[PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[Usama Arif]

folio_migrate_flags() transfers folio state from source to destination
during migration, but does not transfer the large_rmappable flag.

Migration allocators like alloc_migration_target() and
alloc_misplaced_dst_folio() use __folio_alloc() directly without
wrapping the result in page_rmappable_folio(), so the destination folio
never gets large_rmappable set.

This becomes a problem when a folio on the deferred split queue is
migrated: the destination folio can be added to the deferred split queue
via deferred_split_folio() (which does not check large_rmappable), but
when the folio is later freed, folio_unqueue_deferred_split() bails out
early because large_rmappable is not set:

  if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
      return false;

This leaves a stale entry on the deferred split queue, leading to
use-after-free when the shrinker walks the list.

Fix this by transferring large_rmappable in folio_migrate_flags(),
consistent with how all other folio flags are handled.

Fixes: dafff3f4c850 ("mm: split underused THPs")
Signed-off-by: Usama Arif <usama.arif@linux.dev>
---
 mm/migrate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/migrate.c b/mm/migrate.c
index 3380021fd3db..ee1c7bc851dd 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
 	folio_copy_owner(newfolio, folio);
 	pgalloc_tag_swap(newfolio, folio);
 
+	if (folio_test_large_rmappable(folio))
+		folio_set_large_rmappable(newfolio);
+
 	mem_cgroup_migrate(folio, newfolio);
 }
 EXPORT_SYMBOL(folio_migrate_flags);
-- 
2.52.0

Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[David Hildenbrand (Arm)]

On 3/11/26 14:23, Usama Arif wrote:
> folio_migrate_flags() transfers folio state from source to destination
> during migration, but does not transfer the large_rmappable flag.
> 
> Migration allocators like alloc_migration_target() and
> alloc_misplaced_dst_folio() use __folio_alloc() directly without
> wrapping the result in page_rmappable_folio(), so the destination folio
> never gets large_rmappable set.
> 
> This becomes a problem when a folio on the deferred split queue is
> migrated: the destination folio can be added to the deferred split queue
> via deferred_split_folio() (which does not check large_rmappable), but
> when the folio is later freed, folio_unqueue_deferred_split() bails out
> early because large_rmappable is not set:
> 
>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>       return false;
> 
> This leaves a stale entry on the deferred split queue, leading to
> use-after-free when the shrinker walks the list.
> 
> Fix this by transferring large_rmappable in folio_migrate_flags(),
> consistent with how all other folio flags are handled.
> 
> Fixes: dafff3f4c850 ("mm: split underused THPs")
> Signed-off-by: Usama Arif <usama.arif@linux.dev>
> ---
>  mm/migrate.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/migrate.c b/mm/migrate.c
> index 3380021fd3db..ee1c7bc851dd 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>  	folio_copy_owner(newfolio, folio);
>  	pgalloc_tag_swap(newfolio, folio);
>  
> +	if (folio_test_large_rmappable(folio))
> +		folio_set_large_rmappable(newfolio);
> +
>  	mem_cgroup_migrate(folio, newfolio);
>  }
>  EXPORT_SYMBOL(folio_migrate_flags);

compaction_alloc_noprof() does the page_rmappable_folio() at the end.

I'd assume that all migration allocation functions must take care of that.

It's a responsibility of the folio allocation code, not folio migration
code.


-- 
Cheers,

David

Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[Zi Yan]

On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:

> On 3/11/26 14:23, Usama Arif wrote:
>> folio_migrate_flags() transfers folio state from source to destination
>> during migration, but does not transfer the large_rmappable flag.
>>
>> Migration allocators like alloc_migration_target() and
>> alloc_misplaced_dst_folio() use __folio_alloc() directly without
>> wrapping the result in page_rmappable_folio(), so the destination folio
>> never gets large_rmappable set.
>>
>> This becomes a problem when a folio on the deferred split queue is
>> migrated: the destination folio can be added to the deferred split queue
>> via deferred_split_folio() (which does not check large_rmappable), but
>> when the folio is later freed, folio_unqueue_deferred_split() bails out
>> early because large_rmappable is not set:
>>
>>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>>       return false;
>>
>> This leaves a stale entry on the deferred split queue, leading to
>> use-after-free when the shrinker walks the list.
>>
>> Fix this by transferring large_rmappable in folio_migrate_flags(),
>> consistent with how all other folio flags are handled.
>>
>> Fixes: dafff3f4c850 ("mm: split underused THPs")
>> Signed-off-by: Usama Arif <usama.arif@linux.dev>
>> ---
>>  mm/migrate.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/mm/migrate.c b/mm/migrate.c
>> index 3380021fd3db..ee1c7bc851dd 100644
>> --- a/mm/migrate.c
>> +++ b/mm/migrate.c
>> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>>  	folio_copy_owner(newfolio, folio);
>>  	pgalloc_tag_swap(newfolio, folio);
>>
>> +	if (folio_test_large_rmappable(folio))
>> +		folio_set_large_rmappable(newfolio);
>> +
>>  	mem_cgroup_migrate(folio, newfolio);
>>  }
>>  EXPORT_SYMBOL(folio_migrate_flags);
>
> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>
> I'd assume that all migration allocation functions must take care of that.
>
> It's a responsibility of the folio allocation code, not folio migration
> code.

I agree. The migration allocation function needs to give a folio or other
types of page matching the original one. Do we want to turn this into
a WARN to make sure newfolio matches folio's large_rmappable state?

--
Best Regards,
Yan, Zi

Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[David Hildenbrand (Arm)]

On 3/11/26 14:38, Zi Yan wrote:
> On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:
> 
>> On 3/11/26 14:23, Usama Arif wrote:
>>> folio_migrate_flags() transfers folio state from source to destination
>>> during migration, but does not transfer the large_rmappable flag.
>>>
>>> Migration allocators like alloc_migration_target() and
>>> alloc_misplaced_dst_folio() use __folio_alloc() directly without
>>> wrapping the result in page_rmappable_folio(), so the destination folio
>>> never gets large_rmappable set.
>>>
>>> This becomes a problem when a folio on the deferred split queue is
>>> migrated: the destination folio can be added to the deferred split queue
>>> via deferred_split_folio() (which does not check large_rmappable), but
>>> when the folio is later freed, folio_unqueue_deferred_split() bails out
>>> early because large_rmappable is not set:
>>>
>>>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>>>       return false;
>>>
>>> This leaves a stale entry on the deferred split queue, leading to
>>> use-after-free when the shrinker walks the list.
>>>
>>> Fix this by transferring large_rmappable in folio_migrate_flags(),
>>> consistent with how all other folio flags are handled.
>>>
>>> Fixes: dafff3f4c850 ("mm: split underused THPs")
>>> Signed-off-by: Usama Arif <usama.arif@linux.dev>
>>> ---
>>>  mm/migrate.c | 3 +++
>>>  1 file changed, 3 insertions(+)
>>>
>>> diff --git a/mm/migrate.c b/mm/migrate.c
>>> index 3380021fd3db..ee1c7bc851dd 100644
>>> --- a/mm/migrate.c
>>> +++ b/mm/migrate.c
>>> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>>>  	folio_copy_owner(newfolio, folio);
>>>  	pgalloc_tag_swap(newfolio, folio);
>>>
>>> +	if (folio_test_large_rmappable(folio))
>>> +		folio_set_large_rmappable(newfolio);
>>> +
>>>  	mem_cgroup_migrate(folio, newfolio);
>>>  }
>>>  EXPORT_SYMBOL(folio_migrate_flags);
>>
>> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>>
>> I'd assume that all migration allocation functions must take care of that.
>>
>> It's a responsibility of the folio allocation code, not folio migration
>> code.
> 
> I agree. The migration allocation function needs to give a folio or other
> types of page matching the original one. Do we want to turn this into
> a WARN to make sure newfolio matches folio's large_rmappable state?

VM_WARN, sounds reasonable.

-- 
Cheers,

David

Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[Usama Arif]

On 11/03/2026 16:38, Zi Yan wrote:
> On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:
> 
>> On 3/11/26 14:23, Usama Arif wrote:
>>> folio_migrate_flags() transfers folio state from source to destination
>>> during migration, but does not transfer the large_rmappable flag.
>>>
>>> Migration allocators like alloc_migration_target() and
>>> alloc_misplaced_dst_folio() use __folio_alloc() directly without
>>> wrapping the result in page_rmappable_folio(), so the destination folio
>>> never gets large_rmappable set.
>>>
>>> This becomes a problem when a folio on the deferred split queue is
>>> migrated: the destination folio can be added to the deferred split queue
>>> via deferred_split_folio() (which does not check large_rmappable), but
>>> when the folio is later freed, folio_unqueue_deferred_split() bails out
>>> early because large_rmappable is not set:
>>>
>>>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>>>       return false;
>>>
>>> This leaves a stale entry on the deferred split queue, leading to
>>> use-after-free when the shrinker walks the list.
>>>
>>> Fix this by transferring large_rmappable in folio_migrate_flags(),
>>> consistent with how all other folio flags are handled.
>>>
>>> Fixes: dafff3f4c850 ("mm: split underused THPs")
>>> Signed-off-by: Usama Arif <usama.arif@linux.dev>
>>> ---
>>>  mm/migrate.c | 3 +++
>>>  1 file changed, 3 insertions(+)
>>>
>>> diff --git a/mm/migrate.c b/mm/migrate.c
>>> index 3380021fd3db..ee1c7bc851dd 100644
>>> --- a/mm/migrate.c
>>> +++ b/mm/migrate.c
>>> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>>>  	folio_copy_owner(newfolio, folio);
>>>  	pgalloc_tag_swap(newfolio, folio);
>>>
>>> +	if (folio_test_large_rmappable(folio))
>>> +		folio_set_large_rmappable(newfolio);
>>> +
>>>  	mem_cgroup_migrate(folio, newfolio);
>>>  }
>>>  EXPORT_SYMBOL(folio_migrate_flags);
>>
>> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>>
>> I'd assume that all migration allocation functions must take care of that.
>>
>> It's a responsibility of the folio allocation code, not folio migration
>> code.
> 
> I agree. The migration allocation function needs to give a folio or other
> types of page matching the original one. Do we want to turn this into
> a WARN to make sure newfolio matches folio's large_rmappable state?
> 

hmm its done in compaction_alloc() and alloc_migration_target_by_mpol() but I
dont see this being done in alloc_migration_target() and alloc_misplaced_dst_folio().
I think alloc_misplaced_dst_folio() is used by NUMA balancing and alloc_migration_target()
by hotplug and memory failure?

I am not very familiar with migration code, so maybe I am missing where its being done
in these paths?

Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[Usama Arif]

On 11/03/2026 17:24, Usama Arif wrote:
> 
> 
> On 11/03/2026 16:38, Zi Yan wrote:
>> On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:
>>
>>> On 3/11/26 14:23, Usama Arif wrote:
>>>> folio_migrate_flags() transfers folio state from source to destination
>>>> during migration, but does not transfer the large_rmappable flag.
>>>>
>>>> Migration allocators like alloc_migration_target() and
>>>> alloc_misplaced_dst_folio() use __folio_alloc() directly without
>>>> wrapping the result in page_rmappable_folio(), so the destination folio
>>>> never gets large_rmappable set.
>>>>
>>>> This becomes a problem when a folio on the deferred split queue is
>>>> migrated: the destination folio can be added to the deferred split queue
>>>> via deferred_split_folio() (which does not check large_rmappable), but
>>>> when the folio is later freed, folio_unqueue_deferred_split() bails out
>>>> early because large_rmappable is not set:
>>>>
>>>>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>>>>       return false;
>>>>
>>>> This leaves a stale entry on the deferred split queue, leading to
>>>> use-after-free when the shrinker walks the list.
>>>>
>>>> Fix this by transferring large_rmappable in folio_migrate_flags(),
>>>> consistent with how all other folio flags are handled.
>>>>
>>>> Fixes: dafff3f4c850 ("mm: split underused THPs")
>>>> Signed-off-by: Usama Arif <usama.arif@linux.dev>
>>>> ---
>>>>  mm/migrate.c | 3 +++
>>>>  1 file changed, 3 insertions(+)
>>>>
>>>> diff --git a/mm/migrate.c b/mm/migrate.c
>>>> index 3380021fd3db..ee1c7bc851dd 100644
>>>> --- a/mm/migrate.c
>>>> +++ b/mm/migrate.c
>>>> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>>>>  	folio_copy_owner(newfolio, folio);
>>>>  	pgalloc_tag_swap(newfolio, folio);
>>>>
>>>> +	if (folio_test_large_rmappable(folio))
>>>> +		folio_set_large_rmappable(newfolio);
>>>> +
>>>>  	mem_cgroup_migrate(folio, newfolio);
>>>>  }
>>>>  EXPORT_SYMBOL(folio_migrate_flags);
>>>
>>> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>>>
>>> I'd assume that all migration allocation functions must take care of that.
>>>
>>> It's a responsibility of the folio allocation code, not folio migration
>>> code.
>>
>> I agree. The migration allocation function needs to give a folio or other
>> types of page matching the original one. Do we want to turn this into
>> a WARN to make sure newfolio matches folio's large_rmappable state?
>>
> 
> hmm its done in compaction_alloc() and alloc_migration_target_by_mpol() but I
> dont see this being done in alloc_migration_target() and alloc_misplaced_dst_folio().
> I think alloc_misplaced_dst_folio() is used by NUMA balancing and alloc_migration_target()
> by hotplug and memory failure?
> 
> I am not very familiar with migration code, so maybe I am missing where its being done
> in these paths?

ah no ignore me :) __folio_alloc_noprof should set it. Thanks and sorry for the noise!

Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[David Hildenbrand (Arm)]

On 3/11/26 15:24, Usama Arif wrote:
> 
> 
> On 11/03/2026 16:38, Zi Yan wrote:
>> On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:
>>
>>>
>>> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>>>
>>> I'd assume that all migration allocation functions must take care of that.
>>>
>>> It's a responsibility of the folio allocation code, not folio migration
>>> code.
>>
>> I agree. The migration allocation function needs to give a folio or other
>> types of page matching the original one. Do we want to turn this into
>> a WARN to make sure newfolio matches folio's large_rmappable state?
>>
> 
> hmm its done in compaction_alloc() and alloc_migration_target_by_mpol() but I
> dont see this being done in alloc_migration_target() and alloc_misplaced_dst_folio().

__folio_alloc_node() and friends should be calling
page_rmappable_folio(). See __folio_alloc_noprof().

> I think alloc_misplaced_dst_folio() is used by NUMA balancing and alloc_migration_target()
> by hotplug and memory failure?
> 
> I am not very familiar with migration code, so maybe I am missing where its being done
> in these paths?

Please double check. If a call is missing, we should fix it there.

-- 
Cheers,

David