Re: + mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch added to mm-hotfixes-unstable branch

[jane.chu@oracle.com]

On 10/23/2025 4:12 PM, Andrew Morton wrote:
> 
> The patch titled
>       Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
> has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
>       mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
> 
> This patch will shortly appear at
>       https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
> 
> This patch will later appear in the mm-hotfixes-unstable branch at
>      git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> 
> Before you just go and hit "reply", please:
>     a) Consider who else should be cc'ed
>     b) Prefer to cc a suitable mailing list as well
>     c) Ideally: find the original patch on the mailing list and do a
>        reply-to-all to that, adding suitable additional cc's
> 
> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
> 
> The -mm tree is included into linux-next via the mm-everything
> branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there every 2-3 working days
> 
> ------------------------------------------------------
> From: Zi Yan <ziy@nvidia.com>
> Subject: mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
> Date: Wed, 22 Oct 2025 23:05:21 -0400
> 
> folio split clears PG_has_hwpoisoned, but the flag should be preserved in
> after-split folios containing pages with PG_hwpoisoned flag if the folio
> is split to >0 order folios.  Scan all pages in a to-be-split folio to
> determine which after-split folios need the flag.
> 
> An alternatives is to change PG_has_hwpoisoned to PG_maybe_hwpoisoned to
> avoid the scan and set it on all after-split folios, but resulting false
> positive has undesirable negative impact.  To remove false positive,
> caller of folio_test_has_hwpoisoned() and folio_contain_hwpoisoned_page()
> needs to do the scan.  That might be causing a hassle for current and
> future callers and more costly than doing the scan in the split code.
> More details are discussed in [1].
> 
> This issue can be exposed via:
> 1. splitting a has_hwpoisoned folio to >0 order from debugfs interface;
> 2. truncating part of a has_hwpoisoned folio in
>     truncate_inode_partial_folio().
> 
> And later accesses to a hwpoisoned page could be possible due to the
> missing has_hwpoisoned folio flag.  This will lead to MCE errors.
> 
> Link: https://lore.kernel.org/all/CAHbLzkoOZm0PXxE9qwtF4gKR=cpRXrSrJ9V9Pm2DJexs985q4g@mail.gmail.com/ [1]
> Link: https://lkml.kernel.org/r/20251023030521.473097-1-ziy@nvidia.com
> Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages")
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> Acked-by: David Hildenbrand <david@redhat.com>
> Cc: Pankaj Raghav <kernel@pankajraghav.com>
> Reviewed-by: Yang Shi <yang@os.amperecomputing.com>
> Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
> Cc: Barry Song <baohua@kernel.org>
> Cc: Dev Jain <dev.jain@arm.com>
> Cc: Jane Chu <jane.chu@oracle.com>
> Cc: Lance Yang <lance.yang@linux.dev>
> Cc: Liam Howlett <liam.howlett@oracle.com>
> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
> Cc: Luis Chamberalin <mcgrof@kernel.org>
> Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
> Cc: Miaohe Lin <linmiaohe@huawei.com>
> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
> Cc: Nico Pache <npache@redhat.com>
> Cc: Ryan Roberts <ryan.roberts@arm.com>
> Cc: Wei Yang <richard.weiyang@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
> 
>   mm/huge_memory.c |   23 ++++++++++++++++++++---
>   1 file changed, 20 insertions(+), 3 deletions(-)
> 
> --- a/mm/huge_memory.c~mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order
> +++ a/mm/huge_memory.c
> @@ -3263,6 +3263,14 @@ bool can_split_folio(struct folio *folio
>   					caller_pins;
>   }
>   
> +static bool page_range_has_hwpoisoned(struct page *page, long nr_pages)
> +{
> +	for (; nr_pages; page++, nr_pages--)
> +		if (PageHWPoison(page))
> +			return true;
> +	return false;
> +}
> +
>   /*
>    * It splits @folio into @new_order folios and copies the @folio metadata to
>    * all the resulting folios.
> @@ -3270,17 +3278,24 @@ bool can_split_folio(struct folio *folio
>   static void __split_folio_to_order(struct folio *folio, int old_order,
>   		int new_order)
>   {
> +	/* Scan poisoned pages when split a poisoned folio to large folios */
> +	const bool handle_hwpoison = folio_test_has_hwpoisoned(folio) && new_order;
>   	long new_nr_pages = 1 << new_order;
>   	long nr_pages = 1 << old_order;
>   	long i;
>   
> +	folio_clear_has_hwpoisoned(folio);
> +
> +	/* Check first new_nr_pages since the loop below skips them */
> +	if (handle_hwpoison &&
> +	    page_range_has_hwpoisoned(folio_page(folio, 0), new_nr_pages))
> +		folio_set_has_hwpoisoned(folio);

Not sure what am I missing, why are we setting hs_hwpoison to the
pre-split old folio here?  setting it in a new >0 order folio below
make sense, setting it back to the big old folio in case of a failed 
split make sense.

>   	/*
>   	 * Skip the first new_nr_pages, since the new folio from them have all
>   	 * the flags from the original folio.
>   	 */
>   	for (i = new_nr_pages; i < nr_pages; i += new_nr_pages) {
>   		struct page *new_head = &folio->page + i;
> -
>   		/*
>   		 * Careful: new_folio is not a "real" folio before we cleared PageTail.
>   		 * Don't pass it around before clear_compound_head().
> @@ -3322,6 +3337,10 @@ static void __split_folio_to_order(struc
>   				 (1L << PG_dirty) |
>   				 LRU_GEN_MASK | LRU_REFS_MASK));
>   
> +		if (handle_hwpoison &&
> +		    page_range_has_hwpoisoned(new_head, new_nr_pages))
> +			folio_set_has_hwpoisoned(new_folio);
> +
Looks good.

>   		new_folio->mapping = folio->mapping;
>   		new_folio->index = folio->index + i;
>   
> @@ -3422,8 +3441,6 @@ static int __split_unmapped_folio(struct
>   	if (folio_test_anon(folio))
>   		mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
>   
> -	folio_clear_has_hwpoisoned(folio);
> -
>   	/*
>   	 * split to new_order one order at a time. For uniform split,
>   	 * folio is split to new_order directly.
> _
> 
> Patches currently in -mm which might be from ziy@nvidia.com are
> 
> mm-huge_memory-do-not-change-split_huge_page-target-order-silently.patch
> mm-huge_memory-preserve-pg_has_hwpoisoned-if-a-folio-is-split-to-0-order.patch
> 
thanks,-jane