mm/huge_memory: fix NULL pointer deference when splitting folio
authorWei Yang <richard.weiyang@gmail.com>
Wed, 19 Nov 2025 23:53:02 +0000 (23:53 +0000)
committerAndrew Morton <akpm@linux-foundation.org>
Mon, 24 Nov 2025 22:25:17 +0000 (14:25 -0800)
commitcff47b9e39a6abf03dde5f4f156f841b0c54bba0
tree9e3e9b43b8a09c18c308a2903aa005bd01f69c47
parent6c96c6bd2c71fc7ee08580388a3a4a459019c320
mm/huge_memory: fix NULL pointer deference when splitting folio

Commit c010d47f107f ("mm: thp: split huge page to any lower order pages")
introduced an early check on the folio's order via mapping->flags before
proceeding with the split work.

This check introduced a bug: for shmem folios in the swap cache and
truncated folios, the mapping pointer can be NULL.  Accessing
mapping->flags in this state leads directly to a NULL pointer dereference.

This commit fixes the issue by moving the check for mapping != NULL before
any attempt to access mapping->flags.

Link: https://lkml.kernel.org/r/20251119235302.24773-1-richard.weiyang@gmail.com
Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages")
Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm/huge_memory.c