Re: [PATCH mm-unstable 1/1] mm: fix deferred split queue races during migration

[Andrew Morton]

On Wed,  1 Apr 2026 21:10:32 +0800 Lance Yang <lance.yang@xxxxxxxxx> wrote:

> From: Lance Yang <lance.yang@xxxxxxxxx>
> 
> migrate_folio_move() records the deferred split queue state from src and
> replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0)
> makes dst visible before it is requeued, so a concurrent rmap-removal path
> can mark dst partially mapped and trip the WARN in deferred_split_folio().
> 
> Move the requeue before remove_migration_ptes() so dst is back on the
> deferred split queue before it becomes visible again.
> 
> Because migration still holds dst locked at that point, teach
> deferred_split_scan() to requeue a folio when folio_trylock() fails.
> Otherwise a fully mapped underused folio can be dequeued by the shrinker
> and silently lost from split_queue.

Thanks.

> Link: https://syzkaller.appspot.com/bug?extid=a7067a757858ac8eb085
> Fixes: 8a8ca142a488 ("mm: migrate: requeue destination folio on deferred split queue")
> Reported-by: syzbot+a7067a757858ac8eb085@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/linux-mm/69ccb65b.050a0220.183828.003a.GAE@xxxxxxxxxx/
> Cc: <stable@xxxxxxxxxxxxxxx>
> Suggested-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> Signed-off-by: Lance Yang <lance.yang@xxxxxxxxx>

I'll add this to mm-unstable with a plan to move it into the current
mm-stable batch in a few days.  So that 8a8ca142a488 and this
follow-up fix stay in the same bundle.

> [ Backport note ]
> This patch is a follow-up fix for 8a8ca142a488 ("mm: migrate: requeue
> destination folio on deferred split queue"), which is currently only in
> mm-stable, and should be backported together with it.

As far as I understand it, this should happen automatically. 
8a8ca142a488 has cc:stable, this patch has Fixes:8a8ca142a488 and
also cc:stable.

There's enough info here for the -stable people to figure it out!