Re: [PATCH] mm: migrate: transfer large_rmappable flag in folio_migrate_flags()

[Usama Arif]

On 11/03/2026 16:38, Zi Yan wrote:
> On 11 Mar 2026, at 9:33, David Hildenbrand (Arm) wrote:
> 
>> On 3/11/26 14:23, Usama Arif wrote:
>>> folio_migrate_flags() transfers folio state from source to destination
>>> during migration, but does not transfer the large_rmappable flag.
>>>
>>> Migration allocators like alloc_migration_target() and
>>> alloc_misplaced_dst_folio() use __folio_alloc() directly without
>>> wrapping the result in page_rmappable_folio(), so the destination folio
>>> never gets large_rmappable set.
>>>
>>> This becomes a problem when a folio on the deferred split queue is
>>> migrated: the destination folio can be added to the deferred split queue
>>> via deferred_split_folio() (which does not check large_rmappable), but
>>> when the folio is later freed, folio_unqueue_deferred_split() bails out
>>> early because large_rmappable is not set:
>>>
>>>   if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
>>>       return false;
>>>
>>> This leaves a stale entry on the deferred split queue, leading to
>>> use-after-free when the shrinker walks the list.
>>>
>>> Fix this by transferring large_rmappable in folio_migrate_flags(),
>>> consistent with how all other folio flags are handled.
>>>
>>> Fixes: dafff3f4c850 ("mm: split underused THPs")
>>> Signed-off-by: Usama Arif <usama.arif@xxxxxxxxx>
>>> ---
>>>  mm/migrate.c | 3 +++
>>>  1 file changed, 3 insertions(+)
>>>
>>> diff --git a/mm/migrate.c b/mm/migrate.c
>>> index 3380021fd3db..ee1c7bc851dd 100644
>>> --- a/mm/migrate.c
>>> +++ b/mm/migrate.c
>>> @@ -846,6 +846,9 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio)
>>>  	folio_copy_owner(newfolio, folio);
>>>  	pgalloc_tag_swap(newfolio, folio);
>>>
>>> +	if (folio_test_large_rmappable(folio))
>>> +		folio_set_large_rmappable(newfolio);
>>> +
>>>  	mem_cgroup_migrate(folio, newfolio);
>>>  }
>>>  EXPORT_SYMBOL(folio_migrate_flags);
>>
>> compaction_alloc_noprof() does the page_rmappable_folio() at the end.
>>
>> I'd assume that all migration allocation functions must take care of that.
>>
>> It's a responsibility of the folio allocation code, not folio migration
>> code.
> 
> I agree. The migration allocation function needs to give a folio or other
> types of page matching the original one. Do we want to turn this into
> a WARN to make sure newfolio matches folio's large_rmappable state?
> 

hmm its done in compaction_alloc() and alloc_migration_target_by_mpol() but I
dont see this being done in alloc_migration_target() and alloc_misplaced_dst_folio().
I think alloc_misplaced_dst_folio() is used by NUMA balancing and alloc_migration_target()
by hotplug and memory failure?

I am not very familiar with migration code, so maybe I am missing where its being done
in these paths?