The stable_tree_search() function may return an error pointer (NULL or ERR_PTR(...)). The current code does not check for these cases before dereferencing the returned value. Gaosheng once added the necessary check in commit 98c3ca0015b8 ("ksm: convert cmp_and_merge_page() to use a folio"), but it seems the check was lost during the process of being merged into the mainline. Fixes: 98c3ca0015b8 ("ksm: convert cmp_and_merge_page() to use a folio") Signed-off-by: Fushuai Wang --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index 160787bb121c..7aa9b2829a7b 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -2272,7 +2272,8 @@ static void cmp_and_merge_page(struct page *page, struct ksm_rmap_item *rmap_ite /* Start by searching for the folio in the stable tree */ kfolio = stable_tree_search(page); - if (&kfolio->page == page && rmap_item->head == stable_node) { + if (!IS_ERR_OR_NULL(kfolio) && &kfolio->page == page && + rmap_item->head == stable_node) { folio_put(kfolio); return; } -- 2.36.1