+ mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch added to mm-hotfixes-unstable branch

+ mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch added to mm-hotfixes-unstable branch

[Andrew Morton]

The patch titled
     Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
     mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch

This patch will later appear in the mm-hotfixes-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: Zi Yan <ziy@nvidia.com>
Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
Date: Wed, 22 Oct 2025 23:05:21 -0400

folio split clears PG_has_hwpoisoned, but the flag should be preserved in
after-split folios containing pages with PG_hwpoisoned flag if the folio
is split to >0 order folios.  Scan all pages in a to-be-split folio to
determine which after-split folios need the flag.

An alternatives is to change PG_has_hwpoisoned to PG_maybe_hwpoisoned to
avoid the scan and set it on all after-split folios, but resulting false
positive has undesirable negative impact.  To remove false positive,
caller of folio_test_has_hwpoisoned() and folio_contain_hwpoisoned_page()
needs to do the scan.  That might be causing a hassle for current and
future callers and more costly than doing the scan in the split code. 
More details are discussed in [1].

This issue can be exposed via:
1. splitting a has_hwpoisoned folio to >0 order from debugfs interface;
2. truncating part of a has_hwpoisoned folio in
   truncate_inode_partial_folio().

And later accesses to a hwpoisoned page could be possible due to the
missing has_hwpoisoned folio flag.  This will lead to MCE errors.

Link: https://lore.kernel.org/all/CAHbLzkoOZm0PXxE9qwtF4gKR=cpRXrSrJ9V9Pm2DJexs985q4g@mail.gmail.com/ [1]
Link: https://lkml.kernel.org/r/20251023030521.473097-1-ziy@nvidia.com
Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Pankaj Raghav <kernel@pankajraghav.com>
Reviewed-by: Yang Shi <yang@os.amperecomputing.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Jane Chu <jane.chu@oracle.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Luis Chamberalin <mcgrof@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/huge_memory.c |   23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

--- a/mm/huge_memory.c~mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order
+++ a/mm/huge_memory.c
@@ -3263,6 +3263,14 @@ bool can_split_folio(struct folio *folio
 					caller_pins;
 }
 
+static bool page_range_has_hwpoisoned(struct page *page, long nr_pages)
+{
+	for (; nr_pages; page++, nr_pages--)
+		if (PageHWPoison(page))
+			return true;
+	return false;
+}
+
 /*
  * It splits @folio into @new_order folios and copies the @folio metadata to
  * all the resulting folios.
@@ -3270,17 +3278,24 @@ bool can_split_folio(struct folio *folio
 static void __split_folio_to_order(struct folio *folio, int old_order,
 		int new_order)
 {
+	/* Scan poisoned pages when split a poisoned folio to large folios */
+	const bool handle_hwpoison = folio_test_has_hwpoisoned(folio) && new_order;
 	long new_nr_pages = 1 << new_order;
 	long nr_pages = 1 << old_order;
 	long i;
 
+	folio_clear_has_hwpoisoned(folio);
+
+	/* Check first new_nr_pages since the loop below skips them */
+	if (handle_hwpoison &&
+	    page_range_has_hwpoisoned(folio_page(folio, 0), new_nr_pages))
+		folio_set_has_hwpoisoned(folio);
 	/*
 	 * Skip the first new_nr_pages, since the new folio from them have all
 	 * the flags from the original folio.
 	 */
 	for (i = new_nr_pages; i < nr_pages; i += new_nr_pages) {
 		struct page *new_head = &folio->page + i;
-
 		/*
 		 * Careful: new_folio is not a "real" folio before we cleared PageTail.
 		 * Don't pass it around before clear_compound_head().
@@ -3322,6 +3337,10 @@ static void __split_folio_to_order(struc
 				 (1L << PG_dirty) |
 				 LRU_GEN_MASK | LRU_REFS_MASK));
 
+		if (handle_hwpoison &&
+		    page_range_has_hwpoisoned(new_head, new_nr_pages))
+			folio_set_has_hwpoisoned(new_folio);
+
 		new_folio->mapping = folio->mapping;
 		new_folio->index = folio->index + i;
 
@@ -3422,8 +3441,6 @@ static int __split_unmapped_folio(struct
 	if (folio_test_anon(folio))
 		mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
 
-	folio_clear_has_hwpoisoned(folio);
-
 	/*
 	 * split to new_order one order at a time. For uniform split,
 	 * folio is split to new_order directly.
_

Patches currently in -mm which might be from ziy@nvidia.com are

mm-huge_memory-do-not-change-split_huge_page-target-order-silently.patch
mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch

Re: + mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch added to mm-hotfixes-unstable branch

[jane.chu]

On 10/23/2025 4:12 PM, Andrew Morton wrote:
> 
> The patch titled
>       Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
> has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
>       mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
> 
> This patch will shortly appear at
>       https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
> 
> This patch will later appear in the mm-hotfixes-unstable branch at
>      git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> 
> Before you just go and hit "reply", please:
>     a) Consider who else should be cc'ed
>     b) Prefer to cc a suitable mailing list as well
>     c) Ideally: find the original patch on the mailing list and do a
>        reply-to-all to that, adding suitable additional cc's
> 
> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
> 
> The -mm tree is included into linux-next via the mm-everything
> branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there every 2-3 working days
> 
> ------------------------------------------------------
> From: Zi Yan <ziy@nvidia.com>
> Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
> Date: Wed, 22 Oct 2025 23:05:21 -0400
> 
> folio split clears PG_has_hwpoisoned, but the flag should be preserved in
> after-split folios containing pages with PG_hwpoisoned flag if the folio
> is split to >0 order folios.  Scan all pages in a to-be-split folio to
> determine which after-split folios need the flag.
> 
> An alternatives is to change PG_has_hwpoisoned to PG_maybe_hwpoisoned to
> avoid the scan and set it on all after-split folios, but resulting false
> positive has undesirable negative impact.  To remove false positive,
> caller of folio_test_has_hwpoisoned() and folio_contain_hwpoisoned_page()
> needs to do the scan.  That might be causing a hassle for current and
> future callers and more costly than doing the scan in the split code.
> More details are discussed in [1].
> 
> This issue can be exposed via:
> 1. splitting a has_hwpoisoned folio to >0 order from debugfs interface;
> 2. truncating part of a has_hwpoisoned folio in
>     truncate_inode_partial_folio().
> 
> And later accesses to a hwpoisoned page could be possible due to the
> missing has_hwpoisoned folio flag.  This will lead to MCE errors.
> 
> Link: https://lore.kernel.org/all/CAHbLzkoOZm0PXxE9qwtF4gKR=cpRXrSrJ9V9Pm2DJexs985q4g@mail.gmail.com/ [1]
> Link: https://lkml.kernel.org/r/20251023030521.473097-1-ziy@nvidia.com
> Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages")
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> Acked-by: David Hildenbrand <david@redhat.com>
> Cc: Pankaj Raghav <kernel@pankajraghav.com>
> Reviewed-by: Yang Shi <yang@os.amperecomputing.com>
> Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
> Cc: Barry Song <baohua@kernel.org>
> Cc: Dev Jain <dev.jain@arm.com>
> Cc: Jane Chu <jane.chu@oracle.com>
> Cc: Lance Yang <lance.yang@linux.dev>
> Cc: Liam Howlett <liam.howlett@oracle.com>
> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
> Cc: Luis Chamberalin <mcgrof@kernel.org>
> Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
> Cc: Miaohe Lin <linmiaohe@huawei.com>
> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
> Cc: Nico Pache <npache@redhat.com>
> Cc: Ryan Roberts <ryan.roberts@arm.com>
> Cc: Wei Yang <richard.weiyang@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
> 
>   mm/huge_memory.c |   23 ++++++++++++++++++++---
>   1 file changed, 20 insertions(+), 3 deletions(-)
> 
> --- a/mm/huge_memory.c~mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order
> +++ a/mm/huge_memory.c
> @@ -3263,6 +3263,14 @@ bool can_split_folio(struct folio *folio
>   					caller_pins;
>   }
>   
> +static bool page_range_has_hwpoisoned(struct page *page, long nr_pages)
> +{
> +	for (; nr_pages; page++, nr_pages--)
> +		if (PageHWPoison(page))
> +			return true;
> +	return false;
> +}
> +
>   /*
>    * It splits @folio into @new_order folios and copies the @folio metadata to
>    * all the resulting folios.
> @@ -3270,17 +3278,24 @@ bool can_split_folio(struct folio *folio
>   static void __split_folio_to_order(struct folio *folio, int old_order,
>   		int new_order)
>   {
> +	/* Scan poisoned pages when split a poisoned folio to large folios */
> +	const bool handle_hwpoison = folio_test_has_hwpoisoned(folio) && new_order;
>   	long new_nr_pages = 1 << new_order;
>   	long nr_pages = 1 << old_order;
>   	long i;
>   
> +	folio_clear_has_hwpoisoned(folio);
> +
> +	/* Check first new_nr_pages since the loop below skips them */
> +	if (handle_hwpoison &&
> +	    page_range_has_hwpoisoned(folio_page(folio, 0), new_nr_pages))
> +		folio_set_has_hwpoisoned(folio);

Not sure what am I missing, why are we setting hs_hwpoison to the
pre-split old folio here?  setting it in a new >0 order folio below
make sense, setting it back to the big old folio in case of a failed 
split make sense.

>   	/*
>   	 * Skip the first new_nr_pages, since the new folio from them have all
>   	 * the flags from the original folio.
>   	 */
>   	for (i = new_nr_pages; i < nr_pages; i += new_nr_pages) {
>   		struct page *new_head = &folio->page + i;
> -
>   		/*
>   		 * Careful: new_folio is not a "real" folio before we cleared PageTail.
>   		 * Don't pass it around before clear_compound_head().
> @@ -3322,6 +3337,10 @@ static void __split_folio_to_order(struc
>   				 (1L << PG_dirty) |
>   				 LRU_GEN_MASK | LRU_REFS_MASK));
>   
> +		if (handle_hwpoison &&
> +		    page_range_has_hwpoisoned(new_head, new_nr_pages))
> +			folio_set_has_hwpoisoned(new_folio);
> +
Looks good.

>   		new_folio->mapping = folio->mapping;
>   		new_folio->index = folio->index + i;
>   
> @@ -3422,8 +3441,6 @@ static int __split_unmapped_folio(struct
>   	if (folio_test_anon(folio))
>   		mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
>   
> -	folio_clear_has_hwpoisoned(folio);
> -
>   	/*
>   	 * split to new_order one order at a time. For uniform split,
>   	 * folio is split to new_order directly.
> _
> 
> Patches currently in -mm which might be from ziy@nvidia.com are
> 
> mm-huge_memory-do-not-change-split_huge_page-target-order-silently.patch
> mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
> 
thanks,-jane

Re: + mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch added to mm-hotfixes-unstable branch

[Zi Yan]

On 24 Oct 2025, at 23:16, jane.chu@oracle.com wrote:

> On 10/23/2025 4:12 PM, Andrew Morton wrote:
>>
>> The patch titled
>>       Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
>> has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
>>       mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
>>
>> This patch will shortly appear at
>>      https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
>>
>> This patch will later appear in the mm-hotfixes-unstable branch at
>>     git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
>>
>> Before you just go and hit "reply", please:
>>     a) Consider who else should be cc'ed
>>     b) Prefer to cc a suitable mailing list as well
>>     c) Ideally: find the original patch on the mailing list and do a
>>        reply-to-all to that, adding suitable additional cc's
>>
>> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
>>
>> The -mm tree is included into linux-next via the mm-everything
>> branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
>> and is updated there every 2-3 working days
>>
>> ------------------------------------------------------
>> From: Zi Yan <ziy@nvidia.com>
>> Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
>> Date: Wed, 22 Oct 2025 23:05:21 -0400
>>
>> folio split clears PG_has_hwpoisoned, but the flag should be preserved in
>> after-split folios containing pages with PG_hwpoisoned flag if the folio
>> is split to >0 order folios.  Scan all pages in a to-be-split folio to
>> determine which after-split folios need the flag.
>>
>> An alternatives is to change PG_has_hwpoisoned to PG_maybe_hwpoisoned to
>> avoid the scan and set it on all after-split folios, but resulting false
>> positive has undesirable negative impact.  To remove false positive,
>> caller of folio_test_has_hwpoisoned() and folio_contain_hwpoisoned_page()
>> needs to do the scan.  That might be causing a hassle for current and
>> future callers and more costly than doing the scan in the split code.
>> More details are discussed in [1].
>>
>> This issue can be exposed via:
>> 1. splitting a has_hwpoisoned folio to >0 order from debugfs interface;
>> 2. truncating part of a has_hwpoisoned folio in
>>     truncate_inode_partial_folio().
>>
>> And later accesses to a hwpoisoned page could be possible due to the
>> missing has_hwpoisoned folio flag.  This will lead to MCE errors.
>>
>> Link: https://lore.kernel.org/all/CAHbLzkoOZm0PXxE9qwtF4gKR=cpRXrSrJ9V9Pm2DJexs985q4g@mail.gmail.com/ [1]
>> Link: https://lkml.kernel.org/r/20251023030521.473097-1-ziy@nvidia.com
>> Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages")
>> Signed-off-by: Zi Yan <ziy@nvidia.com>
>> Acked-by: David Hildenbrand <david@redhat.com>
>> Cc: Pankaj Raghav <kernel@pankajraghav.com>
>> Reviewed-by: Yang Shi <yang@os.amperecomputing.com>
>> Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
>> Cc: Barry Song <baohua@kernel.org>
>> Cc: Dev Jain <dev.jain@arm.com>
>> Cc: Jane Chu <jane.chu@oracle.com>
>> Cc: Lance Yang <lance.yang@linux.dev>
>> Cc: Liam Howlett <liam.howlett@oracle.com>
>> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
>> Cc: Luis Chamberalin <mcgrof@kernel.org>
>> Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
>> Cc: Miaohe Lin <linmiaohe@huawei.com>
>> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
>> Cc: Nico Pache <npache@redhat.com>
>> Cc: Ryan Roberts <ryan.roberts@arm.com>
>> Cc: Wei Yang <richard.weiyang@gmail.com>
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>> ---
>>
>>   mm/huge_memory.c |   23 ++++++++++++++++++++---
>>   1 file changed, 20 insertions(+), 3 deletions(-)
>>
>> --- a/mm/huge_memory.c~mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order
>> +++ a/mm/huge_memory.c
>> @@ -3263,6 +3263,14 @@ bool can_split_folio(struct folio *folio
>>   					caller_pins;
>>   }
>>  +static bool page_range_has_hwpoisoned(struct page *page, long nr_pages)
>> +{
>> +	for (; nr_pages; page++, nr_pages--)
>> +		if (PageHWPoison(page))
>> +			return true;
>> +	return false;
>> +}
>> +
>>   /*
>>    * It splits @folio into @new_order folios and copies the @folio metadata to
>>    * all the resulting folios.
>> @@ -3270,17 +3278,24 @@ bool can_split_folio(struct folio *folio
>>   static void __split_folio_to_order(struct folio *folio, int old_order,
>>   		int new_order)
>>   {
>> +	/* Scan poisoned pages when split a poisoned folio to large folios */
>> +	const bool handle_hwpoison = folio_test_has_hwpoisoned(folio) && new_order;
>>   	long new_nr_pages = 1 << new_order;
>>   	long nr_pages = 1 << old_order;
>>   	long i;
>>  +	folio_clear_has_hwpoisoned(folio);
>> +
>> +	/* Check first new_nr_pages since the loop below skips them */
>> +	if (handle_hwpoison &&
>> +	    page_range_has_hwpoisoned(folio_page(folio, 0), new_nr_pages))
>> +		folio_set_has_hwpoisoned(folio);
>
> Not sure what am I missing, why are we setting hs_hwpoison to the
> pre-split old folio here?  setting it in a new >0 order folio below
> make sense, setting it back to the big old folio in case of a failed split make sense.

1) __split_folio_to_order() never fails; 2) this is for when any page in
[0, new_nr_pages) has HWPoison set. Like the comment above
this statement said, the split in the loop only check [new_nr_pages, nr_pages)
pages. The statement above checks [0, new_nr_pages) and change the original
folio flag.

>
>>   	/*
>>   	 * Skip the first new_nr_pages, since the new folio from them have all
>>   	 * the flags from the original folio.
>>   	 */
>>   	for (i = new_nr_pages; i < nr_pages; i += new_nr_pages) {
>>   		struct page *new_head = &folio->page + i;
>> -
>>   		/*
>>   		 * Careful: new_folio is not a "real" folio before we cleared PageTail.
>>   		 * Don't pass it around before clear_compound_head().
>> @@ -3322,6 +3337,10 @@ static void __split_folio_to_order(struc
>>   				 (1L << PG_dirty) |
>>   				 LRU_GEN_MASK | LRU_REFS_MASK));
>>  +		if (handle_hwpoison &&
>> +		    page_range_has_hwpoisoned(new_head, new_nr_pages))
>> +			folio_set_has_hwpoisoned(new_folio);
>> +
> Looks good.
>
>>   		new_folio->mapping = folio->mapping;
>>   		new_folio->index = folio->index + i;
>>  @@ -3422,8 +3441,6 @@ static int __split_unmapped_folio(struct
>>   	if (folio_test_anon(folio))
>>   		mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
>>  -	folio_clear_has_hwpoisoned(folio);
>> -
>>   	/*
>>   	 * split to new_order one order at a time. For uniform split,
>>   	 * folio is split to new_order directly.
>> _
>>
>> Patches currently in -mm which might be from ziy@nvidia.com are
>>
>> mm-huge_memory-do-not-change-split_huge_page-target-order-silently.patch
>> mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
>>
> thanks,-jane


--
Best Regards,
Yan, Zi