linux-kernel - Re: [PATCH v2 3/4] mm/huge_memory: make min_order_for

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4a242eb5-dc7c-41d0-942d-4dd3dbc7ec14@lucifer.local>
Date: Mon, 24 Nov 2025 15:18:29 +0000
From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
To: Zi Yan <ziy@...dia.com>
Cc: David Hildenbrand <david@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Baolin Wang <baolin.wang@...ux.alibaba.com>,
        "Liam R. Howlett" <Liam.Howlett@...cle.com>,
        Nico Pache <npache@...hat.com>, Ryan Roberts <ryan.roberts@....com>,
        Dev Jain <dev.jain@....com>, Barry Song <baohua@...nel.org>,
        Lance Yang <lance.yang@...ux.dev>, Miaohe Lin <linmiaohe@...wei.com>,
        Naoya Horiguchi <nao.horiguchi@...il.com>,
        Wei Yang <richard.weiyang@...il.com>,
        Balbir Singh <balbirs@...dia.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/4] mm/huge_memory: make min_order_for_split() always
 return an order

On Fri, Nov 21, 2025 at 09:55:28PM -0500, Zi Yan wrote:
> min_order_for_split() returns -EBUSY when the folio is truncated and cannot
> be split. In commit 77008e1b2ef7 ("mm/huge_memory: do not change
> split_huge_page*() target order silently"), memory_failure() does not
> handle it and pass -EBUSY to try_to_split_thp_page() directly.
> try_to_split_thp_page() returns -EINVAL since -EBUSY becomes 0xfffffff0 as
> new_order is unsigned int in __folio_split() and this large new_order is
> rejected as an invalid input. The code does not cause a bug.

Yikes!

This class of bug is all too common... 'unexpectedly returning an error the
caller wasn't prepared for'.

> soft_offline_in_use_page() also uses min_order_for_split() but it always
> passes 0 as new_order for split.
>
> Fix it by making min_order_for_split() always return an order. When the
> given folio is truncated, namely folio->mapping == NULL, return 0 and let
> a subsequent split function handle the situation and return -EBUSY.

OK so we allow the split essentially or rather give a return value that is
essentially 'we don't care' because any attempt at the split will run into
something like:

		anon_vma = folio_get_anon_vma(folio);
		if (!anon_vma) {
			ret = -EBUSY;
			goto out;
		}

In __folio_split() right?

>
> Add kernel-doc to min_order_for_split() to clarify its use.

Nice.

>
> Signed-off-by: Zi Yan <ziy@...dia.com>

LGTM, so:

Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>

> ---
>  include/linux/huge_mm.h |  6 +++---
>  mm/huge_memory.c        | 25 +++++++++++++++++++------
>  2 files changed, 22 insertions(+), 9 deletions(-)
>
> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> index 1ecaeccf39c9..9b3a4e2b0668 100644
> --- a/include/linux/huge_mm.h
> +++ b/include/linux/huge_mm.h
> @@ -372,7 +372,7 @@ enum split_type {
>  int __split_huge_page_to_list_to_order(struct page *page, struct list_head *list,
>  		unsigned int new_order);
>  int folio_split_unmapped(struct folio *folio, unsigned int new_order);
> -int min_order_for_split(struct folio *folio);
> +unsigned int min_order_for_split(struct folio *folio);
>  int split_folio_to_list(struct folio *folio, struct list_head *list);
>  int folio_check_splittable(struct folio *folio, unsigned int new_order,
>  			   enum split_type split_type, bool warns);
> @@ -634,10 +634,10 @@ static inline int split_huge_page(struct page *page)
>  	return -EINVAL;
>  }
>
> -static inline int min_order_for_split(struct folio *folio)
> +static inline unsigned int min_order_for_split(struct folio *folio)
>  {
>  	VM_WARN_ON_ONCE_FOLIO(1, folio);
> -	return -EINVAL;
> +	return 0;
>  }
>
>  static inline int split_folio_to_list(struct folio *folio, struct list_head *list)
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 6c821c1c0ac3..ebc3ba0907fd 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -4230,16 +4230,29 @@ int folio_split(struct folio *folio, unsigned int new_order,
>  			     SPLIT_TYPE_NON_UNIFORM);
>  }
>
> -int min_order_for_split(struct folio *folio)
> +/**
> + * min_order_for_split() - get the minimum order @folio can be split to
> + * @folio: folio to split
> + *
> + * min_order_for_split() tells the minimum order @folio can be split to.
> + * If a file-backed folio is truncated, 0 will be returned. Any subsequent
> + * split attempt should get -EBUSY from split checking code.
> + *
> + * Return: @folio's minimum order for split
> + */
> +unsigned int min_order_for_split(struct folio *folio)
>  {
>  	if (folio_test_anon(folio))
>  		return 0;
>
> -	if (!folio->mapping) {
> -		if (folio_test_pmd_mappable(folio))
> -			count_vm_event(THP_SPLIT_PAGE_FAILED);
> -		return -EBUSY;
> -	}
> +	/*
> +	 * If the folio got truncated, we don't know the previous mapping and
> +	 * consequently the old min order. But it doesn't matter, as any split
> +	 * attempt will immediately fail with -EBUSY as the folio cannot get
> +	 * split until freed.
> +	 */

Nice to have a comment here to clarify this!

> +	if (!folio->mapping)
> +		return 0;
>
>  	return mapping_min_folio_order(folio->mapping);
>  }
> --
> 2.51.0
>

Cheers, Lorenzo