Re: [PATCH] mm/memory_hotplug: fix call folio_test_large with tail page in do_migrate_range

[Oscar Salvador <osalvador@suse.de>]

On Mon, Mar 24, 2025 at 09:17:50PM +0800, Jinjiang Tu wrote:
> We triggered the below BUG:
> 
... 
> When allocating a hugetlb folio, between the folio is taken from buddy
> and prep_compound_page() is called, start_isolate_page_range() and
> do_migrate_range() is called. When do_migrate_range() scans the head page
> of the hugetlb folio, the compound_head field isn't set, so scans the
> tail page next. And at this time, the compound_head field of tail page is
> set, folio_test_large() is called by tail page, thus triggers VM_BUG_ON().
> 
> To fix it, get folio refcount before calling folio_test_large().
> 
> Fixes: 8135d8926c08 ("mm: memory_hotplug: memory hotremove supports thp migration")
> Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>

Acked-by: Oscar Salvador <osalvador@suse.de>

As David mentions, I think too that this was introduced in
commit: b62b51d2d1593e65 ("mm: memory_hotplug: remove head variable in
do_migrate_range()")


-- 
Oscar Salvador
SUSE Labs