Re: [PATCH] mm/mempolicy: ignore a bind policy whose nodes have no memory

[Joshua Hahn <joshua.hahnjy@gmail.com>]

On Fri, Nov 13, 2026 at 02:26:42PM -0500, Gregory Price (Meta) wrote:
> apply_policy_zone() assumes that policy->nodes intersects N_MEMORY, so
> it reads a bind policy with no N_HIGH_MEMORY node as movable-only.
> 
> On systems with CONFIG_CPUSETS=n, nothing rebinds policies when memory
> is removed, so offlining all memory on the nodes a bind policy names
> leaves it with none. The policy is then treated as movable-only, and
> movable allocations are restricted to nodes without memory.
> 
> This results in allocations failures, a VM_FAULT_OOM leak, and then
> an infinitely retrying fault that hangs the process.
> 
>   page allocation failure: order:0, mode:0x140dca ... nodemask=2
>   Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
> 
> Ignore a bind policy whose nodes have no memory. policy_nodemask()
> already ignores a bind policy that does not intersect the cpuset.
> This covers hugetlb's policy_mbind_nodemask() as well.
> 
> If the nodes regain memory, the policy applies again.
> 
> CPUSETS=n with HOTREMOVE=y is unlikely a common configuration, so this
> isn't marked for stable.
> 
> Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>

Hello Gregory,

Cool find! Thanks for fixing this.
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>

> ---
>  mm/mempolicy.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index ca7e744727b1..5dc2d7ef1544 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -2096,6 +2096,10 @@ bool apply_policy_zone(struct mempolicy *policy, enum zone_type zone)
>  
>  	BUG_ON(dynamic_policy_zone == ZONE_MOVABLE);
>  
> +	/* Memory hot-remove can leave policy->nodes without memory. */
> +	if (!nodes_intersects(policy->nodes, node_states[N_MEMORY]))
> +		return false;
> +
>  	/*
>  	 * if policy->nodes has movable memory only,
>  	 * we apply policy when gfp_zone(gfp) = ZONE_MOVABLE only.
> -- 
> 2.56.0
>