]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
mm/compaction: handle free_pages_prepare() properly in compaction_free()
authorZi Yan <ziy@nvidia.com>
Mon, 22 Jun 2026 15:30:42 +0000 (11:30 -0400)
committerAndrew Morton <akpm@linux-foundation.org>
Thu, 2 Jul 2026 02:02:53 +0000 (19:02 -0700)
free_pages_prepare() can fail but compaction_free() does not handle the
failure case.  Failed pages should not be added back to cc->freepages for
future use, since they can be either PageHWPoison or free_page_is_bad()
and might cause data corruption.

Link: https://lore.kernel.org/20260622-handle_free_pages_prepare_in_compaction_free-v1-1-fcf3b14abcf7@nvidia.com
Fixes: 733aea0b3a7b ("mm/compaction: add support for >0 order folio memory compaction.")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Jiaqi Yan <jiaqiyan@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm/compaction.c

index b776f35ad02007059c9e34d9066496f5c512fb79..f08765ade014ce39a642566c264ad7c323f63227 100644 (file)
@@ -1875,15 +1875,14 @@ static void compaction_free(struct folio *dst, unsigned long data)
        int order = folio_order(dst);
        struct page *page = &dst->page;
 
-       if (folio_put_testzero(dst)) {
-               free_pages_prepare(page, order);
+       if (folio_put_testzero(dst) && free_pages_prepare(page, order)) {
                list_add(&dst->lru, &cc->freepages[order]);
                cc->nr_freepages += 1 << order;
        }
        cc->nr_migratepages += 1 << order;
        /*
-        * someone else has referenced the page, we cannot take it back to our
-        * free list.
+        * someone else has referenced the page or free_pages_prepare() fails,
+        * we cannot take it back to our free list.
         */
 }