Re: [PATCH v2] mm/ksm: mark migration stores with WRITE_ONCE()

[Andrew Morton]

On Mon, 24 Aug 2026 19:24:33 +0800 Chengfeng Ye <nicoyip.dev@xxxxxxxxx> wrote:

> ksm_get_folio() deliberately samples stable_node->kpfn and
> folio->mapping without taking the folio lock because the KSM folio may be
> migrated concurrently.  folio_migrate_ksm() updates the same state using
> plain assignments.
> 
> The reader can load the old kpfn, then the migrator can store the new kpfn,
> execute smp_wmb(), and clear the old folio's mapping before the reader
> checks that mapping.  Thus the initial kpfn load can overlap its update and
> the subsequent mapping load can overlap the clear, with no common lock.
> This leaves marked READ_ONCE() accesses racing with plain stores.
> 
> The kernel reported:
> 
>   BUG: KCSAN: data-race in folio_migrate_ksm / ksm_get_folio
>
> ...
>
> Use WRITE_ONCE() for both stores to pair them with the existing lockless
> reads.  This preserves the existing smp_wmb()/smp_rmb() migration protocol
> and control flow while preventing compiler transformations of the shared
> accesses.
> 

As usual, AI review looked at the surrounding code and went
nuts.  Please check?

	https://sashiko.dev/#/patchset/20260824112433.191301-1-nicoyip.dev@xxxxxxxxx

I don't think any of these are truly pertinent to your fix (which I shall
apply), but maybe while you're in there and all fired up ;)

Thanks!