linux-kernel - Re: [PATCH] PCI/P2PDMA: Reset page reference count when page mapping fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e2e4cbdd-2abe-4e25-9cf2-746af5ede443@deltatee.com>
Date: Tue, 13 Jan 2026 16:34:59 -0700
From: Logan Gunthorpe <logang@...tatee.com>
To: Alistair Popple <apopple@...dia.com>, helgaas@...nel.org
Cc: houtao@...weicloud.com, linux-kernel@...r.kernel.org,
 linux-pci@...r.kernel.org, linux-mm@...ck.org,
 linux-nvme@...ts.infradead.org, bhelgaas@...gle.com, leonro@...dia.com,
 gregkh@...uxfoundation.org, tj@...nel.org, rafael@...nel.org,
 dakr@...nel.org, akpm@...ux-foundation.org, david@...nel.org,
 lorenzo.stoakes@...cle.com, kbusch@...nel.org, axboe@...nel.dk, hch@....de,
 sagi@...mberg.me, houtao1@...wei.com
Subject: Re: [PATCH] PCI/P2PDMA: Reset page reference count when page mapping
 fails

Hi Alistair,

On 2026-01-11 17:54, Alistair Popple wrote:
> When mapping a p2pdma page the page reference count is initialised to
> 1 prior to calling vm_insert_page(). This is to avoid vm_insert_page()
> warning if the page refcount is zero. Prior to setting the page count
> there is a check to ensure the page is currently free (ie. has a zero
> reference count).
> 
> However vm_insert_page() can fail. In this case the pages are freed
> back to the genalloc pool, but that does not reset the page refcount.
> So a future allocation of the same page will see the elevated page
> refcount from the previous set_page_count() call triggering the
> VM_WARN_ON_ONCE_PAGE checking that the page is free.
> 
> Fix this by resetting the page refcount back to zero using
> set_page_count(). Note that put_page() is not used because that
> would result in freeing the page twice due to implicitly calling
> p2pdma_folio_free().
> 
> Fixes: b7e282378773 ("mm/mm_init: move p2pdma page refcount initialisation to p2pdma")
> Signed-off-by: Alistair Popple <apopple@...dia.com>

I had time today to pull out some old hardware and run this patch
through my old p2pdma smoke tests. I don't think the tests exercise the
change, but it looks correct to me on review.

Reviewed-by: Logan Gunthorpe <logang@...tatee.com>

Thanks for the fix!

Logan