Re: [PATCH v5 1/4] mm/memory-failure: report MF_MSG_KERNEL for reserved pages

[Lance Yang <lance.yang@linux.dev>]

On Mon, Apr 27, 2026 at 08:33:30PM +0800, Lance Yang wrote:
>
>On Fri, Apr 24, 2026 at 05:23:59AM -0700, Breno Leitao wrote:
>>When get_hwpoison_page() returns a negative value, distinguish
>>reserved pages from other failure cases by reporting MF_MSG_KERNEL
>>instead of MF_MSG_GET_HWPOISON. Reserved pages belong to the kernel
>>and should be classified accordingly for proper handling.
>>
>>Acked-by: Miaohe Lin <linmiaohe@huawei.com>
>>Signed-off-by: Breno Leitao <leitao@debian.org>
>>---
>> mm/memory-failure.c | 11 ++++++++++-
>> 1 file changed, 10 insertions(+), 1 deletion(-)
>>
>>diff --git a/mm/memory-failure.c b/mm/memory-failure.c
>>index ee42d43613097..7b67e43dafbd1 100644
>>--- a/mm/memory-failure.c
>>+++ b/mm/memory-failure.c
>>@@ -2432,7 +2432,16 @@ int memory_failure(unsigned long pfn, int flags)
>> 		}
>> 		goto unlock_mutex;
>> 	} else if (res < 0) {
>>-		res = action_result(pfn, MF_MSG_GET_HWPOISON, MF_IGNORED);
>>+		/*
>>+		 * PageReserved is stable here: reserved pages have
>>+		 * PG_reserved set at boot or by drivers and are never
>>+		 * freed through the page allocator.
>>+		 */
>
>Not necessarily. PG_reserved is not a permanent lifetime property for
>every page that has carried it.
>
>page-flags.h says early reserved pages may later have PG_reserved
>cleared and then be given to the page allocator :)
>
>At least some drivers also clear PG_reserved when releasing pages they
>marked reserved.
>
>Would it be clearer to say that pages with PG_reserved set are not
>currently managed by the page allocator, rather than saying reserved
>pages are never freed through the page allocator?
>
>Otherwise, LGTM.

Ouch, I missed one more thing ...

Sashiko pointed out that[1]

> +		if (PageReserved(p))

"Can this introduce a use-after-free risk on the struct page?"

get_any_page() may put the page before returning -EIO. After that ref is
dropped, PageReserved(p) is not safe, IIUC :(

Maybe just cache it before the call?

is_reserved = PageReserved(p);
res = get_hwpoison_page(p, flags);

[1] https://sashiko.dev/#/patchset/20260424-ecc_panic-v5-0-a35f4b50425c@debian.org