On Sat Oct 31, 2026 at 10:13 PM EDT, Gregory Price (Meta) wrote: > zonelist_node_idx() looks like it returns a field of the zoneref, as > zonelist_zone_idx() does, but it loads the zone from the slot again. > > Memory hotplug rewrites zonelists in place, so a caller that has already > checked the slot can get a different zone, or the NULL terminator, from > that second load. > > __next_zones_zonelist() and mempolicy_slab_node() had this bug. > > Remove the helper and open-code it in its two remaining callers, neither > of which can race with a rebuild. local_memory_node() runs either inside > __build_all_zonelists() or during CPU bring-up, which holds > cpu_hotplug_lock for write and so excludes mem_hotplug_begin(). > > The lookup in mpol_misplaced() is unreachable: it needs a policy with > MPOL_F_MOF but not MPOL_F_MORON, and nothing sets one without the other. > > Signed-off-by: Gregory Price (Meta) <[email protected]> > --- > include/linux/mmzone.h | 6 ------ > mm/mempolicy.c | 2 +- > mm/page_alloc.c | 2 +- > 3 files changed, 2 insertions(+), 8 deletions(-) > LGTM.
Reviewed-by: Zi Yan <[email protected]> -- Best Regards, Yan, Zi
