Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] mm: out-of-bounds struct page write due to unhandled unaligned range --
commit b8dd4e5f7a50b091c065c7673c2a6a148529465a Author: Muchun Song <[email protected]> mm: warn on unaligned compound zone device ranges A compound page of order N must start at a PFN aligned to 2^N pages. Therefore, a range used to initialize compound pages must start on a compound-page boundary and contain an integral number of compound pages. Link: https://lore.kernel.org/r/[email protected] Link: https://lore.kernel.org/r/[email protected] > diff --git a/mm/mm_init.c b/mm/mm_init.c > index 4c17a892924d2..01ced0553ce9b 100644 > --- a/mm/mm_init.c > +++ b/mm/mm_init.c > @@ -1142,6 +1142,8 @@ void __ref memmap_init_zone_device(struct zone *zone, > if (!nr_pages) > return; > > + VM_WARN_ON(!IS_ALIGNED(start_pfn | nr_pages, pfns_per_compound)); > + [Severity: High] This warning detects the unaligned range, but does this still allow an out-of-bounds write if execution continues? If nr_pages is not a multiple of pfns_per_compound, the main initialization loop in memmap_init_zone_device() advances by pfns_per_compound chunks: for (; pfn < end_pfn; pfn += pfns_per_compound) { ... memmap_init_compound(page, pfn, zone_idx, nid, pgmap, compound_nr_pages(pfn, pgmap)); } And memmap_init_compound() will then write exactly pfns_per_compound entries (since compound_nr_pages() returns pfns_per_compound), ignoring the actual end of the zone-device range: for (pfn = head_pfn + 2; pfn < end_pfn; pfn++) zone_device_page_init_from_template(pfn_to_page(pfn), ...); Could this overrun the allocated range and corrupt adjacent struct pages? Additionally, since VM_WARN_ON is compiled out without CONFIG_DEBUG_VM, could this result in silent memory corruption on production kernels? Should we abort the initialization when an unaligned range is detected? > /* > * Seed the reusable head-page template from the first real struct > * page. The normal page-init and refcount helpers must operate on -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
