From: Matthew Wilcox <willy@infradead.org>
To: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Cc: Linux Memory Management List <linux-mm@kvack.org>,
Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Vlastimil Babka <vbabka@suse.cz>,
chrisl@kernel.org, kasong@tencent.com,
Hugh Dickins <hughd@google.com>
Subject: Re: [RFC PATCH] mm/page_alloc: fix use-after-free in swap due to stale page data after split_page()
Date: Fri, 30 Jan 2026 13:59:47 +0000 [thread overview]
Message-ID: <aXy5U7XJSoSG5HpE@casper.infradead.org> (raw)
In-Reply-To: <CABXGCsNqk6pOkocJ0ctcHssCvke2kqhzoR2BGf_Hh1hWPZATuA@mail.gmail.com>
On Fri, Jan 30, 2026 at 06:49:00PM +0500, Mikhail Gavrilov wrote:
> + /*
> + * Split pages may contain stale data from previous use. Initialize
> + * page->private and page->lru which may have LIST_POISON values.
> + */
> + INIT_LIST_HEAD(&page->lru);
> + for (i = 1; i < (1 << order); i++) {
> + set_page_private(page + i, 0);
> + INIT_LIST_HEAD(&page[i].lru);
> + }
> +
> for (i = 1; i < (1 << order); i++)
> set_page_refcounted(page + i);
> split_page_owner(page, order, 0);
Why add a second loop instead of using the existing one?
next prev parent reply other threads:[~2026-01-30 14:00 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-30 13:49 Mikhail Gavrilov
2026-01-30 13:59 ` Matthew Wilcox [this message]
2026-01-30 14:16 ` Mikhail Gavrilov
2026-01-30 15:30 ` Kairui Song
2026-01-30 15:47 ` Mikhail Gavrilov
2026-02-02 3:17 ` Kairui Song
2026-02-02 5:27 ` Mikhail Gavrilov
2026-02-02 17:54 ` Kairui Song
2026-02-02 20:21 ` Mikhail Gavrilov
2026-02-03 7:14 ` Mikhail Gavrilov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aXy5U7XJSoSG5HpE@casper.infradead.org \
--to=willy@infradead.org \
--cc=akpm@linux-foundation.org \
--cc=chrisl@kernel.org \
--cc=hughd@google.com \
--cc=kasong@tencent.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mikhail.v.gavrilov@gmail.com \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox