Re: [PATCH v3] mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list

[Jinjiang Tu <tujinjiang@huawei.com>]

在 2025/7/11 16:05, David Hildenbrand 写道:
> On 11.07.25 04:17, Jinjiang Tu wrote:
>> In shrink_folio_list(), the hwpoisoned folio may be large folio, which
>> can't be handled by unmap_poisoned_folio(). For THP, try_to_unmap_one()
>> must be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then
>> retry. Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of
>> pvmw.pte. Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a 
>> WARN_ON_ONCE
>> due to the page isn't in swapcache.
>>
>> Since UCE is rare in real world, and race with reclaimation is more 
>> rare,
>> just skipping the hwpoisoned large folio is enough. memory_failure() 
>> will
>> handle it if the UCE is triggered again.
>>
>> Fixes: 1b0449544c64 ("mm/vmscan: don't try to reclaim hwpoison folio")
>> Reported-by: syzbot+3b220254df55d8ca8a61@syzkaller.appspotmail.com
>> Closes: 
>> https://lore.kernel.org/all/68412d57.050a0220.2461cf.000e.GAE@google.com/
>> Acked-by: David Hildenbrand <david@redhat.com>
>> Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
>> Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
>> ---
>> v3:
>>   * collect Acked-by and Reviewed-by
>>   * update commit message and commemts, sugguested by Oscar Salvador.
>>
>>   mm/memory-failure.c | 4 ++++
>>   mm/vmscan.c         | 8 ++++++++
>>   2 files changed, 12 insertions(+)
>>
>> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
>> index b91a33fb6c69..9ee176fcc949 100644
>> --- a/mm/memory-failure.c
>> +++ b/mm/memory-failure.c
>> @@ -1561,6 +1561,10 @@ static int get_hwpoison_page(struct page *p, 
>> unsigned long flags)
>>       return ret;
>>   }
>>   +/*
>> + * The caller must guarantee the folio isn't large folio. 
>> try_to_unmap()
>> + * can't handle it.
>
> Not completely accurate: it may be a hugetlb folios, that is also 
> large, but supported.
>
> "isn't a large folio, except hugetlb."
>
Thanks, updated it.