Re: [PATCH v3] mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list

[Oscar Salvador <osalvador@suse.de>]

On Fri, Jul 11, 2025 at 10:17:34AM +0800, Jinjiang Tu wrote:
> In shrink_folio_list(), the hwpoisoned folio may be large folio, which
> can't be handled by unmap_poisoned_folio(). For THP, try_to_unmap_one()
> must be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then
> retry. Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of
> pvmw.pte. Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a WARN_ON_ONCE
> due to the page isn't in swapcache.
> 
> Since UCE is rare in real world, and race with reclaimation is more rare,
> just skipping the hwpoisoned large folio is enough. memory_failure() will
> handle it if the UCE is triggered again.
> 
> Fixes: 1b0449544c64 ("mm/vmscan: don't try to reclaim hwpoison folio")
> Reported-by: syzbot+3b220254df55d8ca8a61@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68412d57.050a0220.2461cf.000e.GAE@google.com/
> Acked-by: David Hildenbrand <david@redhat.com>
> Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
> Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>

Reviewed-by: Oscar Salvador <osalvador@suse.de>

 

-- 
Oscar Salvador
SUSE Labs