From: Andrew Morton <akpm@linux-foundation.org>
To: Jinjiang Tu <tujinjiang@huawei.com>
Cc: <david@kernel.org>, <lorenzo.stoakes@oracle.com>,
<Liam.Howlett@oracle.com>, <vbabka@kernel.org>, <rppt@kernel.org>,
<surenb@google.com>, <mhocko@suse.com>, <baohua@kernel.org>,
<ryan.roberts@arm.com>, <linux-mm@kvack.org>,
<wangkefeng.wang@huawei.com>, <sunnanyong@huawei.com>
Subject: Re: [PATCH v3] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
Date: Thu, 19 Mar 2026 19:31:57 -0700 [thread overview]
Message-ID: <20260319193157.7cacc7b6628e94ff62541c34@linux-foundation.org> (raw)
In-Reply-To: <d9d50263-a69f-4a16-b409-caeec93c423a@huawei.com>
On Fri, 20 Mar 2026 09:52:42 +0800 Jinjiang Tu <tujinjiang@huawei.com> wrote:
> >> In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
> >> are visible before the tail page becomes non-compound. smp_wmb() should
> >> be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a
> >> result, if zap_nonpresent_ptes() accesses migration entry that stores
> >> tail pfn, softleaf_to_folio() may see the updated compound_head of tail
> >> page before page->flags.
> > Please describe the userspace-visible runtime effects of this bug.
>
> This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio().
>
> This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"),
> which in merged in v6.19-rc1.
Great, thanks, I added cc:stable.
next prev parent reply other threads:[~2026-03-20 2:32 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-19 1:25 [PATCH v3] mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Jinjiang Tu
2026-03-19 8:49 ` David Hildenbrand (Arm)
2026-03-19 22:51 ` Andrew Morton
2026-03-20 1:52 ` Jinjiang Tu
2026-03-20 2:31 ` Andrew Morton [this message]
2026-03-20 8:10 ` David Hildenbrand (Arm)
2026-03-20 8:56 ` Jinjiang Tu
2026-03-20 9:57 ` Lorenzo Stoakes (Oracle)
2026-03-20 10:22 ` David Hildenbrand (Arm)
2026-03-20 10:13 ` Lorenzo Stoakes (Oracle)
2026-03-21 2:40 ` Jinjiang Tu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260319193157.7cacc7b6628e94ff62541c34@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=Liam.Howlett@oracle.com \
--cc=baohua@kernel.org \
--cc=david@kernel.org \
--cc=linux-mm@kvack.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=mhocko@suse.com \
--cc=rppt@kernel.org \
--cc=ryan.roberts@arm.com \
--cc=sunnanyong@huawei.com \
--cc=surenb@google.com \
--cc=tujinjiang@huawei.com \
--cc=vbabka@kernel.org \
--cc=wangkefeng.wang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.