[PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()

[PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()

[Bing Jiao]

Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
demote_folio_list()") refactored the selection logic for demotion target
nodes. However, it removed the initial assignment of 'target_nid' while
leaving a premature check for 'NUMA_NO_NODE' in place.

Since 'target_nid' is now assigned further down in the function based on
preferred and allowed node masks, the initial check at line 1046 is
redundant.

Remove the redundant check to resolve the compiler warning.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
 mm/vmscan.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 213ee75b3306..590ab3ec1998 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1044,10 +1044,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
 	if (list_empty(demote_folios))
 		return 0;

-	if (target_nid == NUMA_NO_NODE)
-		/* No lower-tier nodes or nodes were hot-unplugged. */
-		return 0;
-
 	node_get_allowed_targets(pgdat, &allowed_mask);
 	mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
 	if (nodes_empty(allowed_mask))
--
2.52.0.457.g6b5491de43-goog

[PATCH v1] mm/vmscan: fix uninitialized variable in demote_folio_list()

[Bing Jiao]

Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
demote_folio_list()") refactored the selection logic for demotion target
nodes. However, it removed the initial assignment of 'target_nid' while
leaving a premature check for 'NUMA_NO_NODE' in place.

Since 'target_nid' is now assigned further down in the function based on
preferred and allowed node masks, the initial check at line 1046 is
redundant.

Remove the redundant check to resolve the compiler warning.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
 mm/vmscan.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 213ee75b3306..590ab3ec1998 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1044,10 +1044,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
 	if (list_empty(demote_folios))
 		return 0;

-	if (target_nid == NUMA_NO_NODE)
-		/* No lower-tier nodes or nodes were hot-unplugged. */
-		return 0;
-
 	node_get_allowed_targets(pgdat, &allowed_mask);
 	mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
 	if (nodes_empty(allowed_mask))
--
2.52.0.457.g6b5491de43-goog

Re: [PATCH v1] mm/vmscan: fix uninitialized variable in demote_folio_list()

[Bing Jiao]

On Fri, Jan 09, 2026 at 06:06:21AM +0000, Bing Jiao wrote:
> Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
> demote_folio_list()") refactored the selection logic for demotion target
> nodes. However, it removed the initial assignment of 'target_nid' while
> leaving a premature check for 'NUMA_NO_NODE' in place.
>
> Since 'target_nid' is now assigned further down in the function based on
> preferred and allowed node masks, the initial check at line 1046 is
> redundant.
>
> Remove the redundant check to resolve the compiler warning.
>
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
> Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
> Signed-off-by: Bing Jiao <bingjiao@google.com>
> ---
>  mm/vmscan.c | 4 ----
>  1 file changed, 4 deletions(-)
>
> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index 213ee75b3306..590ab3ec1998 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -1044,10 +1044,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
>  	if (list_empty(demote_folios))
>  		return 0;
>
> -	if (target_nid == NUMA_NO_NODE)
> -		/* No lower-tier nodes or nodes were hot-unplugged. */
> -		return 0;
> -
>  	node_get_allowed_targets(pgdat, &allowed_mask);
>  	mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
>  	if (nodes_empty(allowed_mask))
> --

Hi Andrew,

Sorry for bother you again in my patch series.

The fix is a simple removal of a redundant, premature check that
was using 'target_nid' before its new initialization point, which
is reported by the kernel test.

I am not sure whether it is a good idead to send a standalone patch
to fix it. Maybe it is likely easier to process.
However, if you would like replace the series Commit d92027a5f30a6c
("mm/vmscan: select the closest preferred node in demote_folio_list()")
entirely to keep the versioning consistent, I can send an v8 version.

Thanks for your time on this patch series.

Best regards,
Bing Jiao

Re: [PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()

[SeongJae Park]

On Fri,  9 Jan 2026 05:59:37 +0000 Bing Jiao <bingjiao@google.com> wrote:

> Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
> demote_folio_list()") refactored the selection logic for demotion target
> nodes. However, it removed the initial assignment of 'target_nid' while
> leaving a premature check for 'NUMA_NO_NODE' in place.
> 
> Since 'target_nid' is now assigned further down in the function based on
> preferred and allowed node masks, the initial check at line 1046 is
> redundant.
> 
> Remove the redundant check to resolve the compiler warning.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
> Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")

Seems the broken commit is on mm-new, and therefore no need to Cc stable@.  I
think explicitly clarifying that would be nice.  Also, as this fixup may need
to be squashed into the broken commit before it is pulled into the mainline,
sending this kind of fixup as a reply to the patch mail [1] of the commit would
also be nice, and usual in mm.

[1] https://lkml.kernel.org/r/20260108033248.2791579-3-bingjiao@google.com

> Signed-off-by: Bing Jiao <bingjiao@google.com>

Reviewed-by: SeongJae Park <sj@kernel.org>


Thanks,
SJ

[...]

Re: [PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()

[Bing Jiao]

On Fri, Jan 09, 2026 at 05:28:11PM -0800, SeongJae Park wrote:
> On Fri,  9 Jan 2026 05:59:37 +0000 Bing Jiao <bingjiao@google.com> wrote:
>
> > Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
> > demote_folio_list()") refactored the selection logic for demotion target
> > nodes. However, it removed the initial assignment of 'target_nid' while
> > leaving a premature check for 'NUMA_NO_NODE' in place.
> >
> > Since 'target_nid' is now assigned further down in the function based on
> > preferred and allowed node masks, the initial check at line 1046 is
> > redundant.
> >
> > Remove the redundant check to resolve the compiler warning.
> >
> > Reported-by: kernel test robot <lkp@intel.com>
> > Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
> > Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
>
> Seems the broken commit is on mm-new, and therefore no need to Cc stable@.  I
> think explicitly clarifying that would be nice.  Also, as this fixup may need
> to be squashed into the broken commit before it is pulled into the mainline,
> sending this kind of fixup as a reply to the patch mail [1] of the commit would
> also be nice, and usual in mm.
>
> [1] https://lkml.kernel.org/r/20260108033248.2791579-3-bingjiao@google.com
>
> > Signed-off-by: Bing Jiao <bingjiao@google.com>
>
> Reviewed-by: SeongJae Park <sj@kernel.org>
>
>
> Thanks,
> SJ
>
> [...]

Hi SeongJae,

Thank you for the review and suggestions! The patch has sent to the patch
mail you mentioned.

Have a great weekend!

Best regards,
Bing

[PATCH v7 2/2] mm/vmscan: select the closest preferred node in demote_folio_list()

[Bing Jiao]

The preferred demotion node (migration_target_control.nid) should be
the one closest to the source node to minimize migration latency.
Currently, a discrepancy exists where demote_folio_list() randomly
selects an allowed node if the preferred node from next_demotion_node()
is not set in mems_allowed.

To address it, update next_demotion_node() to return preferred nodes,
allowing the caller to select the preferred one.
Also update demote_folio_list() to traverse the demotion targets
hierarchically until a preferred node within mems_allowed is found.
It ensures that the selected demotion target is consistently
the closest available node.

Signed-off-by: Bing Jiao <bingjiao@google.com>
---
 include/linux/memory-tiers.h |  6 +++---
 mm/memory-tiers.c            | 11 +++++++----
 mm/vmscan.c                  | 25 ++++++++++++++++++++++---
 3 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/include/linux/memory-tiers.h b/include/linux/memory-tiers.h
index 7a805796fcfd..87652042f2c2 100644
--- a/include/linux/memory-tiers.h
+++ b/include/linux/memory-tiers.h
@@ -53,11 +53,11 @@ struct memory_dev_type *mt_find_alloc_memory_type(int adist,
 						  struct list_head *memory_types);
 void mt_put_memory_types(struct list_head *memory_types);
 #ifdef CONFIG_MIGRATION
-int next_demotion_node(int node);
+int next_demotion_node(int node, nodemask_t *preferred_nodes);
 void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets);
 bool node_is_toptier(int node);
 #else
-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, nodemask_t *preferred_nodes)
 {
 	return NUMA_NO_NODE;
 }
@@ -101,7 +101,7 @@ static inline void clear_node_memory_type(int node, struct memory_dev_type *memt

 }

-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, nodemask_t *preferred_nodes)
 {
 	return NUMA_NO_NODE;
 }
diff --git a/mm/memory-tiers.c b/mm/memory-tiers.c
index 864811fff409..286e4b5fa0e5 100644
--- a/mm/memory-tiers.c
+++ b/mm/memory-tiers.c
@@ -320,13 +320,14 @@ void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets)
 /**
  * next_demotion_node() - Get the next node in the demotion path
  * @node: The starting node to lookup the next node
+ * @preferred_nodes: The pointer to nodemask of all preferred nodes to return
  *
  * Return: node id for next memory node in the demotion path hierarchy
- * from @node; NUMA_NO_NODE if @node is terminal.  This does not keep
- * @node online or guarantee that it *continues* to be the next demotion
- * target.
+ * from @node; NUMA_NO_NODE if @node is terminal. Also returns all preferred
+ * nodes in @preferred_nodes. This does not keep @node online or guarantee
+ * that it *continues* to be the next demotion target.
  */
-int next_demotion_node(int node)
+int next_demotion_node(int node, nodemask_t *preferred_nodes)
 {
 	struct demotion_nodes *nd;
 	int target;
@@ -357,6 +358,8 @@ int next_demotion_node(int node)
 	 * target node randomly seems better until now.
 	 */
 	target = node_random(&nd->preferred);
+	if (preferred_nodes)
+		nodes_copy(*preferred_nodes, nd->preferred);
 	rcu_read_unlock();

 	return target;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 94ff5aa7c4fb..213ee75b3306 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1024,9 +1024,10 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
 				      struct pglist_data *pgdat,
 				      struct mem_cgroup *memcg)
 {
-	int target_nid = next_demotion_node(pgdat->node_id);
+	int target_nid;
 	unsigned int nr_succeeded;
 	nodemask_t allowed_mask;
+	nodemask_t preferred;

 	struct migration_target_control mtc = {
 		/*
@@ -1052,8 +1053,26 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
 	if (nodes_empty(allowed_mask))
 		return 0;

-	if (!node_isset(target_nid, allowed_mask))
-		target_nid = node_random(&allowed_mask);
+	target_nid = next_demotion_node(pgdat->node_id, &preferred);
+	while (target_nid != NUMA_NO_NODE &&
+	       !node_isset(target_nid, allowed_mask)) {
+		/* Filter out preferred nodes that are not in allowed. */
+		nodes_and(preferred, preferred, allowed_mask);
+		if (!nodes_empty(preferred)) {
+			/* Randomly select one node from preferred. */
+			target_nid = node_random(&preferred);
+			break;
+		}
+		/*
+		 * Preferred nodes in the lower tier are not set in allowed.
+		 * Recursively get preferred from the next lower tier.
+		 */
+		target_nid = next_demotion_node(target_nid, &preferred);
+	}
+
+	if (target_nid == NUMA_NO_NODE)
+		/* Nodes are gone (e.g., hot-unplugged). */
+		return 0;
 	mtc.nid = target_nid;

 	/* Demotion ignores all cpuset and mempolicy settings */
--
2.52.0.457.g6b5491de43-goog

[PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()

[Bing Jiao]

Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
demote_folio_list()") refactored the selection logic for demotion target
nodes. However, it removed the initial assignment of 'target_nid' while
leaving a premature check for 'NUMA_NO_NODE' in place.

Since 'target_nid' is now assigned further down in the function based on
preferred and allowed node masks, the initial check at line 1046 is
redundant.

Remove the redundant check to resolve the compiler warning.

Link: https://lkml.kernel.org/r/20260109055937.3739860-1-bingjiao@google.com
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
---

Hi Andrew,

Sorry for bother you again in my patch series.

There is a broken commit in mm-new branch, which is introduced by this
patch series, Commit d92027a5f30a6c ("mm/vmscan: select the closest
preferred node in demote_folio_list()").

As the broken commit is currently only in *mm-new*, could you please
squash the fix into the broken commit before it is pulled into
the mainline?

Thanks for your time!

Best regards,
Bing

---
 mm/vmscan.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 213ee75b3306..590ab3ec1998 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1044,10 +1044,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
 	if (list_empty(demote_folios))
 		return 0;

-	if (target_nid == NUMA_NO_NODE)
-		/* No lower-tier nodes or nodes were hot-unplugged. */
-		return 0;
-
 	node_get_allowed_targets(pgdat, &allowed_mask);
 	mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
 	if (nodes_empty(allowed_mask))
--
2.52.0.457.g6b5491de43-goog

[PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()

[Bing Jiao]

Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
demote_folio_list()") refactored the selection logic for demotion target
nodes. However, it removed the initial assignment of 'target_nid' while
leaving a premature check for 'NUMA_NO_NODE' in place.

Since 'target_nid' is now assigned further down in the function based on
preferred and allowed node masks, the initial check at line 1046 is
redundant.

Remove the redundant check to resolve the compiler warning.

Link: https://lkml.kernel.org/r/20260109055937.3739860-1-bingjiao@google.com
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
---

Hi Andrew,

Sorry for bother you again in my patch series.

There is a broken commit in mm-new branch, which is introduced by this
patch series, Commit d92027a5f30a6c ("mm/vmscan: select the closest
preferred node in demote_folio_list()").

As the broken commit is currently only in *mm-new*, could you please
squash the fix into the broken commit before it is pulled into
the mainline?

Thanks for your time!

Best regards,
Bing

---
 mm/vmscan.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 213ee75b3306..590ab3ec1998 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1044,10 +1044,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
 	if (list_empty(demote_folios))
 		return 0;

-	if (target_nid == NUMA_NO_NODE)
-		/* No lower-tier nodes or nodes were hot-unplugged. */
-		return 0;
-
 	node_get_allowed_targets(pgdat, &allowed_mask);
 	mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
 	if (nodes_empty(allowed_mask))
--
2.52.0.457.g6b5491de43-goog