Files
linux/include/linux
Jinjiang Tu 4c5e7f0fcd mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
On arm64 server, we found folio that get from migration entry isn't locked
in softleaf_to_folio().  This issue triggers when mTHP splitting and
zap_nonpresent_ptes() races, and the root cause is lack of memory barrier
in softleaf_to_folio().  The race is as follows:

	CPU0                                             CPU1

deferred_split_scan()                              zap_nonpresent_ptes()
  lock folio
  split_folio()
    unmap_folio()
      change ptes to migration entries
    __split_folio_to_order()                         softleaf_to_folio()
      set flags(including PG_locked) for tail pages    folio = pfn_folio(softleaf_to_pfn(entry))
      smp_wmb()                                        VM_WARN_ON_ONCE(!folio_test_locked(folio))
      prep_compound_page() for tail pages

In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
are visible before the tail page becomes non-compound.  smp_wmb() should
be paired with smp_rmb() in softleaf_to_folio(), which is missed.  As a
result, if zap_nonpresent_ptes() accesses migration entry that stores tail
pfn, softleaf_to_folio() may see the updated compound_head of tail page
before page->flags.

This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()
because of the race between folio split and zap_nonpresent_ptes()
leading to a folio incorrectly undergoing modification without a folio
lock being held.

This is a BUG_ON() before commit 93976a2034 ("mm: eliminate further
swapops predicates"), which in merged in v6.19-rc1.

To fix it, add missing smp_rmb() if the softleaf entry is migration entry
in softleaf_to_folio() and softleaf_to_page().

[tujinjiang@huawei.com: update function name and comments]
  Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com
Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com
Fixes: e9b61f1985 ("thp: reintroduce split_huge_page()")
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-03-27 20:48:37 -07:00
..
2026-02-11 13:44:47 +01:00
2025-10-22 07:54:33 +02:00
2026-01-29 20:21:41 +01:00
2025-12-15 14:33:38 +01:00
2025-09-05 15:06:03 +02:00
2025-07-21 18:18:51 +01:00
2026-01-20 19:44:19 -08:00
2025-07-31 11:28:03 -04:00
2026-02-12 04:23:53 -07:00
2025-11-21 11:21:31 +01:00
2025-09-23 11:13:22 +02:00
2025-12-16 14:40:51 +01:00
2025-10-22 07:55:00 +02:00
2025-11-01 12:44:49 -05:00
2025-12-13 20:04:32 +12:00
2025-08-21 13:58:07 +02:00
2026-02-19 09:12:05 +01:00
2025-12-23 11:23:10 -08:00
2025-10-29 18:28:29 -07:00
2025-09-13 17:32:44 -07:00
2025-08-29 13:39:53 -07:00
2026-01-12 16:52:09 +01:00
2025-11-04 12:36:02 +01:00
2026-02-06 07:29:14 -07:00
2025-10-22 07:53:15 +02:00
2025-09-23 11:13:22 +02:00
2025-06-11 11:57:14 -07:00
2026-01-05 16:43:31 +01:00
2026-01-11 06:09:11 -10:00
2025-07-02 17:18:01 +01:00
2026-01-20 19:24:50 -08:00
2026-01-26 19:03:47 -08:00
2025-11-23 12:30:40 +01:00
2025-12-29 11:53:38 +01:00
2026-01-26 20:02:27 -08:00
2025-09-17 15:58:29 -04:00
2025-06-17 18:18:46 -07:00
2025-11-04 19:10:33 -08:00
2025-09-23 13:28:20 -04:00
2025-11-05 23:58:20 +01:00
2025-11-03 17:41:17 +01:00
2025-11-11 10:01:30 +01:00
2026-02-20 17:31:55 -05:00
2026-01-30 11:34:34 +00:00
2025-09-13 16:55:07 -07:00
2026-02-10 11:39:31 +01:00
2026-02-10 11:39:30 +01:00
2026-01-11 06:09:11 -10:00
2025-08-24 11:41:11 -06:00
2025-07-01 12:29:29 +02:00
2025-10-30 18:35:26 +01:00
2025-10-24 21:39:27 +02:00
2025-10-31 10:16:23 +01:00
2025-11-27 14:24:30 -08:00
2025-11-18 17:52:54 +01:00
2026-01-11 06:09:11 -10:00
2025-11-28 09:21:18 -07:00
2026-01-05 16:43:30 +01:00
2026-01-31 14:22:57 -08:00
2026-01-14 12:04:34 +01:00
2026-01-06 17:06:03 -08:00
2026-01-11 06:09:11 -10:00
2025-11-03 17:41:18 +01:00
2026-01-20 19:24:47 -08:00
2026-01-30 18:26:59 -08:00