[lvc-project] [PATCH v2 6.1] mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range()

[Zi Yan]

On 5 Jun 2026, at 15:07, Alexandra Diupina wrote:

> From: Jinjiang Tu <tujinjiang at huawei.com>
>
> commit 397f6d14f9c370e4910e6885294c340f39dedbf5 upstream.
>
> In do_migrate_range(), the hwpoisoned folio may be large folio, which
> can't be handled by unmap_poisoned_folio().
>
> I can reproduce this issue in qemu after adding delay in memory_failure()
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> Workqueue: kacpi_hotplug acpi_hotplug_work_fn
> RIP: 0010:try_to_unmap_one+0x16a/0xfc0
>   <TASK>
>   rmap_walk_anon+0xda/0x1f0
>   try_to_unmap+0x78/0x80
>   ? __pfx_try_to_unmap_one+0x10/0x10
>   ? __pfx_folio_not_mapped+0x10/0x10
>   ? __pfx_folio_lock_anon_vma_read+0x10/0x10
>   unmap_poisoned_folio+0x60/0x140
>   do_migrate_range+0x4d1/0x600
>   ? slab_memory_callback+0x6a/0x190
>   ? notifier_call_chain+0x56/0xb0
>   offline_pages+0x3e6/0x460
>   memory_subsys_offline+0x130/0x1f0
>   device_offline+0xba/0x110
>   acpi_bus_offline+0xb7/0x130
>   acpi_scan_hot_remove+0x77/0x290
>   acpi_device_hotplug+0x1e0/0x240
>   acpi_hotplug_work_fn+0x1a/0x30
>   process_one_work+0x186/0x340
>
> Besides, do_migrate_range() may be called between memory_failure set
> hwpoison flag and isolate the folio from lru, so remove WARN_ON(). In other
> places, unmap_poisoned_folio() is called when the folio is isolated, obey
> it in do_migrate_range() too.
>
> [david at redhat.com: don't abort offlining, fixed typo, add comment]
> Link: https://lkml.kernel.org/r/3c214dff-9649-4015-840f-10de0e03ebe4@redhat.com
> Fixes: b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined")
> Signed-off-by: Jinjiang Tu <tujinjiang at huawei.com>
> Signed-off-by: David Hildenbrand <david at redhat.com>
> Acked-by: Zi Yan <ziy at nvidia.com>
> Reviewed-by: Miaohe Lin <linmiaohe at huawei.com>
> Cc: Kefeng Wang <wangkefeng.wang at huawei.com>
> Cc: Luis Chamberalin <mcgrof at kernel.org>
> Cc: Matthew Wilcox (Oracle) <willy at infradead.org>
> Cc: Michal Hocko <mhocko at kernel.org>
> Cc: Oscar Salvador <osalvador at suse.de>
> Cc: Pankaj Raghav <kernel at pankajraghav.com>
> Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
> [ Alexandra: replace "goto put_folio" with "continue" ]
> Signed-off-by: Alexandra Diupina <adiupina at astralinux.ru>
> ---
> v2: replace "goto put_folio" in the original patch with "continue"
>  mm/memory_hotplug.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index c8cc2f63c3ea..536478e688a0 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -1654,8 +1654,14 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
>  		 * the unmap as the catch all safety net).
>  		 */
>  		if (PageHWPoison(page)) {
> -			if (WARN_ON(folio_test_lru(folio)))
> -				folio_isolate_lru(folio);
> +			/*
> +			 * unmap_poisoned_folio() cannot handle large folios
> +			 * in all cases yet.
> +			 */
> +			if (folio_test_large(folio) && !folio_test_hugetlb(folio))
> +				continue;
> +			if (folio_test_lru(folio) && !folio_isolate_lru(folio))
> +				continue;
>  			if (folio_mapped(folio)) {
>  				folio_lock(folio);
>  				try_to_unmap(folio, TTU_IGNORE_MLOCK);
> -- 
> 2.30.2

The changes look good to me. My above ack tag applies here too.

Best Regards,
Yan, Zi