Patch "mm: migrate: fix an incorrect call of prep_transhuge_page()" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

mm: migrate: fix an incorrect call of prep_transhuge_page()

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mm-migrate-fix-an-incorrect-call-of-prep_transhuge_page.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Zi Yan <[email protected]>
Date: Wed, 29 Nov 2017 16:11:12 -0800
Subject: mm: migrate: fix an incorrect call of prep_transhuge_page()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Zi Yan <[email protected]>

commit 40a899ed16486455f964e46d1af31fd4fded21c1 upstream.

In https://lkml.org/lkml/2017/11/20/411, Andrea reported that during memory hotplug/hot remove prep_transhuge_page() is called incorrectly on non-THP pages for migration, when THP is on but THP migration is not enabled. This leads to a bad state of target pages for migration.

By inspecting the code, if called on a non-THP, prep_transhuge_page() will

1) change the value of the mapping of (page + 2), since it is used for

    THP deferred list;

2) change the lru value of (page + 1), since it is used for THP's dtor.

Both can lead to data corruption of these two pages.

Andrea said:
"Pragmatically and from the point of view of the memory_hotplug subsys,
the effect is a kernel crash when pages are being migrated during a memory hot remove offline and migration target pages are found in a bad state"

This patch fixes it by only calling prep_transhuge_page() when we are certain that the target page is THP.

index 895ec0c4942e..a2246cf670ba 100644
@@ -54,7 +54,7 @@ static inline struct page *new_page_nodemask(struct page *page,
 	new_page = __alloc_pages_nodemask(gfp_mask, order,
 				preferred_nid, nodemask);
 
-	if (new_page && PageTransHuge(page))
+	if (new_page && PageTransHuge(new_page))
 		prep_transhuge_page(new_page);
 
 	return new_page;

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/mm-migrate-fix-an-incorrect-call-of-prep_transhuge_page.patch