From: "David Hildenbrand (Arm)" <david@kernel.org>
To: Deepanshu Kartikey <kartikey406@gmail.com>,
akpm@linux-foundation.org, ziy@nvidia.com,
matthew.brost@intel.com, joshua.hahnjy@gmail.com,
rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net,
ying.huang@linux.alibaba.com, apopple@nvidia.com
Cc: usama.arif@linux.dev, richard.weiyang@gmail.com, sj@kernel.org,
hannes@cmpxchg.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org,
syzbot+a7067a757858ac8eb085@syzkaller.appspotmail.com,
Lance Yang <lance.yang@linux.dev>
Subject: Re: [PATCH] mm/migrate: fix stale partially_mapped arg to deferred_split_folio()
Date: Wed, 1 Apr 2026 12:10:58 +0200 [thread overview]
Message-ID: <f0599d26-eebb-4bb3-812f-beee0bce5f5a@kernel.org> (raw)
In-Reply-To: <20260401084116.22219-1-kartikey406@gmail.com>
On 4/1/26 10:41, Deepanshu Kartikey wrote:
> In migrate_folio_move(), src_partially_mapped is sampled from the source
> folio before move_to_new_folio() is called:
>
> if (folio_order(src) > 1 &&
> !data_race(list_empty(&src->_deferred_list))) {
> src_deferred_split = true;
> src_partially_mapped = folio_test_partially_mapped(src);
> }
>
> A concurrent thread can unmap pages from the source folio between this
> read and the actual migration, making the sampled value stale.
Trying to make sense of this.
In migrate_folio_move() don't we have the folio completely unmapped
because there are only migration entries referencing the folio?
See migrate_folio_unmap(), where we check !folio_mapped().
Why should we suddenly have mapped folio here? Something is off.
Unmapping a migration entry will not involve rmap code and not mess with
the partially-mapped flag.
--
Cheers,
David
next prev parent reply other threads:[~2026-04-01 10:11 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-01 8:41 [PATCH] mm/migrate: fix stale partially_mapped arg to deferred_split_folio() Deepanshu Kartikey
2026-04-01 9:44 ` David Hildenbrand (Arm)
2026-04-01 10:10 ` David Hildenbrand (Arm) [this message]
2026-04-01 10:15 ` David Hildenbrand (Arm)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f0599d26-eebb-4bb3-812f-beee0bce5f5a@kernel.org \
--to=david@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=apopple@nvidia.com \
--cc=byungchul@sk.com \
--cc=gourry@gourry.net \
--cc=hannes@cmpxchg.org \
--cc=joshua.hahnjy@gmail.com \
--cc=kartikey406@gmail.com \
--cc=lance.yang@linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=matthew.brost@intel.com \
--cc=rakie.kim@sk.com \
--cc=richard.weiyang@gmail.com \
--cc=sj@kernel.org \
--cc=syzbot+a7067a757858ac8eb085@syzkaller.appspotmail.com \
--cc=usama.arif@linux.dev \
--cc=ying.huang@linux.alibaba.com \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox