[PATCH] mm/huge_memory: use READ_ONCE() when cloning folio flags during split

[Ye Liu]

From: Ye Liu <liuye@xxxxxxxxxx>

The head folio's flags are read as a whole word to clone specific bits
into tail folios during a THP split.  This plain read can race with
concurrent atomic flag modifications such as folio_set_waiters()
(PG_waiters), as reported by KCSAN:

  BUG: KCSAN: data-race in __split_huge_page_tail / migration_entry_wait_on_locked

Signed-off-by: Ye Liu <liuye@xxxxxxxxxx>
---
 mm/huge_memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index bd44d58e8684..aac91c972ced 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3731,7 +3731,7 @@ static void __split_folio_to_order(struct folio *folio, int old_order,
 		 * PG_anon_exclusive (-> PG_mappedtodisk) for these here.
 		 */
 		new_folio->flags.f &= ~PAGE_FLAGS_CHECK_AT_PREP;
-		new_folio->flags.f |= (folio->flags.f &
+		new_folio->flags.f |= (READ_ONCE(folio->flags.f) &
 				((1L << PG_referenced) |
 				 (1L << PG_swapbacked) |
 				 (1L << PG_swapcache) |

---
base-commit: 6d0933ae9d46674a6ea63a87e9e9ab4e662670c9
change-id: 20261029-data_race_huge_mem-42f3a6005c43

Best regards,
-- 
Ye Liu <ye.liu@xxxxxxxxx>