From: Andrew Morton <akpm@linux-foundation.org>
To: Jinjiang Tu <tujinjiang@huawei.com>
Cc: <david@kernel.org>, <lorenzo.stoakes@oracle.com>,
<Liam.Howlett@oracle.com>, <vbabka@kernel.org>, <rppt@kernel.org>,
<surenb@google.com>, <mhocko@suse.com>, <baohua@kernel.org>,
<ryan.roberts@arm.com>, <linux-mm@kvack.org>,
<wangkefeng.wang@huawei.com>, <sunnanyong@huawei.com>
Subject: Re: [PATCH v3] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
Date: Thu, 19 Mar 2026 19:31:57 -0700 [thread overview]
Message-ID: <20260319193157.7cacc7b6628e94ff62541c34@linux-foundation.org> (raw)
In-Reply-To: <d9d50263-a69f-4a16-b409-caeec93c423a@huawei.com>
On Fri, 20 Mar 2026 09:52:42 +0800 Jinjiang Tu <tujinjiang@huawei.com> wrote:
> >> In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
> >> are visible before the tail page becomes non-compound. smp_wmb() should
> >> be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a
> >> result, if zap_nonpresent_ptes() accesses migration entry that stores
> >> tail pfn, softleaf_to_folio() may see the updated compound_head of tail
> >> page before page->flags.
> > Please describe the userspace-visible runtime effects of this bug.
>
> This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio().
>
> This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"),
> which in merged in v6.19-rc1.
Great, thanks, I added cc:stable.
next prev parent reply other threads:[~2026-03-20 2:32 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-19 1:25 Jinjiang Tu
2026-03-19 8:49 ` David Hildenbrand (Arm)
2026-03-19 22:51 ` Andrew Morton
2026-03-20 1:52 ` Jinjiang Tu
2026-03-20 2:31 ` Andrew Morton [this message]
2026-03-20 8:10 ` David Hildenbrand (Arm)
2026-03-20 8:56 ` Jinjiang Tu
2026-03-20 9:57 ` Lorenzo Stoakes (Oracle)
2026-03-20 10:22 ` David Hildenbrand (Arm)
2026-03-20 10:13 ` Lorenzo Stoakes (Oracle)
2026-03-21 2:40 ` Jinjiang Tu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260319193157.7cacc7b6628e94ff62541c34@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=Liam.Howlett@oracle.com \
--cc=baohua@kernel.org \
--cc=david@kernel.org \
--cc=linux-mm@kvack.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=mhocko@suse.com \
--cc=rppt@kernel.org \
--cc=ryan.roberts@arm.com \
--cc=sunnanyong@huawei.com \
--cc=surenb@google.com \
--cc=tujinjiang@huawei.com \
--cc=vbabka@kernel.org \
--cc=wangkefeng.wang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox