Re: [PATCH v11] mm: fix ASSERT_EXCLUSIVE_BITS by passing memdesc_flags_t by pointer

[Hui Zhu]

> 
> On Wed, 8 Jul 2026 16:33:08 +0800 Hui Zhu <hui.zhu@xxxxxxxxx> wrote:
> 
> > 
> > From: Hui Zhu <zhuhui@xxxxxxxxxx>
> >  
> >  KCSAN reports a data race between page_to_nid()/folio_pgdat() reading
> >  page->flags and folio_trylock()/folio_lock() concurrently doing
> >  test_and_set_bit_lock(PG_locked, ...) on the same word, e.g.:
> >  
> >  BUG: KCSAN: data-race in __lruvec_stat_mod_folio / shmem_get_folio_gfp
> >  
> >  The race is benign: nid/zone bits are set once at page init and never
> >  overlap with PG_locked. However, ASSERT_EXCLUSIVE_BITS() inside
> >  memdesc_nid/zonenum() was checking a by-value copy of the flags word,
> >  not the live page->flags, so it failed to annotate the real access.
> >  
> >  Change memdesc_nid(), memdesc_zonenum(), memdesc_section(), and
> >  memdesc_is_zone_device() to take a const memdesc_flags_t * and update
> >  all callers to pass &page->flags / &folio->flags, so
> >  ASSERT_EXCLUSIVE_BITS() operates on the actual shared word.
> >  
> >  Guard the ASSERT_EXCLUSIVE_BITS() call in memdesc_zonenum() under
> >  ZONES_WIDTH != 0 to avoid a zero-mask check on configs where the zone
> >  field is absent. memdesc_section() needs no such guard, since
> >  SECTIONS_WIDTH is never 0 wherever SECTION_IN_PAGE_FLAGS is defined.
> >  Under CONFIG_NUMA=n, memdesc_nid() itself is stubbed to "return 0"
> >  instead of reading page->flags, since NODES_MASK is 0 and the check
> >  can never fire; page_to_nid()/folio_nid() now just call memdesc_nid()
> >  unconditionally and rely on that stub, instead of duplicating the
> >  CONFIG_NUMA split at each call site.
> > 
> Thanks.
> 
> > 
> > Co-developed-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> >  Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> >  Signed-off-by: Hui Zhu <zhuhui@xxxxxxxxxx>
> >  Acked-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> >  ---
> >  Changelog:
> >  v11:
> >  According to the comments of David, simplify page_to_nid() to pass
> >  &(PF_POISONED_CHECK(page)->flags) directly.
> >  v10:
> >  According to the comments of David, drop the redundant CONFIG_NUMA split
> >  in page_to_nid()/folio_nid() and remove the SECTIONS_WIDTH != 0 guard
> >  around ASSERT_EXCLUSIVE_BITS() in memdesc_section().
> > 
> I'm having trouble comparing this changelogging with the actual v9->v11
> diff? "drop the redundant CONFIG_NUMA split"?

Because memdesc_nid already handles the non-config_NUMa case, the code
for page_to_nid and folio_nid handling the non-config_NUMa case is removed.

Sorry for the trouble, I will write more details in the changelog
next time.

Best,
Hui

> 
> --- a/include/linux/mm.h~mm-fix-assert_exclusive_bits-by-passing-memdesc_flags_t-by-pointer-fix
> +++ a/include/linux/mm.h
> @@ -2303,29 +2303,15 @@ static inline int memdesc_nid(const memd
>  #endif
>  #endif
>  
> -#ifdef CONFIG_NUMA
>  static inline int page_to_nid(const struct page *page)
>  {
> - const struct page *p = PF_POISONED_CHECK(page);
> -
> - return memdesc_nid(&p->flags);
> + return memdesc_nid(&(PF_POISONED_CHECK(page)->flags));
>  }
>  
>  static inline int folio_nid(const struct folio *folio)
>  {
>  return memdesc_nid(&folio->flags);
>  }
> -#else
> -static inline int page_to_nid(const struct page *page)
> -{
> - return 0;
> -}
> -
> -static inline int folio_nid(const struct folio *folio)
> -{
> - return 0;
> -}
> -#endif
>  
>  #ifdef CONFIG_NUMA_BALANCING
>  /* page access time bits needs to hold at least 4 seconds */
> @@ -2566,9 +2552,7 @@ static inline void set_page_section(stru
>  
>  static inline unsigned long memdesc_section(const memdesc_flags_t *mdf)
>  {
> -#if SECTIONS_WIDTH != 0
>  ASSERT_EXCLUSIVE_BITS(mdf->f, SECTIONS_MASK << SECTIONS_PGSHIFT);
> -#endif
>  return (mdf->f >> SECTIONS_PGSHIFT) & SECTIONS_MASK;
>  }
>  #else /* !SECTION_IN_PAGE_FLAGS */
> _
>