From: Shivam Kalra via B4 Relay <devnull+shivamkalra98.zohomail.in@kernel.org>
To: Andrew Morton <akpm@linux-foundation.org>,
Uladzislau Rezki <urezki@gmail.com>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Alice Ryhl <aliceryhl@google.com>,
Danilo Krummrich <dakr@kernel.org>,
Shivam Kalra <shivamkalra98@zohomail.in>
Subject: [PATCH v6 4/6] mm/vmalloc: protect /proc/vmallocinfo readers with READ_ONCE()
Date: Sat, 21 Mar 2026 23:35:49 +0530 [thread overview]
Message-ID: <20260321-vmalloc-shrink-v6-4-062ca7b7ceb2@zohomail.in> (raw)
In-Reply-To: <20260321-vmalloc-shrink-v6-0-062ca7b7ceb2@zohomail.in>
From: Shivam Kalra <shivamkalra98@zohomail.in>
The /proc/vmallocinfo readers, specifically show_numa_info() and
vmalloc_info_show(), currently read v->nr_pages and the v->pages
array without any concurrent protection.
In preparation for vrealloc() shrink support, where v->nr_pages can
be decreased and entries in the v->pages array can be nulled out
concurrently, these readers must be protected to prevent use-after-free
or NULL pointer dereferences.
Update show_numa_info() to use READ_ONCE(v->nr_pages) and
READ_ONCE(v->pages[nr]), explicitly checking for NULL before
dereferencing the page. Similarly, update vmalloc_info_show() to
read nr_pages safely to avoid parsing a torn or inconsistent value.
Signed-off-by: Shivam Kalra <shivamkalra98@zohomail.in>
---
mm/vmalloc.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 64f5d1088281..7658fdc087d2 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -5204,7 +5204,7 @@ bool vmalloc_dump_obj(void *object)
static void show_numa_info(struct seq_file *m, struct vm_struct *v,
unsigned int *counters)
{
- unsigned int nr;
+ unsigned int nr, nr_pages;
unsigned int step = 1U << vm_area_page_order(v);
if (!counters)
@@ -5212,8 +5212,13 @@ static void show_numa_info(struct seq_file *m, struct vm_struct *v,
memset(counters, 0, nr_node_ids * sizeof(unsigned int));
- for (nr = 0; nr < v->nr_pages; nr += step)
- counters[page_to_nid(v->pages[nr])] += step;
+ nr_pages = READ_ONCE(v->nr_pages);
+ for (nr = 0; nr < nr_pages; nr += step) {
+ struct page *page = READ_ONCE(v->pages[nr]);
+
+ if (page)
+ counters[page_to_nid(page)] += step;
+ }
for_each_node_state(nr, N_HIGH_MEMORY)
if (counters[nr])
seq_printf(m, " N%u=%u", nr, counters[nr]);
@@ -5241,6 +5246,7 @@ static int vmalloc_info_show(struct seq_file *m, void *p)
struct vmap_area *va;
struct vm_struct *v;
unsigned int *counters;
+ unsigned int nr_pages;
if (IS_ENABLED(CONFIG_NUMA))
counters = kmalloc_array(nr_node_ids, sizeof(unsigned int), GFP_KERNEL);
@@ -5270,8 +5276,9 @@ static int vmalloc_info_show(struct seq_file *m, void *p)
if (v->caller)
seq_printf(m, " %pS", v->caller);
- if (v->nr_pages)
- seq_printf(m, " pages=%d", v->nr_pages);
+ nr_pages = READ_ONCE(v->nr_pages);
+ if (nr_pages)
+ seq_printf(m, " pages=%d", nr_pages);
if (v->phys_addr)
seq_printf(m, " phys=%pa", &v->phys_addr);
--
2.43.0
next prev parent reply other threads:[~2026-03-21 18:06 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-21 18:05 [PATCH v6 0/6] mm/vmalloc: free unused pages on vrealloc() shrink Shivam Kalra via B4 Relay
2026-03-21 18:05 ` [PATCH v6 1/6] mm/vmalloc: extract vm_area_free_pages() helper from vfree() Shivam Kalra via B4 Relay
2026-03-21 18:05 ` [PATCH v6 2/6] mm/vmalloc: fix vrealloc() grow-in-place check Shivam Kalra via B4 Relay
2026-03-21 18:05 ` [PATCH v6 3/6] mm/vmalloc: zero newly exposed memory on vrealloc() grow Shivam Kalra via B4 Relay
2026-03-21 18:05 ` Shivam Kalra via B4 Relay [this message]
2026-03-22 14:49 ` [PATCH v6 4/6] mm/vmalloc: protect /proc/vmallocinfo readers with READ_ONCE() Uladzislau Rezki
2026-03-21 18:05 ` [PATCH v6 5/6] mm/vmalloc: free unused pages on vrealloc() shrink Shivam Kalra via B4 Relay
2026-03-21 18:05 ` [PATCH v6 6/6] lib/test_vmalloc: add vrealloc test case Shivam Kalra via B4 Relay
2026-03-21 23:52 ` [PATCH v6 0/6] mm/vmalloc: free unused pages on vrealloc() shrink Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260321-vmalloc-shrink-v6-4-062ca7b7ceb2@zohomail.in \
--to=devnull+shivamkalra98.zohomail.in@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=aliceryhl@google.com \
--cc=dakr@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=shivamkalra98@zohomail.in \
--cc=urezki@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox