Re: [PATCH V2] mm: fix use-after free of page_ext after race with memory-offline

[Michal Hocko]

On Mon 01-08-22 18:31:45, Charan Teja Kalla wrote:
[...]
> >> The roll back operation in the online_page_ext(), where we free the
> >> allocated page_ext's, will not have the PAGE_EXT_INVALID flag thus
> >> WARN() may not work here. no?
> > Wouldn't ms->page_ext be NULL in that case?
> I don't think that ms->page_ext would be NULL here.
> online_page_ext():
>   (a) for (pfn = start; !fail && pfn < end; pfn += PAGES_PER_SECTION)
>      fail = init_section_page_ext():
> 	   ms->page_ext = (void *)base - page_ext_size * pfn;
> 
>   //If fail = -ERROR in the middle, roll back operation.
>   (b) for (pfn = start; pfn < end; pfn += PAGES_PER_SECTION)
>        __free_page_ext();
> 
>    Here (b) can be called on the sections without PAGE_EXT_INVALID with
> ms->page_ext != NULL.
> 
You are right. My sloppy code reading. A tiny comment would be nice.
Because this shouldn't really happen for normal calls.

-- 
Michal Hocko
SUSE Labs