Re: [PATCH] mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list

[David Hildenbrand <david@redhat.com>]

On 11.06.25 09:46, Jinjiang Tu wrote:
> In shrink_folio_list(), the hwpoisoned folio may be large folio, which
> can't be handled by unmap_poisoned_folio().
> 
> Since UCE is rare in real world, and race with reclaimation is more rare,
> just skipping the hwpoisoned large folio is enough. memory_failure() will
> handle it if the UCE is triggered again.
> 
> Fixes: 1b0449544c64 ("mm/vmscan: don't try to reclaim hwpoison folio")

Please also add

Closes:

with a link to the report

> Reported-by: syzbot+3b220254df55d8ca8a61@syzkaller.appspotmail.com
> Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
> ---
>   mm/vmscan.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
> 
> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index b6f4db6c240f..3a4e8d7419ae 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -1131,6 +1131,14 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
>   			goto keep;
>   
>   		if (folio_contain_hwpoisoned_page(folio)) {
> +			/*
> +			 * unmap_poisoned_folio() can't handle large
> +			 * folio, just skip it. memory_failure() will
> +			 * handle it if the UCE is triggered again.
> +			 */
> +			if (folio_test_large(folio))
> +				goto keep_locked;
> +
>   			unmap_poisoned_folio(folio, folio_pfn(folio), false);
>   			folio_unlock(folio);
>   			folio_put(folio);

Why not handle that in unmap_poisoned_folio() to make that limitation 
clear and avoid?

Essentially, checking for folio_test_large() && !folio_test_hugetlb() in 
unmap_poisoned_folio().

I'm surprised that try_to_unmap() doesn't seem to be able to handle 
PMD-mapped file pages, probably easy to add once there is demand for it.

-- 
Cheers,

David / dhildenb