Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[Usama Arif <usama.arif@linux.dev>]

On 11/03/2026 17:24, Usama Arif wrote:
> 
> 
> On 11/03/2026 16:38, Zi Yan wrote:
>> On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:
>>
>>> On 3/11/26 14:23, Usama Arif wrote:
>>>> folio_migrate_flags() transfers folio state from source to destination
>>>> during migration, but does not transfer the large_rmappable flag.
>>>>
>>>> Migration allocators like alloc_migration_target() and
>>>> alloc_misplaced_dst_folio() use __folio_alloc() directly without
>>>> wrapping the result in page_rmappable_folio(), so the destination folio
>>>> never gets large_rmappable set.
>>>>
>>>> This becomes a problem when a folio on the deferred split queue is
>>>> migrated: the destination folio can be added to the deferred split queue
>>>> via deferred_split_folio() (which does not check large_rmappable), but
>>>> when the folio is later freed, folio_unqueue_deferred_split() bails out
>>>> early because large_rmappable is not set:
>>>>
>>>>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>>>>       return false;
>>>>
>>>> This leaves a stale entry on the deferred split queue, leading to
>>>> use-after-free when the shrinker walks the list.
>>>>
>>>> Fix this by transferring large_rmappable in folio_migrate_flags(),
>>>> consistent with how all other folio flags are handled.
>>>>
>>>> Fixes: dafff3f4c850 ("mm: split underused THPs")
>>>> Signed-off-by: Usama Arif <usama.arif@linux.dev>
>>>> ---
>>>>  mm/migrate.c | 3 +++
>>>>  1 file changed, 3 insertions(+)
>>>>
>>>> diff --git a/mm/migrate.c b/mm/migrate.c
>>>> index 3380021fd3db..ee1c7bc851dd 100644
>>>> --- a/mm/migrate.c
>>>> +++ b/mm/migrate.c
>>>> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>>>>  	folio_copy_owner(newfolio, folio);
>>>>  	pgalloc_tag_swap(newfolio, folio);
>>>>
>>>> +	if (folio_test_large_rmappable(folio))
>>>> +		folio_set_large_rmappable(newfolio);
>>>> +
>>>>  	mem_cgroup_migrate(folio, newfolio);
>>>>  }
>>>>  EXPORT_SYMBOL(folio_migrate_flags);
>>>
>>> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>>>
>>> I'd assume that all migration allocation functions must take care of that.
>>>
>>> It's a responsibility of the folio allocation code, not folio migration
>>> code.
>>
>> I agree. The migration allocation function needs to give a folio or other
>> types of page matching the original one. Do we want to turn this into
>> a WARN to make sure newfolio matches folio's large_rmappable state?
>>
> 
> hmm its done in compaction_alloc() and alloc_migration_target_by_mpol() but I
> dont see this being done in alloc_migration_target() and alloc_misplaced_dst_folio().
> I think alloc_misplaced_dst_folio() is used by NUMA balancing and alloc_migration_target()
> by hotplug and memory failure?
> 
> I am not very familiar with migration code, so maybe I am missing where its being done
> in these paths?

ah no ignore me :) __folio_alloc_noprof should set it. Thanks and sorry for the noise!