From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout12.his.huawei.com (canpmsgout12.his.huawei.com [113.46.200.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9A16283C87 for ; Thu, 15 Jan 2026 07:55:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.227 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768463738; cv=none; b=gPK0TKOTX/Iro+ob7KurxWwyzldLaJc2tACW0O1CebzrPhSFnx5LTMdu/maioydONItGNhkWxkKVHQpwW3zCK4hIXlsBecoj/Ff9nHtAiw9sQgKj4q1DhLRtkSem176eMnFc0ArjmEMpscZB7nVrpHZ65KOHu989Jz1g0TMPl68= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768463738; c=relaxed/simple; bh=l/ndTzrv6kfQuJCs4qDBUNfMqlsKHuBVge7NLCgL58Q=; h=Subject:To:CC:References:From:Message-ID:Date:MIME-Version: In-Reply-To:Content-Type; b=hjte6GqAl2bTIdW4c+MlxsnxaYIAUZP8lVWO+OTd8xI+S1V3jgY+XCbCTixPVGSlfCOc8hmnAuo8cvquhrVJJwRyG2JwKPN4USW3D8Nr8OegACjZaqv1TuhOaw/Db+xT/7aCZzlRAeUVVhjcmcz0/gkKtzkES8lVrlUMSFQ9K0Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=1aXwVL7S; arc=none smtp.client-ip=113.46.200.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="1aXwVL7S" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=3LCkFVnIN3e5GhO01onT+0WWHPAZo4gI38LP5FKzlZQ=; b=1aXwVL7S63gAymZoQFKJ1etYX4xbsWQGN/rs/tZolZWju0V3gBptFEY4UO32fvMe+Exn9Cv2k 4ZUhiGJBHOF9ytXG/wzoVA6BpJyWZTzDxYxZWd/3Qk0aaVujl1JcPvUr910PwZjcMCOUQnCjNEx sK8e7k5vNsyaUGu22M5Vtuo= Received: from mail.maildlp.com (unknown [172.19.163.15]) by canpmsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4dsFZN3hGtznTXb; Thu, 15 Jan 2026 15:52:28 +0800 (CST) Received: from dggemv712-chm.china.huawei.com (unknown [10.1.198.32]) by mail.maildlp.com (Postfix) with ESMTPS id 3603A40539; Thu, 15 Jan 2026 15:55:28 +0800 (CST) Received: from kwepemq500010.china.huawei.com (7.202.194.235) by dggemv712-chm.china.huawei.com (10.1.198.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 15 Jan 2026 15:55:27 +0800 Received: from [10.173.125.37] (10.173.125.37) by kwepemq500010.china.huawei.com (7.202.194.235) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 15 Jan 2026 15:55:27 +0800 Subject: Re: [PATCH] mm/page_alloc: Fix freeing of failed-split poisoned compound pages To: Boudewijn van der Heide , , Jiaqi Yan CC: , , , , , , , , , References: <54CB622C-0BB0-4772-A939-162D63433A00@nvidia.com> <20260114144824.69960-1-boudewijn@delta-utec.com> From: Miaohe Lin Message-ID: Date: Thu, 15 Jan 2026 15:55:26 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 In-Reply-To: <20260114144824.69960-1-boudewijn@delta-utec.com> Content-Type: text/plain; charset="utf-8" Content-Language: en-US Content-Transfer-Encoding: 7bit X-ClientProxiedBy: kwepems500001.china.huawei.com (7.221.188.70) To kwepemq500010.china.huawei.com (7.202.194.235) On 2026/1/14 22:48, Boudewijn van der Heide wrote: >>> free_pages_prepare() only handles poisoned order-0 pages. >>> In memory_failure() (hard offline), pages >>> are poisoned before attempting to split huge pages. If the split fails, >>> the page remains a compound (order > 0) but is already poisoned. However, >>> Soft-offline pages are always poisoned as order-0 after migration, so >>> they are unaffected. >>> >>> The '!order' check causes these poisoned compound pages to skip >>> poison handling, leaving them in the buddy allocator. >>> >>> Worst case, a poisoned compound page could be reallocated, >>> potentially leading to crashes, silent data corruption, >>> or unwanted memory containment actions before the poison bit is detected. >>> >>> This patch removes the '&& !order' restriction. Cleanup functions in the >>> poison-handling block correctly handle non-zero order pages, making >>> this change safe. > >> This is not a fix. IIUC, for >0 order free pages, memory failure uses >> take_page_off_buddy() in a different code path. >> > > Thanks again for the quick response and clarification! >>>From my understanding, > you correctly noted that take_page_off_buddy() handles already-free pages, > removing them from the buddy lists and setting SetPageHWPoisonTakenOff(). > This prevents those pages from re-entering the buddy allocator. Thanks both. > > My concern is about in-use THP-backed compound pages: > 1. A compound page is in use. > 2. memory_failure() marks it poisoned (TestSetPageHWPoison). > 3. try_to_split_thp_page() fails. > 4. The process using the THP may be killed; > the page remains compound and poisoned. > 5. Later, when the page is finally freed, it reaches free_pages_prepare(); > 'take_page_off_buddy()' is not invoked in this path. Yes, this is also a problematic scenario for Hugetlb HugePage. And Jiaqi works on it now [1]. I think Jiaqi's patches might apply to THP scenario too. Add @Jiaqi to verify this. [1]: https://lore.kernel.org/all/20260112004923.888429-1-jiaqiyan@google.com/ Thanks. .