Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[Zi Yan]

On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:

> On 3/11/26 14:23, Usama Arif wrote:
>> folio_migrate_flags() transfers folio state from source to destination
>> during migration, but does not transfer the large_rmappable flag.
>>
>> Migration allocators like alloc_migration_target() and
>> alloc_misplaced_dst_folio() use __folio_alloc() directly without
>> wrapping the result in page_rmappable_folio(), so the destination folio
>> never gets large_rmappable set.
>>
>> This becomes a problem when a folio on the deferred split queue is
>> migrated: the destination folio can be added to the deferred split queue
>> via deferred_split_folio() (which does not check large_rmappable), but
>> when the folio is later freed, folio_unqueue_deferred_split() bails out
>> early because large_rmappable is not set:
>>
>>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>>       return false;
>>
>> This leaves a stale entry on the deferred split queue, leading to
>> use-after-free when the shrinker walks the list.
>>
>> Fix this by transferring large_rmappable in folio_migrate_flags(),
>> consistent with how all other folio flags are handled.
>>
>> Fixes: dafff3f4c850 ("mm: split underused THPs")
>> Signed-off-by: Usama Arif <usama.arif@xxxxxxxxx>
>> ---
>>  mm/migrate.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/mm/migrate.c b/mm/migrate.c
>> index 3380021fd3db..ee1c7bc851dd 100644
>> --- a/mm/migrate.c
>> +++ b/mm/migrate.c
>> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>>  	folio_copy_owner(newfolio, folio);
>>  	pgalloc_tag_swap(newfolio, folio);
>>
>> +	if (folio_test_large_rmappable(folio))
>> +		folio_set_large_rmappable(newfolio);
>> +
>>  	mem_cgroup_migrate(folio, newfolio);
>>  }
>>  EXPORT_SYMBOL(folio_migrate_flags);
>
> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>
> I'd assume that all migration allocation functions must take care of that.
>
> It's a responsibility of the folio allocation code, not folio migration
> code.

I agree. The migration allocation function needs to give a folio or other
types of page matching the original one. Do we want to turn this into
a WARN to make sure newfolio matches folio's large_rmappable state?

--
Best Regards,
Yan, Zi