Re: [PATCH] mm/migrate: snapshot the source nid before the misplaced migration

["Zi Yan" <ziy@nvidia.com>]

On Thu Oct 22, 2026 at 11:28 PM EDT, Matthew Wilcox wrote:
> On Fri, Oct 23, 2026 at 10:32:26AM +0800, Yafang Shao wrote:
>> A successful migration frees the source folio, so the folio_nid() read
>> in the promotion counter update can pick up a reallocated page's nid.
>> Snapshot the nid before the migration, next to the memcg snapshot the
>> function already takes.
>
> I don't understand how a node ID can change even after the folio has
> been freed.  I don't think this patch is wrong, but I don't think

I agree with you in the current code base.

> there's actually a bug here that's being fixed.

Strictly speaking, it can be seen as a benign UAF. It works, because

1. folio->flags happens to be the same as page->flags,
2. folio/page nid is stored in the ->flags and never changed.

In memdesc world, after a folio is freed, I assume folio->flags would be
zeroed since struct folio is freed and calling folio_nid() on a freed
folio would give a bogus result (yeah, it can be mitigated by not
zeroing node field and each node has its own struct folio pool, but that
makes folio_nid() implementation dependent).

IMHO, this patch is still worth getting in.

-- 
Best Regards,
Yan, Zi