[PATCH v2 01/15] mm/memory_hotplug: fix possible race in scan_movable_pages()

David Hildenbrand (Arm)
2026-03-20T22:13:48Z

If a hugetlb folio gets freed while we are in scan_movable_pages(),
folio_nr_pages() could return 0, resulting in or'ing "0 - 1 = -1"
to the PFN, resulting in PFN = -1. We're not holding any locks or
references that would prevent that.

for_each_valid_pfn() would then search for the next valid PFN, and could
return a PFN that is outside of the range of the original requested
range. do_migrate_page() would then try to migrate quite a big range,
which is certainly undesirable.

To fix it, simply test for valid folio_nr_pages() values. While at it,
as PageHuge() really just does a page_folio() internally, we can just
use folio_test_hugetlb() on the folio directly.

scan_movable_pages() is expected to be fast, and we try to avoid taking
locks or grabbing references. We cannot use folio_try_get() as that does
not work for free hugetlb folios. We could grab the hugetlb_lock, but
that just adds complexity.

The race is unlikely to trigger in practice, so we won't be CCing
stable.

Fixes: 16540dae959d ("mm/hugetlb: mm/memory_hotplug: use a folio in scan_movable_pages()")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
mm/memory_hotplug.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 86d3faf50453..969cd7ddf68f 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1747,6 +1747,7 @@ static int scan_movable_pages(unsigned long start, unsigned long end,
unsigned long pfn;

for_each_valid_pfn(pfn, start, end) {
+ unsigned long nr_pages;
struct page *page;
struct folio *folio;

@@ -1763,9 +1764,9 @@ static int scan_movable_pages(unsigned long start, unsigned long end,
if (PageOffline(page) && page_count(page))
return -EBUSY;

- if (!PageHuge(page))
- continue;
folio = page_folio(page);
+ if (!folio_test_hugetlb(folio))
+ continue;
/*
* This test is racy as we hold no reference or lock. The
* hugetlb page could have been free'ed and head is no longer
@@ -1775,7 +1776,11 @@ static int scan_movable_pages(unsigned long start, unsigned long end,
*/
if (folio_test_hugetlb_migratable(folio))
goto found;
- pfn |= folio_nr_pages(folio) - 1;
+ nr_pages = folio_nr_pages(folio);
+ if (unlikely(nr_pages < 1 || nr_pages > MAX_FOLIO_NR_PAGES ||
+ !is_power_of_2(nr_pages)))
+ continue;
+ pfn |= nr_pages - 1;
}
return -ENOENT;
found:

--
2.43.0