tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mm: fix deferred split queue races during migration

migrate_folio_move() records the deferred split queue state from src and
replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0)
makes dst visible before it is requeued, so a concurrent rmap-removal path
can mark dst partially mapped and trip the WARN in deferred_split_folio().

Move the requeue before remove_migration_ptes() so dst is back on the
deferred split queue before it becomes visible again.

Because migration still holds dst locked at that point, teach
deferred_split_scan() to requeue a folio when folio_trylock() fails.
Otherwise a fully mapped underused folio can be dequeued by the shrinker
and silently lost from split_queue.

[ziy@nvidia.com: move the comment]
Link: https://lkml.kernel.org/r/FB71A764-0F10-4E5A-B4A0-BA4C7F138408@nvidia.com
Link: https://syzkaller.appspot.com/bug?extid=a7067a757858ac8eb085
Link: https://lkml.kernel.org/r/20260401131032.13011-1-lance.yang@linux.dev
Fixes: 8a8ca142a488 ("mm: migrate: requeue destination folio on deferred split queue")
Signed-off-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reported-by: syzbot+a7067a757858ac8eb085@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-mm/69ccb65b.050a0220.183828.003a.GAE@google.com/
Suggested-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Byungchul Park <byungchul@sk.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Deepanshu Kartikey <kartikey406@gmail.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Lance Yang and committed by
Andrew Morton 3bac0116 5a620198

+19 -14
+10 -5
mm/huge_memory.c
··· 4542 4542 goto next; 4543 4543 } 4544 4544 if (!folio_trylock(folio)) 4545 - goto next; 4545 + goto requeue; 4546 4546 if (!split_folio(folio)) { 4547 4547 did_split = true; 4548 4548 if (underused) ··· 4551 4551 } 4552 4552 folio_unlock(folio); 4553 4553 next: 4554 + /* 4555 + * If thp_underused() returns false, or if split_folio() 4556 + * succeeds, or if split_folio() fails in the case it was 4557 + * underused, then consider it used and don't add it back to 4558 + * split_queue. 4559 + */ 4554 4560 if (did_split || !folio_test_partially_mapped(folio)) 4555 4561 continue; 4562 + requeue: 4556 4563 /* 4557 - * Only add back to the queue if folio is partially mapped. 4558 - * If thp_underused returns false, or if split_folio fails 4559 - * in the case it was underused, then consider it used and 4560 - * don't add it back to split_queue. 4564 + * Add back partially mapped folios, or underused folios that 4565 + * we could not lock this round. 4561 4566 */ 4562 4567 fqueue = folio_split_queue_lock_irqsave(folio, &flags); 4563 4568 if (list_empty(&folio->_deferred_list)) {
+9 -9
mm/migrate.c
··· 1384 1384 goto out; 1385 1385 1386 1386 /* 1387 + * Requeue the destination folio on the deferred split queue if 1388 + * the source was on the queue. The source is unqueued in 1389 + * __folio_migrate_mapping(), so we recorded the state from 1390 + * before move_to_new_folio(). 1391 + */ 1392 + if (src_deferred_split) 1393 + deferred_split_folio(dst, src_partially_mapped); 1394 + 1395 + /* 1387 1396 * When successful, push dst to LRU immediately: so that if it 1388 1397 * turns out to be an mlocked page, remove_migration_ptes() will 1389 1398 * automatically build up the correct dst->mlock_count for it. ··· 1407 1398 1408 1399 if (old_page_state & PAGE_WAS_MAPPED) 1409 1400 remove_migration_ptes(src, dst, 0); 1410 - 1411 - /* 1412 - * Requeue the destination folio on the deferred split queue if 1413 - * the source was on the queue. The source is unqueued in 1414 - * __folio_migrate_mapping(), so we recorded the state from 1415 - * before move_to_new_folio(). 1416 - */ 1417 - if (src_deferred_split) 1418 - deferred_split_folio(dst, src_partially_mapped); 1419 1401 1420 1402 out_unlock_both: 1421 1403 folio_unlock(dst);