Re: [PATCH] mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb

[Jinjiang Tu <tujinjiang@huawei.com>]

在 2026/3/20 11:03, Miaohe Lin 写道:
> On 2026/3/20 10:43, Jinjiang Tu wrote:
>> 在 2026/3/20 10:34, Miaohe Lin 写道:
>>> On 2026/3/18 10:07, Jinjiang Tu wrote:
>>>> When a file hugetlb folio triggers UCE, me_huge_page() will keep the
>>>> hugetlb folio in pagcahe with refcount increased and PG_hwpoison set. Even
>>>> after the hugetlb file is deleted, the hugetlb folio is still leaked.
>>>>
>>>> If we want to offline the memory block that the hwpoisoned hugetlb folio
>>>> belongs to, it fails in dissolve_free_hugetlb_folios() due to the
>>>> hwpoisoned hugetlb folio isn't free.
>>>>
>>>> I can reproduce this issue with the following steps in qemu:
>>>>    1) echo offline >/sys/devices/system/memory/auto_online_blocks
>>>>    2) in qemu monitor:
>>>>          object_add memory-backend-ram,id=mem10,size=1G
>>>>          device_add pc-dimm,id=dimm1,memdev=mem10,node=2
>>>>    3) echo online_movable > /sys/devices/system/node/node2/memory136/state
>>>>    4) echo 5 > /sys/devices/system/node/node2/hugepages/hugepages-2048kB/nr_hugepages
>>>>    5) run ./hugetlb_file. This process will receive SIGBUS.
>>>>    6) remove the hugetlbfs file.
>>>>    7) echo offline > /sys/devices/system/node/node2/memory136/state
>>>>
>>>> hugetlb_file.c:
>>>>     fd = open("/dev/hugepages/my_hugepage_file", O_CREAT | O_RDWR, 0755);
>>>>     fallocate(fd, 0, 0, HUGEPAGE_SIZE * 2);
>>>>     addr = mmap(NULL, HUGEPAGE_SIZE * 2, PROT_READ | PROT_WRITE,
>>>>          MAP_SHARED | MAP_HUGETLB, fd, 0);
>>>>     memset(addr, 0xaa, HUGEPAGE_SIZE * 2);
>>>>     madvise(addr, HUGEPAGE_SIZE, MADV_HWPOISON);
>>>>
>>>> To fix it, when deleting hugetlb folio from pagecache, mark the hugetlb
>>>> folio temporary, and put the refcount increased by memory-failure. After
>>>> the hugetlb folio is deleted from pagecache, the refcount is decreased to
>>>> zero and the hugetlb folio is dissolved.
>>> Thanks for your patch.
>>>
>>>> Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
>>>> ---
>>>>    fs/hugetlbfs/inode.c | 5 +++++
>>>>    1 file changed, 5 insertions(+)
>>>>
>>>> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
>>>> index 3f70c47981de..6bebe2e67f3e 100644
>>>> --- a/fs/hugetlbfs/inode.c
>>>> +++ b/fs/hugetlbfs/inode.c
>>>> @@ -603,6 +603,11 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
>>>>                                index, truncate_op))
>>>>                    freed++;
>>>>    +            if (unlikely(folio_test_hwpoison(folio))) {
>>>> +                folio_set_hugetlb_temporary(folio);
>>> I think it is not needed to mark the hugetlb folio as temporary because
>>> offline_pages() will call dissolve_free_hugetlb_folios().
>> Indeed. I was intended to avoid this hugetlb allocated again, but
>> dequeue_hugetlb_folio_node_exact() will check PG_hwpoison.
>>
>>>> +                folio_put(folio);
>>> __get_huge_page_for_hwpoison() will always set hwpoison for hugetlb folio
>>> even without page refcnt increased. So this folio_put() might be unexpected.
>>> Please see [1] for detail.
>> When memory-failure races with migration, __get_huge_page_for_hwpoison()
>> will set hwpoison without page refcnt increased. In common case, ref is
>> increased before setting hwpoison.
> Right. And in those rare cases, VM_BUG_ON_PAGE(page_ref_count(page) == 0, page) will be triggered
> in folio_put().
>
> Thanks.

hwpoisoned base page is forced to offline. test_pages_isolated() and __offline_isolated_pages() just
skip the hwpoisoned pfn regardless of it's refcount.

I originally tried to force offline hwpoisoned hugetlb too, but it leads to wrong counts (i.e., HugePages_Total).

> .