Re: [PATCH v3] mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list

[David Hildenbrand <david@redhat.com>]

On 11.07.25 04:17, Jinjiang Tu wrote:
> In shrink_folio_list(), the hwpoisoned folio may be large folio, which
> can't be handled by unmap_poisoned_folio(). For THP, try_to_unmap_one()
> must be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then
> retry. Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of
> pvmw.pte. Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a WARN_ON_ONCE
> due to the page isn't in swapcache.
> 
> Since UCE is rare in real world, and race with reclaimation is more rare,
> just skipping the hwpoisoned large folio is enough. memory_failure() will
> handle it if the UCE is triggered again.
> 
> Fixes: 1b0449544c64 ("mm/vmscan: don't try to reclaim hwpoison folio")
> Reported-by: syzbot+3b220254df55d8ca8a61@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68412d57.050a0220.2461cf.000e.GAE@google.com/
> Acked-by: David Hildenbrand <david@redhat.com>
> Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
> Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
> ---
> v3:
>   * collect Acked-by and Reviewed-by
>   * update commit message and commemts, sugguested by Oscar Salvador.
> 
>   mm/memory-failure.c | 4 ++++
>   mm/vmscan.c         | 8 ++++++++
>   2 files changed, 12 insertions(+)
> 
> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> index b91a33fb6c69..9ee176fcc949 100644
> --- a/mm/memory-failure.c
> +++ b/mm/memory-failure.c
> @@ -1561,6 +1561,10 @@ static int get_hwpoison_page(struct page *p, unsigned long flags)
>   	return ret;
>   }
>   
> +/*
> + * The caller must guarantee the folio isn't large folio. try_to_unmap()
> + * can't handle it.

Not completely accurate: it may be a hugetlb folios, that is also large, 
but supported.

"isn't a large folio, except hugetlb."

-- 
Cheers,

David / dhildenb