On 2023/3/5 3:39, SeongJae Park wrote:
damon_pa_young() is accessing a folio via folio_size() after folio_put() for the folio has invoked. Fix it.
Reviewed-by: Kefeng Wang wangkefeng.wang@huawei.com
Fixes: 397b0c3a584b ("mm/damon/paddr: remove folio_sz field from damon_pa_access_chk_result") Cc: stable@vger.kernel.org # 6.3.x Signed-off-by: SeongJae Park sj@kernel.org
mm/damon/paddr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c index 3fda00a0f786..10f159b315ea 100644 --- a/mm/damon/paddr.c +++ b/mm/damon/paddr.c @@ -130,7 +130,6 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz) accessed = false; else accessed = true;
folio_put(folio);@@ -144,10 +143,10 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz) if (need_lock) folio_unlock(folio);
- folio_put(folio);
out: *folio_sz = folio_size(folio);
- folio_put(folio); return accessed; }