch/x86/include/asm/preempt.h:104 include/linux/spinlock_api_smp.h:160 kernel/locking/spinlock.c:202)
[ 271.101869][ T5904] ? do_setitimer (include/linux/spinlock.h:?)
[ 271.102283][ T5904] ? trace_preempt_on (kernel/trace/trace_preemptirq.c:122)
[ 271.102730][ T5904] __x64_sys_vmsplice (fs/splice.c:1580)
[ 271.103151][ T5904] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 271.103653][ T5904] x64_sys_call (kbuild/obj/consumer/x86_64-randconfig-001-20251114/./arch/x86/include/generated/asm/syscalls_64.h:470)
[ 271.104064][ T5904] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 271.104467][ T5904] ? irqentry_exit (kernel/entry/common.c:224)
[ 271.104869][ T5904] ? exc_page_fault (arch/x86/mm/fault.c:?)
[ 271.105286][ T5904] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 271.105781][ T5904] RIP: 0033:0x463519
[ 271.106141][ T5904] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 59 00 00 c3 66 2e 0f 1f 84 00 00 00 00
All code
========
0: 00 f3 add %dh,%bl
2: c3 ret
3: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
a: 00 00 00
d: 0f 1f 40 00 nopl 0x0(%rax)
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 0f 83 db 59 00 00 jae 0x5a11
36: c3 ret
37: 66 data16
38: 2e cs
39: 0f .byte 0xf
3a: 1f (bad)
3b: 84 00 test %al,(%rax)
3d: 00 00 add %al,(%rax)
...
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 0f 83 db 59 00 00 jae 0x59e7
c: c3 ret
d: 66 data16
e: 2e cs
f: 0f .byte 0xf
10: 1f (bad)
11: 84 00 test %al,(%rax)
13: 00 00 add %al,(%rax)
...
[ 271.107601][ T5904] RSP: 002b:00007ffffa2365e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000116
[ 271.108301][ T5904] RAX: ffffffffffffffda RBX: 0000000000000116 RCX: 0000000000463519
[ 271.108967][ T5904] RDX: 00000000000000d4 RSI: 000000002d4190c0 RDI: 0000000000000126
[ 271.109624][ T5904] RBP: 00007f2836c7b000 R08: 0000000000000000 R09: fffffffffffffffb
[ 271.110286][ T5904] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002
[ 271.110942][ T5904] R13: 00007f2836c7b058 R14: 000000002d15b850 R15: 00007f2836c7b000
[ 271.111621][ T5904] </TASK>
[ 271.111949][ T5904] Disabling lock debugging due to kernel taint
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20251117/202511172111.32f89804-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread