On Sat Oct 31, 2026 at 10:13 PM EDT, Gregory Price (Meta) wrote:
> get_page_from_freelist() and alloc_pages_bulk_noprof() reread
> ac->preferred_zoneref->zone at every use. Offlining a zone's last block
> rebuilds the zonelists in place, and the shrunk list's NULL terminator
> can land on the preferred slot mid-walk:
>
> CPU 0 CPU 1
> get_page_from_freelist(GFP_KERNEL | __GFP_THISNODE)
> zone = NORMAL (slot 1)
> offline_pages()
> build_all_zonelists()
> [MOVABLE, NORMAL, NULL]
> -> [NORMAL, NULL]
> rmqueue(zonelist_zone(slot 1), zone)
> zone_statistics(NULL, zone)
>
> BUG: kernel NULL pointer dereference, address: 0000000000000060
> RIP: 0010:get_page_from_freelist+0x6a5/0x15f0
> Call Trace:
> __alloc_frozen_pages_noprof+0x125/0x330
>
> Read the slot once. Zones are never freed, so a stale zone is safe, and
> a NULL slot fails the same way as walking off the end.
>
> Fixes: 11cd8638c37f ("mm, page_alloc: remove stop_machine from
> build_all_zonelists")
> Cc: [email protected]
> Signed-off-by: Gregory Price (Meta) <[email protected]>
> Reviewed-by: Vlastimil Babka (SUSE) <[email protected]>
> ---
> mm/page_alloc.c | 31 +++++++++++++++++++++++--------
> 1 file changed, 23 insertions(+), 8 deletions(-)
>
Makes sense.
Acked-by: Zi Yan <[email protected]>
--
Best Regards,
Yan, Zi
