From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 67E293A383B; Wed, 1 Apr 2026 21:48:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775080120; cv=none; b=kabHktmUbI0sIraEV/zhudZZITtyyBnIu/cJkRPUAhuhN73O47DVmlBfpGhcXjixUibTtSsn1L/wk5LvfnbQTyBMTkXxWCYxyeuFkUJdVRCe3NIr72nmhsrpTAItuAzLz7wp8rd6raHGy7AVAqzAixhzW+rVc6SZ1G41edrfdgc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775080120; c=relaxed/simple; bh=DNJaCNZdFC80zGgJFtAuVlv2J8uV9wtsJdfASUh6qrI=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=p6TurSvwE38rugn5iPKmkf97zf5uUH62j9GauKd7saOrAF8yeyVZW87+Bs98KfiOlSoaXiuPGR2JVHmv+UEG8suRqcCrGZq2eazWj/CVO39XP6FeDVe4oKWMDupTav1ey+wE7MFlhwaRKL6ex7Kp1ZZMLqKiwSd3lYW9sW0lOf0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=oRoFhmas; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="oRoFhmas" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F860C4CEF7; Wed, 1 Apr 2026 21:48:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1775080120; bh=DNJaCNZdFC80zGgJFtAuVlv2J8uV9wtsJdfASUh6qrI=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=oRoFhmasNi1W+kf51MBZlPjvlrcjkvN/UGWInXlI3S+Xz5+GenIfIzdHhFXX6Y2H8 cMdQlm83BYIK82l+hreGER6Wn1Ati6ozJ00tJig6GLJiyT3A3oRrpFfEljAk51Azdh JFOu1iTB0R4bpScWLf39NP376IFOGgRPRDgRV4a8= Date: Wed, 1 Apr 2026 14:48:38 -0700 From: Andrew Morton To: Lance Yang Cc: david@kernel.org, ljs@kernel.org, ziy@nvidia.com, baolin.wang@linux.alibaba.com, Liam.Howlett@oracle.com, npache@redhat.com, ryan.roberts@arm.com, dev.jain@arm.com, baohua@kernel.org, matthew.brost@intel.com, joshua.hahnjy@gmail.com, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, apopple@nvidia.com, richard.weiyang@gmail.com, usama.arif@linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kartikey406@gmail.com, syzbot+a7067a757858ac8eb085@syzkaller.appspotmail.com, stable@vger.kernel.org Subject: Re: [PATCH mm-unstable 1/1] mm: fix deferred split queue races during migration Message-Id: <20260401144838.e07cebebb625b2810257c2ec@linux-foundation.org> In-Reply-To: <20260401131032.13011-1-lance.yang@linux.dev> References: <20260401131032.13011-1-lance.yang@linux.dev> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Wed, 1 Apr 2026 21:10:32 +0800 Lance Yang wrote: > From: Lance Yang > > migrate_folio_move() records the deferred split queue state from src and > replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) > makes dst visible before it is requeued, so a concurrent rmap-removal path > can mark dst partially mapped and trip the WARN in deferred_split_folio(). > > Move the requeue before remove_migration_ptes() so dst is back on the > deferred split queue before it becomes visible again. > > Because migration still holds dst locked at that point, teach > deferred_split_scan() to requeue a folio when folio_trylock() fails. > Otherwise a fully mapped underused folio can be dequeued by the shrinker > and silently lost from split_queue. Thanks. > Link: https://syzkaller.appspot.com/bug?extid=a7067a757858ac8eb085 > Fixes: 8a8ca142a488 ("mm: migrate: requeue destination folio on deferred split queue") > Reported-by: syzbot+a7067a757858ac8eb085@syzkaller.appspotmail.com > Closes: https://lore.kernel.org/linux-mm/69ccb65b.050a0220.183828.003a.GAE@google.com/ > Cc: > Suggested-by: David Hildenbrand (Arm) > Signed-off-by: Lance Yang I'll add this to mm-unstable with a plan to move it into the current mm-stable batch in a few days. So that 8a8ca142a488 and this follow-up fix stay in the same bundle. > [ Backport note ] > This patch is a follow-up fix for 8a8ca142a488 ("mm: migrate: requeue > destination folio on deferred split queue"), which is currently only in > mm-stable, and should be backported together with it. As far as I understand it, this should happen automatically. 8a8ca142a488 has cc:stable, this patch has Fixes:8a8ca142a488 and also cc:stable. There's enough info here for the -stable people to figure it out!