Re: [RFC PATCH] mm/damon/ops-common: call folio_test_lru() after folio_get()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Speculative folio flag access occurs before pointer re-validation, triggering VM_BUG_ON_PGFLAGS() on tail pages.
--

commit 119755fb3390d2b7d6c7f2278054cc95e95531c6
Author: SeongJae Park <sj@kernel.org>

mm/damon/ops-common: call folio_test_lru() after folio_get()

This patch attempts to fix a potential VM_BUG_ON_PGFLAGS crash by removing
the speculative LRU flag check before trying to get a reference in
damon_get_folio(). It moves the LRU check after a successful try_get.

Link: https://lore.kernel.org/20260517234112.89245-1-sj@kernel.org

> diff --git a/mm/damon/ops-common.c b/mm/damon/ops-common.c
> index 3a0ddc3ac7196..d3404615f9b75 100644
> --- a/mm/damon/ops-common.c
> +++ b/mm/damon/ops-common.c
> @@ -32,9 +32,9 @@ struct folio *damon_get_folio(unsigned long pfn)
>  		return NULL;
>  
>  	folio = page_folio(page);
> -	if (!folio_test_lru(folio) || !folio_try_get(folio))
> +	if (!folio_try_get(folio))
>  		return NULL;
> -	if (unlikely(page_folio(page) != folio || !folio_test_lru(folio))) {
> +	if (!folio_test_lru(folio) || unlikely(page_folio(page) != folio)) {

[Severity: High]
Does this sequence reintroduce the same bug the patch intends to fix?

By placing the LRU flag check before the pointer re-validation, C
short-circuit evaluation will evaluate the LRU flag first.

If the page was concurrently freed and reallocated as a tail page,
folio_try_get() might still succeed. Evaluating the LRU flag on this
unvalidated tail page will trigger the VM_BUG_ON_PGFLAGS() in
const_folio_flags().

Should the pointer re-validation happen before accessing any folio flags in
PFN scanners?

>  		folio_put(folio);
>  		folio = NULL;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260523194145.93122-1-sj@kernel.org?part=1