Commit a363d122 authored by Miaohe Lin's avatar Miaohe Lin Committed by Andrew Morton
Browse files

mm: memory-failure: fetch compound head after extra page refcnt is held 

Page might become thp, huge page or being splited after compound head is
fetched but before page refcnt is bumped.  So hpage might be a tail page
leading to VM_BUG_ON_PAGE(PageTail(page)) in PageTransHuge().

Link: https://lkml.kernel.org/r/20230711055016.2286677-8-linmiaohe@huawei.com


Fixes: 415c64c1 ("mm/memory-failure: split thp earlier in memory error handling")
Signed-off-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
Acked-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 5885c6a6

mm/memory-failure.c

+1 −2
Original line number Diff line number Diff line
@@ -2175,8 +2175,6 @@ int memory_failure(unsigned long pfn, int flags) 
		goto unlock_mutex;

	}



	hpage = compound_head(p);



	/*

	 * We need/can do nothing about count=0 pages.

	 * 1) it's a free page, and therefore in safe hand:
@@ -2215,6 +2213,7 @@ int memory_failure(unsigned long pfn, int flags) 
		}

	}



	hpage = compound_head(p);

	if (PageTransHuge(hpage)) {

		/*

		 * The flag must be set after the refcount is bumped