From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=115.124.30.111 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793600420; b=AJYfjY3wPlXpdnmwDNtToCa8EgiK7M1yePuIPAZqqDehajioR08Alnt7bQr1grtzEXu2 +ImenWtq9n6kDoDHx4HNq/XlhyrLczlGQangOTNf2WvKhUOX0J/SsWnoqkJ7YwpDt76Aj h4UMP5DMhaFOwbubHN87YnLfpybZpSc5GQTcpU46a9K7yiZIS+mRTkjGQbtityi0XchUa k951JCFqx+JhQm2xGD64N/t7f2It/mxTJ9Ekmn8FTaQN+SyULeSPPdbCbR6/ke9neFHi9 dv77yGP3g5tOpvlbULaL3XNTVhqwL0DxEbUZ7YJD/1w0vbnknyvwqU/aMVQDrhpJv6g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793600420; h=DMARC-Filter:DKIM-Signature:X-Alimail-AntiSpam:Received:Message-ID: Date:MIME-Version:User-Agent:Subject:To:Cc:References:From: In-Reply-To:Content-Type:Content-Transfer-Encoding; bh=k85vwGun/ME58WuhAJ471wGe1ShuWGkpnjyDxU6NW6s=; b=DXp9q+jImK1yH4Rp1Qx3dDqRF0smzJBcMxdeYD+Ubn4yEfu0IGY6jJWRoZONvHz4aDRY iyJbwGt8OguMOcqISbI7cQnqeFFvjVrgKJLJoJRGiA8MahLr3aOL2FjRr3xnBQSizb+Yo QubRFBnArAqWf2Y7d6zJiqrpXGsSCzbWrEcb/oabbaFBmC0dXldlX2/06VojjS5MPi9ty CDDHy6PzrUcoeXD7WQSZjJz84C6Lbtaz8rqxEQNZNZT0clAbpMWly1CsmVg7ApuGejdCq +gCrmxhyljB8TUrT5l+aW72DMGXxeRwgpZ+GDrZ1lxjUMreLq++BKjcItXDDu7wuzJA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass header.d=linux.alibaba.com header.i=@linux.alibaba.com header.a=rsa-sha256 header.s=default header.b=YYcFwmTi; arc=none smtp.remote-ip=115.124.30.111 Received: from out30-111.freemail.mail.aliyun.com (out30-111.freemail.mail.aliyun.com [115.124.30.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E4EA606A32F; Mon, 2 Nov 2026 06:20:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 2E4EA606A32F Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.a=rsa-sha256 header.s=default header.b=YYcFwmTi DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1793600413; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=k85vwGun/ME58WuhAJ471wGe1ShuWGkpnjyDxU6NW6s=; b=YYcFwmTif2MUle3G2fE4vTBfFxymZ/6Wm/kSqmMfYd4zpHXpazL0oP+iFcGBEjDmOtH0s8ExDjnOTWNQtw1bgB/HSZfRWpsf/vmvfmoWxZgTq8Txx2CVtdKBSj5GXuAcRgUyVtEgjZQnyedY+A4vUqnWsCa8mrCCfNehGjuYvAA= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R601e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037026112;MF=baolin.wang@linux.alibaba.com;NM=1;PH=DS;RN=67;SR=0;TI=SMTPD_---0XDunP4-_1793600408; Received: from 30.74.144.167(mailfrom:baolin.wang@linux.alibaba.com fp:SMTPD_---0XDunP4-_1793600408 cluster:ay36) by smtp.aliyun-inc.com; Mon, 02 Nov 2026 14:20:09 +0800 Message-ID: <2fd4f929-d7e1-4deb-b3c7-4bdc611e789b@linux.alibaba.com> Date: Mon, 2 Nov 2026 14:20:07 +0800 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 10/47] mm/huge_memory: fix list corruption when deferred_split_scan() races with deferred_split_folio() To: "David Hildenbrand (Arm)" , Andrew Morton , Johannes Weiner , Michal Hocko , Qi Zheng , Shakeel Butt , Lorenzo Stoakes , Kairui Song , Barry Song , Axel Rasmussen , Yuanchu Xie , Wei Xu , Baoquan He , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Kees Cook , Peter Zijlstra , Jann Horn , Pedro Falcato , Hugh Dickins , Pasha Tatashin , Pratyush Yadav , "Matthew Wilcox (Oracle)" , Jan Kara , Zi Yan , Lance Yang , Rik van Riel , Harry Yoo , Alistair Popple , Nico Pache , Ryan Roberts , Dev Jain , Usama Arif , Kiryl Shutsemau , Matthew Brost , John Hubbard , Peter Xu , Will Deacon , "Aneesh Kumar K.V" , Nick Piggin , Oscar Salvador , Minchan Kim , Muchun Song , Xu Xin , Chengming Zhou , Chris Li , Kemeng Shi , Nhat Pham , Youngjun Park , Gregory Price , Joshua Hahn , Rakie Kim , Ying Huang , Jason Gunthorpe Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-cxl@vger.kernel.org, stable@vger.kernel.org, Josef Bacik , Mani Tofigh , Muhammad Usama Anjum References: <20261031-fixes_core-v3-0-d6437171ecc3@kernel.org> <20261031-fixes_core-v3-10-d6437171ecc3@kernel.org> From: Baolin Wang In-Reply-To: <20261031-fixes_core-v3-10-d6437171ecc3@kernel.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 10/31/26 5:39 PM, David Hildenbrand (Arm) wrote: > Since the deferred split queue became a list_lru, the isolate callback > moves the folios it took a reference on to an on-stack list, linked > through folio->_deferred_list, and deferred_split_scan() takes them off > that list with list_del_init() without holding the list_lru lock. > > deferred_split_folio() does not know about the on-stack list. It only > holds the list_lru lock when it looks at the same list_head, and it can > run for such a folio: a THP is queued when it is mapped, as a candidate > for the underused check, and is queued "again" when a part of it gets > unmapped: > > CPU0 deferred_split_scan() CPU1 deferred_split_folio() > list_del_init(&folio->_deferred_list) > next->prev = prev > prev->next = next > entry->next = entry > list_lru_lock_irqsave() > folio_set_partially_mapped() > __list_lru_add() > list_empty(item) -> true > list_add_tail(item, &l->list) > item->next = &l->list > item->prev = tail > entry->prev = entry > > The folio now sits on the list_lru with ->prev pointing to itself. The > next removal leaves the neighbours pointing to it, and they still do so > after the folio has been freed. With CONFIG_DEBUG_LIST: > > list_del corruption. prev->next should be ffd4000000270090, but was > ffd4000000278090. (prev=ffd4000000270090) > > Fix it by grabbing the lock around list_del_init() so > deferred_split_folio() cannot race with it. > > Fixes: fafaeceb89a5 ("mm: switch deferred split shrinker to list_lru") > Cc: stable@vger.kernel.org > Reported-by: Josef Bacik > Reviewed-by: Johannes Weiner > Reviewed-by: Mani Tofigh > Tested-by: Mani Tofigh > Reviewed-by: Lance Yang > Tested-by: Muhammad Usama Anjum > Signed-off-by: David Hildenbrand (Arm) > --- LGTM. Reviewed-by: Baolin Wang