Re: [PATCH v2 1/2] xen/page_alloc: verify buddy alignment in reserve_offlined_page()

[Jan Beulich <jbeulich@xxxxxxxx>]

On 03.06.2026 16:17, Bernhard Kaindl wrote:
> reserve_offlined_page() fails to verify alignment when growing
> buddies around offlined pages. Consequently, misaligned buddies
> may be constructed from non-offlined page ranges and returned to
> the free lists.
> 
> After a particular sequence of allocations and frees, pages
> from such a misaligned buddy may be allocated more than once,
> eventually triggering a Xen BUG() in alloc_heap_pages().
> 
> Fixes: e4865c2315 ('Page offline support in Xen side')
> Signed-off-by: Bernhard Kaindl <bernhard.kaindl@xxxxxxxxxx>
> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>

Oleksii, thoughts towards 4.22?

Jan

> ---
> v2:
> - Updated the title for clarity.
> - Bugfix isolated from the test case for backporting.
> - Removed excess parentheses from the alignment check if() expression.
> - Simplified the alignment check to use '& (1UL << cur_order)'. Because
>   the covering buddy head is size-aligned, cur_head is also aligned to
>   cur_order, making this reduction safe (verified against extended tests).
> - Updated the inline code comment to accurately state that only the upper
>   half of the next_order range is checked for offlined pages.
> ---
>  xen/common/page_alloc.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
> index 2c4ff2c34c70..2767376a710b 100644
> --- a/xen/common/page_alloc.c
> +++ b/xen/common/page_alloc.c
> @@ -1202,6 +1202,11 @@ static int reserve_offlined_page(struct page_info 
> *head)
>              if ( (cur_head + (1 << next_order)) >= (head + ( 1 << 
> head_order)) )
>                  goto merge;
>  
> +            /* Do not grow to next_order if cur_head is not aligned to it. */
> +            if ( mfn_x(page_to_mfn(cur_head)) & (1UL << cur_order) )
> +                goto merge;
> +
> +            /* Check for offlined pages in upper half of next_order range. */
>              for ( i = (1 << cur_order), pg = cur_head + (1 << cur_order );
>                    i < (1 << next_order);
>                    i++, pg++ )