Use nth_page() in place of direct struct page manipulation

From: Zi Yan <[email protected]>

When dealing with hugetlb pages, manipulating struct page pointers directly can get to wrong struct page, since struct page is not guaranteed to be contiguous on SPARSEMEM without VMEMMAP. Use nth_page() to handle it properly.

Fixes 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc")

Cc <[email protected]>

Signed-off-by Zi Yan <[email protected]>

Reviewed-by Muchun Song <[email protected]>

---
 mm/cma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

mm/cma.c +1 -1

index da2967c6a223..2b2494fd6b59 100644
@@ -505,7 +505,7 @@ struct page *cma_alloc(struct cma *cma, unsigned long count,
 	 */
 	if (page) {
 		for (i = 0; i < count; i++)
-			page_kasan_tag_reset(page + i);
+			page_kasan_tag_reset(nth_page(page, i));
 	}
 
 	if (ret && !no_warn) {

Signature · 1 line

2.40.1

No related bug is reported. The fix comes from code inspection.

From: Zi Yan <[email protected]>

When dealing with hugetlb pages, manipulating struct page pointers directly can get to wrong struct page, since struct page is not guaranteed to be contiguous on SPARSEMEM without VMEMMAP. Use nth_page() to handle it properly.

Fixes 57a196a58421 ("hugetlb: simplify hugetlb handling in follow_page_mask")

Cc <[email protected]>

Signed-off-by Zi Yan <[email protected]>

Reviewed-by Muchun Song <[email protected]>

---
 mm/hugetlb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

mm/hugetlb.c +1 -1

index af74e83d92aa..8e68e6c53e66 100644
@@ -6469,7 +6469,7 @@ struct page *hugetlb_follow_page_mask(struct vm_area_struct *vma,
 			}
 		}
 
-		page += ((address & ~huge_page_mask(h)) >> PAGE_SHIFT);
+		page = nth_page(page, ((address & ~huge_page_mask(h)) >> PAGE_SHIFT));
 
 		/*
 		 * Note that page may be a sub-page, and with vmemmap

Signature · 1 line

2.40.1

From: Zi Yan <[email protected]>

When dealing with hugetlb pages, manipulating struct page pointers directly can get to wrong struct page, since struct page is not guaranteed to be contiguous on SPARSEMEM without VMEMMAP. Use pfn calculation to handle it properly.

Fixes eeb0efd071d8 ("mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages")

Cc <[email protected]>

Signed-off-by Zi Yan <[email protected]>

Reviewed-by Muchun Song <[email protected]>

Acked-by David Hildenbrand <[email protected]>

---
 mm/memory_hotplug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

mm/memory_hotplug.c +1 -1

index 1b03f4ec6fd2..3b301c4023ff 100644
@@ -1689,7 +1689,7 @@ static int scan_movable_pages(unsigned long start, unsigned long end,
 		 */
 		if (HPageMigratable(head))
 			goto found;
-		skip = compound_nr(head) - (page - head);
+		skip = compound_nr(head) - (pfn - page_to_pfn(head));
 		pfn += skip - 1;
 	}
 	return -ENOENT;

Signature · 1 line

2.40.1

From: Zi Yan <[email protected]>

When dealing with hugetlb pages, struct page is not guaranteed to be contiguous on SPARSEMEM without VMEMMAP. Use nth_page() to handle it properly.

Fixes 38c1ddbde6c6 ("hugetlbfs: improve read HWPOISON hugepage")

Cc <[email protected]>

Signed-off-by Zi Yan <[email protected]>

Reviewed-by Muchun Song <[email protected]>

---
 fs/hugetlbfs/inode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

fs/hugetlbfs/inode.c +2 -2

index 7083fa0caaab..14d3d28e41b0 100644
@@ -295,7 +295,7 @@ static size_t adjust_range_hwpoison(struct page *page, size_t offset, size_t byt
 	size_t res = 0;
 
 	/* First subpage to start the loop. */
-	page += offset / PAGE_SIZE;
+	page = nth_page(page, offset / PAGE_SIZE);
 	offset %= PAGE_SIZE;
 	while (1) {
 		if (is_raw_hwpoison_page_in_hugepage(page))

@@ -309,7 +309,7 @@ static size_t adjust_range_hwpoison(struct page *page, size_t offset, size_t byt
 			break;
 		offset += n;
 		if (offset == PAGE_SIZE) {
-			page++;
+			page = nth_page(page, 1);
 			offset = 0;
 		}
 	}

Signature · 1 line

2.40.1

From: Zi Yan <[email protected]>

__flush_dcache_pages() is called during hugetlb migration via migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() -> move_to_new_folio() -> flush_dcache_folio(). And with hugetlb and without sparsemem vmemmap, struct page is not guaranteed to be contiguous beyond a section. Use nth_page() instead.

Fixes 15fa3e8e3269 ("mips: implement the new page table range API")

Cc <[email protected]>

Signed-off-by Zi Yan <[email protected]>

---
 arch/mips/mm/cache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/mips/mm/cache.c +1 -1

index 02042100e267..7f830634dbe7 100644
@@ -117,7 +117,7 @@ void __flush_dcache_pages(struct page *page, unsigned int nr)
 	 * get faulted into the tlb (and thus flushed) anyways.
 	 */
 	for (i = 0; i < nr; i++) {
-		addr = (unsigned long)kmap_local_page(page + i);
+		addr = (unsigned long)kmap_local_page(nth_page(page, i));
 		flush_data_cache_page(addr);
 		kunmap_local((void *)addr);
 	}

Signature · 1 line

2.40.1

On SPARSEMEM without VMEMMAP, struct page is not guaranteed to be contiguous, since each memory section's memmap might be allocated independently. hugetlb pages can go beyond a memory section size, thus direct struct page manipulation on hugetlb pages/subpages might give wrong struct page. Kernel provides nth_page() to do the manipulation properly. Use that whenever code can see hugetlb pages.