Re: [PATCH v2] mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb

Andrew Morton
2026-03-21T02:50:23Z

On Sat, 21 Mar 2026 10:10:31 +0800 Jinjiang Tu <tujinjiang@huawei.com> wrote:

> When a file hugetlb folio triggers UCE, me_huge_page() will keep the
> hugetlb folio in pagcahe with refcount increased and PG_hwpoison set. Even
> after the hugetlb file is deleted, the hugetlb folio is still leaked.
>
> If we want to offline the memory block that the hwpoisoned hugetlb folio
> belongs to, it fails in dissolve_free_hugetlb_folios() due to the
> hwpoisoned hugetlb folio isn't free.
>
> I can reproduce this issue with the following steps in qemu:
> 1) echo offline >/sys/devices/system/memory/auto_online_blocks
> 2) in qemu monitor:
> object_add memory-backend-ram,id=mem10,size=1G
> device_add pc-dimm,id=dimm1,memdev=mem10,node=2
> 3) echo online_movable > /sys/devices/system/node/node2/memory136/state
> 4) echo 5 > /sys/devices/system/node/node2/hugepages/hugepages-2048kB/nr_hugepages
> 5) run ./hugetlb_file. This process will receive SIGBUS.
> 6) remove the hugetlbfs file.
> 7) echo offline > /sys/devices/system/node/node2/memory136/state
>
> hugetlb_file.c:
> fd = open("/dev/hugepages/my_hugepage_file", O_CREAT | O_RDWR, 0755);
> fallocate(fd, 0, 0, HUGEPAGE_SIZE * 2);
> addr = mmap(NULL, HUGEPAGE_SIZE * 2, PROT_READ | PROT_WRITE,
> MAP_SHARED | MAP_HUGETLB, fd, 0);
> memset(addr, 0xaa, HUGEPAGE_SIZE * 2);
> madvise(addr, HUGEPAGE_SIZE, MADV_HWPOISON);
>
> To fix it, force to put ref of hwpoisoned hugetlb in memory offline, the
> hwpoisoned hugetlb will be freed and succeeds to be dissolved. We couldn't
> avoid races here, just like commit b023f46813cd ("memory-hotplug: skip
> HWPoisoned page when offlining pages"), which force to skip hwpoisoned
> page regardless of refcount.
>

It would be nice to know what changed since v1 and why, although the
patch is super-tiny so I guess that doesn't matter much.

AI review has a question regarding the v1 patch: