[PATCH stable/linux-6.6.y] mm/memory-failure: fix missing ->mf_stats count when hugetlb folio already poisoned

[PATCH stable/linux-6.6.y] mm/memory-failure: fix missing ->mf_stats count when hugetlb folio already poisoned

[Qi Xi]

When a new subpage is poisoned on a hugetlb folio that has already been
marked hwpoison (MF_HUGETLB_FOLIO_PRE_POISONED), hugetlb_update_hwpoison()
increments num_poisoned_pages directly, but the per-node ->mf_stats is
not updated because this path bypasses action_result(). This leaves the
two accounting counters inconsistent within the hardware memory-failure
path: a new poison event is counted in num_poisoned_pages but not reflected
in the per-node mf_stats.

In mainline, commit a148a2040191 ("mm/memory-failure: fix missing
->mf_stats count in hugetlb poison") fixed this by removing the direct
num_poisoned_pages_inc() from the helper and adding action_result() calls
in try_memory_failure_hugetlb() for the already-poisoned cases. The
backport to linux-6.6.y as commit 252bb328b36f ("mm/memory-failure: fix
missing ->mf_stats count in hugetlb poison") applied the refactoring
(naming, constants, switch-case) but omitted the core counting fix,
leaving the inconsistency in place.

Fix this by adding a matching update_per_node_mf_stats() call alongside
the existing num_poisoned_pages_inc() in the same block, so both counters
stay consistent without restructuring the error path.

Fixes: 252bb328b36f ("mm/memory-failure: fix missing ->mf_stats count in hugetlb poison")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
---
 mm/memory-failure.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 86cdf36ee3bb..5f9203bf8ec1 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1947,8 +1947,10 @@ static int hugetlb_update_hwpoison(struct folio *folio, struct page *page)
 		raw_hwp->page = page;
 		llist_add(&raw_hwp->node, head);
 		/* the first error event will be counted in action_result(). */
-		if (ret)
+		if (ret) {
 			num_poisoned_pages_inc(page_to_pfn(page));
+			update_per_node_mf_stats(page_to_pfn(page), MF_FAILED);
+		}
 	} else {
 		/*
 		 * Failed to save raw error info.  We no longer trace all
-- 
2.33.0

Re: [PATCH stable/linux-6.6.y] mm/memory-failure: fix missing ->mf_stats count when hugetlb folio already poisoned

[Qi Xi]

Add stable@ to Cc.

On 06/07/2026 16:41, Qi Xi wrote:
> When a new subpage is poisoned on a hugetlb folio that has already been
> marked hwpoison (MF_HUGETLB_FOLIO_PRE_POISONED), hugetlb_update_hwpoison()
> increments num_poisoned_pages directly, but the per-node ->mf_stats is
> not updated because this path bypasses action_result(). This leaves the
> two accounting counters inconsistent within the hardware memory-failure
> path: a new poison event is counted in num_poisoned_pages but not reflected
> in the per-node mf_stats.
>
> In mainline, commit a148a2040191 ("mm/memory-failure: fix missing
> ->mf_stats count in hugetlb poison") fixed this by removing the direct
> num_poisoned_pages_inc() from the helper and adding action_result() calls
> in try_memory_failure_hugetlb() for the already-poisoned cases. The
> backport to linux-6.6.y as commit 252bb328b36f ("mm/memory-failure: fix
> missing ->mf_stats count in hugetlb poison") applied the refactoring
> (naming, constants, switch-case) but omitted the core counting fix,
> leaving the inconsistency in place.
>
> Fix this by adding a matching update_per_node_mf_stats() call alongside
> the existing num_poisoned_pages_inc() in the same block, so both counters
> stay consistent without restructuring the error path.
>
> Fixes: 252bb328b36f ("mm/memory-failure: fix missing ->mf_stats count in hugetlb poison")
> Signed-off-by: Qi Xi <xiqi2@huawei.com>
> ---
>   mm/memory-failure.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> index 86cdf36ee3bb..5f9203bf8ec1 100644
> --- a/mm/memory-failure.c
> +++ b/mm/memory-failure.c
> @@ -1947,8 +1947,10 @@ static int hugetlb_update_hwpoison(struct folio *folio, struct page *page)
>   		raw_hwp->page = page;
>   		llist_add(&raw_hwp->node, head);
>   		/* the first error event will be counted in action_result(). */
> -		if (ret)
> +		if (ret) {
>   			num_poisoned_pages_inc(page_to_pfn(page));
> +			update_per_node_mf_stats(page_to_pfn(page), MF_FAILED);
> +		}
>   	} else {
>   		/*
>   		 * Failed to save raw error info.  We no longer trace all

Re: [PATCH stable/linux-6.6.y] mm/memory-failure: fix missing ->mf_stats count when hugetlb folio already poisoned

[Greg Kroah-Hartman]

On Tue, Jul 14, 2026 at 09:45:03AM +0800, Qi Xi wrote:
> Add stable@ to Cc.

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

Re: [PATCH stable/linux-6.6.y] mm/memory-failure: fix missing ->mf_stats count when hugetlb folio already poisoned

[Greg Kroah-Hartman]

On Tue, Jul 14, 2026 at 09:45:03AM +0800, Qi Xi wrote:
> Add stable@ to Cc.
> 
> On 06/07/2026 16:41, Qi Xi wrote:
> > When a new subpage is poisoned on a hugetlb folio that has already been
> > marked hwpoison (MF_HUGETLB_FOLIO_PRE_POISONED), hugetlb_update_hwpoison()
> > increments num_poisoned_pages directly, but the per-node ->mf_stats is
> > not updated because this path bypasses action_result(). This leaves the
> > two accounting counters inconsistent within the hardware memory-failure
> > path: a new poison event is counted in num_poisoned_pages but not reflected
> > in the per-node mf_stats.
> > 
> > In mainline, commit a148a2040191 ("mm/memory-failure: fix missing
> > ->mf_stats count in hugetlb poison") fixed this by removing the direct
> > num_poisoned_pages_inc() from the helper and adding action_result() calls
> > in try_memory_failure_hugetlb() for the already-poisoned cases. The
> > backport to linux-6.6.y as commit 252bb328b36f ("mm/memory-failure: fix
> > missing ->mf_stats count in hugetlb poison") applied the refactoring
> > (naming, constants, switch-case) but omitted the core counting fix,
> > leaving the inconsistency in place.
> > 
> > Fix this by adding a matching update_per_node_mf_stats() call alongside
> > the existing num_poisoned_pages_inc() in the same block, so both counters
> > stay consistent without restructuring the error path.
> > 
> > Fixes: 252bb328b36f ("mm/memory-failure: fix missing ->mf_stats count in hugetlb poison")
> > Signed-off-by: Qi Xi <xiqi2@huawei.com>

We need acks/reviews by the relevant maintainers before we can accept
something like this.

thanks,

greg k-h

Re: [PATCH stable/linux-6.6.y] mm/memory-failure: fix missing ->mf_stats count when hugetlb folio already poisoned

[Qi Xi]

On 21/07/2026 21:06, Greg Kroah-Hartman wrote:
> On Tue, Jul 14, 2026 at 09:45:03AM +0800, Qi Xi wrote:
>> Add stable@ to Cc.
>>
>> On 06/07/2026 16:41, Qi Xi wrote:
>>> When a new subpage is poisoned on a hugetlb folio that has already been
>>> marked hwpoison (MF_HUGETLB_FOLIO_PRE_POISONED), hugetlb_update_hwpoison()
>>> increments num_poisoned_pages directly, but the per-node ->mf_stats is
>>> not updated because this path bypasses action_result(). This leaves the
>>> two accounting counters inconsistent within the hardware memory-failure
>>> path: a new poison event is counted in num_poisoned_pages but not reflected
>>> in the per-node mf_stats.
>>>
>>> In mainline, commit a148a2040191 ("mm/memory-failure: fix missing
>>> ->mf_stats count in hugetlb poison") fixed this by removing the direct
>>> num_poisoned_pages_inc() from the helper and adding action_result() calls
>>> in try_memory_failure_hugetlb() for the already-poisoned cases. The
>>> backport to linux-6.6.y as commit 252bb328b36f ("mm/memory-failure: fix
>>> missing ->mf_stats count in hugetlb poison") applied the refactoring
>>> (naming, constants, switch-case) but omitted the core counting fix,
>>> leaving the inconsistency in place.
>>>
>>> Fix this by adding a matching update_per_node_mf_stats() call alongside
>>> the existing num_poisoned_pages_inc() in the same block, so both counters
>>> stay consistent without restructuring the error path.
>>>
>>> Fixes: 252bb328b36f ("mm/memory-failure: fix missing ->mf_stats count in hugetlb poison")
>>> Signed-off-by: Qi Xi <xiqi2@huawei.com>
> We need acks/reviews by the relevant maintainers before we can accept
> something like this.

Thank you for the feedback. I have resent this patch to
stable@vger.kernel.org with the correct format (including upstream
commit reference and proper stable submission format):

https://lore.kernel.org/stable/20260721121956.124887-1-xiqi2@huawei.com/

I'll also work on getting the required Reviewed-by/Acked-by from
the mm/memory-failure maintainers.

Qi

>
> thanks,
>
> greg k-h
>