From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A074C22339; Thu, 5 Feb 2026 03:47:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770263274; cv=none; b=TWhSYz8YDcwffdE4YaEf4tGl7cjwqS1a2STG2lu1p3RDjvLlpUb7La5CJge4CE7ek4hxAOyiCPHj+CairVfRLwPVeg1BNToCMFmOyQWKC2W6s0cATK8qTAFj8aRZ24+gaIxcTVCbGfjbMmK7vEW8sH+E4lEj7EaRRHhKy+t+QDQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770263274; c=relaxed/simple; bh=AlJYk0vwR6a7z3G1T7gdtCSo68C6OKgODawm43o+LVc=; h=Date:To:From:Subject:Message-Id; b=TLFM7jdFlZVInB+fyHefOhOlBk3WNwPdJ56znurrOEo+fKs2QDil0X1V+k2F09Zh7GKTGZBIDeHT2NCqNUsW7OycvkQxb0vVcSdTzydAuczmxVsp8U826a4PrUKaJdHFhu6nwzcAm8gBp4s6+DxHcj2W9VeJ5t2uwvMHTeGPbuQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=UyCz1ArS; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="UyCz1ArS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 147B3C4CEF7; Thu, 5 Feb 2026 03:47:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1770263274; bh=AlJYk0vwR6a7z3G1T7gdtCSo68C6OKgODawm43o+LVc=; h=Date:To:From:Subject:From; b=UyCz1ArSigO634pH2KsNbD6bi6ljow4j49SVWeOiCRhNdre8mOrvixDWU+WQrTPcL UjbYvCHRJG9NlF4CUMtFmRQCYQtWMIzl//AASscYNLKzdwHqBJzeFjEfKefqeLrUBU yazgyhbf3T7NhGVJ9G8wjSXzR+FXAtvskWLPTlok= Date: Wed, 04 Feb 2026 19:47:53 -0800 To: mm-commits@vger.kernel.org,ziy@nvidia.com,stable@vger.kernel.org,lance.yang@linux.dev,gavinguo@igalia.com,david@kernel.org,baolin.wang@linux.alibaba.com,richard.weiyang@gmail.com,akpm@linux-foundation.org From: Andrew Morton Subject: + mm-huge_memory-fix-early-failure-try_to_migrate-when-split-huge-pmd-for-shared-thp.patch added to mm-new branch Message-Id: <20260205034754.147B3C4CEF7@smtp.kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The patch titled Subject: mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared thp has been added to the -mm mm-new branch. Its filename is mm-huge_memory-fix-early-failure-try_to_migrate-when-split-huge-pmd-for-shared-thp.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-huge_memory-fix-early-failure-try_to_migrate-when-split-huge-pmd-for-shared-thp.patch This patch will later appear in the mm-new branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Note, mm-new is a provisional staging ground for work-in-progress patches, and acceptance into mm-new is a notification for others take notice and to finish up reviews. Please do not hesitate to respond to review feedback and post updated versions to replace or incrementally fixup patches in mm-new. The mm-new branch of mm.git is not included in linux-next Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Wei Yang Subject: mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared thp Date: Thu, 5 Feb 2026 03:31:13 +0000 Commit 60fbb14396d5 ("mm/huge_memory: adjust try_to_migrate_one() and split_huge_pmd_locked()") return false unconditionally after split_huge_pmd_locked() which may fail early during try_to_migrate() for shared thp. This will lead to unexpected folio split failure. One way to reproduce: Create an anonymous thp range and fork 512 children, so we have a thp shared mapped in 513 processes. Then trigger folio split with /sys/kernel/debug/split_huge_pages debugfs to split the thp folio to order 0. Without the above commit, we can successfully split to order 0. With the above commit, the folio is still a large folio. The reason is the above commit return false after split pmd unconditionally in the first process and break try_to_migrate(). On memory pressure or failure, we would try to reclaim unused memory or limit bad memory after folio split. If failed to split it, we will leave some more memory unusable than expected. The tricky thing in the above reproduction method is current debugfs interface leverage function split_huge_pages_pid(), which will iterate the whole pmd range and do folio split on each base page address. This means it will try 512 times, and each time split one pmd from pmd mapped to pte mapped thp. If there are less than 512 shared mapped process, the folio is still split successfully at last. But in real world, we usually try it for once. This patch fixes this by restarting page_vma_mapped_walk() after split_huge_pmd_locked(). We cannot simply return "true" to fix the problem, as that would affect another case: split_huge_pmd_locked()->folio_try_share_anon_rmap_pmd() can failed and leave the folio mapped through PTEs; we would return "true" from try_to_migrate_one() in that case as well. While that is mostly harmless, we could end up walking the rmap, wasting some cycles. Link: https://lkml.kernel.org/r/20260205033113.30724-1-richard.weiyang@gmail.com Fixes: 60fbb14396d5 ("mm/huge_memory: adjust try_to_migrate_one() and split_huge_pmd_locked()") Signed-off-by: Wei Yang Reviewed-by: Baolin Wang Reviewed-by: Zi Yan Tested-by: Lance Yang Reviewed-by: Lance Yang Reviewed-by: Gavin Guo Acked-by: David Hildenbrand (arm) Cc: Gavin Guo Cc: "David Hildenbrand (Red Hat)" Cc: Zi Yan Cc: Baolin Wang Cc: Lance Yang Cc: Signed-off-by: Andrew Morton --- mm/rmap.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/mm/rmap.c~mm-huge_memory-fix-early-failure-try_to_migrate-when-split-huge-pmd-for-shared-thp +++ a/mm/rmap.c @@ -2446,11 +2446,17 @@ static bool try_to_migrate_one(struct fo __maybe_unused pmd_t pmdval; if (flags & TTU_SPLIT_HUGE_PMD) { + /* + * split_huge_pmd_locked() might leave the + * folio mapped through PTEs. Retry the walk + * so we can detect this scenario and properly + * abort the walk. + */ split_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, true); - ret = false; - page_vma_mapped_walk_done(&pvmw); - break; + flags &= ~TTU_SPLIT_HUGE_PMD; + page_vma_mapped_walk_restart(&pvmw); + continue; } #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION pmdval = pmdp_get(pvmw.pmd); _ Patches currently in -mm which might be from richard.weiyang@gmail.com are mm-huge_memory-fix-early-failure-try_to_migrate-when-split-huge-pmd-for-shared-thp.patch