[PATCH] mm/huge_memory: use READ_ONCE() when cloning folio flags during split

[PATCH] mm/huge_memory: use READ_ONCE() when cloning folio flags during split

[Ye Liu]

From: Ye Liu <liuye@kylinos.cn>

The head folio's flags are read as a whole word to clone specific bits
into tail folios during a THP split.  This plain read can race with
concurrent atomic flag modifications such as folio_set_waiters()
(PG_waiters), as reported by KCSAN:

  BUG: KCSAN: data-race in __split_huge_page_tail / migration_entry_wait_on_locked

Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
 mm/huge_memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index bd44d58e8684..aac91c972ced 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3731,7 +3731,7 @@ static void __split_folio_to_order(struct folio *folio, int old_order,
 		 * PG_anon_exclusive (-> PG_mappedtodisk) for these here.
 		 */
 		new_folio->flags.f &= ~PAGE_FLAGS_CHECK_AT_PREP;
-		new_folio->flags.f |= (folio->flags.f &
+		new_folio->flags.f |= (READ_ONCE(folio->flags.f) &
 				((1L << PG_referenced) |
 				 (1L << PG_swapbacked) |
 				 (1L << PG_swapcache) |

---
base-commit: 6d0933ae9d46674a6ea63a87e9e9ab4e662670c9
change-id: 20261029-data_race_huge_mem-42f3a6005c43

Best regards,
-- 
Ye Liu <ye.liu@linux.dev>

Re: [PATCH] mm/huge_memory: use READ_ONCE() when cloning folio flags during split

[Barry Song]

On Thu, Oct 29, 2026 at 3:41 PM Ye Liu <ye.liu@linux.dev> wrote:
>
> From: Ye Liu <liuye@kylinos.cn>
>
> The head folio's flags are read as a whole word to clone specific bits
> into tail folios during a THP split.  This plain read can race with
> concurrent atomic flag modifications such as folio_set_waiters()
> (PG_waiters), as reported by KCSAN:
>
>   BUG: KCSAN: data-race in __split_huge_page_tail / migration_entry_wait_on_locked
>
> Signed-off-by: Ye Liu <liuye@kylinos.cn>
> ---

I assume the race is harmless, but silencing KCSAN is still worthwhile.

Reviewed-by: Barry Song <baohua@kernel.org>

Re: [PATCH] mm/huge_memory: use READ_ONCE() when cloning folio flags during split

[David Hildenbrand (Arm)]

On 10/29/26 10:08, Barry Song wrote:
> On Thu, Oct 29, 2026 at 3:41 PM Ye Liu <ye.liu@linux.dev> wrote:
>>
>> From: Ye Liu <liuye@kylinos.cn>
>>
>> The head folio's flags are read as a whole word to clone specific bits
>> into tail folios during a THP split.  This plain read can race with
>> concurrent atomic flag modifications such as folio_set_waiters()
>> (PG_waiters), as reported by KCSAN:
>>
>>   BUG: KCSAN: data-race in __split_huge_page_tail / migration_entry_wait_on_locked
>>
>> Signed-off-by: Ye Liu <liuye@kylinos.cn>
>> ---
> 
> I assume the race is harmless, but silencing KCSAN is still worthwhile.

Isn't there a way we could lose the PG_waiters flag?

-- 
Cheers,

David